etc/rc.network6

   1 #! /bin/sh
   2 #
   3 # Copyright (c) 2000  The KAME Project
   4 # All rights reserved.
   5 #
   6 # Redistribution and use in source and binary forms, with or without
   7 # modification, are permitted provided that the following conditions
   8 # are met:
   9 # 1. Redistributions of source code must retain the above copyright
  10 #    notice, this list of conditions and the following disclaimer.
  11 # 2. Redistributions in binary form must reproduce the above copyright
  12 #    notice, this list of conditions and the following disclaimer in the
  13 #    documentation and/or other materials provided with the distribution.
  14 #
  15 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  16 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  18 # ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  19 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  21 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  24 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  25 # SUCH DAMAGE.
  26 #
  27 # $FreeBSD: src/etc/rc.network6,v 1.5.2.23 2002/07/24 18:25:42 ume Exp $
  28 # $DragonFly: src/etc/Attic/rc.network6,v 1.2 2003/06/17 04:24:45 dillon Exp $
  29 #
  30
  31 # Note that almost all of the user-configurable behavior is not in this
  32 # file, but rather in /etc/defaults/rc.conf.  Please check that file
  33 # first before contemplating any changes here.  If you do need to change
  34 # this file for some reason, we would like to know about it.
  35
  36 # IPv6 startup
  37
  38 network6_pass1() {
  39         echo -n 'Doing IPv6 network setup:'
  40
  41         # Initialize IP filtering using ip6fw
  42         #
  43         if /sbin/ip6fw -q flush > /dev/null 2>&1; then
  44                 ipv6_firewall_in_kernel=1
  45         else
  46                 ipv6_firewall_in_kernel=0
  47         fi
  48
  49         case ${ipv6_firewall_enable} in
  50         [Yy][Ee][Ss])
  51                 if [ "${ipv6_firewall_in_kernel}" -eq 0 ] && kldload ip6fw; then
  52                         ipv6_firewall_in_kernel=1
  53                         echo "Kernel IPv6 firewall module loaded."
  54                 elif [ "${ipv6_firewall_in_kernel}" -eq 0 ]; then
  55                         echo "Warning: IPv6 firewall kernel module failed to load."
  56                 fi
  57                 ;;
  58         esac
  59
  60         # Load the filters if required
  61         #
  62         case ${ipv6_firewall_in_kernel} in
  63         1)
  64                 if [ -z "${ipv6_firewall_script}" ]; then
  65                         ipv6_firewall_script=/etc/rc.firewall6
  66                 fi
  67
  68                 case ${ipv6_firewall_enable} in
  69                 [Yy][Ee][Ss])
  70                         if [ -r "${ipv6_firewall_script}" ]; then
  71                                 . "${ipv6_firewall_script}"
  72                                 echo -n 'IPv6 Firewall rules loaded.'
  73                         elif [ "`ip6fw l 65535`" = "65535 deny ipv6 from any to any" ]; then
  74                                 echo -n "Warning: kernel has IPv6 firewall functionality, "
  75                                 echo "but IPv6 firewall rules are not enabled."
  76                                 echo "           All ipv6 services are disabled."
  77                         fi
  78
  79                         case ${ipv6_firewall_logging} in
  80                         [Yy][Ee][Ss] | '')
  81                                 echo 'IPv6 Firewall logging=YES'
  82                                 sysctl net.inet6.ip6.fw.verbose=1 >/dev/null
  83                                 ;;
  84                         *)
  85                                 ;;
  86                         esac
  87
  88                         ;;
  89                 esac
  90                 ;;
  91         esac
  92
  93         case ${ipv6_network_interfaces} in
  94         [Aa][Uu][Tt][Oo])
  95                 #
  96                 # list of interfaces, and prefix for interfaces
  97                 #
  98                 ipv6_network_interfaces="`ifconfig -l`"
  99                 ;;
 100         [Nn][Oo][Nn][Ee])
 101                 ipv6_network_interfaces=''
 102                 ;;
 103         esac
 104
 105         # just to make sure
 106         ifconfig lo0 up
 107
 108         # disallow "internal" addresses to appear on the wire
 109         route add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject
 110         route add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject
 111
 112         case ${ipv6_gateway_enable} in
 113         [Yy][Ee][Ss])
 114                 # act as a router
 115                 sysctl net.inet6.ip6.forwarding=1
 116                 sysctl net.inet6.ip6.accept_rtadv=0
 117
 118                 # wait for DAD
 119                 for i in $ipv6_network_interfaces; do
 120                         ifconfig $i up
 121                 done
 122                 sleep `sysctl -n net.inet6.ip6.dad_count`
 123                 sleep 1
 124                 ;;
 125         *)
 126                 # act as endhost - start with manual configuration
 127                 # Setup of net.inet6.ip6.accept_rtadv is done later by
 128                 # network6_interface_setup.
