etc/rc.network6

   1 #! /bin/sh
   2 #
   3 # Copyright (c) 2000  The KAME Project
   4 # All rights reserved.
   5 #
   6 # Redistribution and use in source and binary forms, with or without
   7 # modification, are permitted provided that the following conditions
   8 # are met:
   9 # 1. Redistributions of source code must retain the above copyright
  10 #    notice, this list of conditions and the following disclaimer.
  11 # 2. Redistributions in binary form must reproduce the above copyright
  12 #    notice, this list of conditions and the following disclaimer in the
  13 #    documentation and/or other materials provided with the distribution.
  14 #
  15 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  16 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  18 # ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  19 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  21 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  24 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  25 # SUCH DAMAGE.
  26 #
  27 # $FreeBSD$
  28 #
  29
  30 # Note that almost all of the user-configurable behavior is not in this
  31 # file, but rather in /etc/defaults/rc.conf.  Please check that file
  32 # first before contemplating any changes here.  If you do need to change
  33 # this file for some reason, we would like to know about it.
  34
  35 hexdigit () {
  36         if [ $1 -lt 10 ]; then
  37                 echo $1
  38         else
  39                 case $1 in
  40                 10)     echo a ;;
  41                 11)     echo b ;;
  42                 12)     echo c ;;
  43                 13)     echo d ;;
  44                 14)     echo e ;;
  45                 15)     echo f ;;
  46                 esac
  47         fi
  48 }
  49
  50 hexprint () {
  51         val=$1
  52         str=''
  53
  54         dig=`hexdigit $((${val} & 15))`
  55         str=${dig}${str}
  56         val=$((${val} >> 4))
  57         while [ ${val} -gt 0 ]; do
  58                 dig=`hexdigit $((${val} & 15))`
  59                 str=${dig}${str}
  60                 val=$((${val} >> 4))
  61         done
  62
  63         echo ${str}
  64 }
  65
  66 # IPv6 startup
  67
  68 network6_pass1() {
  69         echo -n 'Doing IPv6 network setup:'
  70
  71         # Initialize IP filtering using ip6fw
  72         #
  73         if /sbin/ip6fw -q flush > /dev/null 2>&1; then
  74                 ipv6_firewall_in_kernel=1
  75         else
  76                 ipv6_firewall_in_kernel=0
  77         fi
  78
  79         case ${ipv6_firewall_enable} in
  80         [Yy][Ee][Ss])
  81                 if [ "${ipv6_firewall_in_kernel}" -eq 0 ] && kldload ip6fw; then
  82                         ipv6_firewall_in_kernel=1
  83                         echo "Kernel IPv6 firewall module loaded."
  84                 elif [ "${ipv6_firewall_in_kernel}" -eq 0 ]; then
  85                         echo "Warning: IPv6 firewall kernel module failed to load."
  86                 fi
  87                 ;;
  88         esac
  89
  90         # Load the filters if required
  91         #
  92         case ${ipv6_firewall_in_kernel} in
  93         1)
  94                 if [ -z "${ipv6_firewall_script}" ]; then
  95                         ipv6_firewall_script=/etc/rc.firewall6
  96                 fi
  97
  98                 case ${ipv6_firewall_enable} in
  99                 [Yy][Ee][Ss])
 100                         if [ -r "${ipv6_firewall_script}" ]; then
 101                                 . "${ipv6_firewall_script}"
 102                                 echo -n 'IPv6 Firewall rules loaded.'
 103                         elif [ "`ip6fw l 65535`" = "65535 deny ipv6 from any to any" ]; then
 104                                 echo -n "Warning: kernel has IPv6 firewall functionality, "
 105                                 echo "but IPv6 firewall rules are not enabled."
 106                                 echo "           All ipv6 services are disabled."
