Annotation of src/etc/netstart, Revision 1.198
1.1 deraadt 1: #!/bin/sh -
2: #
1.198 ! rpe 3: # $OpenBSD: netstart,v 1.197 2018/03/04 10:12:26 jmc Exp $
1.153 rpe 4:
5: # Turn off Strict Bourne shell mode.
6: set +o sh
1.101 millert 7:
1.198 ! rpe 8: # Show usage of the netstart script and exit.
! 9: usage() {
! 10: print -u2 "usage: ${0##*/} [[-n] interface ...]"
! 11: exit 1
! 12: }
! 13:
1.173 rpe 14: # Echo file $1 to stdout. Skip comment lines and delete everything
15: # after the first '#' from other lines. Strip leading and trailing
16: # whitespace if IFS is set.
1.160 rpe 17: # Usage: stripcom /path/to/file
1.101 millert 18: stripcom() {
1.160 rpe 19: local _file=$1 _line
20:
21: [[ -f $_file ]] || return
22:
23: while read _line; do
24: [[ -n ${_line%%#*} ]] && print -r -- "$_line"
25: done <$_file
1.101 millert 26: }
1.45 millert 27:
1.177 rpe 28: # Parse and "unpack" a hostname.if(5) line given as positional parameters.
29: # Fill the _cmds array with the resulting interface configuration commands.
30: parse_hn_line() {
31: local _af=0 _name=1 _mask=2 _bc=3 _prefix=2 _c _cmd _prev _daddr
32: set -A _c -- "$@"
33: set -o noglob
34:
35: case ${_c[_af]} in
36: ''|*([[:blank:]])'#'*)
37: return
38: ;;
39: inet) ((${#_c[*]} > 1)) || return
40: [[ ${_c[_name]} == alias ]] && _mask=3 _bc=4
41: [[ -n ${_c[_mask]} ]] && _c[_mask]="netmask ${_c[_mask]}"
42: if [[ -n ${_c[_bc]} ]]; then
43: _c[_bc]="broadcast ${_c[_bc]}"
44: [[ ${_c[_bc]} == *NONE ]] && _c[_bc]=
45: fi
46: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
47: ;;
48: inet6) ((${#_c[*]} > 1)) || return
49: if [[ ${_c[_name]} == autoconf ]]; then
50: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
1.180 rpe 51: V6_AUTOCONF=true
1.177 rpe 52: return
53: fi
54: [[ ${_c[_name]} == alias ]] && _prefix=3
55: [[ -n ${_c[_prefix]} ]] && _c[_prefix]="prefixlen ${_c[_prefix]}"
56: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
57: ;;
58: dest) ((${#_c[*]} == 2)) && _daddr=${_c[1]} || return
59: _prev=$((${#_cmds[*]} - 1))
60: ((_prev >= 0)) || return
61: set -A _c -- ${_cmds[_prev]}
62: _name=3
63: [[ ${_c[_name]} == alias ]] && _name=4
64: _c[_name]="${_c[_name]} $_daddr"
65: _cmds[$_prev]="${_c[@]}"
66: ;;
67: dhcp) _c[0]=
68: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]} down;dhclient $_if"
1.180 rpe 69: V4_DHCPCONF=true
1.177 rpe 70: ;;
71: '!'*) _cmd=$(print -- "${_c[@]}" | sed 's/\$if/'$_if'/g')
72: _cmds[${#_cmds[*]}]="${_cmd#!}"
73: ;;
74: *) _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
75: ;;
76: esac
77: unset _c
1.178 rpe 78: set +o noglob
1.177 rpe 79: }
80:
1.192 rpe 81: # Create interface $1 if it does not yet exist.
1.195 rpe 82: # Usage: ifcreate if1
1.191 dlg 83: ifcreate() {
84: local _if=$1
85:
1.192 rpe 86: { ifconfig $_if || ifconfig $_if create; } >/dev/null 2>&1
1.191 dlg 87: }
88:
1.192 rpe 89: # Create interfaces for network pseudo-devices referred to by hostname.if files.