 129                 sysctl net.inet6.ip6.forwarding=0
 130                 ;;
 131         esac
 132
 133         if [ -n "${ipv6_network_interfaces}" ]; then
 134                 # setting up interfaces
 135                 network6_interface_setup $ipv6_network_interfaces
 136
 137                 # wait for DAD's completion (for global addrs)
 138                 sleep `sysctl -n net.inet6.ip6.dad_count`
 139                 sleep 1
 140         fi
 141
 142         case ${ipv6_gateway_enable} in
 143         [Yy][Ee][Ss])
 144                 # Filter out interfaces on which IPv6 addr init failed.
 145                 ipv6_working_interfaces=""
 146                 for i in ${ipv6_network_interfaces}; do
 147                         laddr=`network6_getladdr $i exclude_tentative`
 148                         case ${laddr} in
 149                         '')
 150                                 ;;
 151                         *)
 152                                 ipv6_working_interfaces="$i \
 153                                         ${ipv6_working_interfaces}"
 154                                 ;;
 155                         esac
 156                 done
 157                 ipv6_network_interfaces=${ipv6_working_interfaces}
 158                 ;;
 159         esac
 160
 161         # 6to4 setup
 162         network6_stf_setup
 163
 164         # install the "default interface" to kernel, which will be used
 165         # as the default route when there's no router.
 166         network6_default_interface_setup
 167
 168         # setup static routes
 169         network6_static_routes_setup
 170
 171         # setup faith
 172         network6_faith_setup
 173
 174         # ipv6_router
 175         case ${ipv6_router_enable} in
 176         [Yy][Ee][Ss])
 177                 if [ -x ${ipv6_router} ]; then
 178                         echo -n " ${ipv6_router}"
 179                         ${ipv6_router} ${ipv6_router_flags}
 180                 fi
 181                 ;;
 182         esac
 183
 184
 185         case ${ipv6_gateway_enable} in
 186         [Yy][Ee][Ss])
 187                 # rtadvd
 188                 # This should enabled with a great care.
 189                 # You may want to fine-tune /etc/rtadvd.conf.
 190                 #
 191                 # And if you wish your rtadvd to receive and process
 192                 # router renumbering messages, specify your Router Renumbering
 193                 # security policy by -R option.
 194                 #
 195                 # See `man 3 ipsec_set_policy` for IPsec policy specification
 196                 # details.
 197                 # (CAUTION: This enables your routers prefix renumbering
 198                 # from another machine, so if you enable this, do it with
 199                 # enough care.)
 200                 #
 201                 case ${rtadvd_enable} in
 202                 [Yy][Ee][Ss])
 203                         # default
 204                         case ${rtadvd_interfaces} in
 205                         '')
 206                                 for i in ${ipv6_network_interfaces}; do
 207                                         case $i in
 208                                         lo0|gif[0-9]*|stf[0-9]*|faith[0-9]*|lp[0-9]*|sl[0-9]*|tun[0-9]*)
 209                                                 continue
 210                                                 ;;
 211                                         *)
 212                                                 rtadvd_interfaces="${rtadvd_interfaces} ${i}"
 213                                                 ;;
 214                                         esac
 215                                 done
 216                                 ;;
 217                         esac
 218                         rtadvd ${rtadvd_interfaces}
 219                         #
 220                         # Enable Router Renumbering, unicast case
 221                         # (use correct src/dst addr)
 222                         # rtadvd -R "in ipsec ah/transport/fec0:0:0:1::1-fec0:0:0:10::1/require" \
 223                         #       ${ipv6_network_interfaces}
 224                         # Enable Router Renumbering, multicast case
 225                         # (use correct src addr)
 226                         # rtadvd -R "in ipsec ah/transport/ff05::2-fec0:0:0:10::1/require" \
 227                         #       ${ipv6_network_interfaces}
 228                         ;;
 229                 esac
 230
 231                 # mroute6d
 232                 case ${mroute6d_enable} in
 233                 [Yy][Ee][Ss])
 234                         if [ -x ${mroute6d_program} ]; then
 235                                 echo -n " ${mroute6d_program}"
 236                                 ${mroute6d_program} ${mroute6d_flags}
 237                         fi
 238                         ;;
 239                 esac
 240                 ;;
 241         esac
 242
 243         case ${ipv6_ipv4mapping} in
 244         [Yy][Ee][Ss])
 245                 echo -n ' IPv4 mapped IPv6 address support=YES'
 246                 sysctl net.inet6.ip6.v6only=0 >/dev/null
 247                 ;;
 248         '' | *)
 249                 echo -n ' IPv4 mapped IPv6 address support=NO'
 250                 sysctl net.inet6.ip6.v6only=1 >/dev/null
 251                 ;;
 252         esac
 253
 254         echo '.'
