etc/rc.network6

   1 #! /bin/sh
   2 # $FreeBSD$
   3
   4 # Note that almost all of the user-configurable behavior is not in this
   5 # file, but rather in /etc/defaults/rc.conf.  Please check that file
   6 # first before contemplating any changes here.  If you do need to change
   7 # this file for some reason, we would like to know about it.
   8
   9 # IPv6 startup
  10
  11 network6_pass1() {
  12         echo -n 'Doing IPv6 network setup:'
  13
  14         case ${ipv6_gateway_enable} in
  15         [Yy][Ee][Ss])
  16                 #
  17                 # list of interfaces, and prefix for interfaces
  18                 #
  19                 case ${ipv6_network_interfaces} in
  20                 [Aa][Uu][Tt][Oo])
  21                         ipv6_network_interfaces="`ifconfig -l`"
  22                         ;;
  23                 esac
  24                 ;;
  25         *)
  26                 #
  27                 # manual configurations - in case ip6_gateway_enable=NO
  28                 # you can configure only single interface,
  29                 # as specification assumes that
  30                 # autoconfigured host has single interface only.
  31                 #
  32                 case ${ipv6_network_interfaces} in
  33                 [Aa][Uu][Tt][Oo])
  34                         ipv6_network_interfaces="`ifconfig -l \
  35                                 | sed -e 's/ .*//'`"
  36                         ;;
  37                 esac
  38                 ;;
  39         esac
  40
  41         # just to make sure
  42         ifconfig lo0 up
  43
  44         # disallow "internal" addresses to appear on the wire
  45         route add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject
  46         route add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject
  47
  48         case ${ipv6_gateway_enable} in
  49         [Yy][Ee][Ss])
  50                 # act as a router
  51                 sysctl -w net.inet6.ip6.forwarding=1
  52                 sysctl -w net.inet6.ip6.accept_rtadv=0
  53
  54                 # wait for DAD
  55                 for i in $ipv6_network_interfaces; do
  56                         ifconfig $i up
  57                 done
  58                 sleep `sysctl -n net.inet6.ip6.dad_count`
  59                 sleep 1
  60
  61                 # setting up interfaces
  62                 for i in $ipv6_network_interfaces; do
  63                         eval prefix=\$ipv6_prefix_$i
  64                         case ${prefix} in
  65                         '')
  66                                 continue;
  67                                 ;;
  68                         esac
  69                         for j in ${prefix}; do
  70                                 case ${prefixcmd_enable} in
  71                                 [Yy][Ee][Ss])
  72                                         prefix $i $j::
  73                                         ;;
  74                                 *)
  75                                         laddr=`ifconfig $i inet6 \
  76                                                 | grep 'inet6 fe80:' \
  77                                                 | head -1 | awk '{print $2}'`
  78                                         hostid=`echo ${laddr} | sed \
  79                                             -e 's/fe80:[0-9a-fA-F]+::/fe80::/' \
  80                                             -e 's/fe80:://' -e 's/%.*//'`
  81                                         address=$j\:${hostid}
  82
  83                                         eval hostid_$i=${hostid}
  84                                         eval address_$i=${address}
  85
  86                                         ifconfig $i inet6 ${address} \
  87                                                 prefixlen 64 alias
  88                                         ;;
  89                                 esac
  90
  91                                 # subnet-router anycast address (rfc2373)
  92                                 ifconfig $i inet6 $j:: prefixlen 64 \
  93                                         alias anycast
  94                         done
  95
  96                         ifconfig $i inet6
  97                 done
  98
  99                 # again, wait for DAD's completion (for global addrs)
 100                 sleep `sysctl -n net.inet6.ip6.dad_count`
 101                 sleep 1
 102
 103                 # Filter out interfaces on which IPv6 addr init failed.
 104                 ipv6_working_interfaces=""
 105                 for i in ${ipv6_network_interfaces}; do
 106                         laddr=`ifconfig $i inet6 2>/dev/null | \
 107                                 grep 'inet6 fe80:' | \
 108                                 head -1 | grep -v tentative`
 109                         case ${laddr} in
 110                         '')
 111                                 ;;
 112                         *)
 113                                 ipv6_working_interfaces="$i \
 114                                         ${ipv6_working_interfaces}"
 115                                 ;;
 116                         esac
 117                 done
 118                 ipv6_network_interfaces=${ipv6_working_interfaces}
 119
 120                 # gifconfig
 121                 network6_gif_setup
 122
 123                 # 6to4 setup
 124                 network6_stf_setup
 125
 126                 # install the "default interface" to kernel, which will be used
 127                 # as the default route when there's no router.
