Annotation of src/etc/netstart, Revision 1.211
1.1 deraadt 1: #!/bin/sh -
2: #
1.211 ! krw 3: # $OpenBSD: netstart,v 1.210 2020/12/21 16:52:49 krw Exp $
1.153 rpe 4:
5: # Turn off Strict Bourne shell mode.
6: set +o sh
1.101 millert 7:
1.198 rpe 8: # Show usage of the netstart script and exit.
9: usage() {
10: print -u2 "usage: ${0##*/} [[-n] interface ...]"
11: exit 1
12: }
13:
1.204 kn 14: # Echo file $1 to stdout. Skip comment lines. Strip leading and trailing
1.173 rpe 15: # whitespace if IFS is set.
1.160 rpe 16: # Usage: stripcom /path/to/file
1.101 millert 17: stripcom() {
1.160 rpe 18: local _file=$1 _line
19:
20: [[ -f $_file ]] || return
21:
22: while read _line; do
23: [[ -n ${_line%%#*} ]] && print -r -- "$_line"
24: done <$_file
1.101 millert 25: }
1.45 millert 26:
1.177 rpe 27: # Parse and "unpack" a hostname.if(5) line given as positional parameters.
28: # Fill the _cmds array with the resulting interface configuration commands.
29: parse_hn_line() {
1.211 ! krw 30: local _af=0 _name=1 _mask=2 _bc=3 _prefix=2 _c _cmd _prev _daddr _dhcp _i
1.177 rpe 31: set -A _c -- "$@"
32: set -o noglob
33:
34: case ${_c[_af]} in
35: ''|*([[:blank:]])'#'*)
36: return
37: ;;
38: inet) ((${#_c[*]} > 1)) || return
39: [[ ${_c[_name]} == alias ]] && _mask=3 _bc=4
40: [[ -n ${_c[_mask]} ]] && _c[_mask]="netmask ${_c[_mask]}"
41: if [[ -n ${_c[_bc]} ]]; then
42: _c[_bc]="broadcast ${_c[_bc]}"
43: [[ ${_c[_bc]} == *NONE ]] && _c[_bc]=
44: fi
45: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
46: ;;
47: inet6) ((${#_c[*]} > 1)) || return
48: if [[ ${_c[_name]} == autoconf ]]; then
49: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
1.180 rpe 50: V6_AUTOCONF=true
1.177 rpe 51: return
52: fi
53: [[ ${_c[_name]} == alias ]] && _prefix=3
54: [[ -n ${_c[_prefix]} ]] && _c[_prefix]="prefixlen ${_c[_prefix]}"
55: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
56: ;;
57: dest) ((${#_c[*]} == 2)) && _daddr=${_c[1]} || return
58: _prev=$((${#_cmds[*]} - 1))
59: ((_prev >= 0)) || return
60: set -A _c -- ${_cmds[_prev]}
61: _name=3
62: [[ ${_c[_name]} == alias ]] && _name=4
63: _c[_name]="${_c[_name]} $_daddr"
64: _cmds[$_prev]="${_c[@]}"
65: ;;
1.211 ! krw 66: dhcp) unset _c[0]
! 67: _i=1
! 68: while [[ ${_c[$_i]} == @(-c|-d|-i|-n|-r|-v) ]]; do
! 69: if [[ ${_c[$_i]} == @(-c|-i) ]]; then
! 70: _dhcp[${#_dhcp[*]}]=${_c[$_i]}
! 71: unset _c[$_i]
! 72: (( _i++ ))
! 73: fi
! 74: _dhcp[${#_dhcp[*]}]=${_c[$_i]}
! 75: unset _c[$_i]
! 76: (( _i++ ))
! 77: done
! 78: ((${#_c[*]} > 0)) && _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
! 79: _cmds[${#_cmds[*]}]="dhclient ${_dhcp[@]} $_if"
1.180 rpe 80: V4_DHCPCONF=true
1.177 rpe 81: ;;
82: '!'*) _cmd=$(print -- "${_c[@]}" | sed 's/\$if/'$_if'/g')
83: _cmds[${#_cmds[*]}]="${_cmd#!}"
84: ;;
85: *) _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
86: ;;
87: esac
88: unset _c
1.178 rpe 89: set +o noglob
1.177 rpe 90: }
91:
1.192 rpe 92: # Create interface $1 if it does not yet exist.
