1#!/sbin/sh 2# 3# CDDL HEADER START 4# 5# The contents of this file are subject to the terms of the 6# Common Development and Distribution License (the "License"). 7# You may not use this file except in compliance with the License. 8# 9# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10# or http://www.opensolaris.org/os/licensing. 11# See the License for the specific language governing permissions 12# and limitations under the License. 13# 14# When distributing Covered Code, include this CDDL HEADER in each 15# file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16# If applicable, add the following below this CDDL HEADER, with the 17# fields enclosed by brackets "[]" replaced with your own identifying 18# information: Portions Copyright [yyyy] [name of copyright owner] 19# 20# CDDL HEADER END 21# 22# 23# Copyright 2006 Sun Microsystems, Inc. All rights reserved. 24# Use is subject to license terms. 25# 26# ident "%Z%%M% %I% %E% SMI" 27# 28# This is the second phase of TCP/IP configuration. The first part is 29# run by the /lib/svc/method/net-physical script (the svc:/network/physical 30# service) and includes configuring the interfaces and setting the machine's 31# hostname. This script (the svc:/network/initial service), does all 32# configuration that can be done before name services are started. This 33# includes configuring IP routing, and setting any tunable parameters. 34# The third part, run by the /lib/svc/method/net-svc script (the 35# svc:/network/service service), does all configuration that may require 36# name services. This includes a final re-configuration of the interfaces. 37# 38 39. /lib/svc/share/smf_include.sh 40 41case "$1" in 42'start') 43 # 44 # In a zone we need this service to be up, but all of the work 45 # it tries to do is irrelevant (and will actually lead to the service 46 # failing if we try to do it), so just bail out. 47 # 48 smf_is_globalzone || exit $SMF_EXIT_OK 49 50 ;; # Fall through -- rest of script is the initialization code 51 52'stop') 53 smf_is_globalzone || exit $SMF_EXIT_OK 54 55 # 56 # If we were routing dynamically, we will note this with 57 # the .dynamic_routing file, so that we can leave the routes 58 # in place without thinking they're static route entries 59 # when we come back into states 2 or 3. 60 # 61 if /usr/bin/pgrep -x -u 0 'in.routed|in.rdisc' >/dev/null 2>&1; then 62 /usr/bin/pkill -z global -x -u 0 'in.routed|in.rdisc' 63 > /etc/.dynamic_routing 64 fi 65 /usr/bin/pkill -z global -x -u 0 'in.ndpd|in.ripngd' 66 exit $SMF_EXIT_OK 67 ;; 68 69*) 70 echo "Usage: $0 { start | stop }" 71 exit 1 72 ;; 73esac 74 75# Configure IPv6 Default Address Selection. 76if [ -f /etc/inet/ipaddrsel.conf ]; then 77 /usr/sbin/ipaddrsel -f /etc/inet/ipaddrsel.conf 78fi 79 80/usr/sbin/ifconfig -a6u >/etc/svc/volatile/ifconfig.$$ 81numv6ifs=`/usr/bin/grep -c inet6 /etc/svc/volatile/ifconfig.$$` 82if [ $numv6ifs -gt 1 ]; then 83 # 84 # Add a static route for multicast packets out of a link-local 85 # interface, although would like to specify multicast interface using 86 # an interface name! 87 # 88 set -- `/usr/bin/awk ' 89 /inet6 fe80:/ { 90 print substr($2, 1, index($2, "/") - 1) 91 }' /etc/svc/volatile/ifconfig.$$` 92 93 if [ -n "$1" ]; then 94 echo "Setting default IPv6 interface for multicast:" \ 95 "add net ff00::/8: gateway $1" 96 /usr/sbin/route -n add -interface -inet6 "ff00::/8" "$1" \ 97 >/dev/null 98 fi 99fi 100/usr/bin/rm -f /etc/svc/volatile/ifconfig.$$ 101 102# 103# Now that /usr is mounted, see if in.mpathd needs to be started by firing it 104# up in "adopt" mode; if there are no interfaces it needs to manage, it will 105# automatically exit. Note that it may already be running if we're not 106# executing as part of system boot. 107# 108/usr/bin/pgrep -x -u 0 in.mpathd >/dev/null 2>&1 || /usr/lib/inet/in.mpathd -a 109 110# 111# Pass to the kernel the list of supported IPsec protocols and algorithms. 112# This will not cause IPsec to be loaded. 113# 114/usr/sbin/ipsecalgs -s 115 116# 117# Initialize IPsec only if ipsecinit.conf exists. Otherwise, save the 118# kernel memory that'll be consumed if IPsec is loaded. See below for more 119# IPsec-related commands. 