5 # The contents of this file are subject to the terms of the
6 # Common Development and Distribution License (the "License").
7 # You may not use this file except in compliance with the License.
9 # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10 # or http://www.opensolaris.org/os/licensing.
11 # See the License for the specific language governing permissions
12 # and limitations under the License.
14 # When distributing Covered Code, include this CDDL HEADER in each
15 # file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16 # If applicable, add the following below this CDDL HEADER, with the
17 # fields enclosed by brackets "[]" replaced with your own identifying
18 # information: Portions Copyright [yyyy] [name of copyright owner]
23 # Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
24 # Copyright 2016 Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>
27 .
/lib
/svc
/share
/smf_include.sh
28 .
/lib
/svc
/share
/ipf_include.sh
30 YPDIR
=/usr
/lib
/netsvc
/yp
32 create_client_ipf_rules
()
35 file=`fmri_to_file $FMRI $IPF_SUFFIX`
36 file6
=`fmri_to_file $FMRI $IPF6_SUFFIX`
37 iana_name
=`svcprop -p $FW_CONTEXT_PG/name $FMRI`
39 block_policy
=$GLOBAL_BLOCK_POLICY
41 if [ "$block_policy" = "return" ]; then
42 block_policy_tcp
="return-rst"
43 block_policy_udp
="return-icmp-as-dest"
46 if [ -z "$domain" ]; then
50 if [ ! -d /var
/yp
/binding
/$domain ]; then
54 echo "# $FMRI" >$file6
56 ypfile
="/var/yp/binding/$domain/ypservers"
57 if [ -f $ypfile ]; then
58 tports
=`$SERVINFO -R -p -t -s $iana_name 2>/dev/null`
59 uports
=`$SERVINFO -R -p -u -s $iana_name 2>/dev/null`
60 tports_6
=`$SERVINFO -R -p -t6 -s $iana_name 2>/dev/null`
61 uports_6
=`$SERVINFO -R -p -u6 -s $iana_name 2>/dev/null`
65 for ypsvr
in `grep -v '^[ ]*#' $ypfile`; do
67 # Get corresponding IPv4/IPv6 addresses
69 servers
=`getent ipnodes $ypsvr | \
70 /usr/bin/awk '$1 ~ !/:/{ print $1 }'`
71 servers_6
=`getent ipnodes $ypsvr | \
72 /usr/bin/awk '$1 ~ /:/{ print $1 }'`
74 if [ -n "$servers" ]; then
75 server_addrs
="$server_addrs $servers"
78 if [ -n "$servers_6" ]; then
79 server_addrs_6
="$server_addrs_6 $servers_6"
83 if [ -n "$tports" -o -n "$tports_6" ]; then
84 for tport
in $tports $tports_6; do
85 echo "block $block_policy_tcp in log" \
86 "proto tcp from any to any" \
87 "port = $tport" >>$file
88 if [ -n "$server_addrs" ]; then
89 for s
in $server_addrs; do
90 echo "pass in log quick" \
92 "to any port = $tport" \
99 if [ -n "$uports" -o -n "$uports_6" ]; then
100 for uport
in $uports $uports_6; do
101 echo "block $block_policy_udp in log" \
102 "proto udp from any to any" \
103 "port = $uport" >>$file
104 if [ -n "$server_addrs" ]; then
105 for s
in $server_addrs; do
106 echo "pass in log quick" \
107 "proto udp from $s" \
108 "to any port = $uport" \
115 if [ -n "$tports_6" ]; then
116 for tport
in $tports_6; do
117 echo "block $block_policy_tcp in log" \
118 "proto tcp from any to any" \
119 "port = $tport" >>$file6
120 if [ -n "$server_addrs_6" ]; then
121 for s
in $server_addrs_6; do
122 echo "pass in log quick" \
123 "proto tcp from $s" \
124 "to any port = $tport" \
131 if [ -n "$uports_6" ]; then
132 for uport
in $uports_6; do
133 echo "block $block_policy_udp in log" \
134 "proto udp from any to any" \
135 "port = $uport" >>$file6
136 if [ -n "$server_addrs_6" ]; then
137 for s
in $server_addrs_6; do
138 echo "pass in log quick" \
139 "proto udp from $s" \
140 "to any port = $uport" \
148 # How do we handle the client broadcast case? Server replies
149 # to the outgoing port that sent the broadcast, but there's
150 # no way the client know a packet is the reply.
152 # Nis server should be specified and clients shouldn't be
153 # doing broadcasts but if it does, no choice but to allow
156 echo "pass in log quick proto udp from any to any" \
157 "port > 32768" >>$file
158 echo "pass in log quick proto udp from any to any" \
159 "port > 32768" >>$file6
166 if [ -n "$1" -a "$1" = "ipfilter" ]; then
167 create_client_ipf_rules
$2
172 'svc:/network/nis/client:default')
175 if [ -z "$domain" ]; then
176 echo "$0: domainname not set"
177 exit $SMF_EXIT_ERR_CONFIG
180 if [ ! -d /var
/yp
/binding
/$domain ]; then
181 echo "$0: /var/yp/binding/$domain is not a directory"
182 exit $SMF_EXIT_ERR_CONFIG
185 # Since two ypbinds will cause ypwhich to hang...
186 if pgrep
-z `/sbin/zonename` ypbind
>/dev
/null
; then
187 echo "$0: ypbind is already running."
188 exit $SMF_EXIT_ERR_CONFIG
191 if [ -f /var
/yp
/binding
/$domain/ypservers
]; then
192 $YPDIR/ypbind
> /dev
/null
2>&1
194 $YPDIR/ypbind
-broadcast > /dev
/null
2>&1
198 if [ $rc != 0 ]; then
199 echo "$0: ypbind failed with $rc"
204 'svc:/network/nis/server:default')
207 if [ -z "$domain" ]; then
208 echo "$0: domainname not set"
209 exit $SMF_EXIT_ERR_CONFIG
212 if [ ! -d /var
/yp
/$domain ]; then
213 echo "$0: domain directory missing"
214 exit $SMF_EXIT_ERR_CONFIG
217 if [ -f /etc
/resolv.conf
]; then
224 if [ $rc != 0 ]; then
225 echo "$0: ypserv failed with $rc"
230 'svc:/network/nis/passwd:default')
231 PWDIR
=`grep "^PWDIR" /var/yp/Makefile 2> /dev/null` \
232 && PWDIR
=`expr "$PWDIR" : '.*=[ ]*\([^ ]*\)'`
233 if [ "$PWDIR" ]; then
234 if [ "$PWDIR" = "/etc" ]; then
240 $YPDIR/rpc.yppasswdd
$PWDIR -m
243 if [ $rc != 0 ]; then
244 echo "$0: rpc.yppasswdd failed with $rc"
250 echo "$0: Unknown service \"$SMF_FMRI\"."
251 exit $SMF_EXIT_ERR_CONFIG