1#!/sbin/sh 2# 3# CDDL HEADER START 4# 5# The contents of this file are subject to the terms of the 6# Common Development and Distribution License, Version 1.0 only 7# (the "License"). You may not use this file except in compliance 8# with the License. 9# 10# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 11# or http://www.opensolaris.org/os/licensing. 12# See the License for the specific language governing permissions 13# and limitations under the License. 14# 15# When distributing Covered Code, include this CDDL HEADER in each 16# file and include the License file at usr/src/OPENSOLARIS.LICENSE. 17# If applicable, add the following below this CDDL HEADER, with the 18# fields enclosed by brackets "[]" replaced with your own identifying 19# information: Portions Copyright [yyyy] [name of copyright owner] 20# 21# CDDL HEADER END 22# 23# 24# Copyright 2004 Sun Microsystems, Inc. All rights reserved. 25# Use is subject to license terms. 26# 27# ident "%Z%%M% %I% %E% SMI" 28 29# 30# This is the second phase of TCP/IP configuration. The first part is 31# run by the /lib/svc/method/net-physical script (the svc:/network/physical 32# service) and includes configuring the interfaces and setting the machine's 33# hostname. This script (the svc:/network/initial service), does all 34# configuration that can be done before name services are started. This 35# includes configuring IP routing, and setting any tunable parameters. 36# The third part, run by the /lib/svc/method/net-svc script (the 37# svc:/network/service service), does all configuration that may require 38# name services. This includes a final re-configuration of the interfaces. 39# 40 41. /lib/svc/share/smf_include.sh 42 43case "$1" in 44'start') 45 # 46 # In a zone we need this service to be up, but all of the work 47 # it tries to do is irrelevant (and will actually lead to the service 48 # failing if we try to do it), so just bail out. 49 # 50 if [ `/sbin/zonename` != "global" ]; then 51 exit 0 52 fi 53 ;; # Fall through -- rest of script is the initialization code 54 55'stop') 56 if [ `/sbin/zonename` != "global" ]; then 57 exit 0 58 fi 59 # 60 # If we were routing dynamically, we will note this with 61 # the .dynamic_routing file, so that we can leave the routes 62 # in place without thinking they're static route entries 63 # when we come back into states 2 or 3. 64 # 65 if /usr/bin/pgrep -x -u 0 'in.routed|in.rdisc' >/dev/null 2>&1; then 66 /usr/bin/pkill -z `/sbin/zonename` -x -u 0 'in.routed|in.rdisc' 67 > /etc/.dynamic_routing 68 fi 69 /usr/bin/pkill -z `/sbin/zonename` -x -u 0 'in.ndpd|in.ripngd' 70 exit 0 71 ;; 72 73*) 74 echo "Usage: $0 { start | stop }" 75 exit 1 76 ;; 77esac 78 79# Configure IPv6 Default Address Selection. 80if [ -f /etc/inet/ipaddrsel.conf ]; then 81 /usr/sbin/ipaddrsel -f /etc/inet/ipaddrsel.conf 82fi 83 84/usr/sbin/ifconfig -a6u >/etc/svc/volatile/ifconfig.$$ 85numv6ifs=`/usr/bin/grep -c inet6 /etc/svc/volatile/ifconfig.$$` 86if [ $numv6ifs -gt 1 ]; then 87 # 88 # Add a static route for multicast packets out of a link-local 89 # interface, although would like to specify multicast interface using 90 # an interface name! 91 # 92 set -- `/usr/bin/awk ' 93 /inet6 fe80:/ { 94 print substr($2, 1, index($2, "/") - 1) 95 }' /etc/svc/volatile/ifconfig.$$` 96 97 if [ -n "$1" ]; then 98 echo "Setting default IPv6 interface for multicast:" \ 99 "add net ff00::/8: gateway $1" 100 /usr/sbin/route -n add -interface -inet6 "ff00::/8" "$1" \ 101 >/dev/null 102 fi 103fi 104/usr/bin/rm -f /etc/svc/volatile/ifconfig.$$ 105 106# 107# Now that /usr is mounted, see if in.mpathd needs to be started by firing it 108# up in "adopt" mode; if there are no interfaces it needs to manage, it will 109# automatically exit. Note that it may already be running if we're not 110# executing as part of system boot. 111# 112/usr/bin/pgrep -x -u 0 in.mpathd >/dev/null 2>&1 || /usr/lib/inet/in.mpathd -a 113 114# 115# Pass to the kernel the list of supported IPsec protocols and algorithms. 116# This will not cause IPsec to be loaded. 