 255
 256         # Let future generations know we made it.
 257         #
 258         network6_pass1_done=YES
 259 }
 260
 261 network6_interface_setup() {
 262         interfaces=$*
 263         rtsol_interfaces=''
 264         case ${ipv6_gateway_enable} in
 265         [Yy][Ee][Ss])
 266                 rtsol_available=no
 267                 ;;
 268         *)
 269                 rtsol_available=yes
 270                 ;;
 271         esac
 272         for i in $interfaces; do
 273                 rtsol_interface=yes
 274                 eval prefix=\$ipv6_prefix_$i
 275                 if [ -n "${prefix}" ]; then
 276                         rtsol_available=no
 277                         rtsol_interface=no
 278                         laddr=`network6_getladdr $i`
 279                         hostid=`expr "${laddr}" : 'fe80::\(.*\)%\(.*\)'`
 280                         for j in ${prefix}; do
 281                                 address=$j\:${hostid}
 282                                 ifconfig $i inet6 ${address} prefixlen 64 alias
 283
 284                                 case ${ipv6_gateway_enable} in
 285                                 [Yy][Ee][Ss])
 286                                         # subnet-router anycast address
 287                                         # (rfc2373)
 288                                         ifconfig $i inet6 $j:: prefixlen 64 \
 289                                                 alias anycast
 290                                         ;;
 291                                 esac
 292                         done
 293                 fi
 294                 eval ipv6_ifconfig=\$ipv6_ifconfig_$i
 295                 if [ -n "${ipv6_ifconfig}" ]; then
 296                         rtsol_available=no
 297                         rtsol_interface=no
 298                         ifconfig $i inet6 ${ipv6_ifconfig} alias
 299                 fi
 300
 301                 if [ ${rtsol_available} = yes -a ${rtsol_interface} = yes ]
 302                 then
 303                         case ${i} in
 304                         lo0|gif[0-9]*|stf[0-9]*|faith[0-9]*|lp[0-9]*|sl[0-9]*|tun[0-9]*)
 305                                 ;;
 306                         *)
 307                                 rtsol_interfaces="${rtsol_interfaces} ${i}"
 308                                 ;;
 309                         esac
 310                 else
 311                         ifconfig $i inet6
 312                 fi
 313         done
 314
 315         if [ ${rtsol_available} = yes -a -n "${rtsol_interfaces}" ]; then
 316                 # Act as endhost - automatically configured.
 317                 # You can configure only single interface, as
 318                 # specification assumes that autoconfigured host has
 319                 # single interface only.
 320                 sysctl net.inet6.ip6.accept_rtadv=1
 321                 set ${rtsol_interfaces}
 322                 ifconfig $1 up
 323                 rtsol $1
 324         fi
 325
 326         for i in $interfaces; do
 327                 alias=0
 328                 while : ; do
 329                         eval ipv6_ifconfig=\$ipv6_ifconfig_${i}_alias${alias}
 330                         if [ -z "${ipv6_ifconfig}" ]; then
 331                                 break;
 332                         fi
 333                         ifconfig $i inet6 ${ipv6_ifconfig} alias
 334                         alias=$((${alias} + 1))
 335                 done
 336         done
 337 }
 338
 339 network6_stf_setup() {
 340         case ${stf_interface_ipv4addr} in
 341         [Nn][Oo] | '')
 342                 ;;
 343         *)
 344                 # assign IPv6 addr and interface route for 6to4 interface
 345                 stf_prefixlen=$((16+${stf_interface_ipv4plen:-0}))
 346                 OIFS="$IFS"
 347                 IFS=".$IFS"
 348                 set ${stf_interface_ipv4addr}
 349                 IFS="$OIFS"
 350                 ipv4_in_hexformat=`printf "%x:%x\n" \
 351                         $(($1*256 + $2)) $(($3*256 + $4))`
 352                 case ${stf_interface_ipv6_ifid} in
 353                 [Aa][Uu][Tt][Oo] | '')
 354                         for i in ${ipv6_network_interfaces}; do
 355                                 laddr=`network6_getladdr ${i}`
 356                                 case ${laddr} in
 357                                 '')
 358                                         ;;
 359                                 *)
 360                                         break
 361                                         ;;
 362                                 esac
 363                         done
 364                         stf_interface_ipv6_ifid=`expr "${laddr}" : \
 365                                                       'fe80::\(.*\)%\(.*\)'`
 366                         case ${stf_interface_ipv6_ifid} in
 367                         '')
 368                                 stf_interface_ipv6_ifid=0:0:0:1
 369                                 ;;
 370                         esac
 371                         ;;
 372                 esac
 373                 ifconfig stf0 inet6 2002:${ipv4_in_hexformat}:${stf_interface_ipv6_slaid:-0}:${stf_interface_ipv6_ifid} \
 374                         prefixlen ${stf_prefixlen}
 375                 # disallow packets to malicious 6to4 prefix
 376                 route add -inet6 2002:e000:: -prefixlen 20 ::1 -reject
 377                 route add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject
 378                 route add -inet6 2002:0000:: -prefixlen 24 ::1 -reject
 379                 route add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject
 380                 ;;
 381         esac
 382 }
 383
 384 network6_static_routes_setup() {
 385         # Set up any static routes.