1.195 rpe 93: # Usage: ifcreate if1
1.191 dlg 94: ifcreate() {
95: local _if=$1
96:
1.192 rpe 97: { ifconfig $_if || ifconfig $_if create; } >/dev/null 2>&1
1.191 dlg 98: }
99:
1.192 rpe 100: # Create interfaces for network pseudo-devices referred to by hostname.if files.
1.195 rpe 101: # Usage: vifscreate
1.191 dlg 102: vifscreate() {
1.192 rpe 103: local _vif _hn _if
1.191 dlg 104:
1.192 rpe 105: for _vif in $(ifconfig -C); do
1.193 rpe 106: for _hn in /etc/hostname.${_vif}+([[:digit:]]); do
1.191 dlg 107: [[ -f $_hn ]] || continue
108: _if=${_hn#/etc/hostname.}
109:
1.193 rpe 110: if ! ifcreate $_if; then
1.194 rpe 111: print -u2 "${0##*/}: create for '$_if' failed."
1.193 rpe 112: fi
1.191 dlg 113: done
114: done
115: }
116:
1.160 rpe 117: # Start a single interface.
118: # Usage: ifstart if1
1.83 miod 119: ifstart() {
1.187 tb 120: local _if=$1 _hn=/etc/hostname.$1 _cmds _i=0 _line _stat
1.177 rpe 121: set -A _cmds
1.174 rpe 122:
1.83 miod 123: # Interface names must be alphanumeric only. We check to avoid
124: # configuring backup or temp files, and to catch the "*" case.
1.177 rpe 125: [[ $_if != +([[:alpha:]])+([[:digit:]]) ]] && return
1.83 miod 126:
1.185 rpe 127: if [[ ! -f $_hn ]]; then
1.194 rpe 128: print -u2 "${0##*/}: $_hn: No such file or directory."
1.121 todd 129: return
130: fi
1.177 rpe 131:
1.146 rpe 132: # Not using stat(1), we can't rely on having /usr yet.
1.185 rpe 133: set -A _stat -- $(ls -nL $_hn)
1.183 rpe 134: if [[ "${_stat[0]}${_stat[2]}${_stat[3]}" != *---00 ]]; then
1.194 rpe 135: print -u2 "WARNING: $_hn is insecure, fixing permissions."
1.185 rpe 136: chmod -LR o-rwx $_hn
137: chown -LR root:wheel $_hn
1.119 deraadt 138: fi
1.83 miod 139:
1.177 rpe 140: # Check for ifconfig'able interface, except if -n option is specified.
141: if ! $PRINT_ONLY; then
1.191 dlg 142: ifcreate $_if || return
1.177 rpe 143: fi
144:
145: # Parse the hostname.if(5) file and fill _cmds array with interface
146: # configuration commands.
147: set -o noglob
1.205 kn 148: while IFS= read -- _line; do
1.177 rpe 149: parse_hn_line $_line
1.185 rpe 150: done <$_hn
1.177 rpe 151:
152: # Apply the interface configuration commands stored in _cmds array.
153: while ((_i < ${#_cmds[*]})); do
154: if $PRINT_ONLY; then
155: print -r -- "${_cmds[_i]}"
1.83 miod 156: else
1.177 rpe 157: eval "${_cmds[_i]}"
1.83 miod 158: fi
1.177 rpe 159: ((_i++))
160: done
161: unset _cmds
1.178 rpe 162: set +o noglob
1.83 miod 163: }
164:
1.161 rpe 165: # Start multiple interfaces by driver name.
166: # Usage: ifmstart "em iwm" "trunk vlan"
1.146 rpe 167: # Start "$1" interfaces in order or all interfaces if empty.
1.161 rpe 168: # Don't start "$2" interfaces. "$2" is optional.
1.105 todd 169: ifmstart() {
1.161 rpe 170: local _sifs=$1 _xifs=$2 _hn _if _sif _xif
171:
172: for _sif in ${_sifs:-ALL}; do
1.193 rpe 173: for _hn in /etc/hostname.+([[:alpha:]])+([[:digit:]]); do
174: [[ -f $_hn ]] || continue
1.161 rpe 175: _if=${_hn#/etc/hostname.}
1.113 david 176:
1.146 rpe 177: # Skip unwanted ifs.
