etc/rc.d/network1

   1 #!/bin/sh -
   2 #
   3 # $FreeBSD$
   4 #       From: @(#)netstart      5.9 (Berkeley) 3/30/91
   5
   6 # Note that almost all of the user-configurable behavior is no longer in
   7 # this file, but rather in /etc/defaults/rc.conf.  Please check that file
   8 # first before contemplating any changes here.  If you do need to change
   9 # this file for some reason, we would like to know about it.
  10
  11 # First pass startup stuff.
  12 #
  13 network_pass1() {
  14         echo -n 'Doing initial network setup:'
  15
  16         # Set the host name if it is not already set
  17         #
  18         if [ -z "`hostname -s`" ]; then
  19                 hostname ${hostname}
  20                 echo -n ' hostname'
  21         fi
  22
  23         # Set the domainname if we're using NIS
  24         #
  25         case ${nisdomainname} in
  26         [Nn][Oo] | '')
  27                 ;;
  28         *)
  29                 domainname ${nisdomainname}
  30                 echo -n ' domain'
  31                 ;;
  32         esac
  33
  34         echo '.'
  35
  36         # Initial ATM interface configuration
  37         #
  38         case ${atm_enable} in
  39         [Yy][Ee][Ss])
  40                 if [ -r /etc/rc.atm ]; then
  41                         . /etc/rc.atm
  42                         atm_pass1
  43                 fi
  44                 ;;
  45         esac
  46
  47         # Special options for sppp(4) interfaces go here.  These need
  48         # to go _before_ the general ifconfig section, since in the case
  49         # of hardwired (no link1 flag) but required authentication, you
  50         # cannot pass auth parameters down to the already running interface.
  51         #
  52         for ifn in ${sppp_interfaces}; do
  53                 eval spppcontrol_args=\$spppconfig_${ifn}
  54                 if [ -n "${spppcontrol_args}" ]; then
  55                         # The auth secrets might contain spaces; in order
  56                         # to retain the quotation, we need to eval them
  57                         # here.
  58                         eval spppcontrol ${ifn} ${spppcontrol_args}
  59                 fi
  60         done
  61
  62         # Set up all the network interfaces, calling startup scripts if needed
  63         #
  64         case ${network_interfaces} in
  65         [Aa][Uu][Tt][Oo])
  66                 network_interfaces="`ifconfig -l`"
  67                 ;;
  68         esac
  69
  70         dhcp_interfaces=""
  71         for ifn in ${network_interfaces}; do
  72                 if [ -r /etc/start_if.${ifn} ]; then
  73                         . /etc/start_if.${ifn}
  74                         eval showstat_$ifn=1
  75                 fi
  76
  77                 # Do the primary ifconfig if specified
  78                 #
  79                 eval ifconfig_args=\$ifconfig_${ifn}
  80
  81                 case ${ifconfig_args} in
  82                 '')
  83                         ;;
  84                 [Dd][Hh][Cc][Pp])
  85                         # DHCP inits are done all in one go below
  86                         dhcp_interfaces="$dhcp_interfaces $ifn"
  87                         eval showstat_$ifn=1
  88                         ;;
  89                 *)
  90                         ifconfig ${ifn} ${ifconfig_args}
  91                         eval showstat_$ifn=1
  92                         ;;
  93                 esac
  94         done
  95
  96         if [ ! -z "${dhcp_interfaces}" ]; then
  97                 ${dhcp_program:-/sbin/dhclient} ${dhcp_flags} ${dhcp_interfaces}
  98         fi
  99
 100         for ifn in ${network_interfaces}; do
 101                 # Check to see if aliases need to be added
 102                 #
 103                 alias=0
 104                 while : ; do
 105                         eval ifconfig_args=\$ifconfig_${ifn}_alias${alias}
 106                         if [ -n "${ifconfig_args}" ]; then
 107                                 ifconfig ${ifn} ${ifconfig_args} alias
 108                                 eval showstat_$ifn=1
 109                                 alias=`expr ${alias} + 1`
 110                         else
 111                                 break;
 112                         fi
 113                 done
 114
 115                 # Do ipx address if specified
 116                 #
 117                 eval ifconfig_args=\$ifconfig_${ifn}_ipx
 118                 if [ -n "${ifconfig_args}" ]; then
 119                         ifconfig ${ifn} ${ifconfig_args}
 120                         eval showstat_$ifn=1
 121                 fi
 122         done
 123
 124         for ifn in ${network_interfaces}; do
 125                 eval showstat=\$showstat_${ifn}
 126                 if [ ! -z ${showstat} ]; then
 127                         ifconfig ${ifn}
 128                 fi
 129         done
 130
 131         # ISDN subsystem startup
 132         #
 133         case ${isdn_enable} in
 134         [Yy][Ee][Ss])
 135                 if [ -r /etc/rc.isdn ]; then
 136                         . /etc/rc.isdn
 137                 fi
 138                 ;;
 139         esac
 140
 141         # Warm up user ppp if required, must happen before natd.