117# 118/usr/sbin/ipsecalgs -s 119 120# 121# Initialize IPsec only if ipsecinit.conf exists. Otherwise, save the 122# kernel memory that'll be consumed if IPsec is loaded. See below for more 123# IPsec-related commands. 124# 125if [ -f /etc/inet/ipsecinit.conf ] ; then 126 /usr/sbin/ipsecconf -qa /etc/inet/ipsecinit.conf 127fi 128 129# 130# Set the RFC 1948 entropy, regardless of if I'm using it or not. If present, 131# use the encrypted root password as a source of entropy. Otherwise, 132# just use the pre-set (and hopefully difficult to guess) entropy that 133# tcp used when it loaded. 134# 135encr=`/usr/bin/awk -F: '/^root:/ {print $2}' /etc/shadow` 136[ -z "$encr" ] || /usr/sbin/ndd -set /dev/tcp tcp_1948_phrase $encr 137unset encr 138 139# 140# Get values for TCP_STRONG_ISS, ACCEPT6TO4RELAY and RELAY6TO4ADDR. 141# 142[ -f /etc/default/inetinit ] && . /etc/default/inetinit 143 144# 145# Set TCP ISS generation. By default the ISS generation is 146# time + random()-delta. This might not be strong enough for some users. 147# See /etc/default/inetinit for settings and further info on TCP_STRONG_ISS. 148# If not set, use TCP's internal default setting. 149# 150if [ $TCP_STRONG_ISS ]; then 151 /usr/sbin/ndd -set /dev/tcp tcp_strong_iss $TCP_STRONG_ISS 152fi 153 154# 155# Configure default IPv4 routers using the local "/etc/defaultrouter" 156# configuration file. The file can contain the hostnames or IP 157# addresses of one or more default routers. If hostnames are used, 158# each hostname must also be listed in the local "/etc/hosts" file 159# because NIS and NIS+ are not running at the time that this script is 160# run. Each router name or address is listed on a single line by 161# itself in the file. Anything else on that line after the router's 162# name or address is ignored. Lines that begin with "#" are 163# considered comments and ignored. 164# 165# The default routes listed in the "/etc/defaultrouter" file will 166# replace those added by the kernel during diskless booting. An 167# empty "/etc/defaultrouter" file will cause the default route 168# added by the kernel to be deleted. 169# 170# Note that the default router file is ignored if we received routes 171# from a DHCP server. Our policy is to always trust DHCP over local 172# administration. 173# 174smf_netstrategy 175 176if [ "$_INIT_NET_STRATEGY" = "dhcp" ] && [ -n "`/sbin/dhcpinfo Router`" ]; then 177 defrouters=`/sbin/dhcpinfo Router` 178elif [ -f /etc/defaultrouter ]; then 179 defrouters=`/usr/bin/grep -v \^\# /etc/defaultrouter | \ 180 /usr/bin/awk '{print $1}'` 181 if [ -n "$defrouters" ]; then 182 # 183 # We want the default router(s) listed in /etc/defaultrouter 184 # to replace the one added from the BOOTPARAMS WHOAMI response 185 # but we must avoid flushing the last route between the running 186 # system and its /usr file system. 187 # 188 189 # First, remember the original route. 190 shift $# 191 set -- `/usr/bin/netstat -rn -f inet | /usr/bin/grep '^default'` 192 route_IP="$2" 193 194 # 195 # Next, add those from /etc/defaultrouter. While doing this, 196 # if one of the routes we add is for the route previously 197 # added as a result of the BOOTPARAMS response, we will see 198 # a message of the form: 199 # "add net default: gateway a.b.c.d: entry exists" 200 # 201 do_delete=yes 202 for router in $defrouters; do 203 set -- `/usr/sbin/route -n add default -gateway $router` 204 [ $? -ne 0 -a "x$5" = "x$route_IP:" ] && do_delete=no 205 done 206 207 # 208 # Finally, delete the original default route unless it was 209 # also listed in the defaultrouter file. 210 # 211 if [ -n "$route_IP" -a $do_delete = yes ]; then 212 /usr/sbin/route -n delete default -gateway $route_IP \ 213 >/dev/null 214 fi 215 else 216 /usr/sbin/route -fn > /dev/null 217 fi 218else 219 defrouters= 220fi 221 222# 223# Use routeadm(1M) to configure forwarding and launch routing daemons for 224# IPv4 and IPv6 based on preset values. These settings only apply to the 225# global zone. For IPv4 dynamic routing, the system will default to 226# disabled if a default route was previously added via BOOTP, DHCP, or 227# the /etc/defaultrouter file. routeadm also starts in.ndpd. 228# 229if [ ! -f /etc/.dynamic_routing ] && [ -z "$defrouters" ]; then 230 # 231 # No default routes were setup by "route" command above. 