120# 121if [ -f /etc/inet/ipsecinit.conf ] ; then 122 /usr/sbin/ipsecconf -qa /etc/inet/ipsecinit.conf 123fi 124 125# 126# Set the RFC 1948 entropy, regardless of if I'm using it or not. If present, 127# use the encrypted root password as a source of entropy. Otherwise, 128# just use the pre-set (and hopefully difficult to guess) entropy that 129# tcp used when it loaded. 130# 131encr=`/usr/bin/awk -F: '/^root:/ {print $2}' /etc/shadow` 132[ -z "$encr" ] || /usr/sbin/ndd -set /dev/tcp tcp_1948_phrase $encr 133unset encr 134 135# 136# Get values for TCP_STRONG_ISS, ACCEPT6TO4RELAY and RELAY6TO4ADDR. 137# 138[ -f /etc/default/inetinit ] && . /etc/default/inetinit 139 140# 141# Set TCP ISS generation. By default the ISS generation is 142# time + random()-delta. This might not be strong enough for some users. 143# See /etc/default/inetinit for settings and further info on TCP_STRONG_ISS. 144# If not set, use TCP's internal default setting. 145# 146if [ $TCP_STRONG_ISS ]; then 147 /usr/sbin/ndd -set /dev/tcp tcp_strong_iss $TCP_STRONG_ISS 148fi 149 150# 151# Configure default IPv4 routers using the local "/etc/defaultrouter" 152# configuration file. The file can contain the hostnames or IP 153# addresses of one or more default routers. If hostnames are used, 154# each hostname must also be listed in the local "/etc/hosts" file 155# because NIS and NIS+ are not running at the time that this script is 156# run. Each router name or address is listed on a single line by 157# itself in the file. Anything else on that line after the router's 158# name or address is ignored. Lines that begin with "#" are 159# considered comments and ignored. 160# 161# The default routes listed in the "/etc/defaultrouter" file will 162# replace those added by the kernel during diskless booting. An 163# empty "/etc/defaultrouter" file will cause the default route 164# added by the kernel to be deleted. 165# 166# Note that the default router file is ignored if we received routes 167# from a DHCP server. Our policy is to always trust DHCP over local 168# administration. 169# 170smf_netstrategy 171 172if [ "$_INIT_NET_STRATEGY" = "dhcp" ] && [ -n "`/sbin/dhcpinfo Router`" ]; then 173 defrouters=`/sbin/dhcpinfo Router` 174elif [ -f /etc/defaultrouter ]; then 175 defrouters=`/usr/bin/grep -v \^\# /etc/defaultrouter | \ 176 /usr/bin/awk '{print $1}'` 177 if [ -n "$defrouters" ]; then 178 # 179 # We want the default router(s) listed in /etc/defaultrouter 180 # to replace the one added from the BOOTPARAMS WHOAMI response 181 # but we must avoid flushing the last route between the running 182 # system and its /usr file system. 183 # 184 185 # First, remember the original route. 186 shift $# 187 set -- `/usr/bin/netstat -rn -f inet | /usr/bin/grep '^default'` 188 route_IP="$2" 189 190 # 191 # Next, add those from /etc/defaultrouter. While doing this, 192 # if one of the routes we add is for the route previously 193 # added as a result of the BOOTPARAMS response, we will see 194 # a message of the form: 195 # "add net default: gateway a.b.c.d: entry exists" 196 # 197 do_delete=yes 198 for router in $defrouters; do 199 set -- `/usr/sbin/route -n add default -gateway $router` 200 [ $? -ne 0 -a "x$5" = "x$route_IP:" ] && do_delete=no 201 done 202 203 # 204 # Finally, delete the original default route unless it was 205 # also listed in the defaultrouter file. 206 # 207 if [ -n "$route_IP" -a $do_delete = yes ]; then 208 /usr/sbin/route -n delete default -gateway $route_IP \ 209 >/dev/null 210 fi 211 else 212 /usr/sbin/route -fn > /dev/null 213 fi 214else 215 defrouters= 216fi 217 218# 219# Use routeadm(1M) to configure forwarding and launch routing daemons for 220# IPv4 and IPv6 based on preset values. These settings only apply to the 221# global zone. For IPv4 dynamic routing, the system will default to 222# disabled if a default route was previously added via BOOTP, DHCP, or 223# the /etc/defaultrouter file. routeadm also starts in.ndpd. 224# 225if [ ! -f /etc/.dynamic_routing ] && [ -z "$defrouters" ]; then 226 # 227 # No default routes were setup by "route" command above. 228 # Check the kernel routing table for any other default 229 # routes. 