Annotation of src/etc/netstart, Revision 1.177
1.1 deraadt 1: #!/bin/sh -
2: #
1.177 ! rpe 3: # $OpenBSD: netstart,v 1.176 2017/04/08 08:33:05 rpe Exp $
1.153 rpe 4:
5: # Turn off Strict Bourne shell mode.
6: set +o sh
1.101 millert 7:
1.173 rpe 8: # Echo file $1 to stdout. Skip comment lines and delete everything
9: # after the first '#' from other lines. Strip leading and trailing
10: # whitespace if IFS is set.
1.160 rpe 11: # Usage: stripcom /path/to/file
1.101 millert 12: stripcom() {
1.160 rpe 13: local _file=$1 _line
14:
15: [[ -f $_file ]] || return
16:
17: while read _line; do
18: [[ -n ${_line%%#*} ]] && print -r -- "$_line"
19: done <$_file
1.101 millert 20: }
1.45 millert 21:
1.177 ! rpe 22: # Parse and "unpack" a hostname.if(5) line given as positional parameters.
! 23: # Fill the _cmds array with the resulting interface configuration commands.
! 24: parse_hn_line() {
! 25: local _af=0 _name=1 _mask=2 _bc=3 _prefix=2 _c _cmd _prev _daddr
! 26: set -A _c -- "$@"
! 27: set -o noglob
! 28:
! 29: case ${_c[_af]} in
! 30: ''|*([[:blank:]])'#'*)
! 31: return
! 32: ;;
! 33: inet) ((${#_c[*]} > 1)) || return
! 34: [[ ${_c[_name]} == alias ]] && _mask=3 _bc=4
! 35: [[ -n ${_c[_mask]} ]] && _c[_mask]="netmask ${_c[_mask]}"
! 36: if [[ -n ${_c[_bc]} ]]; then
! 37: _c[_bc]="broadcast ${_c[_bc]}"
! 38: [[ ${_c[_bc]} == *NONE ]] && _c[_bc]=
! 39: fi
! 40: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
! 41: ;;
! 42: inet6) ((${#_c[*]} > 1)) || return
! 43: if [[ ${_c[_name]} == autoconf ]]; then
! 44: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
! 45: rtsolif="$rtsolif $_if"
! 46: return
! 47: fi
! 48: [[ ${_c[_name]} == alias ]] && _prefix=3
! 49: [[ -n ${_c[_prefix]} ]] && _c[_prefix]="prefixlen ${_c[_prefix]}"
! 50: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
! 51: ;;
! 52: dest) ((${#_c[*]} == 2)) && _daddr=${_c[1]} || return
! 53: _prev=$((${#_cmds[*]} - 1))
! 54: ((_prev >= 0)) || return
! 55: set -A _c -- ${_cmds[_prev]}
! 56: _name=3
! 57: [[ ${_c[_name]} == alias ]] && _name=4
! 58: _c[_name]="${_c[_name]} $_daddr"
! 59: _cmds[$_prev]="${_c[@]}"
! 60: ;;
! 61: dhcp) _c[0]=
! 62: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]} down;dhclient $_if"
! 63: dhcpif="$dhcpif $_if"
! 64: ;;
! 65: rtsol) # XXX Support the rtsol keyword for some time to enable a smooth
! 66: # XXX transition to autoconf.
! 67: _c[0]=
! 68: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]} up"
! 69: _cmds[${#_cmds[*]}]="ifconfig $_if inet6 autoconf"
! 70: rtsolif="$rtsolif $_if"
! 71: ;;
! 72: '!'*) _cmd=$(print -- "${_c[@]}" | sed 's/\$if/'$_if'/g')
! 73: _cmds[${#_cmds[*]}]="${_cmd#!}"
! 74: ;;
! 75: *) _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
! 76: ;;
! 77: esac
! 78: unset _c
! 79: }
! 80:
1.160 rpe 81: # Start a single interface.
82: # Usage: ifstart if1
1.83 miod 83: ifstart() {
1.177 ! rpe 84: local _if=$1 _file=$HN_DIR/hostname.$1 _cmds _i=0 _line _stat
! 85: set -A _cmds
1.174 rpe 86:
1.83 miod 87: # Interface names must be alphanumeric only. We check to avoid
88: # configuring backup or temp files, and to catch the "*" case.
