Add the DragonFly cvs id and perform general cleanups on cvs/rcs/sccs ids. Most
[dragonfly.git] / etc / rc.network6
CommitLineData
984263bc
MD
1#! /bin/sh
2#
3# Copyright (c) 2000 The KAME Project
4# All rights reserved.
5#
6# Redistribution and use in source and binary forms, with or without
7# modification, are permitted provided that the following conditions
8# are met:
9# 1. Redistributions of source code must retain the above copyright
10# notice, this list of conditions and the following disclaimer.
11# 2. Redistributions in binary form must reproduce the above copyright
12# notice, this list of conditions and the following disclaimer in the
13# documentation and/or other materials provided with the distribution.
14#
15# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25# SUCH DAMAGE.
26#
27# $FreeBSD: src/etc/rc.network6,v 1.5.2.23 2002/07/24 18:25:42 ume Exp $
1de703da 28# $DragonFly: src/etc/Attic/rc.network6,v 1.2 2003/06/17 04:24:45 dillon Exp $
984263bc
MD
29#
30
31# Note that almost all of the user-configurable behavior is not in this
32# file, but rather in /etc/defaults/rc.conf. Please check that file
33# first before contemplating any changes here. If you do need to change
34# this file for some reason, we would like to know about it.
35
36# IPv6 startup
37
38network6_pass1() {
39 echo -n 'Doing IPv6 network setup:'
40
41 # Initialize IP filtering using ip6fw
42 #
43 if /sbin/ip6fw -q flush > /dev/null 2>&1; then
44 ipv6_firewall_in_kernel=1
45 else
46 ipv6_firewall_in_kernel=0
47 fi
48
49 case ${ipv6_firewall_enable} in
50 [Yy][Ee][Ss])
51 if [ "${ipv6_firewall_in_kernel}" -eq 0 ] && kldload ip6fw; then
52 ipv6_firewall_in_kernel=1
53 echo "Kernel IPv6 firewall module loaded."
54 elif [ "${ipv6_firewall_in_kernel}" -eq 0 ]; then
55 echo "Warning: IPv6 firewall kernel module failed to load."
56 fi
57 ;;
58 esac
59
60 # Load the filters if required
61 #
62 case ${ipv6_firewall_in_kernel} in
63 1)
64 if [ -z "${ipv6_firewall_script}" ]; then
65 ipv6_firewall_script=/etc/rc.firewall6
66 fi
67
68 case ${ipv6_firewall_enable} in
69 [Yy][Ee][Ss])
70 if [ -r "${ipv6_firewall_script}" ]; then
71 . "${ipv6_firewall_script}"
72 echo -n 'IPv6 Firewall rules loaded.'
73 elif [ "`ip6fw l 65535`" = "65535 deny ipv6 from any to any" ]; then
74 echo -n "Warning: kernel has IPv6 firewall functionality, "
75 echo "but IPv6 firewall rules are not enabled."
76 echo " All ipv6 services are disabled."
77 fi
78
79 case ${ipv6_firewall_logging} in
80 [Yy][Ee][Ss] | '')
81 echo 'IPv6 Firewall logging=YES'
82 sysctl net.inet6.ip6.fw.verbose=1 >/dev/null
83 ;;
84 *)
85 ;;
86 esac
87
88 ;;
89 esac
90 ;;
91 esac
92
93 case ${ipv6_network_interfaces} in
94 [Aa][Uu][Tt][Oo])
95 #
96 # list of interfaces, and prefix for interfaces
97 #
98 ipv6_network_interfaces="`ifconfig -l`"
99 ;;
100 [Nn][Oo][Nn][Ee])
101 ipv6_network_interfaces=''
102 ;;
103 esac
104
105 # just to make sure
106 ifconfig lo0 up
107
108 # disallow "internal" addresses to appear on the wire
109 route add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject
110 route add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject
111
112 case ${ipv6_gateway_enable} in
113 [Yy][Ee][Ss])
114 # act as a router
115 sysctl net.inet6.ip6.forwarding=1
116 sysctl net.inet6.ip6.accept_rtadv=0
117
118 # wait for DAD
119 for i in $ipv6_network_interfaces; do
120 ifconfig $i up
121 done
122 sleep `sysctl -n net.inet6.ip6.dad_count`
123 sleep 1
124 ;;
125 *)
126 # act as endhost - start with manual configuration
127 # Setup of net.inet6.ip6.accept_rtadv is done later by
128 # network6_interface_setup.
