etc/rc.network6

   1 #! /bin/sh
   2 #
   3 # Copyright (c) 2000  The KAME Project
   4 # All rights reserved.
   5 #
   6 # Redistribution and use in source and binary forms, with or without
   7 # modification, are permitted provided that the following conditions
   8 # are met:
   9 # 1. Redistributions of source code must retain the above copyright
  10 #    notice, this list of conditions and the following disclaimer.
  11 # 2. Redistributions in binary form must reproduce the above copyright
  12 #    notice, this list of conditions and the following disclaimer in the
  13 #    documentation and/or other materials provided with the distribution.
  14 #
  15 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  16 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  18 # ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  19 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  21 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  24 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  25 # SUCH DAMAGE.
  26 #
  27 # $FreeBSD$
  28 #
  29
  30 # Note that almost all of the user-configurable behavior is not in this
  31 # file, but rather in /etc/defaults/rc.conf.  Please check that file
  32 # first before contemplating any changes here.  If you do need to change
  33 # this file for some reason, we would like to know about it.
  34
  35 hexdigit () {
  36         if [ $1 -lt 10 ]; then
  37                 echo $1
  38         else
  39                 case $1 in
  40                 10)     echo a ;;
  41                 11)     echo b ;;
  42                 12)     echo c ;;
  43                 13)     echo d ;;
  44                 14)     echo e ;;
  45                 15)     echo f ;;
  46                 esac
  47         fi
  48 }
  49
  50 hexprint () {
  51         val=$1
  52         str=''
  53
  54         dig=`hexdigit $((${val} & 15))`
  55         str=${dig}${str}
  56         val=$((${val} >> 4))
  57         while [ ${val} -gt 0 ]; do
  58                 dig=`hexdigit $((${val} & 15))`
  59                 str=${dig}${str}
  60                 val=$((${val} >> 4))
  61         done
  62
  63         echo ${str}
  64 }
  65
  66 # IPv6 startup
  67
  68 network6_pass1() {
  69         echo -n 'Doing IPv6 network setup:'
  70
  71         # Initialize IP filtering using ip6fw
  72         #
  73         if /sbin/ip6fw -q flush > /dev/null 2>&1; then
  74                 ipv6_firewall_in_kernel=1
  75         else
  76                 ipv6_firewall_in_kernel=0
  77         fi
  78
  79         case ${ipv6_firewall_enable} in
  80         [Yy][Ee][Ss])
  81                 if [ "${ipv6_firewall_in_kernel}" -eq 0 ] && kldload ip6fw; then
  82                         ipv6_firewall_in_kernel=1
  83                         echo "Kernel IPv6 firewall module loaded."
  84                 elif [ "${ipv6_firewall_in_kernel}" -eq 0 ]; then
  85                         echo "Warning: IPv6 firewall kernel module failed to load."
  86                 fi
  87                 ;;
  88         esac
  89
  90         # Load the filters if required
  91         #
  92         case ${ipv6_firewall_in_kernel} in
  93         1)
  94                 if [ -z "${ipv6_firewall_script}" ]; then
  95                         ipv6_firewall_script=/etc/rc.firewall6
  96                 fi
  97
  98                 case ${ipv6_firewall_enable} in
  99                 [Yy][Ee][Ss])
 100                         if [ -r "${ipv6_firewall_script}" ]; then
 101                                 . "${ipv6_firewall_script}"
 102                                 echo -n 'IPv6 Firewall rules loaded.'
 103                         elif [ "`ip6fw l 65535`" = "65535 deny ipv6 from any to any" ]; then
 104                                 echo -n "Warning: kernel has IPv6 firewall functionality, "
 105                                 echo "but IPv6 firewall rules are not enabled."
 106                                 echo "           All ipv6 services are disabled."
