Annotation of src/etc/netstart, Revision 1.218
1.1 deraadt 1: #!/bin/sh -
2: #
1.218 ! florian 3: # $OpenBSD: netstart,v 1.217 2022/02/22 06:44:40 dlg Exp $
1.153 rpe 4:
5: # Turn off Strict Bourne shell mode.
6: set +o sh
1.101 millert 7:
1.198 rpe 8: # Show usage of the netstart script and exit.
9: usage() {
10: print -u2 "usage: ${0##*/} [[-n] interface ...]"
11: exit 1
12: }
13:
1.204 kn 14: # Echo file $1 to stdout. Skip comment lines. Strip leading and trailing
1.173 rpe 15: # whitespace if IFS is set.
1.160 rpe 16: # Usage: stripcom /path/to/file
1.101 millert 17: stripcom() {
1.160 rpe 18: local _file=$1 _line
19:
20: [[ -f $_file ]] || return
21:
22: while read _line; do
23: [[ -n ${_line%%#*} ]] && print -r -- "$_line"
24: done <$_file
1.101 millert 25: }
1.45 millert 26:
1.177 rpe 27: # Parse and "unpack" a hostname.if(5) line given as positional parameters.
28: # Fill the _cmds array with the resulting interface configuration commands.
29: parse_hn_line() {
1.211 krw 30: local _af=0 _name=1 _mask=2 _bc=3 _prefix=2 _c _cmd _prev _daddr _dhcp _i
1.177 rpe 31: set -A _c -- "$@"
32: set -o noglob
33:
34: case ${_c[_af]} in
35: ''|*([[:blank:]])'#'*)
36: return
37: ;;
38: inet) ((${#_c[*]} > 1)) || return
1.212 florian 39: if [[ ${_c[_name]} == autoconf ]]; then
40: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
1.214 sthen 41: V4_AUTOCONF=true
1.212 florian 42: return
43: fi
1.177 rpe 44: [[ ${_c[_name]} == alias ]] && _mask=3 _bc=4
45: [[ -n ${_c[_mask]} ]] && _c[_mask]="netmask ${_c[_mask]}"
46: if [[ -n ${_c[_bc]} ]]; then
47: _c[_bc]="broadcast ${_c[_bc]}"
48: [[ ${_c[_bc]} == *NONE ]] && _c[_bc]=
49: fi
50: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
51: ;;
52: inet6) ((${#_c[*]} > 1)) || return
53: if [[ ${_c[_name]} == autoconf ]]; then
54: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
1.180 rpe 55: V6_AUTOCONF=true
1.177 rpe 56: return
57: fi
58: [[ ${_c[_name]} == alias ]] && _prefix=3
59: [[ -n ${_c[_prefix]} ]] && _c[_prefix]="prefixlen ${_c[_prefix]}"
60: _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
61: ;;
62: dest) ((${#_c[*]} == 2)) && _daddr=${_c[1]} || return
63: _prev=$((${#_cmds[*]} - 1))
64: ((_prev >= 0)) || return
65: set -A _c -- ${_cmds[_prev]}
66: _name=3
67: [[ ${_c[_name]} == alias ]] && _name=4
68: _c[_name]="${_c[_name]} $_daddr"
69: _cmds[$_prev]="${_c[@]}"
70: ;;
1.213 florian 71: dhcp) _cmds[${#_cmds[*]}]="ifconfig $_if inet autoconf"
72: V4_AUTOCONF=true
1.177 rpe 73: ;;
74: '!'*) _cmd=$(print -- "${_c[@]}" | sed 's/\$if/'$_if'/g')
75: _cmds[${#_cmds[*]}]="${_cmd#!}"
76: ;;
77: *) _cmds[${#_cmds[*]}]="ifconfig $_if ${_c[@]}"
78: ;;
79: esac
80: unset _c
1.178 rpe 81: set +o noglob
1.177 rpe 82: }
83:
1.192 rpe 84: # Create interface $1 if it does not yet exist.
1.195 rpe 85: # Usage: ifcreate if1
1.191 dlg 86: ifcreate() {
87: local _if=$1
88:
1.215 bluhm 89: if $PRINT_ONLY; then
90: print -r -- "{ ifconfig $_if || ifconfig $_if create; }"
91: else
92: { ifconfig $_if || ifconfig $_if create; } >/dev/null 2>&1
93: fi
1.191 dlg 94: }
95:
1.192 rpe 96: # Create interfaces for network pseudo-devices referred to by hostname.if files.
