Return to netstart CVS log

Up to [local] / src / etc

Remove ipf.  Darren Reed has interpreted his (old, new, whichever)
licence in a way that makes ipf not free according to the rules we
established over 5 years ago, at www.openbsd.org/goals.html (and those
same basic rules govern the other *BSD projects too).  Specifically,
Darren says that modified versions are not permitted.  But software
which OpenBSD uses and redistributes must be free to all (be they
people or companies), for any purpose they wish to use it, including
modification, use, peeing on, or even integration into baby mulching
machines or atomic bombs to be dropped on Australia.  Furthermore, we
know of a number of companies using ipf with modification like us, who
are now in the same situation, and we hope that some of them will work
with us to fill this gap that now exists in OpenBSD (temporarily, we
hope).

#!/bin/sh -
#
#	$OpenBSD: netstart,v 1.78 2001/05/30 02:11:08 deraadt Exp $

# Returns true if $1 contains only alphanumerics
isalphanumeric() {
	local _n
	_n=$1
	while [ ${#_n} != 0 ]; do
		case $_n in
			[A-Za-z0-9]*)	;;
			*)		return 1;;
		esac
		_n=${_n#?}
	done
	return 0
}

# /etc/myname contains my symbolic name
#
hostname=`cat /etc/myname`
hostname $hostname
if [ -f /etc/defaultdomain ]; then
	domainname `cat /etc/defaultdomain`
fi

# pick up option configuration
. /etc/rc.conf

# set the address for the loopback interface
# it will also initialize IPv6 address for lo0 (::1 and others).
ifconfig lo0 inet localhost

# use loopback, not the wire
route -n add -host $hostname localhost > /dev/null
route -n add -net 127 127.0.0.1 -reject > /dev/null

if ifconfig lo0 inet6 >/dev/null 2>&1; then
	# IPv6 configurations.
	ip6kernel=YES

	# disallow link-local unicast dest without outgoing scope identifiers.
	route add -inet6 fe80:: -prefixlen 10 ::1 -reject > /dev/null

	# disallow site-local unicast dest without outgoing scope identifiers.
	# If you configure site-locals without scope id (it is permissible
	# config for routers that are not on scope boundary), you may want
	# to comment the line out.
	route add -inet6 fec0:: -prefixlen 10 ::1 -reject > /dev/null

	# disallow "internal" addresses to appear on the wire.
	route add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject > /dev/null

	# disallow packets to malicious IPv4 compatible prefix.
	route add -inet6 ::224.0.0.0 -prefixlen 100 ::1 -reject > /dev/null
	route add -inet6 ::127.0.0.0 -prefixlen 104 ::1 -reject > /dev/null
	route add -inet6 ::0.0.0.0 -prefixlen 104 ::1 -reject > /dev/null
	route add -inet6 ::255.0.0.0 -prefixlen 104 ::1 -reject > /dev/null

	# disallow packets to malicious 6to4 prefix.
	route add -inet6 2002:e000:: -prefixlen 20 ::1 -reject > /dev/null
	route add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject > /dev/null
	route add -inet6 2002:0000:: -prefixlen 24 ::1 -reject > /dev/null
	route add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject > /dev/null

	# Completely disallow packets to IPv4 compatible prefix.
	# This may conflict with RFC1933 under following circumstances:
	# (1) An IPv6-only KAME node tries to originate packets to IPv4
	#     compatible destination.  The KAME node has no IPv4 compatible
	#     support.  Under RFC1933, it should transmit native IPv6
	#     packets toward IPv4 compatible destination, hoping it would
	#     reach a router that forwards the packet toward auto-tunnel
	#     interface.
	# (2) An IPv6-only node originates a packet to an IPv4 compatible
	#     destination.  A KAME node is acting as an IPv6 router, and
	#     asked to forward it.
	# Due to rare use of IPv4 compatible addresses, and security issues
	# with it, we disable it by default.
	route add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject > /dev/null

	rtsolif=""
else
	ip6kernel=NO
fi

# configure all of the non-loopback interfaces which we know about.
# refer to hostname.if(5) and bridgename.if(5)
for hn in /etc/hostname.*; do
    # Strip off /etc/hostname. prefix
    if=${hn#/etc/hostname.}

    # Interface names must be alphanumeric only.  We check to avoid
    # configuring backup or temp files, and to catch the "*" case.
    if ! isalphanumeric "$if"; then
	continue
    fi
    ifconfig $if > /dev/null 2>&1
    if [ "$?" != "0" ]; then
	continue
    fi