 128                 network6_default_interface_setup
 129
 130                 # setup static routes
 131                 network6_static_routes_setup
 132
 133                 # ipv6_router
 134                 case ${ipv6_router_enable} in
 135                 [Yy][Ee][Ss])
 136                         if [ -x ${ipv6_router} ]; then
 137                                 echo -n " ${ipv6_router}"
 138                                 ${ipv6_router} ${ipv6_router_flags}
 139                         fi
 140                         ;;
 141                 esac
 142
 143                 # rtadvd
 144                 # This should enabled with a great care.
 145                 # You may want to fine-tune /etc/rtadvd.conf.
 146                 #
 147                 # And if you wish your rtadvd to receive and process
 148                 # router renumbering messages, specify your Router Renumbering
 149                 # security policy by -P option.
 150                 #
 151                 # See `man 3 ipsec_set_policy` for IPsec policy specification
 152                 # details.
 153                 # (CAUTION: This enables your routers prefix renumbering
 154                 # from another machine, so if you enable this, do it with
 155                 # enough care.)
 156                 #
 157                 case ${rtadvd_enable} in
 158                 [Yy][Ee][Ss])
 159                         # default
 160                         rtadvd_interfaces=`echo ${ipv6_network_interfaces} | \
 161                                 sed -e 's/ stf0//'`
 162                         rtadvd ${rtadvd_interfaces}
 163                         #
 164                         # Enable Router Renumbering, unicast case
 165                         # (use correct src/dst addr)
 166                         # rtadvd -P "in ipsec ah/transport/fec0:0:0:1::1-fec0:0:0:10::1/require" \
 167                         #       ${ipv6_network_interfaces}
 168                         # Enable Router Renumbering, multicast case
 169                         # (use correct src addr)
 170                         # rtadvd -P "in ipsec ah/transport/ff05::2-fec0:0:0:10::1/require" \
 171                         #       ${ipv6_network_interfaces}
 172                         ;;
 173                 esac
 174
 175                 # mroute6d
 176                 case ${mroute6d_enable} in
 177                 [Yy][Ee][Ss])
 178                         if [ -x ${mroute6d_program} ]; then
 179                                 echo -n " ${mroute6d_program}"
 180                                 ${mroute6d_program} ${mroute6d_flags}
 181                         fi
 182                         ;;
 183                 esac
 184                 ;;
 185         *)
 186                 # act as endhost - automatically configured
 187                 sysctl -w net.inet6.ip6.forwarding=0
 188                 sysctl -w net.inet6.ip6.accept_rtadv=1
 189
 190                 ifconfig ${ipv6_network_interfaces} up
 191                 rtsol ${ipv6_network_interfaces}
 192
 193
 194
 195                 # wait for DAD's completion (for global addrs)
 196                 sleep `sysctl -n net.inet6.ip6.dad_count`
 197                 sleep 1
 198
 199                 # gifconfig
 200                 network6_gif_setup
 201
 202                 # 6to4 setup
 203                 network6_stf_setup
 204
 205                 # install the "default interface" to kernel, which will be used
 206                 # as the default route when there's no router.
 207                 # ndp -I ${ipv6_default_interface}
 208                 network6_default_interface_setup
 209
 210                 # setup static routes
 211                 network6_static_routes_setup
 212                 ;;
 213         esac
 214
 215         case ${ipv6_ipv4mapping} in
 216         [Yy][Ee][Ss])
 217                 echo -n ' IPv4 mapped IPv6 address support=YES'
 218                 sysctl -w net.inet6.ip6.mapped_addr=1 >/dev/null
 219                 ;;
 220         '' | *)
 221                 echo -n ' IPv4 mapped IPv6 address support=NO'
 222                 sysctl -w net.inet6.ip6.mapped_addr=0 >/dev/null
 223                 ;;
 224         esac
 225
 226         echo '.'
 227
 228         # Let future generations know we made it.