 107                         fi
 108
 109                         case ${ipv6_firewall_logging} in
 110                         [Yy][Ee][Ss] | '')
 111                                 echo 'IPv6 Firewall logging=YES'
 112                                 sysctl net.inet6.ip6.fw.verbose=1 >/dev/null
 113                                 ;;
 114                         *)
 115                                 ;;
 116                         esac
 117
 118                         ;;
 119                 esac
 120                 ;;
 121         esac
 122
 123         case ${ipv6_network_interfaces} in
 124         [Aa][Uu][Tt][Oo])
 125                 #
 126                 # list of interfaces, and prefix for interfaces
 127                 #
 128                 ipv6_network_interfaces="`ifconfig -l`"
 129                 ;;
 130         [Nn][Oo][Nn][Ee])
 131                 ipv6_network_interfaces=''
 132                 ;;
 133         esac
 134
 135         # just to make sure
 136         ifconfig lo0 up
 137
 138         # disallow "internal" addresses to appear on the wire
 139         route add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject
 140         route add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject
 141
 142         case ${ipv6_gateway_enable} in
 143         [Yy][Ee][Ss])
 144                 # act as a router
 145                 sysctl net.inet6.ip6.forwarding=1
 146                 sysctl net.inet6.ip6.accept_rtadv=0
 147
 148                 # wait for DAD
 149                 for i in $ipv6_network_interfaces; do
 150                         ifconfig $i up
 151                 done
 152                 sleep `sysctl -n net.inet6.ip6.dad_count`
 153                 sleep 1
 154                 ;;
 155         *)
 156                 # act as endhost - start with manual configuration
 157                 # Setup of net.inet6.ip6.accept_rtadv is done later by
 158                 # network6_interface_setup.
 159                 sysctl net.inet6.ip6.forwarding=0
 160                 ;;
 161         esac
 162
 163         if [ -n "${ipv6_network_interfaces}" ]; then
 164                 # setting up interfaces
 165                 network6_interface_setup $ipv6_network_interfaces
 166
 167                 # wait for DAD's completion (for global addrs)
 168                 sleep `sysctl -n net.inet6.ip6.dad_count`
 169                 sleep 1
 170         fi
 171
 172         case ${ipv6_gateway_enable} in
 173         [Yy][Ee][Ss])
 174                 # Filter out interfaces on which IPv6 addr init failed.
 175                 ipv6_working_interfaces=""
 176                 for i in ${ipv6_network_interfaces}; do
 177                         laddr=`network6_getladdr $i exclude_tentative`
 178                         case ${laddr} in
 179                         '')
 180                                 ;;
 181                         *)
 182                                 ipv6_working_interfaces="$i \
 183                                         ${ipv6_working_interfaces}"
 184                                 ;;
 185                         esac
 186                 done
 187                 ipv6_network_interfaces=${ipv6_working_interfaces}
 188                 ;;
 189         esac
 190
 191         # 6to4 setup
 192         network6_stf_setup
 193
 194         # install the "default interface" to kernel, which will be used
 195         # as the default route when there's no router.
 196         network6_default_interface_setup
 197
 198         # setup static routes
 199         network6_static_routes_setup
 200
 201         # setup faith
 202         network6_faith_setup
 203
 204         case ${ipv6_gateway_enable} in
 205         [Yy][Ee][Ss])
 206                 # ipv6_router
 207                 case ${ipv6_router_enable} in
 208                 [Yy][Ee][Ss])
 209                         if [ -x ${ipv6_router} ]; then
 210                                 echo -n " ${ipv6_router}"
 211                                 ${ipv6_router} ${ipv6_router_flags}
 212                         fi
 213                         ;;
 214                 esac
 215
 216                 # rtadvd
 217                 # This should enabled with a great care.
 218                 # You may want to fine-tune /etc/rtadvd.conf.
 219                 #
 220                 # And if you wish your rtadvd to receive and process
 221                 # router renumbering messages, specify your Router Renumbering
 222                 # security policy by -R option.
 223                 #
 224                 # See `man 3 ipsec_set_policy` for IPsec policy specification
 225                 # details.
 226                 # (CAUTION: This enables your routers prefix renumbering
 227                 # from another machine, so if you enable this, do it with
 228                 # enough care.)
