etc/rc.d/network

   1 #!/bin/sh
   2 #
   3 # $NetBSD: network,v 1.58 2009/05/14 15:33:36 roy Exp $
   4 #
   5
   6 # PROVIDE: network
   7 # REQUIRE: ipfilter ipsec mountcritlocal root tty sysctl
   8 # BEFORE:  NETWORKING
   9
  10 $_rc_subr_loaded . /etc/rc.subr
  11
  12 name="network"
  13 start_cmd="network_start"
  14 stop_cmd="network_stop"
  15
  16 nl='
  17 ' # a newline
  18
  19 network_start()
  20 {
  21         # set hostname, turn on network
  22         #
  23         echo "Starting network."
  24
  25         # If $hostname is set, use it for my Internet name,
  26         # otherwise use /etc/myname
  27         #
  28         if [ -z "$hostname" ] && [ -f /etc/myname ]; then
  29                 hostname=$(cat /etc/myname)
  30         fi
  31         if [ -n "$hostname" ]; then
  32                 echo "Hostname: $hostname"
  33                 hostname $hostname
  34         else
  35                 # Don't warn about it if we're going to run
  36                 # DHCP later, as we will probably get the
  37                 # hostname at that time.
  38                 #
  39                 if ! checkyesno dhclient && ! checkyesno dhcpcd && \
  40                         [ -z "$(hostname)" ]
  41                 then
  42                         warn "\$hostname not set."
  43                 fi
  44         fi
  45
  46         # Check $domainname first, then /etc/defaultdomain,
  47         # for NIS/YP domain name
  48         #
  49         if [ -z "$domainname" ] && [ -f /etc/defaultdomain ]; then
  50                 domainname=$(cat /etc/defaultdomain)
  51         fi
  52         if [ -n "$domainname" ]; then
  53                 echo "NIS domainname: $domainname"
  54                 domainname $domainname
  55         fi
  56
  57         # Flush all routes just to make sure it is clean
  58         if checkyesno flushroutes; then
  59                 /sbin/route -qn flush
  60         fi
  61
  62         # Set the address for the first loopback interface, so that the
  63         # auto-route from a newly configured interface's address to lo0
  64         # works correctly.
  65         #
  66         # NOTE: obscure networking problems will occur if lo0 isn't configured.
  67         #
  68         /sbin/ifconfig lo0 inet 127.0.0.1
  69
  70         # According to RFC1122, 127.0.0.0/8 must not leave the node.
  71         #
  72         /sbin/route -q add -inet 127.0.0.0 -netmask 0xff000000 127.0.0.1 -reject
  73
  74         # IPv6 routing setups, and host/router mode selection.
  75         #
  76         if /sbin/ifconfig lo0 inet6 >/dev/null 2>&1; then
  77                 # We have IPv6 support in kernel.
  78
  79                 # disallow link-local unicast dest without outgoing scope
  80                 # identifiers.
  81                 #
  82                 /sbin/route -q add -inet6 fe80:: -prefixlen 10 ::1 -reject
  83
  84                 # disallow the use of the RFC3849 documentation address
  85                 #
  86                 /sbin/route -q add -inet6 2001:db8:: -prefixlen 32 ::1 -reject
  87
  88                 # IPv6 site-local scoped address prefix (fec0::/10)
  89                 # has been deprecated by RFC3879.
  90                 #
  91                 if [ -n "$ip6sitelocal" ]; then
  92                         warn "\$ip6sitelocal is no longer valid"
  93                 fi
  94
  95                 # disallow "internal" addresses to appear on the wire.
  96                 #
  97                 /sbin/route -q add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject
  98
  99                 # disallow packets to malicious IPv4 compatible prefix
 100                 #
 101                 /sbin/route -q add -inet6 ::224.0.0.0 -prefixlen 100 ::1 -reject
 102                 /sbin/route -q add -inet6 ::127.0.0.0 -prefixlen 104 ::1 -reject
 103                 /sbin/route -q add -inet6 ::0.0.0.0 -prefixlen 104 ::1 -reject
 104                 /sbin/route -q add -inet6 ::255.0.0.0 -prefixlen 104 ::1 -reject
 105
 106                 # disallow packets to malicious 6to4 prefix
 107                 #
 108                 /sbin/route -q add -inet6 2002:e000:: -prefixlen 20 ::1 -reject
 109                 /sbin/route -q add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject
 110                 /sbin/route -q add -inet6 2002:0000:: -prefixlen 24 ::1 -reject
 111                 /sbin/route -q add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject
 112
 113                 # Completely disallow packets to IPv4 compatible prefix.