1.177 ! rpe 89: [[ $_if != +([[:alpha:]])+([[:digit:]]) ]] && return
1.83 miod 90:
1.176 rpe 91: if [[ ! -f $_file ]]; then
92: echo "netstart: $_file: No such file or directory"
1.121 todd 93: return
94: fi
1.177 ! rpe 95:
1.146 rpe 96: # Not using stat(1), we can't rely on having /usr yet.
1.176 rpe 97: set -A _stat -- $(ls -nL $_file)
98: if [ "${_stat[0]#???????} ${_stat[2]} ${_stat[3]}" != "--- 0 0" ]; then
99: echo "WARNING: $_file is insecure, fixing permissions"
100: chmod -LR o-rwx $_file
101: chown -LR root.wheel $_file
1.119 deraadt 102: fi
1.83 miod 103:
1.177 ! rpe 104: # Check for ifconfig'able interface, except if -n option is specified.
! 105: if ! $PRINT_ONLY; then
! 106: (ifconfig $_if || ifconfig $_if create) >/dev/null 2>&1 ||
! 107: return
! 108: fi
! 109:
! 110: # Parse the hostname.if(5) file and fill _cmds array with interface
! 111: # configuration commands.
! 112: set -o noglob
! 113: while IFS= read -- _line; do
! 114: parse_hn_line $_line
! 115: done <$_file
! 116:
! 117: # Apply the interface configuration commands stored in _cmds array.
! 118: while ((_i < ${#_cmds[*]})); do
! 119: if $PRINT_ONLY; then
! 120: print -r -- "${_cmds[_i]}"
1.83 miod 121: else
1.177 ! rpe 122: eval "${_cmds[_i]}"
1.83 miod 123: fi
1.177 ! rpe 124: ((_i++))
! 125: done
! 126: unset _cmds
1.83 miod 127: }
128:
1.161 rpe 129: # Start multiple interfaces by driver name.
130: # Usage: ifmstart "em iwm" "trunk vlan"
1.146 rpe 131: # Start "$1" interfaces in order or all interfaces if empty.
1.161 rpe 132: # Don't start "$2" interfaces. "$2" is optional.
1.105 todd 133: ifmstart() {
1.161 rpe 134: local _sifs=$1 _xifs=$2 _hn _if _sif _xif
135:
136: for _sif in ${_sifs:-ALL}; do
137: for _hn in /etc/hostname.*; do
138: _if=${_hn#/etc/hostname.}
139: [[ $_if == '*' ]] && continue
1.113 david 140:
1.146 rpe 141: # Skip unwanted ifs.
1.161 rpe 142: for _xif in $_xifs; do
143: [[ $_xif == ${_if%%[0-9]*} ]] && continue 2
1.105 todd 144: done
145:
1.146 rpe 146: # Start wanted ifs.
1.161 rpe 147: [[ $_sif == @(ALL|${_if%%[0-9]*}) ]] && ifstart $_if
1.105 todd 148: done
149: done
150: }
151:
1.162 rpe 152: # IPv6 autoconf the interfaces in the $rtsolif list.
153: # Usage: ifv6autoconf
154: ifv6autoconf() {
155: local _if
156:
1.156 sthen 157: # $ip6kernel will not have been set if we were invoked with a
158: # list of interface names
1.162 rpe 159: ifconfig lo0 inet6 >/dev/null 2>&1 || return 0
160:
161: for _if in $rtsolif; do
162: ifconfig $_if inet6 autoconf
163: done
1.154 sthen 164: }
1.170 jasper 165:
1.172 mpi 166: # Parse /etc/mygate and add default routes for IPv4 and IPv6
167: # Usage: defaultroute
168: defaultroute() {
169: [[ -z $dhcpif ]] && stripcom /etc/mygate | while read gw; do
170: [[ $gw == @(*:*) ]] && continue
171: route -qn delete default >/dev/null 2>&1
172: route -qn add -host default $gw && break
173: done
174: [[ -z $rtsolif ]] && stripcom /etc/mygate | while read gw; do
175: [[ $gw == !(*:*) ]] && continue
176: route -qn delete -inet6 default >/dev/null 2>&1
177: route -qn add -host -inet6 default $gw && break
178: done
179: }
180:
1.170 jasper 181: # Make sure the invoking user has the right privileges.
