Annotation of src/etc/netstart, Revision 1.191
1.1 deraadt 1: #!/bin/sh -
2: #
1.191 ! dlg 3: # $OpenBSD: netstart,v 1.190 2018/02/10 08:46:10 claudio Exp $
1.153 rpe 4:
5: # Turn off Strict Bourne shell mode.
6: set +o sh
1.101 millert 7:
1.173 rpe 8: # Echo file $1 to stdout. Skip comment lines and delete everything
9: # after the first '#' from other lines. Strip leading and trailing
10: # whitespace if IFS is set.
1.160 rpe 11: # Usage: stripcom /path/to/file
1.101 millert 12: stripcom() {
1.160 rpe 13: local _file=$1 _line
14:
15: [[ -f $_file ]] || return
16:
17: while read _line; do
18: [[ -n ${_line%%#*} ]] && print -r -- "$_line"
19: done <$_file
1.101 millert 20: }
1.45 millert 21:
1.177 rpe 22: # Parse and "unpack" a hostname.if(5) line given as positional parameters.
23: # Fill the _cmds array with the resulting interface configuration commands.
24: parse_hn_line() {
25: local _af=0 _name=1 _mask=2 _bc=3 _prefix=2 _c _cmd _prev _daddr
26: set -A _c -- "$@"
27: set -o noglob
28:
29: case ${_c[_af]} in
30: ''|*([[:blank:]])'#'*)
31: return
32: ;;
33: inet) ((${#_c[*]} > 1)) || return
34: [[ ${_c[_name]} == alias ]] && _mask=3 _bc=4
35: [[ -n ${_c[_mask]} ]] && _c[_mask]="netmask ${_c[_mask]}"
36: if [[ -n ${_c[_bc]} ]]; then
37: _c[_bc]="broadcast ${_c[_bc]}"
38: [[ ${_c[_bc]} == *NONE ]] && _c[_bc]=
39: fi
40: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
41: ;;
42: inet6) ((${#_c[*]} > 1)) || return
43: if [[ ${_c[_name]} == autoconf ]]; then
44: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
1.180 rpe 45: V6_AUTOCONF=true
1.177 rpe 46: return
47: fi
48: [[ ${_c[_name]} == alias ]] && _prefix=3
49: [[ -n ${_c[_prefix]} ]] && _c[_prefix]="prefixlen ${_c[_prefix]}"
50: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
51: ;;
52: dest) ((${#_c[*]} == 2)) && _daddr=${_c[1]} || return
53: _prev=$((${#_cmds[*]} - 1))
54: ((_prev >= 0)) || return
55: set -A _c -- ${_cmds[_prev]}
56: _name=3
57: [[ ${_c[_name]} == alias ]] && _name=4
58: _c[_name]="${_c[_name]} $_daddr"
59: _cmds[$_prev]="${_c[@]}"
60: ;;
61: dhcp) _c[0]=
62: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]} down;dhclient $_if"
1.180 rpe 63: V4_DHCPCONF=true
1.177 rpe 64: ;;
65: '!'*) _cmd=$(print -- "${_c[@]}" | sed 's/\$if/'$_if'/g')
66: _cmds[${#_cmds[*]}]="${_cmd#!}"
67: ;;
68: *) _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
69: ;;
70: esac
71: unset _c
1.178 rpe 72: set +o noglob
1.177 rpe 73: }
74:
1.191 ! dlg 75: ifcreate() {
! 76: local _if=$1
! 77:
! 78: { ifconfig $_if || ifconfig $_if create; } >/dev/null 2>&1 || return
! 79: }
! 80:
! 81: vifscreate() {
! 82: local _vifs=$(ifconfig -C) _vif _hn _if
! 83:
! 84: for _vif in ${_vifs}; do
! 85: for _hn in /etc/hostname.${_vif}*; do
! 86: [[ -f $_hn ]] || continue
! 87: _if=${_hn#/etc/hostname.}
! 88:
! 89: # Create wanted ifs.
! 90: ifcreate $_if || return
! 91: done
! 92: done
! 93: }
! 94:
1.160 rpe 95: # Start a single interface.
96: # Usage: ifstart if1
1.83 miod 97: ifstart() {
1.187 tb 98: local _if=$1 _hn=/etc/hostname.$1 _cmds _i=0 _line _stat
1.177 rpe 99: set -A _cmds
1.174 rpe 100:
1.83 miod 101: # Interface names must be alphanumeric only. We check to avoid
102: # configuring backup or temp files, and to catch the "*" case.
1.177 rpe 103: [[ $_if != +([[:alpha:]])+([[:digit:]]) ]] && return
1.83 miod 104:
1.185 rpe 105: if [[ ! -f $_hn ]]; then
106: echo "${0##*/}: $_hn: No such file or directory"
1.121 todd 107: return
108: fi
1.177 rpe 109:
1.146 rpe 110: # Not using stat(1), we can't rely on having /usr yet.
