1#!/sbin/sh 2# 3# CDDL HEADER START 4# 5# The contents of this file are subject to the terms of the 6# Common Development and Distribution License (the "License"). 7# You may not use this file except in compliance with the License. 8# 9# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10# or http://www.opensolaris.org/os/licensing. 11# See the License for the specific language governing permissions 12# and limitations under the License. 13# 14# When distributing Covered Code, include this CDDL HEADER in each 15# file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16# If applicable, add the following below this CDDL HEADER, with the 17# fields enclosed by brackets "[]" replaced with your own identifying 18# information: Portions Copyright [yyyy] [name of copyright owner] 19# 20# CDDL HEADER END 21# 22# 23# Copyright 2006 Sun Microsystems, Inc. All rights reserved. 24# Use is subject to license terms. 25# 26# ident "%Z%%M% %I% %E% SMI" 27# 28# This is the second phase of TCP/IP configuration. The first part is 29# run by the svc:/network/physical service and includes configuring the 30# interfaces and setting the machine's hostname. The svc:/network/initial 31# service does all configuration that can be done before name services are 32# started, bar configuring IP routing (this is carried out by the 33# svc:/network/routing-setup service). The final part, run by the 34# svc:/network/service service, does all configuration that may require 35# name services. This includes a final re-configuration of the 36# interfaces. 37# 38 39. /lib/svc/share/smf_include.sh 40 41# 42# In a zone we need this service to be up, but all of the work 43# it tries to do is irrelevant (and will actually lead to the service 44# failing if we try to do it), so just bail out. 45# 46smf_is_globalzone || exit $SMF_EXIT_OK 47 48# Configure IPv6 Default Address Selection. 49if [ -f /etc/inet/ipaddrsel.conf ]; then 50 /usr/sbin/ipaddrsel -f /etc/inet/ipaddrsel.conf 51fi 52 53# 54# Now that /usr is mounted, see if in.mpathd needs to be started by firing it 55# up in "adopt" mode; if there are no interfaces it needs to manage, it will 56# automatically exit. Note that it may already be running if we're not 57# executing as part of system boot. 58# 59/usr/bin/pgrep -x -u 0 in.mpathd >/dev/null 2>&1 || /usr/lib/inet/in.mpathd -a 60 61# 62# Pass to the kernel the list of supported IPsec protocols and algorithms. 63# This will not cause IPsec to be loaded. 64# 65/usr/sbin/ipsecalgs -s 66 67# 68# Initialize IPsec only if ipsecinit.conf exists. Otherwise, save the 69# kernel memory that'll be consumed if IPsec is loaded. See below for more 70# IPsec-related commands. 71# 72if [ -f /etc/inet/ipsecinit.conf ] ; then 73 /usr/sbin/ipsecconf -qa /etc/inet/ipsecinit.conf 74fi 75 76# 77# Set the RFC 1948 entropy, regardless of if I'm using it or not. If present, 78# use the encrypted root password as a source of entropy. Otherwise, 79# just use the pre-set (and hopefully difficult to guess) entropy that 80# tcp used when it loaded. 81# 82encr=`/usr/bin/awk -F: '/^root:/ {print $2}' /etc/shadow` 83[ -z "$encr" ] || /usr/sbin/ndd -set /dev/tcp tcp_1948_phrase $encr 84unset encr 85 86# 87# Get values for TCP_STRONG_ISS, ACCEPT6TO4RELAY and RELAY6TO4ADDR. 88# 89[ -f /etc/default/inetinit ] && . /etc/default/inetinit 90 91# 92# Set TCP ISS generation. By default the ISS generation is 93# time + random()-delta. This might not be strong enough for some users. 94# See /etc/default/inetinit for settings and further info on TCP_STRONG_ISS. 95# If not set, use TCP's internal default setting. 96# 97if [ $TCP_STRONG_ISS ]; then 98 /usr/sbin/ndd -set /dev/tcp tcp_strong_iss $TCP_STRONG_ISS 99fi 100 101# 102# In spite of global policy, there may be a need for IPsec because of 103# per-socket policy or tunnelled policy. With that in mind, check for manual 104# keys in /etc/inet/secret/ipseckeys, or check for IKE configuration in 105# /etc/inet/ike/config. Either of these will also load and initialize IPsec, 106# thereby consuming kernel memory. 107# 108 109if [ -f /etc/inet/secret/ipseckeys ] ; then 110 /usr/sbin/ipseckey -f /etc/inet/secret/ipseckeys 111fi 112 113if [ -f /etc/inet/ike/config ] ; then 114 /usr/lib/inet/in.iked 115fi 116 117# 118# Configure tunnels which were deferred by /lib/svc/method/net-physical 119# (the svc:/network/physical service) since it depends on the tunnel endpoints 120# being reachable i.e. routing must be running. 121# 122# WARNING: you may wish to turn OFF forwarding if you haven't already, because 123# of various possible security vulnerabilities when configuring tunnels for 124# Virtual Private Network (VPN) construction. 125# 126# Also, if names are used in the /etc/hostname.ip.tun* file, those names 127# have to be in either DNS (and DNS is used) or in /etc/hosts, because this 128# file is executed before NIS or NIS+ is started. 129# 130 131# 132# IPv4 tunnels 133# The second component of the name must be either "ip" or "ip6". 134# 135interface_names="`/usr/bin/ls /etc/hostname.ip*.*[0-9] 2>/dev/null | \ 136 /usr/bin/grep '/etc/hostname\.ip6\{0,1\}\.'`" 137if [ -n "$interface_names" ]; then 138 ( 139 echo "configuring IPv4 tunnels:\c" 140 # Extract the part after the first '.' 141 set -- `for intr in $interface_names; do \ 142 /usr/bin/expr //$intr : '[^.]*\.\(.*\)$'; done` 143 while [ $# -ge 1 ]; do 144 # Skip empty files 145 if [ ! -s /etc/hostname\.$1 ]; then 146 shift 147 continue 148 fi 149 /usr/sbin/ifconfig $1 plumb 150 while read ifcmds; do 151 if [ -n "$ifcmds" ]; then 152 /usr/sbin/ifconfig $1 inet $ifcmds 153 fi 154 done </etc/hostname\.$1 >/dev/null 155 echo " $1\c" 156 shift 157 done 158 echo "." 159 ) 160fi 161 162# 163# IPv6 Tunnels 164# The second component of the name must be either "ip" or "ip6". 165# 166interface_names="`/usr/bin/ls /etc/hostname6.ip*.*[0-9] 2>/dev/null | \ 167 /usr/bin/grep '/etc/hostname6\.ip6\{0,1\}\.'`" 168if [ -n "$interface_names" ]; then 169 ( 170 echo "configuring IPv6 tunnels:\c" 171 # Extract the part after the first '.' 172 set -- `for intr in $interface_names; do \ 173 /usr/bin/expr //$intr : '[^.]*\.\(.*\)$'; done` 174 while [ $# -ge 1 ]; do 175 # Skip empty files 176 if [ ! -s /etc/hostname6\.$1 ]; then 177 shift 178 continue 179 fi 180 /usr/sbin/ifconfig $1 inet6 plumb 181 while read ifcmds; do 182 if [ -n "$ifcmds" ]; then 183 /usr/sbin/ifconfig $1 inet6 $ifcmds 184 fi 185 done </etc/hostname6\.$1 > /dev/null 186 echo " $1\c" 187 shift 188 done 189 echo "." 190 ) 191fi 192 193# Clear exit status. 194exit $SMF_EXIT_OK 195