571 lines
14 KiB
Bash
Executable File
571 lines
14 KiB
Bash
Executable File
#!/bin/sh
|
|
#
|
|
# $NetBSD: network,v 1.85 2020/10/16 15:31:04 kim Exp $
|
|
#
|
|
|
|
# PROVIDE: network
|
|
# REQUIRE: ipfilter ipsec CRITLOCALMOUNTED root tty sysctl
|
|
# BEFORE: NETWORKING
|
|
|
|
$_rc_subr_loaded . /etc/rc.subr
|
|
|
|
name="network"
|
|
start_cmd="network_start"
|
|
stop_cmd="network_stop"
|
|
|
|
nl='
|
|
' # a newline
|
|
|
|
intmissing()
|
|
{
|
|
local int="$1"
|
|
shift
|
|
for i; do
|
|
if [ "$int" = "$i" ]; then
|
|
return 1
|
|
fi
|
|
done
|
|
return 0
|
|
}
|
|
|
|
have_inet6()
|
|
{
|
|
/sbin/ifconfig lo0 inet6 >/dev/null 2>&1
|
|
}
|
|
|
|
network_start()
|
|
{
|
|
# set hostname, turn on network
|
|
#
|
|
echo "Starting network."
|
|
|
|
network_start_hostname
|
|
network_start_domainname
|
|
network_start_loopback
|
|
have_inet6 &&
|
|
network_start_ipv6_route
|
|
[ "$net_interfaces" != NO ] &&
|
|
network_start_interfaces
|
|
network_start_aliases
|
|
network_start_defaultroute
|
|
network_start_defaultroute6
|
|
have_inet6 &&
|
|
network_wait_dad
|
|
network_start_resolv
|
|
network_start_local
|
|
}
|
|
|
|
network_start_hostname()
|
|
{
|
|
# If $hostname is set, use it for my Internet name,
|
|
# otherwise use /etc/myname
|
|
#
|
|
if [ -z "$hostname" ] && [ -f /etc/myname ]; then
|
|
hostname=$(kat /etc/myname)
|
|
fi
|
|
if [ -n "$hostname" ]; then
|
|
echo "Hostname: $hostname"
|
|
hostname $hostname
|
|
else
|
|
# Don't warn about it if we're going to run
|
|
# DHCP later, as we will probably get the
|
|
# hostname at that time.
|
|
#
|
|
if ! checkyesno dhcpcd && \
|
|
[ -z "$(hostname)" ]
|
|
then
|
|
warn "\$hostname not set."
|
|
fi
|
|
fi
|
|
}
|
|
|
|
network_start_domainname()
|
|
{
|
|
# Check $domainname first, then /etc/defaultdomain,
|
|
# for NIS/YP domain name
|
|
#
|
|
if [ -z "$domainname" ] && [ -f /etc/defaultdomain ]; then
|
|
domainname=$(kat /etc/defaultdomain)
|
|
fi
|
|
if [ -n "$domainname" ]; then
|
|
echo "NIS domainname: $domainname"
|
|
domainname $domainname
|
|
fi
|
|
|
|
# Flush all routes just to make sure it is clean
|
|
if checkyesno flushroutes; then
|
|
/sbin/route -qn flush
|
|
fi
|
|
}
|
|
|
|
network_start_loopback()
|
|
{
|
|
# Set the address for the first loopback interface, so that the
|
|
# auto-route from a newly configured interface's address to lo0
|
|
# works correctly.
|
|
#
|
|
# NOTE: obscure networking problems will occur if lo0 isn't configured.
|
|
#
|
|
/sbin/ifconfig lo0 inet 127.0.0.1
|
|
|
|
# According to RFC1122, 127.0.0.0/8 must not leave the node.
|
|
#
|
|
/sbin/route -q add -inet 127.0.0.0 -netmask 0xff000000 127.0.0.1 -reject
|
|
}
|
|
|
|
network_start_ipv6_route()