1.185 rpe 111: set -A _stat -- $(ls -nL $_hn)
1.183 rpe 112: if [[ "${_stat[0]}${_stat[2]}${_stat[3]}" != *---00 ]]; then
1.185 rpe 113: echo "WARNING: $_hn is insecure, fixing permissions"
114: chmod -LR o-rwx $_hn
115: chown -LR root:wheel $_hn
1.119 deraadt 116: fi
1.83 miod 117:
1.177 rpe 118: # Check for ifconfig'able interface, except if -n option is specified.
119: if ! $PRINT_ONLY; then
1.191 ! dlg 120: ifcreate $_if || return
1.177 rpe 121: fi
122:
123: # Parse the hostname.if(5) file and fill _cmds array with interface
124: # configuration commands.
125: set -o noglob
126: while IFS= read -- _line; do
127: parse_hn_line $_line
1.185 rpe 128: done <$_hn
1.177 rpe 129:
130: # Apply the interface configuration commands stored in _cmds array.
131: while ((_i < ${#_cmds[*]})); do
132: if $PRINT_ONLY; then
133: print -r -- "${_cmds[_i]}"
1.83 miod 134: else
1.177 rpe 135: eval "${_cmds[_i]}"
1.83 miod 136: fi
1.177 rpe 137: ((_i++))
138: done
139: unset _cmds
1.178 rpe 140: set +o noglob
1.83 miod 141: }
142:
1.161 rpe 143: # Start multiple interfaces by driver name.
144: # Usage: ifmstart "em iwm" "trunk vlan"
1.146 rpe 145: # Start "$1" interfaces in order or all interfaces if empty.
1.161 rpe 146: # Don't start "$2" interfaces. "$2" is optional.
1.105 todd 147: ifmstart() {
1.161 rpe 148: local _sifs=$1 _xifs=$2 _hn _if _sif _xif
149:
150: for _sif in ${_sifs:-ALL}; do
151: for _hn in /etc/hostname.*; do
152: _if=${_hn#/etc/hostname.}
153: [[ $_if == '*' ]] && continue
1.113 david 154:
1.146 rpe 155: # Skip unwanted ifs.
1.161 rpe 156: for _xif in $_xifs; do
157: [[ $_xif == ${_if%%[0-9]*} ]] && continue 2
1.105 todd 158: done
159:
1.146 rpe 160: # Start wanted ifs.
1.161 rpe 161: [[ $_sif == @(ALL|${_if%%[0-9]*}) ]] && ifstart $_if
1.105 todd 162: done
163: done
164: }
165:
1.172 mpi 166: # Parse /etc/mygate and add default routes for IPv4 and IPv6
167: # Usage: defaultroute
168: defaultroute() {
1.188 tb 169: local _cmd;
170:
1.180 rpe 171: ! $V4_DHCPCONF && stripcom /etc/mygate |
172: while read gw; do
173: [[ $gw == @(*:*) ]] && continue
1.188 tb 174: _cmd="route -qn add -host default $gw"
175: if $PRINT_ONLY; then
176: print -r -- "$_cmd" && break
177: else
178: $_cmd && break
179: fi
1.172 mpi 180: done
1.180 rpe 181: ! $V6_AUTOCONF && stripcom /etc/mygate |
182: while read gw; do
183: [[ $gw == !(*:*) ]] && continue
1.188 tb 184: _cmd="route -qn add -host -inet6 default $gw"
185: if $PRINT_ONLY; then
186: print -r -- "$_cmd" && break
187: else
188: $_cmd && break
189: fi
1.172 mpi 190: done
191: }
1.154 sthen 192:
1.151 rpe 193: # Get network related vars from rc.conf using the parsing routine from rc.subr.
194: FUNCS_ONLY=1 . /etc/rc.d/rc.subr
1.150 ajacouto 195: _rc_parse_conf
1.177 rpe 196:
197: PRINT_ONLY=false
198: USAGE="USAGE: ${0##*/} [-n] [interface ...]"
1.180 rpe 199: V4_DHCPCONF=false
200: V6_AUTOCONF=false
201:
1.177 rpe 202: while getopts ":n" opt; do
203: case $opt in
204: n) PRINT_ONLY=true;;
205: *) print -u2 "$USAGE"; exit 1;;
206: esac
207: done
208: shift $((OPTIND-1))
209:
210: # Option -n is only supported if interface names are specified as parameters.
211: if $PRINT_ONLY && (($# == 0)); then
212: print -u2 "Missing parameters.\n$USAGE"
213: exit 1
214: fi
1.189 florian 215:
216: $PRINT_ONLY || [[ ! -f /etc/soii.key ]] ||
217: sysctl -q "net.inet6.ip6.soiikey=$(</etc/soii.key)"
1.1 deraadt 218:
1.83 miod 219: # If we were invoked with a list of interface names, just reconfigure these
1.172 mpi 220: # interfaces (or bridges), add default routes and return.
1.159 rpe 221: if (($# > 0)); then
222: for _if; do ifstart $_if; done
1.172 mpi 223: defaultroute
1.83 miod 224: return
225: fi
226:
227: # Otherwise, process with the complete network initialization.
228:
1.146 rpe 229: # /etc/myname contains my symbolic name.