 142         #
 143         case ${ppp_enable} in
 144         [Yy][Ee][Ss])
 145                 # Establish ppp mode.
 146                 #
 147                 if [ "${ppp_mode}" != "ddial" -a "${ppp_mode}" != "direct" \
 148                         -a "${ppp_mode}" != "dedicated" \
 149                         -a "${ppp_mode}" != "background" ]; then
 150                         ppp_mode="auto";
 151                 fi
 152
 153                 ppp_command="-${ppp_mode} ";
 154
 155                 # Switch on alias mode?
 156                 #
 157                 case ${ppp_nat} in
 158                 [Yy][Ee][Ss])
 159                         ppp_command="${ppp_command} -nat";
 160                         ;;
 161                 esac
 162
 163                 echo -n 'Starting ppp: '; ppp ${ppp_command} -quiet ${ppp_profile}
 164                 ;;
 165         esac
 166
 167         # Initialize IP filtering using ipfw
 168         #
 169         echo ''
 170
 171         if /sbin/ipfw -q flush > /dev/null 2>&1; then
 172                 firewall_in_kernel=1
 173         else
 174                 firewall_in_kernel=0
 175         fi
 176
 177         case ${firewall_enable} in
 178         [Yy][Ee][Ss])
 179                 if [ "${firewall_in_kernel}" -eq 0 ] && kldload ipfw; then
 180                         firewall_in_kernel=1
 181                         echo "Kernel firewall module loaded."
 182                 elif [ "${firewall_in_kernel}" -eq 0 ]; then
 183                         echo "Warning: firewall kernel module failed to load."
 184                 fi
 185                 ;;
 186         esac
 187
 188         # Load the filters if required
 189         #
 190         case ${firewall_in_kernel} in
 191         1)
 192                 if [ -z "${firewall_script}" ]; then
 193                         firewall_script=/etc/rc.firewall
 194                 fi
 195
 196                 case ${firewall_enable} in
 197                 [Yy][Ee][Ss])
 198                         if [ -r "${firewall_script}" ]; then
 199                                 . "${firewall_script}"
 200                                 echo -n 'Firewall rules loaded, starting divert daemons:'
 201
 202                                 # Network Address Translation daemon
 203                                 #
 204                                 case ${natd_enable} in
 205                                 [Yy][Ee][Ss])
 206                                         if [ -n "${natd_interface}" ]; then
 207                                                 if echo ${natd_interface} | \
 208                                                         grep -q -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
 209                                                         natd_ifarg="-a ${natd_interface}"
 210                                                 else
 211                                                         natd_ifarg="-n ${natd_interface}"
 212                                                 fi
 213
 214                                                 echo -n ' natd'; ${natd_program:-/sbin/natd} ${natd_flags} ${natd_ifarg}
 215                                         fi
 216                                         ;;
 217                                 esac
 218
 219                                 echo '.'