1.195 rpe 97: # Usage: vifscreate
1.191 dlg 98: vifscreate() {
1.192 rpe 99: local _vif _hn _if
1.191 dlg 100:
1.192 rpe 101: for _vif in $(ifconfig -C); do
1.193 rpe 102: for _hn in /etc/hostname.${_vif}+([[:digit:]]); do
1.191 dlg 103: [[ -f $_hn ]] || continue
104: _if=${_hn#/etc/hostname.}
1.216 bluhm 105:
106: # loopback for routing domain is created by kernel
107: [[ -n ${_if##lo[1-9]*} ]] || continue
1.191 dlg 108:
1.193 rpe 109: if ! ifcreate $_if; then
1.194 rpe 110: print -u2 "${0##*/}: create for '$_if' failed."
1.193 rpe 111: fi
1.191 dlg 112: done
113: done
114: }
115:
1.160 rpe 116: # Start a single interface.
117: # Usage: ifstart if1
1.83 miod 118: ifstart() {
1.187 tb 119: local _if=$1 _hn=/etc/hostname.$1 _cmds _i=0 _line _stat
1.177 rpe 120: set -A _cmds
1.174 rpe 121:
1.83 miod 122: # Interface names must be alphanumeric only. We check to avoid
123: # configuring backup or temp files, and to catch the "*" case.
1.177 rpe 124: [[ $_if != +([[:alpha:]])+([[:digit:]]) ]] && return
1.83 miod 125:
1.185 rpe 126: if [[ ! -f $_hn ]]; then
1.194 rpe 127: print -u2 "${0##*/}: $_hn: No such file or directory."
1.121 todd 128: return
129: fi
1.177 rpe 130:
1.146 rpe 131: # Not using stat(1), we can't rely on having /usr yet.
1.185 rpe 132: set -A _stat -- $(ls -nL $_hn)
1.183 rpe 133: if [[ "${_stat[0]}${_stat[2]}${_stat[3]}" != *---00 ]]; then
1.194 rpe 134: print -u2 "WARNING: $_hn is insecure, fixing permissions."
1.185 rpe 135: chmod -LR o-rwx $_hn
136: chown -LR root:wheel $_hn
1.119 deraadt 137: fi
1.83 miod 138:
1.177 rpe 139: # Check for ifconfig'able interface, except if -n option is specified.
1.215 bluhm 140: ifcreate $_if || return
1.177 rpe 141:
142: # Parse the hostname.if(5) file and fill _cmds array with interface
143: # configuration commands.
144: set -o noglob
1.205 kn 145: while IFS= read -- _line; do
1.177 rpe 146: parse_hn_line $_line
1.185 rpe 147: done <$_hn
1.177 rpe 148:
149: # Apply the interface configuration commands stored in _cmds array.
150: while ((_i < ${#_cmds[*]})); do
151: if $PRINT_ONLY; then
152: print -r -- "${_cmds[_i]}"
1.83 miod 153: else
1.177 rpe 154: eval "${_cmds[_i]}"
1.83 miod 155: fi
1.177 rpe 156: ((_i++))
157: done
158: unset _cmds
1.178 rpe 159: set +o noglob
1.83 miod 160: }
161:
1.161 rpe 162: # Start multiple interfaces by driver name.
163: # Usage: ifmstart "em iwm" "trunk vlan"
1.146 rpe 164: # Start "$1" interfaces in order or all interfaces if empty.
1.161 rpe 165: # Don't start "$2" interfaces. "$2" is optional.
1.105 todd 166: ifmstart() {
1.161 rpe 167: local _sifs=$1 _xifs=$2 _hn _if _sif _xif
168:
169: for _sif in ${_sifs:-ALL}; do
1.193 rpe 170: for _hn in /etc/hostname.+([[:alpha:]])+([[:digit:]]); do
171: [[ -f $_hn ]] || continue
1.161 rpe 172: _if=${_hn#/etc/hostname.}
1.113 david 173:
1.146 rpe 174: # Skip unwanted ifs.
1.161 rpe 175: for _xif in $_xifs; do
176: [[ $_xif == ${_if%%[0-9]*} ]] && continue 2
1.105 todd 177: done
178:
1.146 rpe 179: # Start wanted ifs.
1.161 rpe 180: [[ $_sif == @(ALL|${_if%%[0-9]*}) ]] && ifstart $_if
1.105 todd 181: done
182: done
183: }
184:
1.195 rpe 185: # Parse /etc/mygate and add default routes for IPv4 and IPv6.