|
|
{
|
|
# IPv6 routing setups, and host/router mode selection.
|
|
#
|
|
# We have IPv6 support in kernel.
|
|
|
|
# disallow link-local unicast dest without outgoing scope
|
|
# identifiers.
|
|
#
|
|
/sbin/route -q add -inet6 fe80:: -prefixlen 10 ::1 -reject
|
|
|
|
# disallow the use of the RFC3849 documentation address
|
|
#
|
|
/sbin/route -q add -inet6 2001:db8:: -prefixlen 32 ::1 -reject
|
|
|
|
# IPv6 site-local scoped address prefix (fec0::/10)
|
|
# has been deprecated by RFC3879.
|
|
#
|
|
if [ -n "$ip6sitelocal" ]; then
|
|
warn "\$ip6sitelocal is no longer valid"
|
|
fi
|
|
|
|
# disallow "internal" addresses to appear on the wire.
|
|
#
|
|
/sbin/route -q add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject
|
|
|
|
# disallow packets to malicious IPv4 compatible prefix
|
|
#
|
|
/sbin/route -q add -inet6 ::224.0.0.0 -prefixlen 100 ::1 -reject
|
|
/sbin/route -q add -inet6 ::127.0.0.0 -prefixlen 104 ::1 -reject
|
|
/sbin/route -q add -inet6 ::0.0.0.0 -prefixlen 104 ::1 -reject
|
|
/sbin/route -q add -inet6 ::255.0.0.0 -prefixlen 104 ::1 -reject
|
|
|
|
# disallow packets to malicious 6to4 prefix
|
|
#
|
|
/sbin/route -q add -inet6 2002:e000:: -prefixlen 20 ::1 -reject
|
|
/sbin/route -q add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject
|
|
/sbin/route -q add -inet6 2002:0000:: -prefixlen 24 ::1 -reject
|
|
/sbin/route -q add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject
|
|
|
|
# Completely disallow packets to IPv4 compatible prefix.
|
|
# This may conflict with RFC1933 under following circumstances:
|
|
# (1) An IPv6-only KAME node tries to originate packets to IPv4
|
|
# compatible destination. The KAME node has no IPv4
|
|
# compatible support. Under RFC1933, it should transmit
|
|
# native IPv6 packets toward IPv4 compatible destination,
|
|
# hoping it would reach a router that forwards the packet
|
|
# toward auto-tunnel interface.
|
|
# (2) An IPv6-only node originates a packet to IPv4 compatible
|
|
# destination. A KAME node is acting as an IPv6 router, and
|
|
# asked to forward it.
|
|
# Due to rare use of IPv4 compatible address, and security
|
|
# issues with it, we disable it by default.
|
|
#
|
|
/sbin/route -q add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject
|
|
|
|
/sbin/sysctl -qw net.inet6.ip6.forwarding=0
|
|
|
|
case $ip6mode in
|
|
router)
|
|
echo 'IPv6 mode: router'
|
|
/sbin/sysctl -qw net.inet6.ip6.forwarding=1
|
|
|
|
# disallow unique-local unicast forwarding without
|
|
# explicit configuration.
|
|
if ! checkyesno ip6uniquelocal; then
|
|
/sbin/route -q add -inet6 fc00:: -prefixlen 7 \
|
|
::1 -reject
|
|
fi
|
|
;;
|
|
|
|
autohost)
|
|
if ! checkyesno dhcpcd; then
|
|
warn "rtsol and kernel ra handling have been removed"
|
|
warn "please configure dhcpcd in its place."
|
|
fi
|
|
;;
|
|
|
|
host)
|
|
echo 'IPv6 mode: host'
|
|
;;
|
|
|
|
*) warn "invalid \$ip6mode value "\"$ip6mode\"
|
|
;;
|
|
|
|
esac
|
|
}
|
|
|
|
network_start_interfaces()