 220
 221                         elif [ "`ipfw l 65535`" = "65535 deny ip from any to any" ]; then
 222                                 echo -n "Warning: kernel has firewall functionality, "
 223                                 echo "but firewall rules are not enabled."
 224                                 echo "           All ip services are disabled."
 225                         fi
 226
 227                         case ${firewall_logging} in
 228                         [Yy][Ee][Ss] | '')
 229                                 echo 'Firewall logging=YES'
 230                                 sysctl -w net.inet.ip.fw.verbose=1 >/dev/null
 231                                 ;;
 232                         *)
 233                                 ;;
 234                         esac
 235
 236                         ;;
 237                 esac
 238                 ;;
 239         esac
 240
 241         # Additional ATM interface configuration
 242         #
 243         if [ -n "${atm_pass1_done}" ]; then
 244                 atm_pass2
 245         fi
 246
 247         # Configure routing
 248         #
 249         case ${defaultrouter} in
 250         [Nn][Oo] | '')
 251                 ;;
 252         *)
 253                 static_routes="default ${static_routes}"
 254                 route_default="default ${defaultrouter}"
 255                 ;;
 256         esac
 257
 258         # Set up any static routes.  This should be done before router discovery.
 259         #
 260         if [ -n "${static_routes}" ]; then
 261                 for i in ${static_routes}; do
 262                         eval route_args=\$route_${i}
 263                         route add ${route_args}
 264                 done
 265         fi
 266
 267         echo -n 'Additional routing options:'
 268         case ${tcp_extensions} in
 269         [Yy][Ee][Ss] | '')
 270                 ;;
 271         *)
 272                 echo -n ' tcp extensions=NO'
 273                 sysctl -w net.inet.tcp.rfc1323=0 >/dev/null
 274                 ;;
 275         esac
 276
 277         case ${icmp_bmcastecho} in
 278         [Yy][Ee][Ss])
 279                 echo -n ' broadcast ping responses=YES'
 280                 sysctl -w net.inet.icmp.bmcastecho=1 >/dev/null
 281                 ;;
 282         esac
 283
 284         case ${icmp_drop_redirect} in
 285         [Yy][Ee][Ss])
 286                 echo -n ' ignore ICMP redirect=YES'
 287                 sysctl -w net.inet.icmp.drop_redirect=1 >/dev/null
 288                 ;;
 289         esac
 290
 291         case ${icmp_log_redirect} in
 292         [Yy][Ee][Ss])
 293                 echo -n ' log ICMP redirect=YES'
 294                 sysctl -w net.inet.icmp.log_redirect=1 >/dev/null
 295                 ;;
 296         esac
 297
 298         case ${gateway_enable} in
 299         [Yy][Ee][Ss])
 300                 echo -n ' IP gateway=YES'
 301                 sysctl -w net.inet.ip.forwarding=1 >/dev/null
 302                 ;;
 303         esac
 304
 305         case ${forward_sourceroute} in
 306         [Yy][Ee][Ss])
 307                 echo -n ' do source routing=YES'
 308                 sysctl -w net.inet.ip.sourceroute=1 >/dev/null
 309                 ;;
 310         esac
 311
 312         case ${accept_sourceroute} in
 313         [Yy][Ee][Ss])
 314                 echo -n ' accept source routing=YES'
 315                 sysctl -w net.inet.ip.accept_sourceroute=1 >/dev/null
 316                 ;;
 317         esac
 318
 319         case ${tcp_keepalive} in
 320         [Yy][Ee][Ss])
 321                 echo -n ' TCP keepalive=YES'
 322                 sysctl -w net.inet.tcp.always_keepalive=1 >/dev/null
 323                 ;;
 324         esac
 325
 326         case ${tcp_restrict_rst} in
 327         [Yy][Ee][Ss])
 328                 echo -n ' restrict TCP reset=YES'
 329                 sysctl -w net.inet.tcp.restrict_rst=1 >/dev/null
 330                 ;;
 331         esac
 332
 333         case ${tcp_drop_synfin} in
 334         [Yy][Ee][Ss])
 335                 echo -n ' drop SYN+FIN packets=YES'
 336                 sysctl -w net.inet.tcp.drop_synfin=1 >/dev/null
 337                 ;;
 338         esac
 339
 340         case ${ipxgateway_enable} in
 341         [Yy][Ee][Ss])
 342                 echo -n ' IPX gateway=YES'
 343                 sysctl -w net.ipx.ipx.ipxforwarding=1 >/dev/null
 344                 ;;
 345         esac
 346
 347         case ${arpproxy_all} in
 348         [Yy][Ee][Ss])
 349                 echo -n ' ARP proxyall=YES'
 350                 sysctl -w net.link.ether.inet.proxyall=1 >/dev/null
 351                 ;;
 352         esac
 353         echo '.'
