etc/network.subr

   1 #!/bin/sh -
   2 #
   3 # $FreeBSD$
   4 #       From: @(#)netstart      5.9 (Berkeley) 3/30/91
   5
   6 # Note that almost all of the user-configurable behavior is no longer in
   7 # this file, but rather in /etc/defaults/rc.conf.  Please check that file
   8 # first before contemplating any changes here.  If you do need to change
   9 # this file for some reason, we would like to know about it.
  10
  11 # First pass startup stuff.
  12 #
  13 network_pass1() {
  14         echo -n 'Doing initial network setup:'
  15
  16         # Set the host name if it is not already set
  17         #
  18         if [ -z "`hostname -s`" ]; then
  19                 hostname ${hostname}
  20                 echo -n ' hostname'
  21         fi
  22
  23         # Set the domainname if we're using NIS
  24         #
  25         case ${nisdomainname} in
  26         [Nn][Oo] | '')
  27                 ;;
  28         *)
  29                 domainname ${nisdomainname}
  30                 echo -n ' domain'
  31                 ;;
  32         esac
  33
  34         echo '.'
  35
  36         # Initial ATM interface configuration
  37         #
  38         case ${atm_enable} in
  39         [Yy][Ee][Ss])
  40                 if [ -r /etc/rc.atm ]; then
  41                         . /etc/rc.atm
  42                         atm_pass1
  43                 fi
  44                 ;;
  45         esac
  46
  47         # Special options for sppp(4) interfaces go here.  These need
  48         # to go _before_ the general ifconfig section, since in the case
  49         # of hardwired (no link1 flag) but required authentication, you
  50         # cannot pass auth parameters down to the already running interface.
  51         #
  52         for ifn in ${sppp_interfaces}; do
  53                 eval spppcontrol_args=\$spppconfig_${ifn}
  54                 if [ -n "${spppcontrol_args}" ]; then
  55                         # The auth secrets might contain spaces; in order
  56                         # to retain the quotation, we need to eval them
  57                         # here.
  58                         eval spppcontrol ${ifn} ${spppcontrol_args}
  59                 fi
  60         done
  61
  62         # Set up all the network interfaces, calling startup scripts if needed
  63         #
  64         case ${network_interfaces} in
  65         [Aa][Uu][Tt][Oo])
  66                 network_interfaces="`ifconfig -l`"
  67                 ;;
  68         esac
  69
  70         dhcp_interfaces=""
  71         for ifn in ${network_interfaces}; do
  72                 if [ -r /etc/start_if.${ifn} ]; then
  73                         . /etc/start_if.${ifn}
  74                         eval showstat_$ifn=1
  75                 fi
  76
  77                 # Do the primary ifconfig if specified
  78                 #
  79                 eval ifconfig_args=\$ifconfig_${ifn}
  80
  81                 case ${ifconfig_args} in
  82                 '')
  83                         ;;
  84                 [Dd][Hh][Cc][Pp])
  85                         # DHCP inits are done all in one go below
  86                         dhcp_interfaces="$dhcp_interfaces $ifn"
  87                         eval showstat_$ifn=1
  88                         ;;
  89                 *)
  90                         ifconfig ${ifn} ${ifconfig_args}
  91                         eval showstat_$ifn=1
  92                         ;;
  93                 esac
  94         done
  95
  96         if [ ! -z "${dhcp_interfaces}" ]; then
  97                 ${dhcp_program:-/sbin/dhclient} ${dhcp_flags} ${dhcp_interfaces}
  98         fi
  99
 100         for ifn in ${network_interfaces}; do
 101                 # Check to see if aliases need to be added
 102                 #
 103                 alias=0
 104                 while : ; do
 105                         eval ifconfig_args=\$ifconfig_${ifn}_alias${alias}
 106                         if [ -n "${ifconfig_args}" ]; then
 107                                 ifconfig ${ifn} ${ifconfig_args} alias
 108                                 eval showstat_$ifn=1
 109                                 alias=`expr ${alias} + 1`
 110                         else
 111                                 break;
 112                         fi
 113                 done
 114
 115                 # Do ipx address if specified
 116                 #
 117                 eval ifconfig_args=\$ifconfig_${ifn}_ipx
 118                 if [ -n "${ifconfig_args}" ]; then
 119                         ifconfig ${ifn} ${ifconfig_args}
 120                         eval showstat_$ifn=1
 121                 fi
 122         done
 123
 124         for ifn in ${network_interfaces}; do
 125                 eval showstat=\$showstat_${ifn}
 126                 if [ ! -z ${showstat} ]; then
 127                         ifconfig ${ifn}
 128                 fi
 129         done
 130
 131         # ISDN subsystem startup
 132         #
 133         case ${isdn_enable} in
 134         [Yy][Ee][Ss])
 135                 if [ -r /etc/rc.isdn ]; then
 136                         . /etc/rc.isdn
 137                 fi
 138                 ;;
 139         esac
 140
 141         # Warm up user ppp if required, must happen before natd.