1.159 rpe 230: [[ -f /etc/myname ]] && hostname "$(stripcom /etc/myname)"
1.4 dm 231:
1.131 sobrado 232: # Set the address for the loopback interface. Bringing the interface up,
233: # automatically invokes the IPv6 address ::1.
1.129 henning 234: ifconfig lo0 inet 127.0.0.1/8
1.24 kstailey 235:
1.54 itojun 236: if ifconfig lo0 inet6 >/dev/null 2>&1; then
237: # IPv6 configurations.
238: ip6kernel=YES
239:
1.83 miod 240: # Disallow link-local unicast dest without outgoing scope identifiers.
1.147 rpe 241: route -qn add -inet6 fe80:: -prefixlen 10 ::1 -reject >/dev/null
1.66 itojun 242:
1.83 miod 243: # Disallow site-local unicast dest without outgoing scope identifiers.
1.66 itojun 244: # If you configure site-locals without scope id (it is permissible
245: # config for routers that are not on scope boundary), you may want
246: # to comment the line out.
1.147 rpe 247: route -qn add -inet6 fec0:: -prefixlen 10 ::1 -reject >/dev/null
1.66 itojun 248:
1.83 miod 249: # Disallow "internal" addresses to appear on the wire.
1.147 rpe 250: route -qn add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject >/dev/null
1.66 itojun 251:
1.83 miod 252: # Disallow packets to malicious 6to4 prefix.
1.147 rpe 253: route -qn add -inet6 2002:e000:: -prefixlen 20 ::1 -reject >/dev/null
254: route -qn add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject >/dev/null
255: route -qn add -inet6 2002:0000:: -prefixlen 24 ::1 -reject >/dev/null
256: route -qn add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject >/dev/null
1.115 itojun 257:
258: # Disallow packets without scope identifier.
1.147 rpe 259: route -qn add -inet6 ff01:: -prefixlen 16 ::1 -reject >/dev/null
260: route -qn add -inet6 ff02:: -prefixlen 16 ::1 -reject >/dev/null
1.66 itojun 261:
262: # Completely disallow packets to IPv4 compatible prefix.
1.146 rpe 263: #
1.66 itojun 264: # This may conflict with RFC1933 under following circumstances:
265: # (1) An IPv6-only KAME node tries to originate packets to IPv4
1.77 deraadt 266: # compatible destination. The KAME node has no IPv4 compatible
1.66 itojun 267: # support. Under RFC1933, it should transmit native IPv6
268: # packets toward IPv4 compatible destination, hoping it would
269: # reach a router that forwards the packet toward auto-tunnel
270: # interface.
1.77 deraadt 271: # (2) An IPv6-only node originates a packet to an IPv4 compatible
1.66 itojun 272: # destination. A KAME node is acting as an IPv6 router, and
273: # asked to forward it.
1.146 rpe 274: #
1.77 deraadt 275: # Due to rare use of IPv4 compatible addresses, and security issues
1.66 itojun 276: # with it, we disable it by default.
1.147 rpe 277: route -qn add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject >/dev/null
1.54 itojun 278: else
279: ip6kernel=NO
280: fi
281:
1.191 ! dlg 282: # Create all the pseudo interfaces up front
! 283: vifscreate
1.105 todd 284:
285: # Configure all the non-loopback interfaces which we know about, but
1.127 deraadt 286: # do not start interfaces which must be delayed. Refer to hostname.if(5)
1.191 ! dlg 287: ifmstart "" "trunk svlan vlan carp pppoe tun tap gif etherip gre egre mobileip pflow"
1.56 itojun 288:
1.118 brad 289: # The trunk interfaces need to come up first in this list.
1.132 mpf 290: # The (s)vlan interfaces need to come up after trunk.
1.118 brad 291: # Configure all the carp interfaces which we know about before default route.
1.191 ! dlg 292: ifmstart "trunk svlan vlan carp pppoe"
1.102 mcbride 293:
1.138 todd 294: # Look for default routes in /etc/mygate.
1.172 mpi 295: defaultroute
1.44 deraadt 296:
1.48 niklas 297: # Multicast routing.
1.168 sthen 298: if [[ $multicast != YES ]]; then
299: route -qn delete 224.0.0.0/4 >/dev/null 2>&1
1.147 rpe 300: route -qn add -net 224.0.0.0/4 -interface 127.0.0.1 -reject >/dev/null
1.168 sthen 301: fi
1.105 todd 302:
1.146 rpe 303: # Reject 127/8 other than 127.0.0.1.
1.147 rpe 304: route -qn add -net 127 127.0.0.1 -reject >/dev/null
1.191 ! dlg 305:
! 306: # Configure interfaces that rely on routing
! 307: ifmstart "tun tap gif etherip gre egre mobileip pflow"
1.116 david 308:
1.159 rpe 309: if [[ $ip6kernel == YES ]]; then
1.146 rpe 310: # This is to make sure DAD is completed before going further.
1.124 markus 311: count=0
1.159 rpe 312: while ((count++ < 10 && $(sysctl -n net.inet6.ip6.dad_pending) != 0)); do
1.124 markus 313: sleep 1
314: done
1.116 david 315: fi
![[BACK]](/icons/back.gif){kind=icon}
Return to netstart CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / etc