 354
 355         echo -n 'routing daemons:'
 356         case ${router_enable} in
 357         [Yy][Ee][Ss])
 358                 echo -n " ${router}";   ${router} ${router_flags}
 359                 ;;
 360         esac
 361
 362         case ${ipxrouted_enable} in
 363         [Yy][Ee][Ss])
 364                 echo -n ' IPXrouted'
 365                 IPXrouted ${ipxrouted_flags} > /dev/null 2>&1
 366                 ;;
 367         esac
 368
 369         case ${mrouted_enable} in
 370         [Yy][Ee][Ss])
 371                 echo -n ' mrouted';     mrouted ${mrouted_flags}
 372                 ;;
 373         esac
 374
 375         case ${rarpd_enable} in
 376         [Yy][Ee][Ss])
 377                 echo -n ' rarpd';       rarpd ${rarpd_flags}
 378                 ;;
 379         esac
 380         echo '.'
 381
 382         # Let future generations know we made it.
 383         #
 384         network_pass1_done=YES
 385 }
 386
 387 network_pass2() {
 388         echo -n 'Doing additional network setup:'
 389         case ${named_enable} in
 390         [Yy][Ee][Ss])
 391                 echo -n ' named';       ${named_program:-named} ${named_flags}
 392                 ;;
 393         esac
 394
 395         case ${ntpdate_enable} in
 396         [Yy][Ee][Ss])
 397                 echo -n ' ntpdate'
 398                 ${ntpdate_program:-ntpdate} ${ntpdate_flags} >/dev/null 2>&1
 399                 ;;
 400         esac
 401
 402         case ${xntpd_enable} in
 403         [Yy][Ee][Ss])
 404                 echo -n ' ntpd';        ${xntpd_program:-ntpd} ${xntpd_flags}
 405                 ;;
 406         esac
 407
 408         case ${timed_enable} in
 409         [Yy][Ee][Ss])
 410                 echo -n ' timed';       timed ${timed_flags}
 411                 ;;
 412         esac
 413
 414         case ${portmap_enable} in
 415         [Yy][Ee][Ss])
 416                 echo -n ' portmap';     ${portmap_program:-/usr/sbin/portmap} ${portmap_flags}
 417                 ;;
 418         esac
 419
 420         # Start ypserv if we're an NIS server.
 421         # Run rpc.ypxfrd and rpc.yppasswdd only on the NIS master server.