 386         case ${ipv6_defaultrouter} in
 387         [Nn][Oo] | '')
 388                 ;;
 389         *)
 390                 ipv6_static_routes="default ${ipv6_static_routes}"
 391                 ipv6_route_default="default ${ipv6_defaultrouter}"
 392                 ;;
 393         esac
 394         case ${ipv6_static_routes} in
 395         [Nn][Oo] | '')
 396                 ;;
 397         *)
 398                 for i in ${ipv6_static_routes}; do
 399                         eval ipv6_route_args=\$ipv6_route_${i}
 400                         route add -inet6 ${ipv6_route_args}
 401                 done
 402                 ;;
 403         esac
 404 }
 405
 406 network6_faith_setup() {
 407         case ${ipv6_faith_prefix} in
 408         [Nn][Oo] | '')
 409                 ;;
 410         *)
 411                 sysctl net.inet6.ip6.keepfaith=1
 412                 ifconfig faith0 create >/dev/null 2>&1
 413                 ifconfig faith0 up
 414                 for prefix in ${ipv6_faith_prefix}; do
 415                         prefixlen=`expr "${prefix}" : ".*/\(.*\)"`
 416                         case ${prefixlen} in
 417                         '')
 418                                 prefixlen=96
 419                                 ;;
 420                         *)
 421                                 prefix=`expr "${prefix}" : \
 422                                              "\(.*\)/${prefixlen}"`
 423                                 ;;
 424                         esac
 425                         route add -inet6 ${prefix} -prefixlen ${prefixlen} ::1
 426                         route change -inet6 ${prefix} -prefixlen ${prefixlen} \
 427                                 -ifp faith0
 428                 done
 429                 ;;
 430         esac
 431 }
 432
 433 network6_default_interface_setup() {
 434         # Choose IPv6 default interface if it is not clearly specified.
 435         case ${ipv6_default_interface} in
 436         '')
 437                 for i in ${ipv6_network_interfaces}; do
 438                         case $i in
 439                         lo0|faith[0-9]*)
 440                                 continue
 441                                 ;;
 442                         esac
 443                         laddr=`network6_getladdr $i exclude_tentative`
 444                         case ${laddr} in
 445                         '')
 446                                 ;;
 447                         *)
 448                                 ipv6_default_interface=$i
 449                                 break
 450                                 ;;
 451                         esac
 452                 done
 453                 ;;
 454         esac
 455
 456         # Disallow unicast packets without outgoing scope identifiers,
 457         # or route such packets to a "default" interface, if it is specified.
 458         route add -inet6 fe80:: -prefixlen 10 ::1 -reject
 459         case ${ipv6_default_interface} in
 460         [Nn][Oo] | '')
 461                 route add -inet6 ff02:: -prefixlen 16 ::1 -reject
 462                 ;;
 463         *)
 464                 laddr=`network6_getladdr ${ipv6_default_interface}`
 465                 route add -inet6 ff02:: ${laddr} -prefixlen 16 -interface \
 466                         -cloning
 467
 468                 # Disable installing the default interface with the
 469                 # case net.inet6.ip6.forwarding=0 and
 470                 # net.inet6.ip6.accept_rtadv=0, due to avoid conflict
 471                 # between the default router list and the manual
 472                 # configured default route.
 473                 case ${ipv6_gateway_enable} in
 474                 [Yy][Ee][Ss])
 475                         ;;
 476                 *)
 477                         if [ `sysctl -n net.inet6.ip6.accept_rtadv` -eq 1 ]
 478                         then
 479                                 ndp -I ${ipv6_default_interface}
 480                         fi
 481                         ;;
 482                 esac
 483                 ;;
 484         esac
 485 }
 486
 487 network6_getladdr() {
 488         ifconfig $1 2>/dev/null | while read proto addr rest; do
 489                 case ${proto} in
 490                 inet6)
 491                         case ${addr} in
 492                         fe80::*)
 493                                 if [ -z "$2" ]; then
 494                                         echo ${addr}
 495                                         return
 496                                 fi
 497                                 case ${rest} in
 498                                 *tentative*)
 499                                         continue
 500                                         ;;
 501                                 *)
 502                                         echo ${addr}
 503                                         return
 504                                 esac
 505                         esac
 506                 esac
 507         done
 508 }