1.195 rpe 90: # Usage: vifscreate
1.191 dlg 91: vifscreate() {
1.192 rpe 92: local _vif _hn _if
1.191 dlg 93:
1.192 rpe 94: for _vif in $(ifconfig -C); do
1.193 rpe 95: for _hn in /etc/hostname.${_vif}+([[:digit:]]); do
1.191 dlg 96: [[ -f $_hn ]] || continue
97: _if=${_hn#/etc/hostname.}
98:
1.193 rpe 99: if ! ifcreate $_if; then
1.194 rpe 100: print -u2 "${0##*/}: create for '$_if' failed."
1.193 rpe 101: fi
1.191 dlg 102: done
103: done
104: }
105:
1.160 rpe 106: # Start a single interface.
107: # Usage: ifstart if1
1.83 miod 108: ifstart() {
1.187 tb 109: local _if=$1 _hn=/etc/hostname.$1 _cmds _i=0 _line _stat
1.177 rpe 110: set -A _cmds
1.174 rpe 111:
1.83 miod 112: # Interface names must be alphanumeric only. We check to avoid
113: # configuring backup or temp files, and to catch the "*" case.
1.177 rpe 114: [[ $_if != +([[:alpha:]])+([[:digit:]]) ]] && return
1.83 miod 115:
1.185 rpe 116: if [[ ! -f $_hn ]]; then
1.194 rpe 117: print -u2 "${0##*/}: $_hn: No such file or directory."
1.121 todd 118: return
119: fi
1.177 rpe 120:
1.146 rpe 121: # Not using stat(1), we can't rely on having /usr yet.
1.185 rpe 122: set -A _stat -- $(ls -nL $_hn)
1.183 rpe 123: if [[ "${_stat[0]}${_stat[2]}${_stat[3]}" != *---00 ]]; then
1.194 rpe 124: print -u2 "WARNING: $_hn is insecure, fixing permissions."
1.185 rpe 125: chmod -LR o-rwx $_hn
126: chown -LR root:wheel $_hn
1.119 deraadt 127: fi
1.83 miod 128:
1.177 rpe 129: # Check for ifconfig'able interface, except if -n option is specified.
130: if ! $PRINT_ONLY; then
1.191 dlg 131: ifcreate $_if || return
1.177 rpe 132: fi
133:
134: # Parse the hostname.if(5) file and fill _cmds array with interface
135: # configuration commands.
136: set -o noglob
137: while IFS= read -- _line; do
138: parse_hn_line $_line
1.185 rpe 139: done <$_hn
1.177 rpe 140:
141: # Apply the interface configuration commands stored in _cmds array.
142: while ((_i < ${#_cmds[*]})); do
143: if $PRINT_ONLY; then
144: print -r -- "${_cmds[_i]}"
1.83 miod 145: else
1.177 rpe 146: eval "${_cmds[_i]}"
1.83 miod 147: fi
1.177 rpe 148: ((_i++))
149: done
150: unset _cmds
1.178 rpe 151: set +o noglob
1.83 miod 152: }
153:
1.161 rpe 154: # Start multiple interfaces by driver name.
155: # Usage: ifmstart "em iwm" "trunk vlan"
1.146 rpe 156: # Start "$1" interfaces in order or all interfaces if empty.
1.161 rpe 157: # Don't start "$2" interfaces. "$2" is optional.
1.105 todd 158: ifmstart() {
1.161 rpe 159: local _sifs=$1 _xifs=$2 _hn _if _sif _xif
160:
161: for _sif in ${_sifs:-ALL}; do
1.193 rpe 162: for _hn in /etc/hostname.+([[:alpha:]])+([[:digit:]]); do
163: [[ -f $_hn ]] || continue
1.161 rpe 164: _if=${_hn#/etc/hostname.}
1.113 david 165:
1.146 rpe 166: # Skip unwanted ifs.
1.161 rpe 167: for _xif in $_xifs; do
168: [[ $_xif == ${_if%%[0-9]*} ]] && continue 2
1.105 todd 169: done
170:
1.146 rpe 171: # Start wanted ifs.