230 # 231 /usr/bin/netstat -rn -f inet | \ 232 /usr/bin/grep default >/dev/null 2>&1 && defrouters=yes 233fi 234[ -f /etc/.dynamic_routing ] && /usr/bin/rm -f /etc/.dynamic_routing 235if [ -z "$defrouters" ]; then 236 routeadmstr="-e ipv4-routing" 237else 238 routeadmstr="-d ipv4-routing" 239fi 240# 241# The -b option used here tells routeadm that the ipv4-routing 242# option in $routeadmstr is the boot-time default. The 243# boot-time default is used if the administrator has not 244# explicitly enabled or disabled ipv4-routing using the -e or 245# -d routeadm option. 246# 247/usr/sbin/routeadm -u -b $routeadmstr 248 249# 250# In spite of global policy, there may be a need for IPsec because of 251# per-socket policy or tunnelled policy. With that in mind, check for manual 252# keys in /etc/inet/secret/ipseckeys, or check for IKE configuration in 253# /etc/inet/ike/config. Either of these will also load and initialize IPsec, 254# thereby consuming kernel memory. 255# 256 257if [ -f /etc/inet/secret/ipseckeys ] ; then 258 /usr/sbin/ipseckey -f /etc/inet/secret/ipseckeys 259fi 260 261if [ -f /etc/inet/ike/config ] ; then 262 /usr/lib/inet/in.iked 263fi 264 265# 266# Configure tunnels which were deferred by /lib/svc/method/net-physical 267# (the svc:/network/physical service) since it depends on the tunnel endpoints 268# being reachable i.e. routing must be running. 269# 270# WARNING: you may wish to turn OFF forwarding if you haven't already, because 271# of various possible security vulnerabilities when configuring tunnels for 272# Virtual Private Network (VPN) construction. 273# 274# Also, if names are used in the /etc/hostname.ip.tun* file, those names 275# have to be in either DNS (and DNS is used) or in /etc/hosts, because this 276# file is executed before NIS or NIS+ is started. 277# 278 279# 280# IPv4 tunnels 281# The second component of the name must be either "ip" or "ip6". 282# 283interface_names="`/usr/bin/ls /etc/hostname.ip*.*[0-9] 2>/dev/null | \ 284 /usr/bin/grep '/etc/hostname\.ip6\{0,1\}\.'`" 285if [ -n "$interface_names" ]; then 286 ( 287 echo "configuring IPv4 tunnels:\c" 288 # Extract the part after the first '.' 289 set -- `for intr in $interface_names; do \ 290 /usr/bin/expr //$intr : '[^.]*\.\(.*\)$'; done` 291 while [ $# -ge 1 ]; do 292 # Skip empty files 293 if [ ! -s /etc/hostname\.$1 ]; then 294 shift 295 continue 296 fi 297 /usr/sbin/ifconfig $1 plumb 298 while read ifcmds; do 299 if [ -n "$ifcmds" ]; then 300 /usr/sbin/ifconfig $1 inet $ifcmds 301 fi 302 done </etc/hostname\.$1 >/dev/null 303 echo " $1\c" 304 shift 305 done 306 echo "." 307 ) 308fi 309 310# 311# IPv6 Tunnels 312# The second component of the name must be either "ip" or "ip6". 313# 314interface_names="`/usr/bin/ls /etc/hostname6.ip*.*[0-9] 2>/dev/null | \ 315 /usr/bin/grep '/etc/hostname6\.ip6\{0,1\}\.'`" 316if [ -n "$interface_names" ]; then 317 ( 318 echo "configuring IPv6 tunnels:\c" 319 # Extract the part after the first '.' 320 set -- `for intr in $interface_names; do \ 321 /usr/bin/expr //$intr : '[^.]*\.\(.*\)$'; done` 322 while [ $# -ge 1 ]; do 323 # Skip empty files 324 if [ ! -s /etc/hostname6\.$1 ]; then 325 shift 326 continue 327 fi 328 /usr/sbin/ifconfig $1 inet6 plumb 329 while read ifcmds; do 330 if [ -n "$ifcmds" ]; then 331 /usr/sbin/ifconfig $1 inet6 $ifcmds 332 fi 333 done </etc/hostname6\.$1 > /dev/null 334 echo " $1\c" 335 shift 336 done 337 echo "." 338 ) 339fi 340 341# 342# Set 6to4 Relay Router communication support policy and, if applicable, 343# the destination Relay Router IPv4 address. See /etc/default/inetinit for 344# setting and further info on ACCEPT6TO4RELAY and RELAY6TO4ADDR. 345# If ACCEPT6TO4RELAY=NO, the default value in the kernel will 346# be used. 347# 348ACCEPT6TO4RELAY=`echo "$ACCEPT6TO4RELAY" | /usr/bin/tr '[A-Z]' '[a-z]'` 349if [ "$ACCEPT6TO4RELAY" = yes ]; then 350 if [ "$RELAY6TO4ADDR" ]; then 351 /usr/sbin/6to4relay -e -a $RELAY6TO4ADDR 352 else 353 /usr/sbin/6to4relay -e 354 fi 355fi 356 357# 358# Read /etc/inet/static_routes and add each route. 359# 360if [ -f /etc/inet/static_routes ]; then 361 echo "Adding persistent routes:" 362 /usr/bin/egrep -v "^(#|$)" /etc/inet/static_routes | while read line; do 363 /usr/sbin/route add $line 364 done 365fi 366 367# Clear exit status. 368exit $SMF_EXIT_OK 369