network revision 1.52
1 #!/bin/sh 2 # 3 # $NetBSD: network,v 1.52 2008/05/29 15:38:35 joerg Exp $ 4 # 5 6 # PROVIDE: network 7 # REQUIRE: ipfilter ipsec mountcritlocal root tty sysctl 8 # BEFORE: NETWORKING 9 10 $_rc_subr_loaded . /etc/rc.subr 11 12 name="network" 13 start_cmd="network_start" 14 stop_cmd="network_stop" 15 16 network_start() 17 { 18 # set hostname, turn on network 19 # 20 echo "Starting network." 21 22 # If $hostname is set, use it for my Internet name, 23 # otherwise use /etc/myname 24 # 25 if [ -z "$hostname" ] && [ -f /etc/myname ]; then 26 hostname=$(cat /etc/myname) 27 fi 28 if [ -n "$hostname" ]; then 29 echo "Hostname: $hostname" 30 hostname $hostname 31 else 32 # Don't warn about it if we're going to run 33 # DHCP later, as we will probably get the 34 # hostname at that time. 35 # 36 if ! checkyesno dhclient && [ -z "$(hostname)" ]; then 37 warn "\$hostname not set." 38 fi 39 fi 40 41 # Check $domainname first, then /etc/defaultdomain, 42 # for NIS/YP domain name 43 # 44 if [ -z "$domainname" ] && [ -f /etc/defaultdomain ]; then 45 domainname=$(cat /etc/defaultdomain) 46 fi 47 if [ -n "$domainname" ]; then 48 echo "NIS domainname: $domainname" 49 domainname $domainname 50 fi 51 52 # Flush all routes just to make sure it is clean 53 if checkyesno flushroutes; then 54 route -qn flush 55 fi 56 57 # Set the address for the first loopback interface, so that the 58 # auto-route from a newly configured interface's address to lo0 59 # works correctly. 60 # 61 # NOTE: obscure networking problems will occur if lo0 isn't configured. 62 # 63 ifconfig lo0 inet 127.0.0.1 64 65 # According to RFC1122, 127.0.0.0/8 must not leave the node. 66 # 67 route -q add -inet 127.0.0.0 -netmask 0xff000000 127.0.0.1 -reject 68 69 # IPv6 routing setups, and host/router mode selection. 70 # 71 if ifconfig lo0 inet6 >/dev/null 2>&1; then 72 # We have IPv6 support in kernel. 73 74 # disallow link-local unicast dest without outgoing scope 75 # identifiers. 76 # 77 route -q add -inet6 fe80:: -prefixlen 10 ::1 -reject 78 79 # disallow the use of the RFC3849 documentation address 80 # 81 route -q add -inet6 2001:db8:: -prefixlen 32 ::1 -reject 82 83 # IPv6 site-local scoped address prefix (fec0::/10) 84 # has been deprecated by RFC3879. 85 # 86 if [ -n "$ip6sitelocal" ]; then 87 warn "\$ip6sitelocal is no longer valid" 88 fi 89 90 # disallow "internal" addresses to appear on the wire. 91 # 92 route -q add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject 93 94 # disallow packets to malicious IPv4 compatible prefix 95 # 96 route -q add -inet6 ::224.0.0.0 -prefixlen 100 ::1 -reject 97 route -q add -inet6 ::127.0.0.0 -prefixlen 104 ::1 -reject 98 route -q add -inet6 ::0.0.0.0 -prefixlen 104 ::1 -reject 99 route -q add -inet6 ::255.0.0.0 -prefixlen 104 ::1 -reject 100 101 # disallow packets to malicious 6to4 prefix 102 # 103 route -q add -inet6 2002:e000:: -prefixlen 20 ::1 -reject 104 route -q add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject 105 route -q add -inet6 2002:0000:: -prefixlen 24 ::1 -reject 106 route -q add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject 107 108 # Completely disallow packets to IPv4 compatible prefix. 109 # This may conflict with RFC1933 under following circumstances: 110 # (1) An IPv6-only KAME node tries to originate packets to IPv4 111 # compatible destination. The KAME node has no IPv4 112 # compatible support. Under RFC1933, it should transmit 113 # native IPv6 packets toward IPv4 compatible destination, 114 # hoping it would reach a router that forwards the packet 115 # toward auto-tunnel interface. 116 # (2) An IPv6-only node originates a packet to IPv4 compatible 117 # destination. A KAME node is acting as an IPv6 router, and 118 # asked to forward it. 119 # Due to rare use of IPv4 compatible address, and security 120 # issues with it, we disable it by default. 