1#!/sbin/sh 2# 3# CDDL HEADER START 4# 5# The contents of this file are subject to the terms of the 6# Common Development and Distribution License, Version 1.0 only 7# (the "License"). You may not use this file except in compliance 8# with the License. 9# 10# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 11# or http://www.opensolaris.org/os/licensing. 12# See the License for the specific language governing permissions 13# and limitations under the License. 14# 15# When distributing Covered Code, include this CDDL HEADER in each 16# file and include the License file at usr/src/OPENSOLARIS.LICENSE. 17# If applicable, add the following below this CDDL HEADER, with the 18# fields enclosed by brackets "[]" replaced with your own identifying 19# information: Portions Copyright [yyyy] [name of copyright owner] 20# 21# CDDL HEADER END 22# 23# 24# Copyright 2005 Sun Microsystems, Inc. All rights reserved. 25# Use is subject to license terms. 26# 27# ident "%Z%%M% %I% %E% SMI" 28 29# 30# This is the second phase of TCP/IP configuration. The first part is 31# run by the /lib/svc/method/net-physical script (the svc:/network/physical 32# service) and includes configuring the interfaces and setting the machine's 33# hostname. This script (the svc:/network/initial service), does all 34# configuration that can be done before name services are started. This 35# includes configuring IP routing, and setting any tunable parameters. 36# The third part, run by the /lib/svc/method/net-svc script (the 37# svc:/network/service service), does all configuration that may require 38# name services. This includes a final re-configuration of the interfaces. 39# 40 41. /lib/svc/share/smf_include.sh 42 43case "$1" in 44'start') 45 # 46 # In a zone we need this service to be up, but all of the work 47 # it tries to do is irrelevant (and will actually lead to the service 48 # failing if we try to do it), so just bail out. 49 # 50 if [ `/sbin/zonename` != "global" ]; then 51 exit 0 52 fi 53 ;; # Fall through -- rest of script is the initialization code 54 55'stop') 56 if [ `/sbin/zonename` != "global" ]; then 57 exit 0 58 fi 59 # 60 # If we were routing dynamically, we will note this with 61 # the .dynamic_routing file, so that we can leave the routes 62 # in place without thinking they're static route entries 63 # when we come back into states 2 or 3. 64 # 65 if /usr/bin/pgrep -x -u 0 'in.routed|in.rdisc' >/dev/null 2>&1; then 66 /usr/bin/pkill -z `/sbin/zonename` -x -u 0 'in.routed|in.rdisc' 67 > /etc/.dynamic_routing 68 fi 69 /usr/bin/pkill -z `/sbin/zonename` -x -u 0 'in.ndpd|in.ripngd' 70 exit 0 71 ;; 72 73*) 74 echo "Usage: $0 { start | stop }" 75 exit 1 76 ;; 77esac 78 79# Configure IPv6 Default Address Selection. 80if [ -f /etc/inet/ipaddrsel.conf ]; then 81 /usr/sbin/ipaddrsel -f /etc/inet/ipaddrsel.conf 82fi 83 84/usr/sbin/ifconfig -a6u >/etc/svc/volatile/ifconfig.$$ 85numv6ifs=`/usr/bin/grep -c inet6 /etc/svc/volatile/ifconfig.$$` 86if [ $numv6ifs -gt 1 ]; then 87 # 88 # Add a static route for multicast packets out of a link-local 89 # interface, although would like to specify multicast interface using 90 # an interface name! 91 # 92 set -- `/usr/bin/awk ' 93 /inet6 fe80:/ { 94 print substr($2, 1, index($2, "/") - 1) 95 }' /etc/svc/volatile/ifconfig.