 107                         fi
 108
 109                         case ${ipv6_firewall_logging} in
 110                         [Yy][Ee][Ss] | '')
 111                                 echo 'IPv6 Firewall logging=YES'
 112                                 sysctl net.inet6.ip6.fw.verbose=1 >/dev/null
 113                                 ;;
 114                         *)
 115                                 ;;
 116                         esac
 117
 118                         ;;
 119                 esac
 120                 ;;
 121         esac
 122
 123         case ${ipv6_network_interfaces} in
 124         [Aa][Uu][Tt][Oo])
 125                 #
 126                 # list of interfaces, and prefix for interfaces
 127                 #
 128                 ipv6_network_interfaces="`ifconfig -l`"
 129                 ;;
 130         [Nn][Oo][Nn][Ee])
 131                 ipv6_network_interfaces=''
 132                 ;;
 133         esac
 134
 135         # just to make sure
 136         ifconfig lo0 up
 137
 138         # disallow "internal" addresses to appear on the wire
 139         route add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject
 140         route add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject
 141
 142         case ${ipv6_gateway_enable} in
 143         [Yy][Ee][Ss])
 144                 # act as a router
 145                 sysctl net.inet6.ip6.forwarding=1
 146                 sysctl net.inet6.ip6.accept_rtadv=0
 147
 148                 # wait for DAD
 149                 for i in $ipv6_network_interfaces; do
 150                         ifconfig $i up
 151                 done
 152                 sleep `sysctl -n net.inet6.ip6.dad_count`
 153                 sleep 1
 154                 ;;
 155         *)
 156                 # act as endhost - start with manual configuration
 157                 # Setup of net.inet6.ip6.accept_rtadv is done later by
 158                 # network6_interface_setup.
 159                 sysctl net.inet6.ip6.forwarding=0
 160                 ;;
 161         esac
 162
 163         if [ -n "${ipv6_network_interfaces}" ]; then
 164                 # setting up interfaces
 165                 network6_interface_setup $ipv6_network_interfaces
 166
 167                 # wait for DAD's completion (for global addrs)
 168                 sleep `sysctl -n net.inet6.ip6.dad_count`
 169                 sleep 1
 170         fi
 171
 172         case ${ipv6_gateway_enable} in
 173         [Yy][Ee][Ss])
 174                 # Filter out interfaces on which IPv6 addr init failed.
 175                 ipv6_working_interfaces=""
 176                 for i in ${ipv6_network_interfaces}; do
 177                         laddr=`network6_getladdr $i exclude_tentative`
 178                         case ${laddr} in
 179                         '')
 180                                 ;;
 181                         *)
 182                                 ipv6_working_interfaces="$i \
 183                                         ${ipv6_working_interfaces}"
 184                                 ;;
 185                         esac
 186                 done
 187                 ipv6_network_interfaces=${ipv6_working_interfaces}
 188                 ;;
 189         esac
 190
 191         # 6to4 setup
 192         network6_stf_setup
 193
 194         # install the "default interface" to kernel, which will be used
 195         # as the default route when there's no router.
 196         network6_default_interface_setup
 197
 198         # setup static routes
 199         network6_static_routes_setup
 200
 201         # setup faith
 202         network6_faith_setup
 203
 204         # ipv6_router
 205         case ${ipv6_router_enable} in
 206         [Yy][Ee][Ss])
 207                 if [ -x ${ipv6_router} ]; then
 208                         echo -n " ${ipv6_router}"
 209                         ${ipv6_router} ${ipv6_router_flags}
 210                 fi
 211                 ;;
 212         esac
 213
 214
 215         case ${ipv6_gateway_enable} in
 216         [Yy][Ee][Ss])
 217                 # rtadvd
 218                 # This should enabled with a great care.
 219                 # You may want to fine-tune /etc/rtadvd.conf.
 220                 #
 221                 # And if you wish your rtadvd to receive and process
 222                 # router renumbering messages, specify your Router Renumbering
 223                 # security policy by -R option.
 224                 #
 225                 # See `man 3 ipsec_set_policy` for IPsec policy specification
 226                 # details.
 227                 # (CAUTION: This enables your routers prefix renumbering
 228                 # from another machine, so if you enable this, do it with
 229                 # enough care.)