 142         #
 143         case ${ppp_enable} in
 144         [Yy][Ee][Ss])
 145                 # Establish ppp mode.
 146                 #
 147                 if [ "${ppp_mode}" != "ddial" -a "${ppp_mode}" != "direct" \
 148                         -a "${ppp_mode}" != "dedicated" \
 149                         -a "${ppp_mode}" != "background" ]; then
 150                         ppp_mode="auto";
 151                 fi
 152
 153                 ppp_command="-${ppp_mode} ";
 154
 155                 # Switch on alias mode?
 156                 #
 157                 case ${ppp_nat} in
 158                 [Yy][Ee][Ss])
 159                         ppp_command="${ppp_command} -nat";
 160                         ;;
 161                 esac
 162
 163                 echo -n 'Starting ppp: '; ppp ${ppp_command} -quiet ${ppp_profile}
 164                 ;;
 165         esac
 166
 167         # Initialize IP filtering using ipfw
 168         #
 169         echo ''
 170
 171         if /sbin/ipfw -q flush > /dev/null 2>&1; then
 172                 firewall_in_kernel=1
 173         else
 174                 firewall_in_kernel=0
 175         fi
 176
 177         case ${firewall_enable} in
 178         [Yy][Ee][Ss])
 179                 if [ "${firewall_in_kernel}" -eq 0 ] && kldload ipfw; then
 180                         firewall_in_kernel=1
 181                         echo "Kernel firewall module loaded."
 182                 elif [ "${firewall_in_kernel}" -eq 0 ]; then
 183                         echo "Warning: firewall kernel module failed to load."
 184                 fi
 185                 ;;
 186         esac
 187
 188         # Load the filters if required
 189         #
 190         case ${firewall_in_kernel} in
 191         1)
 192                 if [ -z "${firewall_script}" ]; then
 193                         firewall_script=/etc/rc.firewall
 194                 fi
 195
 196                 case ${firewall_enable} in
 197                 [Yy][Ee][Ss])
 198                         if [ -r "${firewall_script}" ]; then
 199                                 . "${firewall_script}"
 200                                 echo -n 'Firewall rules loaded, starting divert daemons:'
 201
 202                                 # Network Address Translation daemon
 203                                 #
 204                                 case ${natd_enable} in
 205                                 [Yy][Ee][Ss])
 206                                         if [ -n "${natd_interface}" ]; then
 207                                                 if echo ${natd_interface} | \
 208                                                         grep -q -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
 209                                                         natd_ifarg="-a ${natd_interface}"
 210                                                 else
 211                                                         natd_ifarg="-n ${natd_interface}"
 212                                                 fi
 213
 214                                                 echo -n ' natd'; ${natd_program:-/sbin/natd} ${natd_flags} ${natd_ifarg}
 215                                         fi
 216                                         ;;
 217                                 esac
 218
 219                                 echo '.'
 220
 221                         elif [ "`ipfw l 65535`" = "65535 deny ip from any to any" ]; then
 222                                 echo -n "Warning: kernel has firewall functionality, "
 223                                 echo "but firewall rules are not enabled."
 224                                 echo "           All ip services are disabled."