1.161 rpe 172: [[ $_sif == @(ALL|${_if%%[0-9]*}) ]] && ifstart $_if
1.105 todd 173: done
174: done
175: }
176:
1.195 rpe 177: # Parse /etc/mygate and add default routes for IPv4 and IPv6.
1.172 mpi 178: # Usage: defaultroute
179: defaultroute() {
1.188 tb 180: local _cmd;
181:
1.180 rpe 182: ! $V4_DHCPCONF && stripcom /etc/mygate |
183: while read gw; do
184: [[ $gw == @(*:*) ]] && continue
1.188 tb 185: _cmd="route -qn add -host default $gw"
186: if $PRINT_ONLY; then
187: print -r -- "$_cmd" && break
188: else
189: $_cmd && break
190: fi
1.172 mpi 191: done
1.180 rpe 192: ! $V6_AUTOCONF && stripcom /etc/mygate |
193: while read gw; do
194: [[ $gw == !(*:*) ]] && continue
1.188 tb 195: _cmd="route -qn add -host -inet6 default $gw"
196: if $PRINT_ONLY; then
197: print -r -- "$_cmd" && break
198: else
199: $_cmd && break
200: fi
1.172 mpi 201: done
202: }
1.154 sthen 203:
1.151 rpe 204: # Get network related vars from rc.conf using the parsing routine from rc.subr.
205: FUNCS_ONLY=1 . /etc/rc.d/rc.subr
1.150 ajacouto 206: _rc_parse_conf
1.177 rpe 207:
208: PRINT_ONLY=false
1.180 rpe 209: V4_DHCPCONF=false
210: V6_AUTOCONF=false
211:
1.177 rpe 212: while getopts ":n" opt; do
213: case $opt in
214: n) PRINT_ONLY=true;;
1.198 ! rpe 215: *) usage;;
1.177 rpe 216: esac
217: done
218: shift $((OPTIND-1))
219:
220: # Option -n is only supported if interface names are specified as parameters.
1.198 ! rpe 221: $PRINT_ONLY && (($# == 0)) && usage
1.189 florian 222:
1.195 rpe 223: # Load key material for the generation of IPv6 Semantically Opaque Interface
224: # Identifiers (SOII) used for link local and SLAAC addresses.
1.189 florian 225: $PRINT_ONLY || [[ ! -f /etc/soii.key ]] ||
226: sysctl -q "net.inet6.ip6.soiikey=$(</etc/soii.key)"
1.1 deraadt 227:
1.83 miod 228: # If we were invoked with a list of interface names, just reconfigure these
1.172 mpi 229: # interfaces (or bridges), add default routes and return.
1.159 rpe 230: if (($# > 0)); then
231: for _if; do ifstart $_if; done
1.172 mpi 232: defaultroute
1.83 miod 233: return
234: fi
235:
236: # Otherwise, process with the complete network initialization.
237:
1.146 rpe 238: # /etc/myname contains my symbolic name.
1.159 rpe 239: [[ -f /etc/myname ]] && hostname "$(stripcom /etc/myname)"
1.4 dm 240:
1.131 sobrado 241: # Set the address for the loopback interface. Bringing the interface up,
242: # automatically invokes the IPv6 address ::1.
1.129 henning 243: ifconfig lo0 inet 127.0.0.1/8
1.24 kstailey 244:
1.195 rpe 245: # IPv6 configuration.
1.54 itojun 246: if ifconfig lo0 inet6 >/dev/null 2>&1; then
247: ip6kernel=YES
248:
1.83 miod 249: # Disallow link-local unicast dest without outgoing scope identifiers.
1.147 rpe 250: route -qn add -inet6 fe80:: -prefixlen 10 ::1 -reject >/dev/null
1.66 itojun 251:
1.83 miod 252: # Disallow site-local unicast dest without outgoing scope identifiers.
1.66 itojun 253: # If you configure site-locals without scope id (it is permissible
254: # config for routers that are not on scope boundary), you may want
255: # to comment the line out.
1.147 rpe 256: route -qn add -inet6 fec0:: -prefixlen 10 ::1 -reject >/dev/null
1.66 itojun 257:
1.83 miod 258: # Disallow "internal" addresses to appear on the wire.