129 sysctl net.inet6.ip6.forwarding=0
130 ;;
131 esac
132
133 if [ -n "${ipv6_network_interfaces}" ]; then
134 # setting up interfaces
135 network6_interface_setup $ipv6_network_interfaces
136
137 # wait for DAD's completion (for global addrs)
138 sleep `sysctl -n net.inet6.ip6.dad_count`
139 sleep 1
140 fi
141
142 case ${ipv6_gateway_enable} in
143 [Yy][Ee][Ss])
144 # Filter out interfaces on which IPv6 addr init failed.
145 ipv6_working_interfaces=""
146 for i in ${ipv6_network_interfaces}; do
147 laddr=`network6_getladdr $i exclude_tentative`
148 case ${laddr} in
149 '')
150 ;;
151 *)
152 ipv6_working_interfaces="$i \
153 ${ipv6_working_interfaces}"
154 ;;
155 esac
156 done
157 ipv6_network_interfaces=${ipv6_working_interfaces}
158 ;;
159 esac
160
161 # 6to4 setup
162 network6_stf_setup
163
164 # install the "default interface" to kernel, which will be used
165 # as the default route when there's no router.
166 network6_default_interface_setup
167
168 # setup static routes
169 network6_static_routes_setup
170
171 # setup faith
172 network6_faith_setup
173
174 # ipv6_router
175 case ${ipv6_router_enable} in
176 [Yy][Ee][Ss])
177 if [ -x ${ipv6_router} ]; then
178 echo -n " ${ipv6_router}"
179 ${ipv6_router} ${ipv6_router_flags}
180 fi
181 ;;
182 esac
183
184
185 case ${ipv6_gateway_enable} in
186 [Yy][Ee][Ss])
187 # rtadvd
188 # This should enabled with a great care.
189 # You may want to fine-tune /etc/rtadvd.conf.
190 #
191 # And if you wish your rtadvd to receive and process
192 # router renumbering messages, specify your Router Renumbering
193 # security policy by -R option.
194 #
195 # See `man 3 ipsec_set_policy` for IPsec policy specification
196 # details.
197 # (CAUTION: This enables your routers prefix renumbering
198 # from another machine, so if you enable this, do it with
199 # enough care.)
200 #
201 case ${rtadvd_enable} in
202 [Yy][Ee][Ss])
203 # default
204 case ${rtadvd_interfaces} in
205 '')
206 for i in ${ipv6_network_interfaces}; do
207 case $i in
208 lo0|gif[0-9]*|stf[0-9]*|faith[0-9]*|lp[0-9]*|sl[0-9]*|tun[0-9]*)
209 continue
210 ;;
211 *)
212 rtadvd_interfaces="${rtadvd_interfaces} ${i}"
213 ;;
214 esac
215 done
216 ;;
217 esac
218 rtadvd ${rtadvd_interfaces}
219 #
220 # Enable Router Renumbering, unicast case
221 # (use correct src/dst addr)
222 # rtadvd -R "in ipsec ah/transport/fec0:0:0:1::1-fec0:0:0:10::1/require" \
223 # ${ipv6_network_interfaces}
224 # Enable Router Renumbering, multicast case
225 # (use correct src addr)
226 # rtadvd -R "in ipsec ah/transport/ff05::2-fec0:0:0:10::1/require" \
227 # ${ipv6_network_interfaces}
228 ;;
229 esac
230
231 # mroute6d
232 case ${mroute6d_enable} in
233 [Yy][Ee][Ss])
234 if [ -x ${mroute6d_program} ]; then
235 echo -n " ${mroute6d_program}"
236 ${mroute6d_program} ${mroute6d_flags}
237 fi
238 ;;
239 esac
240 ;;
241 esac
242
243 case ${ipv6_ipv4mapping} in
244 [Yy][Ee][Ss])
245 echo -n ' IPv4 mapped IPv6 address support=YES'
246 sysctl net.inet6.ip6.v6only=0 >/dev/null
247 ;;
248 '' | *)
249 echo -n ' IPv4 mapped IPv6 address support=NO'
250 sysctl net.inet6.ip6.v6only=1 >/dev/null
251 ;;
252 esac
253
254 echo '.'