$$` 96 97 if [ -n "$1" ]; then 98 echo "Setting default IPv6 interface for multicast:" \ 99 "add net ff00::/8: gateway $1" 100 /usr/sbin/route -n add -interface -inet6 "ff00::/8" "$1" \ 101 >/dev/null 102 fi 103fi 104/usr/bin/rm -f /etc/svc/volatile/ifconfig.$$ 105 106# 107# Now that /usr is mounted, see if in.mpathd needs to be started by firing it 108# up in "adopt" mode; if there are no interfaces it needs to manage, it will 109# automatically exit. Note that it may already be running if we're not 110# executing as part of system boot. 111# 112/usr/bin/pgrep -x -u 0 in.mpathd >/dev/null 2>&1 || /usr/lib/inet/in.mpathd -a 113 114# 115# Pass to the kernel the list of supported IPsec protocols and algorithms. 116# This will not cause IPsec to be loaded. 117# 118/usr/sbin/ipsecalgs -s 119 120# 121# Initialize IPsec only if ipsecinit.conf exists. Otherwise, save the 122# kernel memory that'll be consumed if IPsec is loaded. See below for more 123# IPsec-related commands. 124# 125if [ -f /etc/inet/ipsecinit.conf ] ; then 126 /usr/sbin/ipsecconf -qa /etc/inet/ipsecinit.conf 127fi 128 129# 130# Set the RFC 1948 entropy, regardless of if I'm using it or not. If present, 131# use the encrypted root password as a source of entropy. Otherwise, 132# just use the pre-set (and hopefully difficult to guess) entropy that 133# tcp used when it loaded. 134# 135encr=`/usr/bin/awk -F: '/^root:/ {print $2}' /etc/shadow` 136[ -z "$encr" ] || /usr/sbin/ndd -set /dev/tcp tcp_1948_phrase $encr 137unset encr 138 139# 140# Get values for TCP_STRONG_ISS, ACCEPT6TO4RELAY and RELAY6TO4ADDR. 141# 142[ -f /etc/default/inetinit ] && . /etc/default/inetinit 143 144# 145# Set TCP ISS generation. By default the ISS generation is 146# time + random()-delta. This might not be strong enough for some users. 147# See /etc/default/inetinit for settings and further info on TCP_STRONG_ISS. 148# If not set, use TCP's internal default setting. 149# 150if [ $TCP_STRONG_ISS ]; then 151 /usr/sbin/ndd -set /dev/tcp tcp_strong_iss $TCP_STRONG_ISS 152fi 153 154# 155# Configure default IPv4 routers using the local "/etc/defaultrouter" 156# configuration file. The file can contain the hostnames or IP 157# addresses of one or more default routers. If hostnames are used, 158# each hostname must also be listed in the local "/etc/hosts" file 159# because NIS and NIS+ are not running at the time that this script is 160# run. Each router name or address is listed on a single line by 161# itself in the file. Anything else on that line after the router's 162# name or address is ignored. Lines that begin with "#" are 163# considered comments and ignored. 164# 165# The default routes listed in the "/etc/defaultrouter" file will 166# replace those added by the kernel during diskless booting. An 167# empty "/etc/defaultrouter" file will cause the default route 168# added by the kernel to be deleted. 169# 170# Note that the default router file is ignored if we received routes 171# from a DHCP server. Our policy is to always trust DHCP over local 172# administration. 173# 174smf_netstrategy 175 176if [ "$_INIT_NET_STRATEGY" = "dhcp" ] && [ -n "`/sbin/dhcpinfo Router`" ]; then 177 defrouters=`/sbin/dhcpinfo Router` 178elif [ -f /etc/defaultrouter ]; then 179 defrouters=`/usr/bin/grep -v \^\# /etc/defaultrouter | \ 180 /usr/bin/awk '{print $1}'` 181 if [ -n "$defrouters" ]; then 182 # 183 # We want the default router(s) listed in /etc/defaultrouter 184 # to replace the one added from the BOOTPARAMS WHOAMI response 185 # but we must avoid flushing the last route between the running 186 # system and its /usr file system. 