121 # 122 route -q add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject 123 124 sysctl -qw net.inet6.ip6.forwarding=0 125 sysctl -qw net.inet6.ip6.accept_rtadv=0 126 127 case $ip6mode in 128 router) 129 echo 'IPv6 mode: router' 130 sysctl -qw net.inet6.ip6.forwarding=1 131 132 # disallow unique-local unicast forwarding without 133 # explicit configuration. 134 if ! checkyesno ip6uniquelocal; then 135 route -q add -inet6 fc00:: -prefixlen 7 \ 136 ::1 -reject 137 fi 138 ;; 139 140 autohost) 141 echo 'IPv6 mode: autoconfigured host' 142 sysctl -qw net.inet6.ip6.accept_rtadv=1 143 ;; 144 145 host) 146 echo 'IPv6 mode: host' 147 ;; 148 149 *) warn "invalid \$ip6mode value "\"$ip6mode\" 150 ;; 151 152 esac 153 fi 154 155 # Configure all of the network interfaces listed in $net_interfaces; 156 # if $auto_ifconfig is YES, grab all interfaces from ifconfig. 157 # In the following, "xxN" stands in for interface names, like "le0". 158 # For any interfaces that has an $ifconfig_xxN variable associated, 159 # we do "ifconfig xxN $ifconfig_xxN". 160 # If there is no such variable, we take the contents of the file 161 # /etc/ifconfig.xxN, and run "ifconfig xxN" repeatedly, using each 162 # line of the file as the arguments for a separate "ifconfig" 163 # invocation. 164 # 165 # In order to configure an interface reasonably, you at the very least 166 # need to specify "[addr_family] [hostname]" (e.g "inet my.domain.org"), 167 # and probably a netmask (as in "netmask 0xffffffe0"). You will 168 # frequently need to specify a media type, as in "media UTP", for 169 # interface cards with multiple media connections that do not 170 # autoconfigure. See the ifconfig manual page for details. 171 # 172 # Note that /etc/ifconfig.xxN takes multiple lines. The following 173 # configuration is possible: 174 # inet 10.1.1.1 netmask 0xffffff00 175 # inet 10.1.1.2 netmask 0xffffff00 alias 176 # inet6 2001:db8::1 prefixlen 64 alias 177 # 178 # You can put shell script fragment into /etc/ifconfig.xxN by 179 # starting a line with "!". Refer to ifconfig.if(5) for details. 180 # 181 if [ "$net_interfaces" != NO ]; then 182 if checkyesno auto_ifconfig; then 183 tmp=$(ifconfig -l) 184 for cloner in $(ifconfig -C 2>/dev/null); do 185 for int in /etc/ifconfig.${cloner}[0-9]*; do 186 [ ! -f $int ] && break 187 tmp="$tmp ${int##*.}" 188 done 189 done 190 else 191 tmp="$net_interfaces" 192 fi 193 echo -n 'Configuring network interfaces:' 194 for int in $tmp; do 195 eval args=\$ifconfig_$int 196 if [ -n "$args" ] || [ -f /etc/ifconfig.$int ]; then 197 if ifconfig $int create 2>/dev/null && \ 198 checkyesno ipfilter; then 199 # resync ipf(4) 200 ipf -y >/dev/null 201 fi 202 fi 203 if [ "$args" = "dhcp" ]; then 204 echo -n " $int" 205 dhcpcd -n ${dhcpcd_flags} $int 206 elif [ -n "$args" ]; then 207 echo -n " $int" 208 ifconfig $int $args 209 elif [ -f /etc/ifconfig.$int ]; then 210 echo -n " $int" 211 while read args; do 212 [ -z "$args" ] && continue 213 case "$args" in 214 "#"*|create) 215 ;; 216 "!"*) 217 eval ${args#*!} 218 ;; 219 dhcp) 220 dhcpcd -n ${dhcpcd_flags} \ 221 $int 222 ;; 223 *) 224 eval ifconfig $int $args 225 ;; 226 esac 227 done < /etc/ifconfig.$int 228 else 229 if ! checkyesno auto_ifconfig; then 230 echo 231 warn \ 232 "/etc/ifconfig.$int missing and ifconfig_$int not set;" 233 warn "interface $int not configured." 234 fi 235 continue 236 fi 237 configured_interfaces="$configured_interfaces $int" 238 done 239 echo "." 240 fi 241 242 # Check $defaultroute, then /etc/mygate, for the name or address 243 # of my IPv4 gateway host. If using a name, that name must be in 244 # /etc/hosts. 245 # 246 if [ -z "$defaultroute" ] && [ -f /etc/mygate ]; then 247 defaultroute=$(cat /etc/mygate) 248 fi 249 if [ -n "$defaultroute" ]; then 250 route add default $defaultroute 251 fi 252 253 # Check $defaultroute6, then /etc/mygate6, for the name or address 254 # of my IPv6 gateway host. If using a name, that name must be in 255 # /etc/hosts. Note that the gateway host address must be a link-local 256 # address if it is not using an stf* interface. 