232 # Check the kernel routing table for any other default 233 # routes. 234 # 235 /usr/bin/netstat -rn -f inet | \ 236 /usr/bin/grep default >/dev/null 2>&1 && defrouters=yes 237fi 238[ -f /etc/.dynamic_routing ] && /usr/bin/rm -f /etc/.dynamic_routing 239if [ -z "$defrouters" ]; then 240 routeadmstr="-e ipv4-routing" 241else 242 routeadmstr="-d ipv4-routing" 243fi 244# 245# The -b option used here tells routeadm that the ipv4-routing 246# option in $routeadmstr is the boot-time default. The 247# boot-time default is used if the administrator has not 248# explicitly enabled or disabled ipv4-routing using the -e or 249# -d routeadm option. 250# 251/usr/sbin/routeadm -u -b $routeadmstr 252 253# 254# In spite of global policy, there may be a need for IPsec because of 255# per-socket policy or tunnelled policy. With that in mind, check for manual 256# keys in /etc/inet/secret/ipseckeys, or check for IKE configuration in 257# /etc/inet/ike/config. Either of these will also load and initialize IPsec, 258# thereby consuming kernel memory. 259# 260 261if [ -f /etc/inet/secret/ipseckeys ] ; then 262 /usr/sbin/ipseckey -f /etc/inet/secret/ipseckeys 263fi 264 265if [ -f /etc/inet/ike/config ] ; then 266 /usr/lib/inet/in.iked 267fi 268 269# 270# Configure tunnels which were deferred by /lib/svc/method/net-physical 271# (the svc:/network/physical service) since it depends on the tunnel endpoints 272# being reachable i.e. routing must be running. 273# 274# WARNING: you may wish to turn OFF forwarding if you haven't already, because 275# of various possible security vulnerabilities when configuring tunnels for 276# Virtual Private Network (VPN) construction. 277# 278# Also, if names are used in the /etc/hostname.ip.tun* file, those names 279# have to be in either DNS (and DNS is used) or in /etc/hosts, because this 280# file is executed before NIS or NIS+ is started. 281# 282 283# 284# IPv4 tunnels 285# The second component of the name must be either "ip" or "ip6". 286# 287interface_names="`/usr/bin/ls /etc/hostname.ip*.*[0-9] 2>/dev/null | \ 288 /usr/bin/grep '/etc/hostname\.ip6\{0,1\}\.'`" 289if [ -n "$interface_names" ]; then 290 ( 291 echo "configuring IPv4 tunnels:\c" 292 # Extract the part after the first '.' 293 set -- `for intr in $interface_names; do \ 294 /usr/bin/expr //$intr : '[^.]*\.\(.*\)$'; done` 295 while [ $# -ge 1 ]; do 296 # Skip empty files 297 if [ ! -s /etc/hostname\.$1 ]; then 298 shift 299 continue 300 fi 301 /usr/sbin/ifconfig $1 plumb 302 while read ifcmds; do 303 if [ -n "$ifcmds" ]; then 304 /usr/sbin/ifconfig $1 inet $ifcmds 305 fi 306 done </etc/hostname\.$1 >/dev/null 307 echo " $1\c" 308 shift 309 done 310 echo "." 311 ) 312fi 313 314# 315# IPv6 Tunnels 316# The second component of the name must be either "ip" or "ip6". 317# 318interface_names="`/usr/bin/ls /etc/hostname6.ip*.*[0-9] 2>/dev/null | \ 319 /usr/bin/grep '/etc/hostname6\.ip6\{0,1\}\.'`" 320if [ -n "$interface_names" ]; then 321 ( 322 echo "configuring IPv6 tunnels:\c" 323 # Extract the part after the first '.' 324 set -- `for intr in $interface_names; do \ 325 /usr/bin/expr //$intr : '[^.]*\.\(.*\)$'; done` 326 while [ $# -ge 1 ]; do 327 # Skip empty files 328 if [ ! -s /etc/hostname6\.$1 ]; then 329 shift 330 continue 331 fi 332 /usr/sbin/ifconfig $1 inet6 plumb 333 while read ifcmds; do 334 if [ -n "$ifcmds" ]; then 335 /usr/sbin/ifconfig $1 inet6 $ifcmds 336 fi 337 done </etc/hostname6\.$1 > /dev/null 338 echo " $1\c" 339 shift 340 done 341 echo "." 342 ) 343fi 344 345# 346# Set 6to4 Relay Router communication support policy and, if applicable, 347# the destination Relay Router IPv4 address. See /etc/default/inetinit for 348# setting and further info on ACCEPT6TO4RELAY and RELAY6TO4ADDR. 349# If ACCEPT6TO4RELAY=NO, the default value in the kernel will 350# be used. 351# 352ACCEPT6TO4RELAY=`echo "$ACCEPT6TO4RELAY" | /usr/bin/tr '[A-Z]' '[a-z]'` 353if [ "$ACCEPT6TO4RELAY" = yes ]; then 354 if [ "$RELAY6TO4ADDR" ]; then 355 /usr/sbin/6to4relay -e -a $RELAY6TO4ADDR 356 else 357 /usr/sbin/6to4relay -e 358 fi 359fi 360 361# Clear exit status. 362exit 0 363