 230                 #
 231                 case ${rtadvd_enable} in
 232                 [Yy][Ee][Ss])
 233                         # default
 234                         case ${rtadvd_interfaces} in
 235                         '')
 236                                 for i in ${ipv6_network_interfaces}; do
 237                                         case $i in
 238                                         lo0|gif[0-9]*|stf[0-9]*|faith[0-9]*|lp[0-9]*|sl[0-9]*|tun[0-9]*)
 239                                                 continue
 240                                                 ;;
 241                                         *)
 242                                                 rtadvd_interfaces="${rtadvd_interfaces} ${i}"
 243                                                 ;;
 244                                         esac
 245                                 done
 246                                 ;;
 247                         esac
 248                         rtadvd ${rtadvd_interfaces}
 249                         #
 250                         # Enable Router Renumbering, unicast case
 251                         # (use correct src/dst addr)
 252                         # rtadvd -R "in ipsec ah/transport/fec0:0:0:1::1-fec0:0:0:10::1/require" \
 253                         #       ${ipv6_network_interfaces}
 254                         # Enable Router Renumbering, multicast case
 255                         # (use correct src addr)
 256                         # rtadvd -R "in ipsec ah/transport/ff05::2-fec0:0:0:10::1/require" \
 257                         #       ${ipv6_network_interfaces}
 258                         ;;
 259                 esac
 260
 261                 # mroute6d
 262                 case ${mroute6d_enable} in
 263                 [Yy][Ee][Ss])
 264                         if [ -x ${mroute6d_program} ]; then
 265                                 echo -n " ${mroute6d_program}"
 266                                 ${mroute6d_program} ${mroute6d_flags}
 267                         fi
 268                         ;;
 269                 esac
 270                 ;;
 271         esac
 272
 273         case ${ipv6_ipv4mapping} in
 274         [Yy][Ee][Ss])
 275                 echo -n ' IPv4 mapped IPv6 address support=YES'
 276                 sysctl net.inet6.ip6.v6only=0 >/dev/null
 277                 ;;
 278         '' | *)
 279                 echo -n ' IPv4 mapped IPv6 address support=NO'
 280                 sysctl net.inet6.ip6.v6only=1 >/dev/null
 281                 ;;
 282         esac
 283
 284         echo '.'
 285
 286         # Let future generations know we made it.
 287         #
 288         network6_pass1_done=YES
 289 }
 290
 291 network6_interface_setup() {
 292         interfaces=$*
 293         rtsol_interfaces=''
 294         case ${ipv6_gateway_enable} in
 295         [Yy][Ee][Ss])
 296                 rtsol_available=no
 297                 ;;
 298         *)
 299                 rtsol_available=yes
 300                 ;;
 301         esac
 302         for i in $interfaces; do
 303                 rtsol_interface=yes
 304                 eval prefix=\$ipv6_prefix_$i
 305                 if [ -n "${prefix}" ]; then
 306                         rtsol_available=no
 307                         rtsol_interface=no
 308                         laddr=`network6_getladdr $i`
 309                         hostid=`expr "${laddr}" : 'fe80::\(.*\)%\(.*\)'`
 310                         for j in ${prefix}; do
 311                                 address=$j\:${hostid}
 312                                 ifconfig $i inet6 ${address} prefixlen 64 alias
 313
 314                                 case ${ipv6_gateway_enable} in
 315                                 [Yy][Ee][Ss])
 316                                         # subnet-router anycast address
 317                                         # (rfc2373)
 318                                         ifconfig $i inet6 $j:: prefixlen 64 \
 319                                                 alias anycast
 320                                         ;;
 321                                 esac
 322                         done
 323                 fi
 324                 eval ipv6_ifconfig=\$ipv6_ifconfig_$i
 325                 if [ -n "${ipv6_ifconfig}" ]; then
 326                         rtsol_available=no
 327                         rtsol_interface=no
 328                         ifconfig $i inet6 ${ipv6_ifconfig} alias
 329                 fi
 330
 331                 if [ ${rtsol_available} = yes -a ${rtsol_interface} = yes ]
 332                 then
 333                         case ${i} in
 334                         lo0|gif[0-9]*|stf[0-9]*|faith[0-9]*|lp[0-9]*|sl[0-9]*|tun[0-9]*)
 335                                 ;;
 336                         *)
 337                                 rtsol_interfaces="${rtsol_interfaces} ${i}"
 338                                 ;;
 339                         esac
 340                 else
 341                         ifconfig $i inet6
 342                 fi
 343         done
 344
 345         if [ ${rtsol_available} = yes -a -n "${rtsol_interfaces}" ]; then
 346                 # Act as endhost - automatically configured.