257 # 258 if [ -z "$defaultroute6" ] && [ -f /etc/mygate6 ]; then 259 defaultroute6=$(cat /etc/mygate6) 260 fi 261 if [ -n "$defaultroute6" ]; then 262 if [ "$ip6mode" = "autohost" ]; then 263 echo 264 warn \ 265 "ip6mode is set to 'autohost' and a v6 default route is also set." 266 fi 267 route add -inet6 default $defaultroute6 268 fi 269 270 echo -n "Adding interface aliases:" 271 272 # Check if each configured interface xxN has an $ifaliases_xxN variable 273 # associated, then configure additional IP addresses for that interface. 274 # The variable contains a list of "address netmask" pairs, with 275 # "netmask" set to "-" if the interface default netmask is to be used. 276 # 277 # Note that $ifaliases_xxN works only with certain configurations and 278 # considered not recommended. Use /etc/ifconfig.xxN if possible. 279 # 280 # 281 for int in lo0 $configured_interfaces; do 282 eval args=\$ifaliases_$int 283 if [ -n "$args" ]; then 284 set -- $args 285 while [ $# -ge 2 ]; do 286 addr=$1 ; net=$2 ; shift 2 287 if [ "$net" = "-" ]; then 288 # for compatibility only, obsolete 289 ifconfig $int inet alias $addr 290 else 291 ifconfig $int inet alias $addr \ 292 netmask $net 293 fi 294 echo -n " $int:$addr" 295 done 296 fi 297 done 298 299 # /etc/ifaliases, if it exists, contains the names of additional IP 300 # addresses for each interface. It is formatted as a series of lines 301 # that contain 302 # address interface netmask 303 # 304 # Note that /etc/ifaliases works only with certain cases only and its 305 # use is not recommended. Use /etc/ifconfig.xxN instead. 306 # 307 # 308 if [ -f /etc/ifaliases ]; then 309 while read addr int net; do 310 if [ -z "$net" ]; then 311 # for compatibility only, obsolete 312 ifconfig $int inet alias $addr 313 else 314 ifconfig $int inet alias $addr netmask $net 315 fi 316 done < /etc/ifaliases 317 fi 318 319 echo 320 321 # IPv6 interface autoconfiguration. 322 # 323 if ifconfig lo0 inet6 >/dev/null 2>&1; then 324 # wait till DAD is completed. always invoke it in case 325 # if are configured manually by ifconfig 326 # 327 dadcount=$(sysctl -n net.inet6.ip6.dad_count 2>/dev/null) 328 sleep $dadcount 329 sleep 1 330 331 if checkyesno rtsol; then 332 if [ "$ip6mode" = "autohost" ]; then 333 echo 'Sending router solicitation...' 334 rtsol $rtsol_flags 335 else 336 echo 337 warn \ 338 "ip6mode must be set to 'autohost' to use rtsol." 339 fi 340 341 # wait till DAD is completed, for global addresses 342 # configured by router advert message. 343 # 344 sleep $dadcount 345 sleep 1 346 fi 347 fi 348 349 # XXX this must die 350 if [ -s /etc/netstart.local ]; then 351 sh /etc/netstart.local start 352 fi 353 } 354 355 network_stop() 356 { 357 echo "Stopping network." 358 359 # XXX this must die 360 if [ -s /etc/netstart.local ]; then 361 sh /etc/netstart.local stop 362 fi 363 364 echo "Deleting aliases." 365 if [ -f /etc/ifaliases ]; then 366 while read addr int net; do 367 ifconfig $int inet delete $addr 368 done < /etc/ifaliases 369 fi 370 371 for int in $(ifconfig -lu); do 372 eval args=\$ifaliases_$int 373 if [ -n "$args" ]; then 374 set -- $args 375 while [ $# -ge 2 ]; do 376 addr=$1 ; net=$2 ; shift 2 377 ifconfig $int inet delete $addr 378 done 379 fi 380 done 381 382 # down interfaces 383 # 384 echo -n 'Downing network interfaces:' 385 if [ "$net_interfaces" != NO ]; then 386 if checkyesno auto_ifconfig; then 387 tmp=$(ifconfig -l) 388 else 389 tmp="$net_interfaces" 390 fi 391 for int in $tmp; do 392 eval args=\$ifconfig_$int 393 if [ -n "$args" ] || [ -f /etc/ifconfig.$int ]; then 394 echo -n " $int" 395 dhcpcd -k $int 2> /dev/null 396 ifconfig $int down 397 if ifconfig $int destroy 2>/dev/null && \ 398 checkyesno ipfilter; then 399 # resync ipf(4) 400 ipf -y >/dev/null 401 fi 402 fi 403 done 404 echo "." 405 fi 406 407 # flush routes 408 # 409 route -qn flush 410 411 } 412 413 load_rc_config $name 414 load_rc_config_var dhclient dhclient 415 load_rc_config_var ipfilter ipfilter 416 run_rc_command "$1" 417
Indexes created Tue Oct 07 21:09:53 GMT 2025