1.147 rpe 259: route -qn add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject >/dev/null
1.66 itojun 260:
1.83 miod 261: # Disallow packets to malicious 6to4 prefix.
1.147 rpe 262: route -qn add -inet6 2002:e000:: -prefixlen 20 ::1 -reject >/dev/null
263: route -qn add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject >/dev/null
264: route -qn add -inet6 2002:0000:: -prefixlen 24 ::1 -reject >/dev/null
265: route -qn add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject >/dev/null
1.115 itojun 266:
267: # Disallow packets without scope identifier.
1.147 rpe 268: route -qn add -inet6 ff01:: -prefixlen 16 ::1 -reject >/dev/null
269: route -qn add -inet6 ff02:: -prefixlen 16 ::1 -reject >/dev/null
1.66 itojun 270:
271: # Completely disallow packets to IPv4 compatible prefix.
1.146 rpe 272: #
1.66 itojun 273: # This may conflict with RFC1933 under following circumstances:
274: # (1) An IPv6-only KAME node tries to originate packets to IPv4
1.77 deraadt 275: # compatible destination. The KAME node has no IPv4 compatible
1.66 itojun 276: # support. Under RFC1933, it should transmit native IPv6
277: # packets toward IPv4 compatible destination, hoping it would
278: # reach a router that forwards the packet toward auto-tunnel
279: # interface.
1.77 deraadt 280: # (2) An IPv6-only node originates a packet to an IPv4 compatible
1.66 itojun 281: # destination. A KAME node is acting as an IPv6 router, and
282: # asked to forward it.
1.146 rpe 283: #
1.77 deraadt 284: # Due to rare use of IPv4 compatible addresses, and security issues
1.66 itojun 285: # with it, we disable it by default.
1.147 rpe 286: route -qn add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject >/dev/null
1.54 itojun 287: else
288: ip6kernel=NO
289: fi
290:
1.195 rpe 291: # Create all the pseudo interfaces up front.
1.191 dlg 292: vifscreate
1.105 todd 293:
294: # Configure all the non-loopback interfaces which we know about, but
1.127 deraadt 295: # do not start interfaces which must be delayed. Refer to hostname.if(5)
1.191 dlg 296: ifmstart "" "trunk svlan vlan carp pppoe tun tap gif etherip gre egre mobileip pflow"
1.56 itojun 297:
1.118 brad 298: # The trunk interfaces need to come up first in this list.
1.132 mpf 299: # The (s)vlan interfaces need to come up after trunk.
1.118 brad 300: # Configure all the carp interfaces which we know about before default route.
1.191 dlg 301: ifmstart "trunk svlan vlan carp pppoe"
1.102 mcbride 302:
1.195 rpe 303: # Set default routes for IPv4 and IPv6.
1.172 mpi 304: defaultroute
1.44 deraadt 305:
1.48 niklas 306: # Multicast routing.
1.168 sthen 307: if [[ $multicast != YES ]]; then
308: route -qn delete 224.0.0.0/4 >/dev/null 2>&1
1.147 rpe 309: route -qn add -net 224.0.0.0/4 -interface 127.0.0.1 -reject >/dev/null
1.168 sthen 310: fi
1.105 todd 311:
1.146 rpe 312: # Reject 127/8 other than 127.0.0.1.
1.147 rpe 313: route -qn add -net 127 127.0.0.1 -reject >/dev/null
1.191 dlg 314:
315: # Configure interfaces that rely on routing
316: ifmstart "tun tap gif etherip gre egre mobileip pflow"
1.116 david 317:
1.159 rpe 318: if [[ $ip6kernel == YES ]]; then
1.195 rpe 319: # Ensure IPv6 Duplicate Address Detection (DAD) is completed.
1.124 markus 320: count=0
1.159 rpe 321: while ((count++ < 10 && $(sysctl -n net.inet6.ip6.dad_pending) != 0)); do
1.124 markus 322: sleep 1
323: done
1.116 david 324: fi
![[BACK]](/icons/back.gif){kind=icon}
Return to netstart CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / etc