|
|
{
|
|
# Configure all of the network interfaces listed in $net_interfaces;
|
|
# if $auto_ifconfig is YES, grab all interfaces from ifconfig.
|
|
# In the following, "xxN" stands in for interface names, like "le0".
|
|
#
|
|
# For any interfaces that has an $ifconfig_xxN variable
|
|
# associated, we break it into lines using ';' as a separator,
|
|
# then process it just like the contents of an /etc/ifconfig.xxN
|
|
# file.
|
|
#
|
|
# For each line from the $ifconfig_xxN variable or the
|
|
# /etc/ifconfig.xxN file, we ignore comments and blank lines,
|
|
# treat lines beginning with "!" as commands to execute, treat
|
|
# "dhcp" as a special case to invoke dhcpcd, treat "rtsol" as
|
|
# a special case to send a router solicitation, and for any other
|
|
# line we run "ifconfig xxN", using each line of the file as the
|
|
# arguments for a separate "ifconfig" invocation.
|
|
#
|
|
# In order to configure an interface reasonably, you at the very least
|
|
# need to specify "[addr_family] [hostname]" (e.g "inet my.domain.org"),
|
|
# and probably a netmask (as in "netmask 0xffffffe0"). You will
|
|
# frequently need to specify a media type, as in "media UTP", for
|
|
# interface cards with multiple media connections that do not
|
|
# autoconfigure. See the ifconfig manual page for details.
|
|
#
|
|
# Note that /etc/ifconfig.xxN takes multiple lines. The following
|
|
# configuration is possible:
|
|
# inet 10.1.1.1 netmask 0xffffff00
|
|
# inet 10.1.1.2 netmask 0xffffff00 alias
|
|
# inet6 2001:db8::1 prefixlen 64 alias
|
|
#
|
|
# You can put shell script fragment into /etc/ifconfig.xxN by
|
|
# starting a line with "!". Refer to ifconfig.if(5) for details.
|
|
#
|
|
ifaces="$(/sbin/ifconfig -l)"
|
|
if checkyesno auto_ifconfig; then
|
|
tmp="$ifaces"
|
|
for cloner in $(/sbin/ifconfig -C); do
|
|
for int in /etc/ifconfig.${cloner}[0-9]*; do
|
|
[ ! -f $int ] && break
|
|
tmp="$tmp ${int##*.}"
|
|
done
|
|
done
|
|
else
|
|
tmp="$net_interfaces"
|
|
fi
|
|
echo -n 'Configuring network interfaces:'
|
|
for int in $tmp; do
|
|
eval argslist=\$ifconfig_$int
|
|
|
|
# Skip interfaces that do not have explicit
|
|
# configuration information. If auto_ifconfig is
|
|
# false then also warn about such interfaces.
|
|
#
|
|
if [ -z "$argslist" ] && ! [ -f /etc/ifconfig.$int ]
|
|
then
|
|
if ! checkyesno auto_ifconfig; then
|
|
echo
|
|
warn \
|
|
"/etc/ifconfig.$int missing and ifconfig_$int not set;"
|
|
warn "interface $int not configured."
|
|
fi
|
|
continue
|
|
fi
|
|
|
|
echo -n " $int"
|
|
|
|
# Create the interface if necessary.
|
|
# If the interface did not exist before,
|
|
# then also resync ipf(4).
|
|
#
|
|
if intmissing $int $ifaces; then
|
|
if /sbin/ifconfig $int create && \
|
|
checkyesno ipfilter; then
|
|
/sbin/ipf -y >/dev/null
|
|
fi
|
|
fi
|
|
|
|
# If $ifconfig_xxN is empty, then use
|
|
# /etc/ifconfig.xxN, which we know exists due to
|
|
# an earlier test.
|
|
#
|
|
# If $ifconfig_xxN is non-empty and contains a
|
|
# newline, then just use it as is. (This allows
|
|
# semicolons through unmolested.)
|
|
#
|
|
# If $ifconfig_xxN is non-empty and does not
|
|
# contain a newline, then convert all semicolons
|
|
# to newlines.
|
|
#
|
|
case "$argslist" in
|
|
'')
|
|
cat /etc/ifconfig.$int
|
|
;;
|
|
*"${nl}"*)
|
|
echo "$argslist"
|
|
;;
|
|
*)
|
|
(
|
|
set -o noglob
|
|
IFS=';'; set -- $argslist
|
|
#echo >&2 "[$#] [$1] [$2] [$3] [$4]"
|
|
IFS="$nl"; echo "$*"
|
|
)
|
|
;;
|
|
esac |
|
|
collapse_backslash_newline |
|
|
while read -r args; do
|
|
case "$args" in
|
|
''|"#"*|create)
|
|
;;
|
|
"!"*)
|
|
# Run arbitrary command in a subshell.
|
|
( eval "${args#*!}" )
|
|
;;
|
|
dhcp)
|
|
if ! checkyesno dhcpcd; then
|
|
/sbin/dhcpcd -n --dhcp \
|
|
${dhcpcd_flags} $int
|
|
fi
|
|
;;
|
|
rtsol)
|
|
if ! checkyesno dhcpcd; then
|
|
/sbin/dhcpcd -n6b \
|
|
${dhcpcd_flags} $int
|
|
fi
|
|
;;
|
|
*)
|
|
# Pass args to ifconfig. Note
|
|
# that args may contain embedded
|
|
# shell metacharacters, such as
|
|
# "ssid 'foo;*>bar'". We eval
|
|
# one more time so that things
|
|
# like ssid "Columbia University" work.
|
|
(
|
|
set -o noglob
|
|
eval set -- $args
|
|
#echo >&2 "[$#] [$1] [$2] [$3]"
|
|
/sbin/ifconfig $int "$@"
|
|
)
|
|
;;
|
|
esac
|
|
done
|
|
configured_interfaces="$configured_interfaces $int"
|
|
done
|
|
echo "."