 225                         fi
 226
 227                         case ${firewall_logging} in
 228                         [Yy][Ee][Ss] | '')
 229                                 echo 'Firewall logging=YES'
 230                                 sysctl -w net.inet.ip.fw.verbose=1 >/dev/null
 231                                 ;;
 232                         *)
 233                                 ;;
 234                         esac
 235
 236                         ;;
 237                 esac
 238                 ;;
 239         esac
 240
 241         # Additional ATM interface configuration
 242         #
 243         if [ -n "${atm_pass1_done}" ]; then
 244                 atm_pass2
 245         fi
 246
 247         # Configure routing
 248         #
 249         case ${defaultrouter} in
 250         [Nn][Oo] | '')
 251                 ;;
 252         *)
 253                 static_routes="default ${static_routes}"
 254                 route_default="default ${defaultrouter}"
 255                 ;;
 256         esac
 257
 258         # Set up any static routes.  This should be done before router discovery.
 259         #
 260         if [ -n "${static_routes}" ]; then
 261                 for i in ${static_routes}; do
 262                         eval route_args=\$route_${i}
 263                         route add ${route_args}
 264                 done
 265         fi
 266
 267         echo -n 'Additional routing options:'
 268         case ${tcp_extensions} in
 269         [Yy][Ee][Ss] | '')
 270                 ;;
 271         *)
 272                 echo -n ' tcp extensions=NO'
 273                 sysctl -w net.inet.tcp.rfc1323=0 >/dev/null
 274                 ;;
 275         esac
 276
 277         case ${icmp_bmcastecho} in
 278         [Yy][Ee][Ss])
 279                 echo -n ' broadcast ping responses=YES'
 280                 sysctl -w net.inet.icmp.bmcastecho=1 >/dev/null
 281                 ;;
 282         esac
 283
 284         case ${icmp_drop_redirect} in
 285         [Yy][Ee][Ss])
 286                 echo -n ' ignore ICMP redirect=YES'
 287                 sysctl -w net.inet.icmp.drop_redirect=1 >/dev/null
 288                 ;;
 289         esac
 290
 291         case ${icmp_log_redirect} in
 292         [Yy][Ee][Ss])
 293                 echo -n ' log ICMP redirect=YES'
 294                 sysctl -w net.inet.icmp.log_redirect=1 >/dev/null
 295                 ;;
 296         esac
 297
 298         case ${gateway_enable} in
 299         [Yy][Ee][Ss])
 300                 echo -n ' IP gateway=YES'
 301                 sysctl -w net.inet.ip.forwarding=1 >/dev/null
 302                 ;;
 303         esac
 304
 305         case ${forward_sourceroute} in
 306         [Yy][Ee][Ss])
 307                 echo -n ' do source routing=YES'
 308                 sysctl -w net.inet.ip.sourceroute=1 >/dev/null
 309                 ;;
 310         esac
 311
 312         case ${accept_sourceroute} in
 313         [Yy][Ee][Ss])
 314                 echo -n ' accept source routing=YES'
 315                 sysctl -w net.inet.ip.accept_sourceroute=1 >/dev/null
 316                 ;;
 317         esac
 318
 319         case ${tcp_keepalive} in
 320         [Yy][Ee][Ss])
 321                 echo -n ' TCP keepalive=YES'
 322                 sysctl -w net.inet.tcp.always_keepalive=1 >/dev/null
 323                 ;;
 324         esac
 325
 326         case ${tcp_restrict_rst} in
 327         [Yy][Ee][Ss])
 328                 echo -n ' restrict TCP reset=YES'
 329                 sysctl -w net.inet.tcp.restrict_rst=1 >/dev/null
 330                 ;;
 331         esac
 332
 333         case ${tcp_drop_synfin} in
 334         [Yy][Ee][Ss])
 335                 echo -n ' drop SYN+FIN packets=YES'
 336                 sysctl -w net.inet.tcp.drop_synfin=1 >/dev/null
 337                 ;;
 338         esac
 339
 340         case ${ipxgateway_enable} in
 341         [Yy][Ee][Ss])
 342                 echo -n ' IPX gateway=YES'
 343                 sysctl -w net.ipx.ipx.ipxforwarding=1 >/dev/null
 344                 ;;
 345         esac
 346
 347         case ${arpproxy_all} in
 348         [Yy][Ee][Ss])
 349                 echo -n ' ARP proxyall=YES'
 350                 sysctl -w net.link.ether.inet.proxyall=1 >/dev/null
 351                 ;;
 352         esac
 353
 354         case ${ip_portrange_first} in
 355         [Nn][Oo] | '')
 356                 ;;
 357         *)
 358                 echo -n ' ip_portrange_first=$ip_portrange_first'
 359                 sysctl -w net.inet.ip.portrange.first=$ip_portrange_first >/dev/null
 360                 ;;
 361         esac
 362
 363         case ${ip_portrange_last} in
 364         [Nn][Oo] | '')
 365             ;;
 366         *)
 367                 echo -n ' ip_portrange_last=$ip_portrange_last'
 368                 sysctl -w net.inet.ip.portrange.last=$ip_portrange_last >/dev/null
 369                 ;;
 370         esac
 371
 372         echo '.'