1.172 mpi 186: # Usage: defaultroute
187: defaultroute() {
1.209 tb 188: local _cmd _v4set=false _v6set=false;
1.208 deraadt 189: set -o noglob
1.188 tb 190:
1.208 deraadt 191: stripcom /etc/mygate |
1.180 rpe 192: while read gw; do
1.208 deraadt 193: case $gw in
194: '!'*)
1.209 tb 195: _cmd=$(print -- "$gw")
1.208 deraadt 196: _cmd="${_cmd#!}"
197: ;;
1.209 tb 198: !(*:*))
1.214 sthen 199: ($_v4set || $V4_AUTOCONF) && continue
1.209 tb 200: _cmd="route -qn add -host default $gw"
201: _v4set=true
202: ;;
1.208 deraadt 203: *)
1.209 tb 204: ($_v6set || $V6_AUTOCONF) && continue
205: _cmd="route -qn add -host -inet6 default $gw"
206: _v6set=true
1.208 deraadt 207: ;;
208: esac
1.188 tb 209: if $PRINT_ONLY; then
1.208 deraadt 210: print -r -- "$_cmd"
1.188 tb 211: else
1.208 deraadt 212: $_cmd
1.188 tb 213: fi
1.172 mpi 214: done
1.208 deraadt 215: set +o noglob
1.172 mpi 216: }
1.199 tb 217:
1.215 bluhm 218: # add all the routes needed for IPv6
219: ip6routes() {
220: local _i=0
221: set -A _cmds
222:
223: # Disallow link-local unicast dest without outgoing scope identifiers.
224: _cmds[_i++]="route -qn add -inet6 fe80:: -prefixlen 10 ::1 -reject"
225:
226: # Disallow site-local unicast dest without outgoing scope identifiers.
227: # If you configure site-locals without scope id (it is permissible
228: # config for routers that are not on scope boundary), you may want
229: # to comment the line out.
230: _cmds[_i++]="route -qn add -inet6 fec0:: -prefixlen 10 ::1 -reject"
231:
232: # Disallow "internal" addresses to appear on the wire.
233: _cmds[_i++]="route -qn add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject"
234:
235: # Disallow packets to malicious 6to4 prefix.
236: _cmds[_i++]="route -qn add -inet6 2002:e000:: -prefixlen 20 ::1 -reject"
237: _cmds[_i++]="route -qn add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject"
238: _cmds[_i++]="route -qn add -inet6 2002:0000:: -prefixlen 24 ::1 -reject"
239: _cmds[_i++]="route -qn add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject"
240:
241: # Disallow packets without scope identifier.
242: _cmds[_i++]="route -qn add -inet6 ff01:: -prefixlen 16 ::1 -reject"
243: _cmds[_i++]="route -qn add -inet6 ff02:: -prefixlen 16 ::1 -reject"
244:
245: # Completely disallow packets to IPv4 compatible prefix.
246: #
247: # This may conflict with RFC1933 under following circumstances:
248: # (1) An IPv6-only KAME node tries to originate packets to IPv4
249: # compatible destination. The KAME node has no IPv4 compatible
250: # support. Under RFC1933, it should transmit native IPv6
251: # packets toward IPv4 compatible destination, hoping it would
252: # reach a router that forwards the packet toward auto-tunnel
253: # interface.
254: # (2) An IPv6-only node originates a packet to an IPv4 compatible
255: # destination. A KAME node is acting as an IPv6 router, and
256: # asked to forward it.
257: #
258: # Due to rare use of IPv4 compatible addresses, and security issues
259: # with it, we disable it by default.
260: _cmds[_i++]="route -qn add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject"
261:
262: # Apply the interface configuration commands stored in _cmds array.
263: _i=0
264: while ((_i < ${#_cmds[*]})); do
265: if $PRINT_ONLY; then
266: print -r -- "${_cmds[_i]}"
267: else
268: eval "${_cmds[_i]}"
269: fi
270: ((_i++))
271: done
272: unset _cmds
273: }
274:
1.218 ! florian 275: # wait for autoconf interfaces
! 276: wait_autoconf_default() {
! 277: if ifconfig | grep -q ': flags=.*<.*AUTOCONF.*>'; then
! 278: count=0
! 279: while ((count++ < 20)); do
! 280: route -n show | grep -q ^default && break
! 281: sleep .5
! 282: done
! 283: fi
! 284: }
! 285:
1.199 tb 286: # Make sure the invoking user has the right privileges. Check for presence of
287: # id(1) to avoid problems with diskless setups.
288: if [[ -x /usr/bin/id ]] && (($(id -u) != 0)); then
289: echo "${0##*/}: need root privileges"
290: exit 1
291: fi
1.154 sthen 292:
1.151 rpe 293: # Get network related vars from rc.conf using the parsing routine from rc.subr.