187 # 188 189 # First, remember the original route. 190 shift $# 191 set -- `/usr/bin/netstat -rn -f inet | /usr/bin/grep '^default'` 192 route_IP="$2" 193 194 # 195 # Next, add those from /etc/defaultrouter. While doing this, 196 # if one of the routes we add is for the route previously 197 # added as a result of the BOOTPARAMS response, we will see 198 # a message of the form: 199 # "add net default: gateway a.b.c.d: entry exists" 200 # 201 do_delete=yes 202 for router in $defrouters; do 203 set -- `/usr/sbin/route -n add default -gateway $router` 204 [ $? -ne 0 -a "x$5" = "x$route_IP:" ] && do_delete=no 205 done 206 207 # 208 # Finally, delete the original default route unless it was 209 # also listed in the defaultrouter file. 210 # 211 if [ -n "$route_IP" -a $do_delete = yes ]; then 212 /usr/sbin/route -n delete default -gateway $route_IP \ 213 >/dev/null 214 fi 215 else 216 /usr/sbin/route -fn > /dev/null 217 fi 218else 219 defrouters= 220fi 221 222# Make a first pass through /etc/inet/static_routes, attempting to add 223# each route. Ignore any errors since this will be attempted again once 224# the tunnels are up. 225# 226if [ -f /etc/inet/static_routes ]; then 227 /usr/bin/egrep -v "^(#|$)" /etc/inet/static_routes | while read line; do 228 /usr/sbin/route add $line 229 done > /dev/null 2>&1 230fi 231 232# 233# Use routeadm(1M) to configure forwarding and launch routing daemons for 234# IPv4 and IPv6 based on preset values. These settings only apply to the 235# global zone. For IPv4 dynamic routing, the system will default to 236# disabled if a default route was previously added via BOOTP, DHCP, or 237# the /etc/defaultrouter file. routeadm also starts in.ndpd. 238# 239if [ ! -f /etc/.dynamic_routing ] && [ -z "$defrouters" ]; then 240 # 241 # No default routes were setup by "route" command above. 242 # Check the kernel routing table for any other default 243 # routes. 244 # 245 /usr/bin/netstat -rn -f inet | \ 246 /usr/bin/grep default >/dev/null 2>&1 && defrouters=yes 247fi 248[ -f /etc/.dynamic_routing ] && /usr/bin/rm -f /etc/.dynamic_routing 249if [ -z "$defrouters" ]; then 250 routeadmstr="-e ipv4-routing" 251else 252 routeadmstr="-d ipv4-routing" 253fi 254# 255# The -b option used here tells routeadm that the ipv4-routing 256# option in $routeadmstr is the boot-time default. The 257# boot-time default is used if the administrator has not 258# explicitly enabled or disabled ipv4-routing using the -e or 259# -d routeadm option. 260# 261/usr/sbin/routeadm -u -b $routeadmstr 262 263# 264# In spite of global policy, there may be a need for IPsec because of 265# per-socket policy or tunnelled policy. With that in mind, check for manual 266# keys in /etc/inet/secret/ipseckeys, or check for IKE configuration in 267# /etc/inet/ike/config. Either of these will also load and initialize IPsec, 268# thereby consuming kernel memory. 