1.161 rpe 178: for _xif in $_xifs; do
179: [[ $_xif == ${_if%%[0-9]*} ]] && continue 2
1.105 todd 180: done
181:
1.146 rpe 182: # Start wanted ifs.
1.161 rpe 183: [[ $_sif == @(ALL|${_if%%[0-9]*}) ]] && ifstart $_if
1.105 todd 184: done
185: done
186: }
187:
1.195 rpe 188: # Parse /etc/mygate and add default routes for IPv4 and IPv6.
1.172 mpi 189: # Usage: defaultroute
190: defaultroute() {
1.209 tb 191: local _cmd _v4set=false _v6set=false;
1.208 deraadt 192: set -o noglob
1.188 tb 193:
1.208 deraadt 194: stripcom /etc/mygate |
1.180 rpe 195: while read gw; do
1.208 deraadt 196: case $gw in
197: '!'*)
1.209 tb 198: _cmd=$(print -- "$gw")
1.208 deraadt 199: _cmd="${_cmd#!}"
200: ;;
1.209 tb 201: !(*:*))
202: ($_v4set || $V4_DHCPCONF) && continue
203: _cmd="route -qn add -host default $gw"
204: _v4set=true
205: ;;
1.208 deraadt 206: *)
1.209 tb 207: ($_v6set || $V6_AUTOCONF) && continue
208: _cmd="route -qn add -host -inet6 default $gw"
209: _v6set=true
1.208 deraadt 210: ;;
211: esac
1.188 tb 212: if $PRINT_ONLY; then
1.208 deraadt 213: print -r -- "$_cmd"
1.188 tb 214: else
1.208 deraadt 215: $_cmd
1.188 tb 216: fi
1.172 mpi 217: done
1.208 deraadt 218: set +o noglob
1.172 mpi 219: }
1.199 tb 220:
221: # Make sure the invoking user has the right privileges. Check for presence of
222: # id(1) to avoid problems with diskless setups.
223: if [[ -x /usr/bin/id ]] && (($(id -u) != 0)); then
224: echo "${0##*/}: need root privileges"
225: exit 1
226: fi
1.154 sthen 227:
1.151 rpe 228: # Get network related vars from rc.conf using the parsing routine from rc.subr.
229: FUNCS_ONLY=1 . /etc/rc.d/rc.subr
1.150 ajacouto 230: _rc_parse_conf
1.177 rpe 231:
232: PRINT_ONLY=false
1.180 rpe 233: V4_DHCPCONF=false
234: V6_AUTOCONF=false
235:
1.177 rpe 236: while getopts ":n" opt; do
237: case $opt in
238: n) PRINT_ONLY=true;;
1.198 rpe 239: *) usage;;
1.177 rpe 240: esac
241: done
242: shift $((OPTIND-1))
243:
244: # Option -n is only supported if interface names are specified as parameters.
1.198 rpe 245: $PRINT_ONLY && (($# == 0)) && usage
1.189 florian 246:
1.195 rpe 247: # Load key material for the generation of IPv6 Semantically Opaque Interface
248: # Identifiers (SOII) used for link local and SLAAC addresses.
1.189 florian 249: $PRINT_ONLY || [[ ! -f /etc/soii.key ]] ||
250: sysctl -q "net.inet6.ip6.soiikey=$(</etc/soii.key)"
1.1 deraadt 251:
1.83 miod 252: # If we were invoked with a list of interface names, just reconfigure these
1.172 mpi 253: # interfaces (or bridges), add default routes and return.
1.159 rpe 254: if (($# > 0)); then
255: for _if; do ifstart $_if; done
1.172 mpi 256: defaultroute
1.83 miod 257: return
258: fi
259:
260: # Otherwise, process with the complete network initialization.
1.4 dm 261:
1.131 sobrado 262: # Set the address for the loopback interface. Bringing the interface up,
263: # automatically invokes the IPv6 address ::1.
1.129 henning 264: ifconfig lo0 inet 127.0.0.1/8
1.24 kstailey 265:
1.195 rpe 266: # IPv6 configuration.
1.54 itojun 267: if ifconfig lo0 inet6 >/dev/null 2>&1; then
268: ip6kernel=YES
269:
1.83 miod 270: # Disallow link-local unicast dest without outgoing scope identifiers.
1.202 kn 271: route -qn add -inet6 fe80:: -prefixlen 10 ::1 -reject
1.66 itojun 272:
1.83 miod 273: # Disallow site-local unicast dest without outgoing scope identifiers.