 373
 374         case ${ipsec_enable} in
 375         [Yy][Ee][Ss])
 376                 if [ -f ${ipsec_file} ]; then
 377                     echo ' ipsec: enabled'
 378                     setkey -f ${ipsec_file}
 379                 else
 380                     echo ' ipsec: file not found'
 381                 fi
 382                 ;;
 383         esac
 384
 385         echo -n 'routing daemons:'
 386         case ${router_enable} in
 387         [Yy][Ee][Ss])
 388                 echo -n " ${router}";   ${router} ${router_flags}
 389                 ;;
 390         esac
 391
 392         case ${ipxrouted_enable} in
 393         [Yy][Ee][Ss])
 394                 echo -n ' IPXrouted'
 395                 IPXrouted ${ipxrouted_flags} > /dev/null 2>&1
 396                 ;;
 397         esac
 398
 399         case ${mrouted_enable} in
 400         [Yy][Ee][Ss])
 401                 echo -n ' mrouted';     mrouted ${mrouted_flags}
 402                 ;;
 403         esac
 404
 405         case ${rarpd_enable} in
 406         [Yy][Ee][Ss])
 407                 echo -n ' rarpd';       rarpd ${rarpd_flags}
 408                 ;;
 409         esac
 410         echo '.'
 411
 412         # Let future generations know we made it.
 413         #
 414         network_pass1_done=YES
 415 }
 416
 417 network_pass2() {
 418         echo -n 'Doing additional network setup:'
 419         case ${named_enable} in
 420         [Yy][Ee][Ss])
 421                 echo -n ' named';       ${named_program:-named} ${named_flags}
 422                 ;;
 423         esac
 424
 425         case ${ntpdate_enable} in
 426         [Yy][Ee][Ss])
 427                 echo -n ' ntpdate'
 428                 ${ntpdate_program:-ntpdate} ${ntpdate_flags} >/dev/null 2>&1
 429                 ;;
 430         esac
 431
 432         case ${xntpd_enable} in
 433         [Yy][Ee][Ss])
 434                 echo -n ' ntpd';        ${xntpd_program:-ntpd} ${xntpd_flags}
 435                 ;;
 436         esac
 437
 438         case ${timed_enable} in
 439         [Yy][Ee][Ss])
 440                 echo -n ' timed';       timed ${timed_flags}
 441                 ;;
 442         esac
 443
 444         case ${portmap_enable} in
 445         [Yy][Ee][Ss])
 446                 echo -n ' portmap';     ${portmap_program:-/usr/sbin/portmap} ${portmap_flags}
 447                 ;;
 448         esac
 449
 450         # Start ypserv if we're an NIS server.
 451         # Run rpc.ypxfrd and rpc.yppasswdd only on the NIS master server.