255
256 # Let future generations know we made it.
257 #
258 network6_pass1_done=YES
259}
260
261network6_interface_setup() {
262 interfaces=$*
263 rtsol_interfaces=''
264 case ${ipv6_gateway_enable} in
265 [Yy][Ee][Ss])
266 rtsol_available=no
267 ;;
268 *)
269 rtsol_available=yes
270 ;;
271 esac
272 for i in $interfaces; do
273 rtsol_interface=yes
274 eval prefix=\$ipv6_prefix_$i
275 if [ -n "${prefix}" ]; then
276 rtsol_available=no
277 rtsol_interface=no
278 laddr=`network6_getladdr $i`
279 hostid=`expr "${laddr}" : 'fe80::\(.*\)%\(.*\)'`
280 for j in ${prefix}; do
281 address=$j\:${hostid}
282 ifconfig $i inet6 ${address} prefixlen 64 alias
283
284 case ${ipv6_gateway_enable} in
285 [Yy][Ee][Ss])
286 # subnet-router anycast address
287 # (rfc2373)
288 ifconfig $i inet6 $j:: prefixlen 64 \
289 alias anycast
290 ;;
291 esac
292 done
293 fi
294 eval ipv6_ifconfig=\$ipv6_ifconfig_$i
295 if [ -n "${ipv6_ifconfig}" ]; then
296 rtsol_available=no
297 rtsol_interface=no
298 ifconfig $i inet6 ${ipv6_ifconfig} alias
299 fi
300
301 if [ ${rtsol_available} = yes -a ${rtsol_interface} = yes ]
302 then
303 case ${i} in
304 lo0|gif[0-9]*|stf[0-9]*|faith[0-9]*|lp[0-9]*|sl[0-9]*|tun[0-9]*)
305 ;;
306 *)
307 rtsol_interfaces="${rtsol_interfaces} ${i}"
308 ;;
309 esac
310 else
311 ifconfig $i inet6
312 fi
313 done
314
315 if [ ${rtsol_available} = yes -a -n "${rtsol_interfaces}" ]; then
316 # Act as endhost - automatically configured.
317 # You can configure only single interface, as
318 # specification assumes that autoconfigured host has
319 # single interface only.
320 sysctl net.inet6.ip6.accept_rtadv=1
321 set ${rtsol_interfaces}
322 ifconfig $1 up
323 rtsol $1
324 fi
325
326 for i in $interfaces; do
327 alias=0
328 while : ; do
329 eval ipv6_ifconfig=\$ipv6_ifconfig_${i}_alias${alias}
330 if [ -z "${ipv6_ifconfig}" ]; then
331 break;
332 fi
333 ifconfig $i inet6 ${ipv6_ifconfig} alias
334 alias=$((${alias} + 1))
335 done
336 done
337}
338
339network6_stf_setup() {
340 case ${stf_interface_ipv4addr} in
341 [Nn][Oo] | '')
342 ;;
343 *)
344 # assign IPv6 addr and interface route for 6to4 interface
345 stf_prefixlen=$((16+${stf_interface_ipv4plen:-0}))
346 OIFS="$IFS"
347 IFS=".$IFS"
348 set ${stf_interface_ipv4addr}
349 IFS="$OIFS"
350 ipv4_in_hexformat=`printf "%x:%x\n" \
351 $(($1*256 + $2)) $(($3*256 + $4))`
352 case ${stf_interface_ipv6_ifid} in
353 [Aa][Uu][Tt][Oo] | '')
354 for i in ${ipv6_network_interfaces}; do
355 laddr=`network6_getladdr ${i}`
356 case ${laddr} in
357 '')
358 ;;
359 *)
360 break
361 ;;
362 esac
363 done
364 stf_interface_ipv6_ifid=`expr "${laddr}" : \
365 'fe80::\(.*\)%\(.*\)'`
366 case ${stf_interface_ipv6_ifid} in
367 '')
368 stf_interface_ipv6_ifid=0:0:0:1
369 ;;
370 esac
371 ;;
372 esac
373 ifconfig stf0 inet6 2002:${ipv4_in_hexformat}:${stf_interface_ipv6_slaid:-0}:${stf_interface_ipv6_ifid} \
374 prefixlen ${stf_prefixlen}
375 # disallow packets to malicious 6to4 prefix
376 route add -inet6 2002:e000:: -prefixlen 20 ::1 -reject
377 route add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject
378 route add -inet6 2002:0000:: -prefixlen 24 ::1 -reject
379 route add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject
380 ;;
381 esac
382}
383
384network6_static_routes_setup() {
385 # Set up any static routes.