1.66 itojun 274: # If you configure site-locals without scope id (it is permissible
275: # config for routers that are not on scope boundary), you may want
276: # to comment the line out.
1.202 kn 277: route -qn add -inet6 fec0:: -prefixlen 10 ::1 -reject
1.66 itojun 278:
1.83 miod 279: # Disallow "internal" addresses to appear on the wire.
1.202 kn 280: route -qn add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject
1.66 itojun 281:
1.83 miod 282: # Disallow packets to malicious 6to4 prefix.
1.202 kn 283: route -qn add -inet6 2002:e000:: -prefixlen 20 ::1 -reject
284: route -qn add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject
285: route -qn add -inet6 2002:0000:: -prefixlen 24 ::1 -reject
286: route -qn add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject
1.115 itojun 287:
288: # Disallow packets without scope identifier.
1.202 kn 289: route -qn add -inet6 ff01:: -prefixlen 16 ::1 -reject
290: route -qn add -inet6 ff02:: -prefixlen 16 ::1 -reject
1.66 itojun 291:
292: # Completely disallow packets to IPv4 compatible prefix.
1.146 rpe 293: #
1.66 itojun 294: # This may conflict with RFC1933 under following circumstances:
295: # (1) An IPv6-only KAME node tries to originate packets to IPv4
1.77 deraadt 296: # compatible destination. The KAME node has no IPv4 compatible
1.66 itojun 297: # support. Under RFC1933, it should transmit native IPv6
298: # packets toward IPv4 compatible destination, hoping it would
299: # reach a router that forwards the packet toward auto-tunnel
300: # interface.
1.77 deraadt 301: # (2) An IPv6-only node originates a packet to an IPv4 compatible
1.66 itojun 302: # destination. A KAME node is acting as an IPv6 router, and
303: # asked to forward it.
1.146 rpe 304: #
1.77 deraadt 305: # Due to rare use of IPv4 compatible addresses, and security issues
1.66 itojun 306: # with it, we disable it by default.
1.202 kn 307: route -qn add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject
1.54 itojun 308: else
309: ip6kernel=NO
310: fi
311:
1.195 rpe 312: # Create all the pseudo interfaces up front.
1.191 dlg 313: vifscreate
1.105 todd 314:
315: # Configure all the non-loopback interfaces which we know about, but
1.127 deraadt 316: # do not start interfaces which must be delayed. Refer to hostname.if(5)
1.207 jmc 317: ifmstart "" "aggr trunk svlan vlan carp pppoe tun tap gif etherip gre egre pflow wg"
1.56 itojun 318:
1.201 dlg 319: # The aggr and trunk interfaces need to come up first in this list.
1.132 mpf 320: # The (s)vlan interfaces need to come up after trunk.
1.118 brad 321: # Configure all the carp interfaces which we know about before default route.
1.201 dlg 322: ifmstart "aggr trunk svlan vlan carp pppoe"
1.102 mcbride 323:
1.195 rpe 324: # Set default routes for IPv4 and IPv6.
1.172 mpi 325: defaultroute
1.44 deraadt 326:
1.48 niklas 327: # Multicast routing.
1.168 sthen 328: if [[ $multicast != YES ]]; then
329: route -qn delete 224.0.0.0/4 >/dev/null 2>&1
1.147 rpe 330: route -qn add -net 224.0.0.0/4 -interface 127.0.0.1 -reject >/dev/null
1.168 sthen 331: fi
1.105 todd 332:
1.146 rpe 333: # Reject 127/8 other than 127.0.0.1.
1.147 rpe 334: route -qn add -net 127 127.0.0.1 -reject >/dev/null
1.191 dlg 335:
336: # Configure interfaces that rely on routing
1.207 jmc 337: ifmstart "tun tap gif etherip gre egre pflow wg"
1.116 david 338:
1.159 rpe 339: if [[ $ip6kernel == YES ]]; then
1.195 rpe 340: # Ensure IPv6 Duplicate Address Detection (DAD) is completed.
1.124 markus 341: count=0
1.159 rpe 342: while ((count++ < 10 && $(sysctl -n net.inet6.ip6.dad_pending) != 0)); do
1.124 markus 343: sleep 1
344: done
1.116 david 345: fi
![[BACK]](/icons/back.gif){kind=icon}
Return to netstart CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / etc