|
|
}
|
|
|
|
network_start_aliases()
|
|
{
|
|
echo -n "Adding interface aliases:"
|
|
|
|
# Check if each configured interface xxN has an $ifaliases_xxN variable
|
|
# associated, then configure additional IP addresses for that interface.
|
|
# The variable contains a list of "address netmask" pairs, with
|
|
# "netmask" set to "-" if the interface default netmask is to be used.
|
|
#
|
|
# Note that $ifaliases_xxN works only in certain cases and its
|
|
# use is not recommended. Use /etc/ifconfig.xxN or multiple
|
|
# commands in $ifconfig_xxN instead.
|
|
#
|
|
for int in lo0 $configured_interfaces; do
|
|
eval args=\$ifaliases_$int
|
|
if [ -n "$args" ]; then
|
|
set -- $args
|
|
while [ $# -ge 2 ]; do
|
|
addr=$1 ; net=$2 ; shift 2
|
|
if [ "$net" = "-" ]; then
|
|
# for compatibility only, obsolete
|
|
/sbin/ifconfig $int inet alias $addr
|
|
else
|
|
/sbin/ifconfig $int inet alias $addr \
|
|
netmask $net
|
|
fi
|
|
echo -n " $int:$addr"
|
|
done
|
|
fi
|
|
done
|
|
|
|
# /etc/ifaliases, if it exists, contains the names of additional IP
|
|
# addresses for each interface. It is formatted as a series of lines
|
|
# that contain
|
|
# address interface netmask
|
|
#
|
|
# Note that /etc/ifaliases works only in certain cases and its
|
|
# use is not recommended. Use /etc/ifconfig.xxN or multiple
|
|
# commands in $ifconfig_xxN instead.
|
|
#
|
|
if [ -f /etc/ifaliases ]; then
|
|
while read addr int net; do
|
|
if [ -z "$net" ]; then
|
|
# for compatibility only, obsolete
|
|
/sbin/ifconfig $int inet alias $addr
|
|
else
|
|
/sbin/ifconfig $int inet alias $addr netmask $net
|
|
fi
|
|
done < /etc/ifaliases
|
|
fi
|
|
|
|
echo "." # for "Adding interface aliases:"
|
|
}
|
|
|
|
network_start_defaultroute()
|
|
{
|
|
# Check $defaultroute, then /etc/mygate, for the name or address
|
|
# of my IPv4 gateway host. If using a name, that name must be in
|
|
# /etc/hosts.
|
|
#
|
|
if [ -z "$defaultroute" ] && [ -f /etc/mygate ]; then
|
|
defaultroute=$(kat /etc/mygate)
|
|
fi
|
|
if [ -n "$defaultroute" ]; then
|
|
/sbin/route add default $defaultroute
|
|
fi
|
|
}
|
|
|
|
network_start_defaultroute6()
|
|
{
|
|
# Check $defaultroute6, then /etc/mygate6, for the name or address
|
|
# of my IPv6 gateway host. If using a name, that name must be in
|
|
# /etc/hosts. Note that the gateway host address must be a link-local
|
|
# address if it is not using an stf* interface.
|
|
#
|
|
if [ -z "$defaultroute6" ] && [ -f /etc/mygate6 ]; then
|
|
defaultroute6=$(kat /etc/mygate6)
|
|
fi
|
|
if [ -n "$defaultroute6" ]; then
|
|
if [ "$ip6mode" = "autohost" ]; then
|
|
echo
|
|
warn \
|
|
"ip6mode is set to 'autohost' and a v6 default route is also set."
|
|
fi
|
|
/sbin/route add -inet6 default $defaultroute6
|
|
fi
|
|
}
|
|
|
|
network_wait_dad()
|
|
{
|
|
# Wait for the DAD flags to clear from all addresses.
|
|
if [ -n "$ifconfig_wait_dad_flags" ]; then
|
|
echo "Waiting for duplicate address detection to finish..."