 229                 #
 230                 case ${rtadvd_enable} in
 231                 [Yy][Ee][Ss])
 232                         # default
 233                         case ${rtadvd_interfaces} in
 234                         '')
 235                                 for i in ${ipv6_network_interfaces}; do
 236                                         case $i in
 237                                         lo0|gif[0-9]*|stf[0-9]*|faith[0-9]*|lp[0-9]*|sl[0-9]*|tun[0-9]*)
 238                                                 continue
 239                                                 ;;
 240                                         *)
 241                                                 rtadvd_interfaces="${rtadvd_interfaces} ${i}"
 242                                                 ;;
 243                                         esac
 244                                 done
 245                                 ;;
 246                         esac
 247                         rtadvd ${rtadvd_interfaces}
 248                         #
 249                         # Enable Router Renumbering, unicast case
 250                         # (use correct src/dst addr)
 251                         # rtadvd -R "in ipsec ah/transport/fec0:0:0:1::1-fec0:0:0:10::1/require" \
 252                         #       ${ipv6_network_interfaces}
 253                         # Enable Router Renumbering, multicast case
 254                         # (use correct src addr)
 255                         # rtadvd -R "in ipsec ah/transport/ff05::2-fec0:0:0:10::1/require" \
 256                         #       ${ipv6_network_interfaces}
 257                         ;;
 258                 esac
 259
 260                 # mroute6d
 261                 case ${mroute6d_enable} in
 262                 [Yy][Ee][Ss])
 263                         if [ -x ${mroute6d_program} ]; then
 264                                 echo -n " ${mroute6d_program}"
 265                                 ${mroute6d_program} ${mroute6d_flags}
 266                         fi
 267                         ;;
 268                 esac
 269                 ;;
 270         esac
 271
 272         case ${ipv6_ipv4mapping} in
 273         [Yy][Ee][Ss])
 274                 echo -n ' IPv4 mapped IPv6 address support=YES'
 275                 sysctl net.inet6.ip6.v6only=0 >/dev/null
 276                 ;;
 277         '' | *)
 278                 echo -n ' IPv4 mapped IPv6 address support=NO'
 279                 sysctl net.inet6.ip6.v6only=1 >/dev/null
 280                 ;;
 281         esac
 282
 283         echo '.'
 284
 285         # Let future generations know we made it.
 286         #
 287         network6_pass1_done=YES
 288 }
 289
 290 network6_interface_setup() {
 291         interfaces=$*
 292         rtsol_interfaces=''
 293         case ${ipv6_gateway_enable} in
 294         [Yy][Ee][Ss])
 295                 rtsol_available=no
 296                 ;;
 297         *)
 298                 rtsol_available=yes
 299                 ;;
 300         esac
 301         for i in $interfaces; do
 302                 rtsol_interface=yes
 303                 eval prefix=\$ipv6_prefix_$i
 304                 if [ -n "${prefix}" ]; then
 305                         rtsol_available=no
 306                         rtsol_interface=no
 307                         laddr=`network6_getladdr $i`
 308                         hostid=`expr "${laddr}" : 'fe80::\(.*\)%\(.*\)'`
 309                         for j in ${prefix}; do
 310                                 address=$j\:${hostid}
 311                                 ifconfig $i inet6 ${address} prefixlen 64 alias
 312
 313                                 case ${ipv6_gateway_enable} in
 314                                 [Yy][Ee][Ss])
 315                                         # subnet-router anycast address
 316                                         # (rfc2373)
 317                                         ifconfig $i inet6 $j:: prefixlen 64 \
 318                                                 alias anycast
 319                                         ;;
 320                                 esac
 321                         done
 322                 fi
 323                 eval ipv6_ifconfig=\$ipv6_ifconfig_$i
 324                 if [ -n "${ipv6_ifconfig}" ]; then
 325                         rtsol_available=no
 326                         rtsol_interface=no
 327                         ifconfig $i inet6 ${ipv6_ifconfig} alias
 328                 fi
 329
 330                 if [ ${rtsol_available} = yes -a ${rtsol_interface} = yes ]
 331                 then
 332                         case ${i} in
 333                         lo0|gif[0-9]*|stf[0-9]*|faith[0-9]*|lp[0-9]*|sl[0-9]*|tun[0-9]*)
 334                                 ;;
 335                         *)
 336                                 rtsol_interfaces="${rtsol_interfaces} ${i}"
 337                                 ;;
 338                         esac
 339                 else
 340                         ifconfig $i inet6
 341                 fi
 342         done
 343
 344         if [ ${rtsol_available} = yes -a -n "${rtsol_interfaces}" ]; then
 345                 # Act as endhost - automatically configured.