 229         #
 230         network6_pass1_done=YES
 231 }
 232
 233 network6_gif_setup() {
 234         case ${gif_interfaces} in
 235         [Nn][Oo] | '')
 236                 ;;
 237         *)
 238                 for i in ${gif_interfaces}; do
 239                         eval peers=\$gifconfig_$i
 240                         case ${peers} in
 241                         '')
 242                                 continue
 243                                 ;;
 244                         *)
 245                                 gifconfig $i ${peers}
 246                                 ;;
 247                         esac
 248                 done
 249                 ;;
 250         esac
 251 }
 252
 253 network6_stf_setup() {
 254         case ${stf_interface_ipv4addr} in
 255         [Nn][Oo] | '')
 256                 ;;
 257         *)
 258                 # setup outer IPv4 addrs
 259                 gifconfig stf0 ${stf_interface_ipv4addr} 255.255.255.255
 260                 # assign IPv6 addr and interface route for 6to4 interface
 261                 stf_prefixlen=$((16+${stf_interface_ipv4plen:-0}))
 262                 OIFS="$IFS"
 263                 IFS=".$IFS"
 264                 set ${stf_interface_ipv4addr}
 265                 IFS="$OIFS"
 266                 ipv4_in_hexformat=`printf "%x:%x\n" \
 267                         $(($1*256 + $2)) $(($3*256 + $4))`
 268                 case ${stf_interface_ipv6_ifid} in
 269                 [Aa][Uu][Tt][Oo] | '')
 270                         laddr=`ifconfig stf0 inet6 | grep 'inet6 fe80:' \
 271                                 | head -1 | awk '{print $2}'`
 272                         stf_interface_ipv6_ifid=`echo ${laddr} | sed \
 273                                 -e 's/fe80:[0-9a-fA-F]+::/fe80::/' \
 274                                 -e 's/fe80:://' -e 's/%.*//'`
 275                         case ${stf_interface_ipv6_ifid} in
 276                         '')
 277                                 stf_interface_ipv6_ifid=0:0:0:1
 278                                 ;;
 279                         esac
 280                         ;;
 281                 esac
 282                 ifconfig stf0 inet6 2002:${ipv4_in_hexformat}:${stf_interface_ipv6_slaid:-0}:${stf_interface_ipv6_ifid} \
 283                         prefixlen ${stf_prefixlen}
 284                 # disallow packets to malicious 6to4 prefix
 285                 route add -inet6 2002:7f00:0000:: -prefixlen 24 ::1 -reject
 286                 route add -inet6 2002:0000:0000:: -prefixlen 48 ::1 -reject
 287                 route add -inet6 2002:ffff:ffff:: -prefixlen 48 ::1 -reject
 288                 ;;
 289         esac
 290 }
 291
 292 network6_static_routes_setup() {
 293         # Set up any static routes.
 294         case ${ipv6_static_routes} in
 295         [Nn][Oo] | '')
 296                 ;;
 297         *)
 298                 for i in ${ipv6_static_routes}; do
 299                         eval ipv6_route_args=\$ipv6_route_${i}
 300                         route add -inet6 ${ipv6_route_args}
 301                 done
 302                 ;;
 303         esac
 304 }
 305
 306 network6_default_interface_setup() {
 307         # Choose IPv6 default interface if it is not clearly specified.
 308         case ${ipv6_default_interface} in
 309         [Nn][Oo] | '')
 310                 for i in ${ipv6_network_interfaces}; do
 311                         laddr=`ifconfig $i inet6 2>/dev/null \
 312                                 | grep 'inet6 fe80:' | \
 313                                 head -1 | grep -v tentative`
 314                         case ${laddr} in
 315                         '')
 316                                 ;;
 317                         *)
 318                                 ipv6_default_interface=$i
 319                                 break
 320                                 ;;
 321                         esac
 322                 done
 323                 ;;
 324         esac
 325
 326         # Disallow unicast packets without outgoing scope identifiers,
 327         # or route such packets to a "default" interface, if it is specified.
 328         case ${ipv6_default_interface} in
 329         [Nn][Oo] | '')
 330                 route add -inet6 fe80:: -prefixlen 10 ::1 -reject
 331                 route add -inet6 ff02:: -prefixlen 16 ::1 -reject
 332                 ;;
 333         *)
 334                 laddr=`ifconfig ${ipv6_default_interface} inet6 \
 335                         | grep 'inet6 fe80:' | head -1 | awk '{print $2}'`
 336                 route add -inet6 fe80:: ${laddr} -prefixlen 10 -interface \
 337                         -cloning
 338                 route add -inet6 ff02:: ${laddr} -prefixlen 16 -interface \
 339                         -cloning
 340                 ;;
 341         esac
 342 }