|
|
ifconfig $ifconfig_wait_dad_flags
|
|
fi
|
|
}
|
|
|
|
network_start_resolv()
|
|
{
|
|
resconf=
|
|
|
|
if [ -n "$dns_domain" ]; then
|
|
resconf="${resconf}domain $dns_domain$nl"
|
|
fi
|
|
if [ -n "$dns_search" ]; then
|
|
resconf="${resconf}search $dns_search$nl"
|
|
fi
|
|
for n in $dns_nameservers; do
|
|
resconf="${resconf}nameserver $n$nl"
|
|
done
|
|
if [ -n "$dns_sortlist" ]; then
|
|
resconf="${resconf}sortlist $dns_sortlist$nl"
|
|
fi
|
|
if [ -n "$dns_options" ]; then
|
|
resconf="${resconf}options $dns_options$nl"
|
|
fi
|
|
if [ -n "$resconf" ]; then
|
|
resconf="# Generated by /etc/rc.d/network$nl$resconf"
|
|
echo 'Configuring resolv.conf'
|
|
printf %s "$resconf" | resolvconf -m "${dns_metric:-0}" -a network
|
|
fi
|
|
}
|
|
|
|
network_start_local()
|
|
{
|
|
# XXX this must die
|
|
if [ -s /etc/netstart.local ]; then
|
|
sh /etc/netstart.local start
|
|
fi
|
|
}
|
|
|
|
network_stop()
|
|
{
|
|
echo "Stopping network."
|
|
|
|
network_stop_local
|
|
network_stop_resolv
|
|
network_stop_aliases
|
|
[ "$net_interfaces" != NO ] &&
|
|
network_stop_interfaces
|
|
network_stop_route
|
|
}
|
|
|
|
network_stop_local()
|
|
{
|
|
# XXX this must die
|
|
if [ -s /etc/netstart.local ]; then
|
|
sh /etc/netstart.local stop
|
|
fi
|
|
}
|
|
|
|
network_stop_resolv()
|
|
{
|
|
resolvconf -f -d network
|
|
}
|
|
|
|
network_stop_aliases()
|
|
{
|
|
echo "Deleting aliases."
|
|
if [ -f /etc/ifaliases ]; then
|
|
while read addr int net; do
|
|
/sbin/ifconfig $int inet delete $addr
|
|
done < /etc/ifaliases
|
|
fi
|
|
|
|
for int in $(/sbin/ifconfig -lu); do
|
|
eval args=\$ifaliases_$int
|
|
if [ -n "$args" ]; then
|
|
set -- $args
|
|
while [ $# -ge 2 ]; do
|
|
addr=$1 ; net=$2 ; shift 2
|
|
/sbin/ifconfig $int inet delete $addr
|
|
done
|
|
fi
|
|
done
|
|
}
|
|
|
|
network_stop_interfaces()
|
|
{
|
|
# down interfaces
|
|
#
|
|
echo -n 'Downing network interfaces:'
|
|
if checkyesno auto_ifconfig; then
|
|
tmp=$(/sbin/ifconfig -l)
|
|
else
|
|
tmp="$net_interfaces"
|
|
fi
|
|
for int in $tmp; do
|
|
eval args=\$ifconfig_$int
|
|
if [ -n "$args" ] || [ -f /etc/ifconfig.$int ]; then
|
|
echo -n " $int"
|
|
if [ -f /var/run/dhcpcd-$int.pid ]; then
|
|
/sbin/dhcpcd -k $int 2> /dev/null
|
|
fi
|
|
/sbin/ifconfig $int down
|
|
if /sbin/ifconfig $int destroy 2>/dev/null && \
|
|
checkyesno ipfilter; then
|
|
# resync ipf(4)
|
|
/sbin/ipf -y >/dev/null
|
|
fi
|
|
fi
|
|
done
|
|
echo "."
|
|
}
|
|
|
|
network_stop_route()
|
|
{
|
|
# flush routes
|
|
#
|
|
if checkyesno flushroutes; then
|
|
/sbin/route -qn flush
|
|
fi
|
|
}
|
|
|
|
load_rc_config $name
|
|
load_rc_config_var dhcpcd dhcpcd
|
|
load_rc_config_var ipfilter ipfilter
|
|
run_rc_command "$1"
|