 452         #
 453         case ${nis_server_enable} in
 454         [Yy][Ee][Ss])
 455                 echo -n ' ypserv'; ypserv ${nis_server_flags}
 456
 457                 case ${nis_ypxfrd_enable} in
 458                 [Yy][Ee][Ss])
 459                         echo -n ' rpc.ypxfrd'
 460                         rpc.ypxfrd ${nis_ypxfrd_flags}
 461                         ;;
 462                 esac
 463
 464                 case ${nis_yppasswdd_enable} in
 465                 [Yy][Ee][Ss])
 466                         echo -n ' rpc.yppasswdd'
 467                         rpc.yppasswdd ${nis_yppasswdd_flags}
 468                         ;;
 469                 esac
 470                 ;;
 471         esac
 472
 473         # Start ypbind if we're an NIS client
 474         #
 475         case ${nis_client_enable} in
 476         [Yy][Ee][Ss])
 477                 echo -n ' ypbind'; ypbind ${nis_client_flags}
 478                 case ${nis_ypset_enable} in
 479                 [Yy][Ee][Ss])
 480                         echo -n ' ypset';       ypset ${nis_ypset_flags}
 481                         ;;
 482                 esac
 483                 ;;
 484         esac
 485
 486         # Start keyserv if we are running Secure RPC
 487         #
 488         case ${keyserv_enable} in
 489         [Yy][Ee][Ss])
 490                 echo -n ' keyserv';     keyserv ${keyserv_flags}
 491                 ;;
 492         esac
 493
 494         # Start ypupdated if we are running Secure RPC and we are NIS master
 495         #
 496         case ${rpc_ypupdated_enable} in
 497         [Yy][Ee][Ss])
 498                 echo -n ' rpc.ypupdated';       rpc.ypupdated
 499                 ;;
 500         esac
 501
 502         # Start ATM daemons
 503         if [ -n "${atm_pass2_done}" ]; then
 504                 atm_pass3
 505         fi
 506
 507         echo '.'
 508         network_pass2_done=YES
 509 }
 510
 511 network_pass3() {
 512         echo -n 'Starting final network daemons:'
 513
 514         case ${nfs_server_enable} in
 515         [Yy][Ee][Ss])
 516                 if [ -r /etc/exports ]; then
 517                         echo -n ' mountd'
 518
 519                         case ${weak_mountd_authentication} in
 520                         [Yy][Ee][Ss])
 521                                 mountd_flags="${mountd_flags} -n"
 522                                 ;;
 523                         esac
 524
 525                         mountd ${mountd_flags}
 526
 527                         case ${nfs_reserved_port_only} in
 528                         [Yy][Ee][Ss])
 529                                 echo -n ' NFS on reserved port only=YES'
 530                                 sysctl -w vfs.nfs.nfs_privport=1 >/dev/null
 531                                 ;;
 532                         esac
 533
 534                         echo -n ' nfsd';        nfsd ${nfs_server_flags}
 535
 536                         if [ -n "${nfs_bufpackets}" ]; then
 537                                 sysctl -w vfs.nfs.bufpackets=${nfs_bufpackets} \
 538                                         > /dev/null
 539                         fi
 540
 541                         case ${rpc_lockd_enable} in
 542                         [Yy][Ee][Ss])
 543                                 echo -n ' rpc.lockd';   rpc.lockd
 544                                 ;;
 545                         esac
 546
 547                         case ${rpc_statd_enable} in
 548                         [Yy][Ee][Ss])
 549                                 echo -n ' rpc.statd';   rpc.statd
 550                                 ;;
 551                         esac
 552                 fi
 553                 ;;
 554         *)
 555                 case ${single_mountd_enable} in
 556                 [Yy][Ee][Ss])
 557                         if [ -r /etc/exports ]; then
 558                                 echo -n ' mountd'
 559
 560                                 case ${weak_mountd_authentication} in
 561                                 [Yy][Ee][Ss])
 562                                         mountd_flags="-n"
 563                                         ;;
 564                                 esac
 565
 566                                 mountd ${mountd_flags}
 567                         fi
 568                         ;;
 569                 esac
 570                 ;;
 571         esac
 572
 573         case ${nfs_client_enable} in
 574         [Yy][Ee][Ss])
 575                 echo -n ' nfsiod';      nfsiod ${nfs_client_flags}
 576                 if [ -n "${nfs_access_cache}" ]; then
 577                 echo -n " NFS access cache time=${nfs_access_cache}"
 578                 sysctl -w vfs.nfs.access_cache_timeout=${nfs_access_cache} \
 579                         >/dev/null
 580                 fi
 581                 ;;
 582         esac
 583
 584         # If /var/db/mounttab exists, some nfs-server has not been
 585         # sucessfully notified about a previous client shutdown.