 114                 # This may conflict with RFC1933 under following circumstances:
 115                 # (1) An IPv6-only KAME node tries to originate packets to IPv4
 116                 #     compatible destination.  The KAME node has no IPv4
 117                 #     compatible support.  Under RFC1933, it should transmit
 118                 #     native IPv6 packets toward IPv4 compatible destination,
 119                 #     hoping it would reach a router that forwards the packet
 120                 #     toward auto-tunnel interface.
 121                 # (2) An IPv6-only node originates a packet to IPv4 compatible
 122                 #     destination.  A KAME node is acting as an IPv6 router, and
 123                 #     asked to forward it.
 124                 # Due to rare use of IPv4 compatible address, and security
 125                 # issues with it, we disable it by default.
 126                 #
 127                 /sbin/route -q add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject
 128
 129                 /sbin/sysctl -qw net.inet6.ip6.forwarding=0
 130                 /sbin/sysctl -qw net.inet6.ip6.accept_rtadv=0
 131
 132                 case $ip6mode in
 133                 router)
 134                         echo 'IPv6 mode: router'
 135                         /sbin/sysctl -qw net.inet6.ip6.forwarding=1
 136
 137                         # disallow unique-local unicast forwarding without
 138                         # explicit configuration.
 139                         if ! checkyesno ip6uniquelocal; then
 140                                 /sbin/route -q add -inet6 fc00:: -prefixlen 7 \
 141                                     ::1 -reject
 142                         fi
 143                         ;;
 144
 145                 autohost)
 146                         echo 'IPv6 mode: autoconfigured host'
 147                         /sbin/sysctl -qw net.inet6.ip6.accept_rtadv=1
 148                         ;;
 149
 150                 host)
 151                         echo 'IPv6 mode: host'
 152                         ;;
 153
 154                 *)      warn "invalid \$ip6mode value "\"$ip6mode\"
 155                         ;;
 156
 157                 esac
 158         fi
 159
 160         # Configure all of the network interfaces listed in $net_interfaces;
 161         # if $auto_ifconfig is YES, grab all interfaces from ifconfig.
 162         # In the following, "xxN" stands in for interface names, like "le0".
 163         #
 164         # For any interfaces that has an $ifconfig_xxN variable
 165         # associated, we break it into lines using ';' as a separator,
 166         # then process it just like the contents of an /etc/ifconfig.xxN
 167         # file.
 168         #
 169         # For each line from the $ifconfig_xxN variable or the
 170         # /etc/ifconfig.xxN file, we ignore comments and blank lines,
 171         # treat lines beginning with "!" as commands to execute, treat
 172         # "dhcp" as a special case to invoke dhcpcd, and for any other
 173         # line we run "ifconfig xxN", using each line of the file as the
 174         # arguments for a separate "ifconfig" invocation.
 175         #
 176         # In order to configure an interface reasonably, you at the very least
 177         # need to specify "[addr_family] [hostname]" (e.g "inet my.domain.org"),
 178         # and probably a netmask (as in "netmask 0xffffffe0"). You will
 179         # frequently need to specify a media type, as in "media UTP", for
 180         # interface cards with multiple media connections that do not
 181         # autoconfigure. See the ifconfig manual page for details.
 182         #
 183         # Note that /etc/ifconfig.xxN takes multiple lines.  The following
 184         # configuration is possible:
 185         #       inet 10.1.1.1 netmask 0xffffff00
 186         #       inet 10.1.1.2 netmask 0xffffff00 alias
 187         #       inet6 2001:db8::1 prefixlen 64 alias
 188         #
 189         # You can put shell script fragment into /etc/ifconfig.xxN by
 190         # starting a line with "!".  Refer to ifconfig.if(5) for details.
 191         #
 192         if [ "$net_interfaces" != NO ]; then
 193                 if checkyesno auto_ifconfig; then
 194                         tmp=$(/sbin/ifconfig -l)
 195                         for cloner in $(/sbin/ifconfig -C 2>/dev/null); do
 196                                 for int in /etc/ifconfig.${cloner}[0-9]*; do
 197                                         [ ! -f $int ] && break
 198                                         tmp="$tmp ${int##*.}"
 199                                 done
 200                         done
 201                 else
 202                         tmp="$net_interfaces"
 203                 fi
 204                 echo -n 'Configuring network interfaces:'
 205                 for int in $tmp; do
 206                         eval argslist=\$ifconfig_$int
 207
 208                         # Skip interfaces that do not have explicit
 209                         # configuration information.  If auto_ifconfig is
 210                         # false then also warn about such interfaces.
 211                         #
 212                         if [ -z "$argslist" ] && ! [ -f /etc/ifconfig.$int ]
 213                         then
 214                                 if ! checkyesno auto_ifconfig; then
 215                                         echo
 216                                         warn \
 217                         "/etc/ifconfig.$int missing and ifconfig_$int not set;"
 218                                         warn "interface $int not configured."