 347                 # You can configure only single interface, as
 348                 # specification assumes that autoconfigured host has
 349                 # single interface only.
 350                 sysctl net.inet6.ip6.accept_rtadv=1
 351                 set ${rtsol_interfaces}
 352                 ifconfig $1 up
 353                 rtsol $1
 354         fi
 355
 356         for i in $interfaces; do
 357                 alias=0
 358                 while : ; do
 359                         eval ipv6_ifconfig=\$ipv6_ifconfig_${i}_alias${alias}
 360                         if [ -z "${ipv6_ifconfig}" ]; then
 361                                 break;
 362                         fi
 363                         ifconfig $i inet6 ${ipv6_ifconfig} alias
 364                         alias=$((${alias} + 1))
 365                 done
 366         done
 367 }
 368
 369 network6_stf_setup() {
 370         case ${stf_interface_ipv4addr} in
 371         [Nn][Oo] | '')
 372                 ;;
 373         *)
 374                 # assign IPv6 addr and interface route for 6to4 interface
 375                 stf_prefixlen=$((16+${stf_interface_ipv4plen:-0}))
 376                 OIFS="$IFS"
 377                 IFS=".$IFS"
 378                 set ${stf_interface_ipv4addr}
 379                 IFS="$OIFS"
 380                 hexfrag1=`hexprint $(($1*256 + $2))`
 381                 hexfrag2=`hexprint $(($3*256 + $4))`
 382                 ipv4_in_hexformat="${hexfrag1}:${hexfrag2}"
 383                 case ${stf_interface_ipv6_ifid} in
 384                 [Aa][Uu][Tt][Oo] | '')
 385                         for i in ${ipv6_network_interfaces}; do
 386                                 laddr=`network6_getladdr ${i}`
 387                                 case ${laddr} in
 388                                 '')
 389                                         ;;
 390                                 *)
 391                                         break
 392                                         ;;
 393                                 esac
 394                         done
 395                         stf_interface_ipv6_ifid=`expr "${laddr}" : \
 396                                                       'fe80::\(.*\)%\(.*\)'`
 397                         case ${stf_interface_ipv6_ifid} in
 398                         '')
 399                                 stf_interface_ipv6_ifid=0:0:0:1
 400                                 ;;
 401                         esac
 402                         ;;
 403                 esac
 404                 ifconfig stf0 create >/dev/null 2>&1
 405                 ifconfig stf0 inet6 2002:${ipv4_in_hexformat}:${stf_interface_ipv6_slaid:-0}:${stf_interface_ipv6_ifid} \
 406                         prefixlen ${stf_prefixlen}
 407                 # disallow packets to malicious 6to4 prefix
 408                 route add -inet6 2002:e000:: -prefixlen 20 ::1 -reject
 409                 route add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject
 410                 route add -inet6 2002:0000:: -prefixlen 24 ::1 -reject
 411                 route add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject
 412                 ;;
 413         esac
 414 }
 415
 416 network6_static_routes_setup() {
 417         # Set up any static routes.