 586         # If there is no /var/db/mounttab, we do nothing.
 587         if [ -f /var/db/mounttab ]; then
 588                 rpc.umntall -k
 589         fi
 590
 591         case ${amd_enable} in
 592         [Yy][Ee][Ss])
 593                 echo -n ' amd'
 594                 case ${amd_map_program} in
 595                 [Nn][Oo] | '')
 596                         ;;
 597                 *)
 598                         amd_flags="${amd_flags} `eval ${amd_map_program}`"
 599                         ;;
 600                 esac
 601
 602                 if [ -n "${amd_flags}" ]; then
 603                         amd -p ${amd_flags} > /var/run/amd.pid 2> /dev/null
 604                 else
 605                         amd 2> /dev/null
 606                 fi
 607                 ;;
 608         esac
 609
 610         case ${rwhod_enable} in
 611         [Yy][Ee][Ss])
 612                 echo -n ' rwhod';       rwhod ${rwhod_flags}
 613                 ;;
 614         esac
 615
 616         # Kerberos runs ONLY on the Kerberos server machine
 617         case ${kerberos_server_enable} in
 618         [Yy][Ee][Ss])
 619                 case ${kerberos_stash} in
 620                 [Yy][Ee][Ss])
 621                         stash_flag=-n
 622                         ;;
 623                 *)
 624                         stash_flag=
 625                         ;;
 626                 esac
 627
 628                 echo -n ' kerberos'
 629                 kerberos ${stash_flag} >> /var/log/kerberos.log &
 630
 631                 case ${kadmind_server_enable} in
 632                 [Yy][Ee][Ss])
 633                         echo -n ' kadmind'
 634                         (sleep 20; kadmind ${stash_flag} >/dev/null 2>&1 &) &
 635                         ;;
 636                 esac
 637                 unset stash_flag
 638                 ;;
 639         esac
 640
 641         case ${pppoed_enable} in
 642         [Yy][Ee][Ss])
 643                 if [ -n "${pppoed_provider}" ]; then
 644                         pppoed_flags="${pppoed_flags} -p ${pppoed_provider}"
 645                 fi
 646                 echo -n ' pppoed';
 647                 /usr/libexec/pppoed ${pppoed_flags} ${pppoed_interface}
 648                 ;;
 649         esac
 650
 651         case ${sshd_enable} in
 652         [Yy][Ee][Ss])
 653                 if [ ! -f /etc/ssh/ssh_host_key ]; then
 654                         echo ' creating ssh RSA host key';
 655                         /usr/bin/ssh-keygen -N "" -f /etc/ssh/ssh_host_key
 656                 fi
 657                 if [ ! -f /etc/ssh/ssh_host_dsa_key ]; then
 658                         echo ' creating ssh DSA host key';
 659                         /usr/bin/ssh-keygen -d -N "" -f /etc/ssh/ssh_host_dsa_key
 660                 fi
 661                 ;;
 662         esac
 663
 664         echo '.'
 665         network_pass3_done=YES
 666 }
 667
 668 network_pass4() {
 669         echo -n 'Additional TCP options:'
 670         case ${log_in_vain} in
 671         [Nn][Oo] | '')
 672                 ;;
 673         *)
 674                 echo -n ' log_in_vain=YES'
 675                 sysctl -w net.inet.tcp.log_in_vain=1 >/dev/null
 676                 sysctl -w net.inet.udp.log_in_vain=1 >/dev/null
 677                 ;;
 678         esac
 679
 680         echo '.'
 681         network_pass4_done=YES
 682 }