 219                                 fi
 220                                 continue
 221                         fi
 222
 223                         echo -n " $int"
 224
 225                         # Create the interface if necessary.
 226                         # If the interface did not exist before,
 227                         # then also resync ipf(4).
 228                         #
 229                         if /sbin/ifconfig $int create 2>/dev/null && \
 230                            checkyesno ipfilter; then
 231                                 /sbin/ipf -y >/dev/null
 232                         fi
 233
 234                         # If $ifconfig_xxN is empty, then use
 235                         # /etc/ifconfig.xxN, which we know exists due to
 236                         # an earlier test.
 237                         #
 238                         # If $ifconfig_xxN is non-empty and contains a
 239                         # newline, then just use it as is.  (This allows
 240                         # semicolons through unmolested.)
 241                         #
 242                         # If $ifconfig_xxN is non-empty and does not
 243                         # contain a newline, then convert all semicolons
 244                         # to newlines.
 245                         #
 246                         case "$argslist" in
 247                         '')
 248                                 cat /etc/ifconfig.$int
 249                                 ;;
 250                         *"${nl}"*)
 251                                 echo "$argslist"
 252                                 ;;
 253                         *)
 254                                 (
 255                                         set -o noglob
 256                                         IFS=';'; set -- $argslist
 257                                         #echo >&2 "[$#] [$1] [$2] [$3] [$4]"
 258                                         IFS="$nl"; echo "$*"
 259                                 )
 260                                 ;;
 261                         esac |
 262                         while read -r args; do
 263                                 case "$args" in
 264                                 ''|"#"*|create)
 265                                         ;;
 266                                 "!"*)
 267                                         # Run arbitrary command in a subshell.
 268                                         ( eval "${args#*!}" )
 269                                         ;;
 270                                 dhcp)
 271                                         if ! checkyesno dhcpcd; then
 272                                                 /sbin/dhcpcd -n \
 273                                                         ${dhcpcd_flags} $int
 274                                         fi
 275                                         ;;
 276                                 *)
 277                                         # Pass args to ifconfig.  Note
 278                                         # that args may contain embedded
 279                                         # shell metacharacters, such as
 280                                         # "ssid 'foo;*>bar'". We eval
 281                                         # one more time so that things
 282                                         # like ssid "Columbia University" work.
 283                                         (
 284                                                 set -o noglob
 285                                                 eval set -- $args
 286                                                 #echo >&2 "[$#] [$1] [$2] [$3]"
 287                                                 /sbin/ifconfig $int "$@"
 288                                         )
 289                                         ;;
 290                                 esac
 291                         done
 292                         configured_interfaces="$configured_interfaces $int"
 293                 done
 294                 echo "."
 295         fi
 296
 297         echo -n "Adding interface aliases:"
 298
 299         # Check if each configured interface xxN has an $ifaliases_xxN variable
 300         # associated, then configure additional IP addresses for that interface.
 301         # The variable contains a list of "address netmask" pairs, with
 302         # "netmask" set to "-" if the interface default netmask is to be used.
 303         #
 304         # Note that $ifaliases_xxN works only in certain cases and its
 305         # use is not recommended.  Use /etc/ifconfig.xxN or multiple
 306         # commands in $ifconfig_xxN instead.
 307         #
 308         for int in lo0 $configured_interfaces; do
 309                 eval args=\$ifaliases_$int
 310                 if [ -n "$args" ]; then
 311                         set -- $args
 312                         while [ $# -ge 2 ]; do
 313                                 addr=$1 ; net=$2 ; shift 2
 314                                 if [ "$net" = "-" ]; then
 315                                         # for compatibility only, obsolete
 316                                         /sbin/ifconfig $int inet alias $addr
 317                                 else
 318                                         /sbin/ifconfig $int inet alias $addr \
 319                                             netmask $net
 320                                 fi
 321                                 echo -n " $int:$addr"
 322                         done
 323                 fi
 324         done
 325
 326         # /etc/ifaliases, if it exists, contains the names of additional IP
 327         # addresses for each interface. It is formatted as a series of lines
 328         # that contain
 329         #       address interface netmask
 330         #
 331         # Note that /etc/ifaliases works only in certain cases and its
 332         # use is not recommended.  Use /etc/ifconfig.xxN or multiple
 333         # commands in $ifconfig_xxN instead.
 334         #
 335         if [ -f /etc/ifaliases ]; then
 336                 while read addr int net; do
 337                         if [ -z "$net" ]; then
 338                                 # for compatibility only, obsolete
 339                                 /sbin/ifconfig $int inet alias $addr
 340                         else
 341                                 /sbin/ifconfig $int inet alias $addr netmask $net
 342                         fi
 343                 done < /etc/ifaliases
 344         fi
 345
 346         echo "." # for "Adding interface aliases:"
 347
 348         # Check $defaultroute, then /etc/mygate, for the name or address
 349         # of my IPv4 gateway host. If using a name, that name must be in
 350         # /etc/hosts.