    # Now parse the hostname.* file
    while :; do
	if [ "$cmd2" ]; then
	    # we are carrying over from the 'read dt dtaddr' last time
	    set -- $cmd2
	    af="$1" name="$2" mask="$3" bcaddr="$4" ext1="$5" cmd2=
	    # make sure and get any remaining args in ext2, like the read below
	    i=1; while [ i -lt 6 -a -n "$1" ]; do shift; let i=i+1; done
	    ext2="$@"
	else
	    # read the next line or exit the while loop
	    read af name mask bcaddr ext1 ext2 || break
	fi
	# $af can be "dhcp", "up", "rtsol", an address family, commands, or
	# a comment.
	case "$af" in
	"#"*|"") # skip comments and empty lines
	    continue
	    ;;
	"!"*) # parse commands
	    cmd="${af#*!} ${name} ${mask} ${bcaddr} ${ext1} ${ext2}"
	    ;;
	"bridge")
	    cmd="echo ${hn}: bridges now supported via bridgename.* files"
	    ;;
	"dhcp")
	    [ "$name" = "NONE" ] && name=
	    [ "$mask" = "NONE" ] && mask=
	    [ "$bcaddr" = "NONE" ] && bcaddr=
	    ifconfig $if $name $mask $bcaddr $ext1 $ext2 down
	    cmd="dhclient $if"
	    ;;
	"rtsol")
	    ifconfig $if $name $mask $bcaddr $ext1 $ext2 up
	    rtsolif="$rtsolif $if"
	    cmd=
	    ;;
	"up")
	    # The only one of these guaranteed to be set is $if
	    # the remaining ones exist so that media controls work
	    cmd="ifconfig $if $name $mask $bcaddr $ext1 $ext2 up"
	    ;;
	*)
	    read dt dtaddr
	    if [ "$name"  = "alias" ]; then
		# perform a 'shift' of sorts
		alias=$name
		name=$mask
		mask=$bcaddr
		bcaddr=$ext1
		ext1=$ext2
		ext2=
	    else
		alias=
	    fi
	    cmd="ifconfig $if $af $alias $name "
	    case "$dt" in
	    dest)
		cmd="$cmd $dtaddr"
		;;
	    [a-z!]*)
		cmd2="$dt $dtaddr"
		;;
	    esac
	    if [ ! -n "$name" ]; then
		    echo "/etc/hostname.$if: invalid network configuration file"
		return
	    fi
	    case $af in
	    inet)
		[ "$mask" ] && cmd="$cmd netmask $mask"
		if [ "$bcaddr" -a "X$bcaddr" != "XNONE" ]; then
		    cmd="$cmd broadcast $bcaddr"
		fi
		[ "$alias" ] && rtcmd="; route -n add -host $name 127.0.0.1"
		;;
	    inet6) [ "$mask" ] && cmd="$cmd prefixlen $mask"
		cmd="$cmd $bcaddr"
		;;
	    *) cmd="$cmd $mask $bcaddr"
	    esac
	    cmd="$cmd $ext1 $ext2$rtcmd" rtcmd=
	    ;;
	esac
	eval "$cmd"
    done < /etc/hostname.$if
done

if [ "$ip6kernel" = "YES" -a "x$rtsolif" != "x" ]; then
	fw=`sysctl -n net.inet6.ip6.forwarding`
	ra=`sysctl -n net.inet6.ip6.accept_rtadv`
	if [ "x$fw" = "x0" -a "x$ra" = "x1" ]; then
		echo "IPv6 autoconf:$rtsolif"
		rtsol $rtsolif
	else
		echo "WARNING: inconsistent config - check /etc/sysctl.conf for IPv6 autoconf"
	fi
fi
if [ "$ip6kernel" = "YES" ]; then
	# this is to make sure DAD is completed before going further.
	sleep `sysctl -n net.inet6.ip6.dad_count`
	sleep 1
fi

for bn in /etc/bridgename.*; do
    # Strip off /etc/bridgename. prefix
    if=${bn#/etc/bridgename.}

    # Interface names must be alphanumeric only.  We check to avoid
    # configuring backup or temp files, and to catch the "*" case.
    if ! isalphanumeric "$if"; then
        continue
    fi
    brconfig $if > /dev/null 2>&1
    if [ "$?" != "0" ]; then
	continue
    fi

    # Now parse the bridgename.* file
    {
	# All lines are run as brconfig(8) commands.
	while read line ; do
	    line=${line%%#*}		# strip comments
	    test -z "$line" && continue
	    case "$line" in
	    "!"*)
		cmd="${line#*!}"
		;;
	    *)
		cmd="brconfig $if $line"
		;;
	    esac
	    eval "$cmd"
	done
    } < /etc/bridgename.$if
done

# /etc/mygate, if it exists, contains the name of my gateway host
# that name must be in /etc/hosts.
if [ -f /etc/mygate ]; then
	route -n add -host default `cat /etc/mygate`
fi

# Multicast routing.
#
# The routing to the 224.0.0.0/4 net is setup according to these rules:
# multicast_host	multicast_router	route		comment
# NO			NO			-reject		no multicast
# NO			YES			none installed	daemon will run
# YES/interface		NO			-interface	YES=def. iface
#	   Any other combination		-reject		config error
case "$multicast_host:$multicast_router" in
NO:NO)
	route -n add -net 224.0.0.0/4 -interface 127.0.0.1 -reject> /dev/null
	;;
NO:YES)
	;;
*:NO)
	set `if [ $multicast_host = YES ]; then
		ed -s '!route -n show' <<EOF
/^default/p
EOF
	else
		ed -s "!ifconfig $multicast_host" <<EOF
/^	inet /p
EOF
	fi`
	route -n add -net 224.0.0.0/4 -interface $2 > /dev/null
	;;
*:*)
	echo 'config error, multicasting disabled until rc.conf is fixed'
	route -n add -net 224.0.0.0/4 -interface 127.0.0.1 -reject > /dev/null
	;;
esac