294: FUNCS_ONLY=1 . /etc/rc.d/rc.subr
1.150 ajacouto 295: _rc_parse_conf
1.177 rpe 296:
297: PRINT_ONLY=false
1.214 sthen 298: V4_AUTOCONF=false
1.180 rpe 299: V6_AUTOCONF=false
300:
1.177 rpe 301: while getopts ":n" opt; do
302: case $opt in
303: n) PRINT_ONLY=true;;
1.198 rpe 304: *) usage;;
1.177 rpe 305: esac
306: done
307: shift $((OPTIND-1))
308:
1.195 rpe 309: # Load key material for the generation of IPv6 Semantically Opaque Interface
310: # Identifiers (SOII) used for link local and SLAAC addresses.
1.189 florian 311: $PRINT_ONLY || [[ ! -f /etc/soii.key ]] ||
312: sysctl -q "net.inet6.ip6.soiikey=$(</etc/soii.key)"
1.1 deraadt 313:
1.83 miod 314: # If we were invoked with a list of interface names, just reconfigure these
1.172 mpi 315: # interfaces (or bridges), add default routes and return.
1.159 rpe 316: if (($# > 0)); then
317: for _if; do ifstart $_if; done
1.172 mpi 318: defaultroute
1.83 miod 319: return
320: fi
321:
322: # Otherwise, process with the complete network initialization.
1.4 dm 323:
1.131 sobrado 324: # Set the address for the loopback interface. Bringing the interface up,
325: # automatically invokes the IPv6 address ::1.
1.215 bluhm 326: if $PRINT_ONLY; then
327: print -r -- "ifconfig lo0 inet 127.0.0.1/8"
328: else
329: ifconfig lo0 inet 127.0.0.1/8
330: fi
1.24 kstailey 331:
1.195 rpe 332: # IPv6 configuration.
1.54 itojun 333: if ifconfig lo0 inet6 >/dev/null 2>&1; then
334: ip6kernel=YES
1.215 bluhm 335: ip6routes
1.54 itojun 336: else
337: ip6kernel=NO
338: fi
339:
1.195 rpe 340: # Create all the pseudo interfaces up front.
1.191 dlg 341: vifscreate
1.105 todd 342:
343: # Configure all the non-loopback interfaces which we know about, but
1.127 deraadt 344: # do not start interfaces which must be delayed. Refer to hostname.if(5)
1.217 dlg 345: ifmstart "" "aggr trunk svlan vlan carp pppoe tun tap gif etherip gre egre nvgre eoip vxlan pflow wg"
1.56 itojun 346:
1.201 dlg 347: # The aggr and trunk interfaces need to come up first in this list.
1.132 mpf 348: # The (s)vlan interfaces need to come up after trunk.
1.118 brad 349: # Configure all the carp interfaces which we know about before default route.
1.201 dlg 350: ifmstart "aggr trunk svlan vlan carp pppoe"
1.102 mcbride 351:
1.195 rpe 352: # Set default routes for IPv4 and IPv6.
1.172 mpi 353: defaultroute
1.44 deraadt 354:
1.48 niklas 355: # Multicast routing.
1.168 sthen 356: if [[ $multicast != YES ]]; then
1.215 bluhm 357: if $PRINT_ONLY; then
358: print -r -- "route -qn delete 224.0.0.0/4"
359: print -r -- "route -qn add -net 224.0.0.0/4 -interface 127.0.0.1 -reject"
360: else
361: route -qn delete 224.0.0.0/4
362: route -qn add -net 224.0.0.0/4 -interface 127.0.0.1 -reject
363: fi
1.168 sthen 364: fi
1.105 todd 365:
1.146 rpe 366: # Reject 127/8 other than 127.0.0.1.
1.215 bluhm 367: if $PRINT_ONLY; then
368: print -r -- "route -qn add -net 127 127.0.0.1 -reject"
369: else
370: route -qn add -net 127 127.0.0.1 -reject
371: fi
1.218 ! florian 372:
! 373: # If interface autoconf exists, pause a little for at least one default route
! 374: wait_autoconf_default
1.191 dlg 375:
376: # Configure interfaces that rely on routing
1.217 dlg 377: ifmstart "tun tap gif etherip gre egre nvgre eoip vxlan pflow wg"
1.116 david 378:
1.159 rpe 379: if [[ $ip6kernel == YES ]]; then
1.195 rpe 380: # Ensure IPv6 Duplicate Address Detection (DAD) is completed.
1.124 markus 381: count=0
1.159 rpe 382: while ((count++ < 10 && $(sysctl -n net.inet6.ip6.dad_pending) != 0)); do
1.124 markus 383: sleep 1
384: done
1.116 david 385: fi