 346                 # You can configure only single interface, as
 347                 # specification assumes that autoconfigured host has
 348                 # single interface only.
 349                 sysctl net.inet6.ip6.accept_rtadv=1
 350                 set ${rtsol_interfaces}
 351                 ifconfig $1 up
 352                 rtsol $1
 353         fi
 354
 355         for i in $interfaces; do
 356                 alias=0
 357                 while : ; do
 358                         eval ipv6_ifconfig=\$ipv6_ifconfig_${i}_alias${alias}
 359                         if [ -z "${ipv6_ifconfig}" ]; then
 360                                 break;
 361                         fi
 362                         ifconfig $i inet6 ${ipv6_ifconfig} alias
 363                         alias=$((${alias} + 1))
 364                 done
 365         done
 366 }
 367
 368 network6_stf_setup() {
 369         case ${stf_interface_ipv4addr} in
 370         [Nn][Oo] | '')
 371                 ;;
 372         *)
 373                 # assign IPv6 addr and interface route for 6to4 interface
 374                 stf_prefixlen=$((16+${stf_interface_ipv4plen:-0}))
 375                 OIFS="$IFS"
 376                 IFS=".$IFS"
 377                 set ${stf_interface_ipv4addr}
 378                 IFS="$OIFS"
 379                 hexfrag1=`hexprint $(($1*256 + $2))`
 380                 hexfrag2=`hexprint $(($3*256 + $4))`
 381                 ipv4_in_hexformat="${hexfrag1}:${hexfrag2}"
 382                 case ${stf_interface_ipv6_ifid} in
 383                 [Aa][Uu][Tt][Oo] | '')
 384                         for i in ${ipv6_network_interfaces}; do
 385                                 laddr=`network6_getladdr ${i}`
 386                                 case ${laddr} in
 387                                 '')
 388                                         ;;
 389                                 *)
 390                                         break
 391                                         ;;
 392                                 esac
 393                         done
 394                         stf_interface_ipv6_ifid=`expr "${laddr}" : \
 395                                                       'fe80::\(.*\)%\(.*\)'`
 396                         case ${stf_interface_ipv6_ifid} in
 397                         '')
 398                                 stf_interface_ipv6_ifid=0:0:0:1
 399                                 ;;
 400                         esac
 401                         ;;
 402                 esac
 403                 ifconfig stf0 create >/dev/null 2>&1
 404                 ifconfig stf0 inet6 2002:${ipv4_in_hexformat}:${stf_interface_ipv6_slaid:-0}:${stf_interface_ipv6_ifid} \
 405                         prefixlen ${stf_prefixlen}
 406                 # disallow packets to malicious 6to4 prefix
 407                 route add -inet6 2002:e000:: -prefixlen 20 ::1 -reject
 408                 route add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject
 409                 route add -inet6 2002:0000:: -prefixlen 24 ::1 -reject
 410                 route add -inet6 2002:ff00:: -prefixlen 24 ::1 -reject
 411                 ;;
 412         esac
 413 }
 414
 415 network6_static_routes_setup() {
 416         # Set up any static routes.