386 case ${ipv6_defaultrouter} in
387 [Nn][Oo] | '')
388 ;;
389 *)
390 ipv6_static_routes="default ${ipv6_static_routes}"
391 ipv6_route_default="default ${ipv6_defaultrouter}"
392 ;;
393 esac
394 case ${ipv6_static_routes} in
395 [Nn][Oo] | '')
396 ;;
397 *)
398 for i in ${ipv6_static_routes}; do
399 eval ipv6_route_args=\$ipv6_route_${i}
400 route add -inet6 ${ipv6_route_args}
401 done
402 ;;
403 esac
404}
405
406network6_faith_setup() {
407 case ${ipv6_faith_prefix} in
408 [Nn][Oo] | '')
409 ;;
410 *)
411 sysctl net.inet6.ip6.keepfaith=1
412 ifconfig faith0 create >/dev/null 2>&1
413 ifconfig faith0 up
414 for prefix in ${ipv6_faith_prefix}; do
415 prefixlen=`expr "${prefix}" : ".*/\(.*\)"`
416 case ${prefixlen} in
417 '')
418 prefixlen=96
419 ;;
420 *)
421 prefix=`expr "${prefix}" : \
422 "\(.*\)/${prefixlen}"`
423 ;;
424 esac
425 route add -inet6 ${prefix} -prefixlen ${prefixlen} ::1
426 route change -inet6 ${prefix} -prefixlen ${prefixlen} \
427 -ifp faith0
428 done
429 ;;
430 esac
431}
432
433network6_default_interface_setup() {
434 # Choose IPv6 default interface if it is not clearly specified.
435 case ${ipv6_default_interface} in
436 '')
437 for i in ${ipv6_network_interfaces}; do
438 case $i in
439 lo0|faith[0-9]*)
440 continue
441 ;;
442 esac
443 laddr=`network6_getladdr $i exclude_tentative`
444 case ${laddr} in
445 '')
446 ;;
447 *)
448 ipv6_default_interface=$i
449 break
450 ;;
451 esac
452 done
453 ;;
454 esac
455
456 # Disallow unicast packets without outgoing scope identifiers,
457 # or route such packets to a "default" interface, if it is specified.
458 route add -inet6 fe80:: -prefixlen 10 ::1 -reject
459 case ${ipv6_default_interface} in
460 [Nn][Oo] | '')
461 route add -inet6 ff02:: -prefixlen 16 ::1 -reject
462 ;;
463 *)
464 laddr=`network6_getladdr ${ipv6_default_interface}`
465 route add -inet6 ff02:: ${laddr} -prefixlen 16 -interface \
466 -cloning
467
468 # Disable installing the default interface with the
469 # case net.inet6.ip6.forwarding=0 and
470 # net.inet6.ip6.accept_rtadv=0, due to avoid conflict
471 # between the default router list and the manual
472 # configured default route.
473 case ${ipv6_gateway_enable} in
474 [Yy][Ee][Ss])
475 ;;
476 *)
477 if [ `sysctl -n net.inet6.ip6.accept_rtadv` -eq 1 ]
478 then
479 ndp -I ${ipv6_default_interface}
480 fi
481 ;;
482 esac
483 ;;
484 esac
485}
486
487network6_getladdr() {
488 ifconfig $1 2>/dev/null | while read proto addr rest; do
489 case ${proto} in
490 inet6)
491 case ${addr} in
492 fe80::*)
493 if [ -z "$2" ]; then
494 echo ${addr}
495 return
496 fi
497 case ${rest} in
498 *tentative*)
499 continue
500 ;;
501 *)
502 echo ${addr}
503 return
504 esac
505 esac
506 esac
507 done
508}