 418         case ${ipv6_defaultrouter} in
 419         [Nn][Oo] | '')
 420                 ;;
 421         *)
 422                 ipv6_static_routes="default ${ipv6_static_routes}"
 423                 ipv6_route_default="default ${ipv6_defaultrouter}"
 424                 ;;
 425         esac
 426         case ${ipv6_static_routes} in
 427         [Nn][Oo] | '')
 428                 ;;
 429         *)
 430                 for i in ${ipv6_static_routes}; do
 431                         eval ipv6_route_args=\$ipv6_route_${i}
 432                         route add -inet6 ${ipv6_route_args}
 433                 done
 434                 ;;
 435         esac
 436 }
 437
 438 network6_faith_setup() {
 439         case ${ipv6_faith_prefix} in
 440         [Nn][Oo] | '')
 441                 ;;
 442         *)
 443                 sysctl net.inet6.ip6.keepfaith=1
 444                 ifconfig faith0 create >/dev/null 2>&1
 445                 ifconfig faith0 up
 446                 for prefix in ${ipv6_faith_prefix}; do
 447                         prefixlen=`expr "${prefix}" : ".*/\(.*\)"`
 448                         case ${prefixlen} in
 449                         '')
 450                                 prefixlen=96
 451                                 ;;
 452                         *)
 453                                 prefix=`expr "${prefix}" : \
 454                                              "\(.*\)/${prefixlen}"`
 455                                 ;;
 456                         esac
 457                         route add -inet6 ${prefix} -prefixlen ${prefixlen} ::1
 458                         route change -inet6 ${prefix} -prefixlen ${prefixlen} \
 459                                 -ifp faith0
 460                 done
 461                 ;;
 462         esac
 463 }
 464
 465 network6_default_interface_setup() {
 466         # Choose IPv6 default interface if it is not clearly specified.
 467         case ${ipv6_default_interface} in
 468         '')
 469                 for i in ${ipv6_network_interfaces}; do
 470                         case $i in
 471                         lo0|faith[0-9]*)
 472                                 continue
 473                                 ;;
 474                         esac
 475                         laddr=`network6_getladdr $i exclude_tentative`
 476                         case ${laddr} in
 477                         '')
 478                                 ;;
 479                         *)
 480                                 ipv6_default_interface=$i
 481                                 break
 482                                 ;;
 483                         esac
 484                 done
 485                 ;;
 486         esac
 487
 488         # Disallow unicast packets without outgoing scope identifiers,
 489         # or route such packets to a "default" interface, if it is specified.
 490         route add -inet6 fe80:: -prefixlen 10 ::1 -reject
 491         case ${ipv6_default_interface} in
 492         [Nn][Oo] | '')
 493                 route add -inet6 ff02:: -prefixlen 16 ::1 -reject
 494                 ;;
 495         *)
 496                 laddr=`network6_getladdr ${ipv6_default_interface}`
 497                 route add -inet6 ff02:: ${laddr} -prefixlen 16 -interface \
 498                         -cloning
 499
 500                 # Disable installing the default interface with the
 501                 # case net.inet6.ip6.forwarding=0 and
 502                 # net.inet6.ip6.accept_rtadv=0, due to avoid conflict
 503                 # between the default router list and the manual
 504                 # configured default route.
 505                 case ${ipv6_gateway_enable} in
 506                 [Yy][Ee][Ss])
 507                         ;;
 508                 *)
 509                         if [ `sysctl -n net.inet6.ip6.accept_rtadv` -eq 1 ]
 510                         then
 511                                 ndp -I ${ipv6_default_interface}
 512                         fi
 513                         ;;
 514                 esac
 515                 ;;
 516         esac
 517 }
 518
 519 network6_getladdr() {
 520         ifconfig $1 2>/dev/null | while read proto addr rest; do
 521                 case ${proto} in
 522                 inet6)
 523                         case ${addr} in
 524                         fe80::*)
 525                                 if [ -z "$2" ]; then
 526                                         echo ${addr}
 527                                         return
 528                                 fi
 529                                 case ${rest} in
 530                                 *tentative*)
 531                                         continue
 532                                         ;;
 533                                 *)
 534                                         echo ${addr}
 535                                         return
 536                                 esac
 537                         esac
 538                 esac
 539         done
 540 }