182: if (($(id -u) != 0)); then
183: echo "${0##*/}: need root privileges"
184: exit 1
185: fi
1.154 sthen 186:
1.151 rpe 187: # Get network related vars from rc.conf using the parsing routine from rc.subr.
188: FUNCS_ONLY=1 . /etc/rc.d/rc.subr
1.150 ajacouto 189: _rc_parse_conf
1.177 ! rpe 190:
! 191: HN_DIR=${HN_DIR:-/etc}
! 192: PRINT_ONLY=false
! 193: USAGE="USAGE: ${0##*/} [-n] [interface ...]"
! 194: while getopts ":n" opt; do
! 195: case $opt in
! 196: n) PRINT_ONLY=true;;
! 197: *) print -u2 "$USAGE"; exit 1;;
! 198: esac
! 199: done
! 200: shift $((OPTIND-1))
! 201:
! 202: # Option -n is only supported if interface names are specified as parameters.
! 203: if $PRINT_ONLY && (($# == 0)); then
! 204: print -u2 "Missing parameters.\n$USAGE"
! 205: exit 1
! 206: fi
1.1 deraadt 207:
1.83 miod 208: # If we were invoked with a list of interface names, just reconfigure these
1.172 mpi 209: # interfaces (or bridges), add default routes and return.
1.159 rpe 210: if (($# > 0)); then
211: for _if; do ifstart $_if; done
1.162 rpe 212: ifv6autoconf
1.172 mpi 213: defaultroute
1.83 miod 214: return
215: fi
216:
217: # Otherwise, process with the complete network initialization.
218:
1.146 rpe 219: # /etc/myname contains my symbolic name.
1.159 rpe 220: [[ -f /etc/myname ]] && hostname "$(stripcom /etc/myname)"
1.4 dm 221:
1.131 sobrado 222: # Set the address for the loopback interface. Bringing the interface up,
223: # automatically invokes the IPv6 address ::1.
1.129 henning 224: ifconfig lo0 inet 127.0.0.1/8
1.24 kstailey 225:
1.54 itojun 226: if ifconfig lo0 inet6 >/dev/null 2>&1; then
227: # IPv6 configurations.
228: ip6kernel=YES
229:
1.83 miod 230: # Disallow link-local unicast dest without outgoing scope identifiers.
1.147 rpe 231: route -qn add -inet6 fe80:: -prefixlen 10 ::1 -reject >/dev/null
1.66 itojun 232:
1.83 miod 233: # Disallow site-local unicast dest without outgoing scope identifiers.
1.66 itojun 234: # If you configure site-locals without scope id (it is permissible
235: # config for routers that are not on scope boundary), you may want
236: # to comment the line out.
1.147 rpe 237: route -qn add -inet6 fec0:: -prefixlen 10 ::1 -reject >/dev/null
1.66 itojun 238:
1.83 miod 239: # Disallow "internal" addresses to appear on the wire.
1.147 rpe 240: route -qn add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject >/dev/null
1.66 itojun 241:
1.83 miod 242: # Disallow packets to malicious IPv4 compatible prefix.
1.147 rpe 243: route -qn add -inet6 ::224.0.0.0 -prefixlen 100 ::1 -reject >/dev/null
244: route -qn add -inet6 ::127.0.0.0 -prefixlen 104 ::1 -reject >/dev/null
245: route -qn add -inet6 ::0.0.0.0 -prefixlen 104 ::1 -reject >/dev/null
246: route -qn add -inet6 ::255.0.0.0 -prefixlen 104 ::1 -reject >/dev/null
1.66 itojun 247:
1.83 miod 248: # Disallow packets to malicious 6to4 prefix.