 351         #
 352         if [ -z "$defaultroute" ] && [ -f /etc/mygate ]; then
 353                 defaultroute=$(cat /etc/mygate)
 354         fi
 355         if [ -n "$defaultroute" ]; then
 356                 /sbin/route add default $defaultroute
 357         fi
 358
 359         # Check $defaultroute6, then /etc/mygate6, for the name or address
 360         # of my IPv6 gateway host. If using a name, that name must be in
 361         # /etc/hosts.  Note that the gateway host address must be a link-local
 362         # address if it is not using an stf* interface.
 363         #
 364         if [ -z "$defaultroute6" ] && [ -f /etc/mygate6 ]; then
 365                 defaultroute6=$(cat /etc/mygate6)
 366         fi
 367         if [ -n "$defaultroute6" ]; then
 368                 if [ "$ip6mode" = "autohost" ]; then
 369                         echo
 370                         warn \
 371             "ip6mode is set to 'autohost' and a v6 default route is also set."
 372                 fi
 373                 /sbin/route add -inet6 default $defaultroute6
 374         fi
 375
 376         # IPv6 interface autoconfiguration.
 377         #
 378         if /sbin/ifconfig lo0 inet6 >/dev/null 2>&1; then
 379                 # wait till DAD is completed. always invoke it in case
 380                 # if are configured manually by ifconfig
 381                 #
 382                 dadcount=$(/sbin/sysctl -n net.inet6.ip6.dad_count 2>/dev/null)
 383                 sleep $dadcount
 384                 sleep 1
 385
 386                 if checkyesno rtsol; then
 387                         if [ "$ip6mode" = "autohost" ]; then
 388                                 echo 'Sending router solicitation...'
 389                                 /sbin/rtsol $rtsol_flags
 390                         else
 391                                 echo
 392                                 warn \
 393                             "ip6mode must be set to 'autohost' to use rtsol."
 394                         fi
 395
 396                         # wait till DAD is completed, for global addresses
 397                         # configured by router advert message.
 398                         #
 399                         sleep $dadcount
 400                         sleep 1
 401                 fi
 402         fi
 403
 404         # XXX this must die
 405         if [ -s /etc/netstart.local ]; then
 406                 sh /etc/netstart.local start
 407         fi
 408 }
 409
 410 network_stop()
 411 {
 412         echo "Stopping network."
 413
 414         # XXX this must die
 415         if [ -s /etc/netstart.local ]; then
 416                 sh /etc/netstart.local stop
 417         fi
 418
 419         echo "Deleting aliases."
 420         if [ -f /etc/ifaliases ]; then
 421                 while read addr int net; do
 422                         /sbin/ifconfig $int inet delete $addr
 423                 done < /etc/ifaliases
 424         fi
 425
 426         for int in $(/sbin/ifconfig -lu); do
 427                 eval args=\$ifaliases_$int
 428                 if [ -n "$args" ]; then
 429                         set -- $args
 430                         while [ $# -ge 2 ]; do
 431                                 addr=$1 ; net=$2 ; shift 2
 432                                 /sbin/ifconfig $int inet delete $addr
 433                         done
 434                 fi
 435         done
 436
 437         # down interfaces
 438         #
 439         echo -n 'Downing network interfaces:'
 440         if [ "$net_interfaces" != NO ]; then
 441                 if checkyesno auto_ifconfig; then
 442                         tmp=$(/sbin/ifconfig -l)
 443                 else
 444                         tmp="$net_interfaces"
 445                 fi
 446                 for int in $tmp; do
 447                         eval args=\$ifconfig_$int
 448                         if [ -n "$args" ] || [ -f /etc/ifconfig.$int ]; then
 449                                 echo -n " $int"
 450                                 if [ -f /var/run/dhcpcd-$int.pid ]; then
 451                                         /sbin/dhcpcd -k $int 2> /dev/null
 452                                 fi
 453                                 /sbin/ifconfig $int down
 454                                 if /sbin/ifconfig $int destroy 2>/dev/null && \
 455                                    checkyesno ipfilter; then
 456                                         # resync ipf(4)
 457                                         /sbin/ipf -y >/dev/null
 458                                 fi
 459                         fi
 460                 done
 461                 echo "."
 462         fi
 463
 464         # flush routes
 465         #
 466         /sbin/route -qn flush
 467
 468 }
 469
 470 load_rc_config $name
 471 load_rc_config_var dhclient dhclient
 472 load_rc_config_var dhcpcd dhcpcd
 473 load_rc_config_var ipfilter ipfilter
 474 run_rc_command "$1"