269# 270 271if [ -f /etc/inet/secret/ipseckeys ] ; then 272 /usr/sbin/ipseckey -f /etc/inet/secret/ipseckeys 273fi 274 275if [ -f /etc/inet/ike/config ] ; then 276 /usr/lib/inet/in.iked 277fi 278 279# 280# Configure tunnels which were deferred by /lib/svc/method/net-physical 281# (the svc:/network/physical service) since it depends on the tunnel endpoints 282# being reachable i.e. routing must be running. 283# 284# WARNING: you may wish to turn OFF forwarding if you haven't already, because 285# of various possible security vulnerabilities when configuring tunnels for 286# Virtual Private Network (VPN) construction. 287# 288# Also, if names are used in the /etc/hostname.ip.tun* file, those names 289# have to be in either DNS (and DNS is used) or in /etc/hosts, because this 290# file is executed before NIS or NIS+ is started. 291# 292 293# 294# IPv4 tunnels 295# The second component of the name must be either "ip" or "ip6". 296# 297interface_names="`/usr/bin/ls /etc/hostname.ip*.*[0-9] 2>/dev/null | \ 298 /usr/bin/grep '/etc/hostname\.ip6\{0,1\}\.'`" 299if [ -n "$interface_names" ]; then 300 ( 301 echo "configuring IPv4 tunnels:\c" 302 # Extract the part after the first '.' 303 set -- `for intr in $interface_names; do \ 304 /usr/bin/expr //$intr : '[^.]*\.\(.*\)$'; done` 305 while [ $# -ge 1 ]; do 306 # Skip empty files 307 if [ ! -s /etc/hostname\.$1 ]; then 308 shift 309 continue 310 fi 311 /usr/sbin/ifconfig $1 plumb 312 while read ifcmds; do 313 if [ -n "$ifcmds" ]; then 314 /usr/sbin/ifconfig $1 inet $ifcmds 315 fi 316 done </etc/hostname\.$1 >/dev/null 317 echo " $1\c" 318 shift 319 done 320 echo "." 321 ) 322fi 323 324# 325# IPv6 Tunnels 326# The second component of the name must be either "ip" or "ip6". 327# 328interface_names="`/usr/bin/ls /etc/hostname6.ip*.*[0-9] 2>/dev/null | \ 329 /usr/bin/grep '/etc/hostname6\.ip6\{0,1\}\.'`" 330if [ -n "$interface_names" ]; then 331 ( 332 echo "configuring IPv6 tunnels:\c" 333 # Extract the part after the first '.' 334 set -- `for intr in $interface_names; do \ 335 /usr/bin/expr //$intr : '[^.]*\.\(.*\)$'; done` 336 while [ $# -ge 1 ]; do 337 # Skip empty files 338 if [ ! -s /etc/hostname6\.$1 ]; then 339 shift 340 continue 341 fi 342 /usr/sbin/ifconfig $1 inet6 plumb 343 while read ifcmds; do 344 if [ -n "$ifcmds" ]; then 345 /usr/sbin/ifconfig $1 inet6 $ifcmds 346 fi 347 done </etc/hostname6\.$1 > /dev/null 348 echo " $1\c" 349 shift 350 done 351 echo "." 352 ) 353fi 354 355# 356# Set 6to4 Relay Router communication support policy and, if applicable, 357# the destination Relay Router IPv4 address. See /etc/default/inetinit for 358# setting and further info on ACCEPT6TO4RELAY and RELAY6TO4ADDR. 359# If ACCEPT6TO4RELAY=NO, the default value in the kernel will 360# be used. 361# 362ACCEPT6TO4RELAY=`echo "$ACCEPT6TO4RELAY" | /usr/bin/tr '[A-Z]' '[a-z]'` 363if [ "$ACCEPT6TO4RELAY" = yes ]; then 364 if [ "$RELAY6TO4ADDR" ]; then 365 /usr/sbin/6to4relay -e -a $RELAY6TO4ADDR 366 else 367 /usr/sbin/6to4relay -e 368 fi 369fi 370 371# 372# Make a second pass through /etc/inet/static_routes, attempting to add 373# each route. This time, any errors except those for duplicates entries 374# are reported. 375# 376if [ -f /etc/inet/static_routes ]; then 377 /usr/bin/egrep -v "^(#|$)" /etc/inet/static_routes | while read line; do 378 /usr/sbin/route add $line 379 done | /usr/bin/egrep -v "^[^:]+:[^:]+(: entry exists)?\$" >\ 380 /dev/msglog 2>&1 381fi 382 383# Clear exit status. 384exit 0 385