1.147 rpe 249: route -qn add -inet6 2002:e000:: -prefixlen 20 ::1 -reject >/dev/null
250: route -qn add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject >/dev/null
251: route -qn add -inet6 2002:0000:: -prefixlen 24 ::1 -reject >/dev/null
252: route -qn add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject >/dev/null
1.115 itojun 253:
254: # Disallow packets without scope identifier.
1.147 rpe 255: route -qn add -inet6 ff01:: -prefixlen 16 ::1 -reject >/dev/null
256: route -qn add -inet6 ff02:: -prefixlen 16 ::1 -reject >/dev/null
1.66 itojun 257:
258: # Completely disallow packets to IPv4 compatible prefix.
1.146 rpe 259: #
1.66 itojun 260: # This may conflict with RFC1933 under following circumstances:
261: # (1) An IPv6-only KAME node tries to originate packets to IPv4
1.77 deraadt 262: # compatible destination. The KAME node has no IPv4 compatible
1.66 itojun 263: # support. Under RFC1933, it should transmit native IPv6
264: # packets toward IPv4 compatible destination, hoping it would
265: # reach a router that forwards the packet toward auto-tunnel
266: # interface.
1.77 deraadt 267: # (2) An IPv6-only node originates a packet to an IPv4 compatible
1.66 itojun 268: # destination. A KAME node is acting as an IPv6 router, and
269: # asked to forward it.
1.146 rpe 270: #
1.77 deraadt 271: # Due to rare use of IPv4 compatible addresses, and security issues
1.66 itojun 272: # with it, we disable it by default.
1.147 rpe 273: route -qn add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject >/dev/null
1.56 itojun 274:
275: rtsolif=""
1.54 itojun 276: else
277: ip6kernel=NO
278: fi
279:
1.105 todd 280:
281: # Configure all the non-loopback interfaces which we know about, but
1.127 deraadt 282: # do not start interfaces which must be delayed. Refer to hostname.if(5)
1.171 rzalamen 283: ifmstart "" "trunk svlan vlan carp gif gre pfsync pppoe tun bridge switch pflow"
1.56 itojun 284:
1.118 brad 285: # The trunk interfaces need to come up first in this list.
1.132 mpf 286: # The (s)vlan interfaces need to come up after trunk.
1.118 brad 287: # Configure all the carp interfaces which we know about before default route.
1.132 mpf 288: ifmstart "trunk svlan vlan carp"
1.118 brad 289:
1.154 sthen 290: # Now that $rtsolif has been populated, IPv6 autoconf those interfaces
1.162 rpe 291: ifv6autoconf
1.102 mcbride 292:
1.138 todd 293: # Look for default routes in /etc/mygate.
1.172 mpi 294: defaultroute
1.44 deraadt 295:
1.48 niklas 296: # Multicast routing.
1.168 sthen 297: if [[ $multicast != YES ]]; then
298: route -qn delete 224.0.0.0/4 >/dev/null 2>&1
1.147 rpe 299: route -qn add -net 224.0.0.0/4 -interface 127.0.0.1 -reject >/dev/null
1.168 sthen 300: fi
1.105 todd 301:
1.152 florian 302: # Configure PPPoE, GIF, GRE, TUN and PFLOW interfaces, delayed because they
303: # require routes to be set. TUN might depend on PPPoE, and GIF or GRE may
304: # depend on either of them. PFLOW might bind to ip addresses configured
305: # on either of them.
1.171 rzalamen 306: ifmstart "pppoe tun gif gre bridge switch pflow"
1.92 deraadt 307:
1.146 rpe 308: # Reject 127/8 other than 127.0.0.1.
1.147 rpe 309: route -qn add -net 127 127.0.0.1 -reject >/dev/null
1.116 david 310:
1.159 rpe 311: if [[ $ip6kernel == YES ]]; then
1.146 rpe 312: # This is to make sure DAD is completed before going further.
1.124 markus 313: count=0
1.159 rpe 314: while ((count++ < 10 && $(sysctl -n net.inet6.ip6.dad_pending) != 0)); do
1.124 markus 315: sleep 1
316: done
1.116 david 317: fi
![[BACK]](/icons/back.gif){kind=icon}
Return to netstart CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / etc