 417         case ${ipv6_defaultrouter} in
 418         [Nn][Oo] | '')
 419                 ;;
 420         *)
 421                 ipv6_static_routes="default ${ipv6_static_routes}"
 422                 ipv6_route_default="default ${ipv6_defaultrouter}"
 423                 ;;
 424         esac
 425         case ${ipv6_static_routes} in
 426         [Nn][Oo] | '')
 427                 ;;
 428         *)
 429                 for i in ${ipv6_static_routes}; do
 430                         eval ipv6_route_args=\$ipv6_route_${i}
 431                         route add -inet6 ${ipv6_route_args}
 432                 done
 433                 ;;
 434         esac
 435 }
 436
 437 network6_faith_setup() {
 438         case ${ipv6_faith_prefix} in
 439         [Nn][Oo] | '')
 440                 ;;
 441         *)
 442                 sysctl net.inet6.ip6.keepfaith=1
 443                 ifconfig faith0 create >/dev/null 2>&1
 444                 ifconfig faith0 up
 445                 for prefix in ${ipv6_faith_prefix}; do
 446                         prefixlen=`expr "${prefix}" : ".*/\(.*\)"`
 447                         case ${prefixlen} in
 448                         '')
 449                                 prefixlen=96
 450                                 ;;
 451                         *)
 452                                 prefix=`expr "${prefix}" : \
 453                                              "\(.*\)/${prefixlen}"`
 454                                 ;;
 455                         esac
 456                         route add -inet6 ${prefix} -prefixlen ${prefixlen} ::1
 457                         route change -inet6 ${prefix} -prefixlen ${prefixlen} \
 458                                 -ifp faith0
 459                 done
 460                 ;;
 461         esac
 462 }
 463
 464 network6_default_interface_setup() {
 465         # Choose IPv6 default interface if it is not clearly specified.
 466         case ${ipv6_default_interface} in
 467         '')
 468                 for i in ${ipv6_network_interfaces}; do
 469                         case $i in
 470                         lo0|faith[0-9]*)
 471                                 continue
 472                                 ;;
 473                         esac
 474                         laddr=`network6_getladdr $i exclude_tentative`
 475                         case ${laddr} in
 476                         '')
 477                                 ;;
 478                         *)
 479                                 ipv6_default_interface=$i
 480                                 break
 481                                 ;;
 482                         esac
 483                 done
 484                 ;;
 485         esac
 486
 487         # Disallow unicast packets without outgoing scope identifiers,
 488         # or route such packets to a "default" interface, if it is specified.
 489         route add -inet6 fe80:: -prefixlen 10 ::1 -reject
 490         case ${ipv6_default_interface} in
 491         [Nn][Oo] | '')
 492                 route add -inet6 ff02:: -prefixlen 16 ::1 -reject
 493                 ;;
 494         *)
 495                 laddr=`network6_getladdr ${ipv6_default_interface}`
 496                 route add -inet6 ff02:: ${laddr} -prefixlen 16 -interface \
 497                         -cloning
 498
 499                 # Disable installing the default interface with the
 500                 # case net.inet6.ip6.forwarding=0 and
 501                 # net.inet6.ip6.accept_rtadv=0, due to avoid conflict
 502                 # between the default router list and the manual
 503                 # configured default route.
 504                 case ${ipv6_gateway_enable} in
 505                 [Yy][Ee][Ss])
 506                         ;;
 507                 *)
 508                         if [ `sysctl -n net.inet6.ip6.accept_rtadv` -eq 1 ]
 509                         then
 510                                 ndp -I ${ipv6_default_interface}
 511                         fi
 512                         ;;
 513                 esac
 514                 ;;
 515         esac
 516 }
 517
 518 network6_getladdr() {
 519         ifconfig $1 2>/dev/null | while read proto addr rest; do
 520                 case ${proto} in
 521                 inet6)
 522                         case ${addr} in
 523                         fe80::*)
 524                                 if [ -z "$2" ]; then
 525                                         echo ${addr}
 526                                         return
 527                                 fi
 528                                 case ${rest} in
 529                                 *tentative*)
 530                                         continue
 531                                         ;;
 532                                 *)
 533                                         echo ${addr}
 534                                         return
 535                                 esac
 536                         esac
 537                 esac
 538         done
 539 }