 422         #
 423         case ${nis_server_enable} in
 424         [Yy][Ee][Ss])
 425                 echo -n ' ypserv'; ypserv ${nis_server_flags}
 426
 427                 case ${nis_ypxfrd_enable} in
 428                 [Yy][Ee][Ss])
 429                         echo -n ' rpc.ypxfrd'
 430                         rpc.ypxfrd ${nis_ypxfrd_flags}
 431                         ;;
 432                 esac
 433
 434                 case ${nis_yppasswdd_enable} in
 435                 [Yy][Ee][Ss])
 436                         echo -n ' rpc.yppasswdd'
 437                         rpc.yppasswdd ${nis_yppasswdd_flags}
 438                         ;;
 439                 esac
 440                 ;;
 441         esac
 442
 443         # Start ypbind if we're an NIS client
 444         #
 445         case ${nis_client_enable} in
 446         [Yy][Ee][Ss])
 447                 echo -n ' ypbind'; ypbind ${nis_client_flags}
 448                 case ${nis_ypset_enable} in
 449                 [Yy][Ee][Ss])
 450                         echo -n ' ypset';       ypset ${nis_ypset_flags}
 451                         ;;
 452                 esac
 453                 ;;
 454         esac
 455
 456         # Start keyserv if we are running Secure RPC
 457         #
 458         case ${keyserv_enable} in
 459         [Yy][Ee][Ss])
 460                 echo -n ' keyserv';     keyserv ${keyserv_flags}
 461                 ;;
 462         esac
 463
 464         # Start ypupdated if we are running Secure RPC and we are NIS master
 465         #
 466         case ${rpc_ypupdated_enable} in
 467         [Yy][Ee][Ss])
 468                 echo -n ' rpc.ypupdated';       rpc.ypupdated
 469                 ;;
 470         esac
 471
 472         # Start ATM daemons
 473         if [ -n "${atm_pass2_done}" ]; then
 474                 atm_pass3
 475         fi
 476
 477         echo '.'
 478         network_pass2_done=YES
 479 }
 480
 481 network_pass3() {
 482         echo -n 'Starting final network daemons:'
 483
 484         case ${nfs_server_enable} in
 485         [Yy][Ee][Ss])
 486                 if [ -r /etc/exports ]; then
 487                         echo -n ' mountd'
 488
 489                         case ${weak_mountd_authentication} in
 490                         [Yy][Ee][Ss])
 491                                 mountd_flags="-n"
 492                                 ;;
 493                         esac
 494
 495                         mountd ${mountd_flags}
 496
 497                         case ${nfs_reserved_port_only} in
 498                         [Yy][Ee][Ss])
 499                                 echo -n ' NFS on reserved port only=YES'
 500                                 sysctl -w vfs.nfs.nfs_privport=1 >/dev/null
 501                                 ;;
 502                         esac
 503
 504                         echo -n ' nfsd';        nfsd ${nfs_server_flags}
 505
 506                         if [ -n "${nfs_bufpackets}" ]; then
 507                                 sysctl -w vfs.nfs.bufpackets=${nfs_bufpackets} \
 508                                         > /dev/null
 509                         fi
 510
 511                         case ${rpc_lockd_enable} in
 512                         [Yy][Ee][Ss])
 513                                 echo -n ' rpc.lockd';   rpc.lockd
 514                                 ;;
 515                         esac
 516
 517                         case ${rpc_statd_enable} in
 518                         [Yy][Ee][Ss])
 519                                 echo -n ' rpc.statd';   rpc.statd
 520                                 ;;
 521                         esac
 522                 fi
 523                 ;;
 524         *)
 525                 case ${single_mountd_enable} in
 526                 [Yy][Ee][Ss])
 527                         if [ -r /etc/exports ]; then
 528                                 echo -n ' mountd'
 529
 530                                 case ${weak_mountd_authentication} in
 531                                 [Yy][Ee][Ss])
 532                                         mountd_flags="-n"
 533                                         ;;
 534                                 esac
 535
 536                                 mountd ${mountd_flags}
 537                         fi
 538                         ;;
 539                 esac
 540                 ;;
 541         esac
 542
 543         case ${nfs_client_enable} in
 544         [Yy][Ee][Ss])
 545                 echo -n ' nfsiod';      nfsiod ${nfs_client_flags}
 546                 if [ -n "${nfs_access_cache}" ]; then
 547                 echo -n " NFS access cache time=${nfs_access_cache}"
 548                 sysctl -w vfs.nfs.access_cache_timeout=${nfs_access_cache} \
 549                         >/dev/null
 550                 fi
 551                 ;;
 552         esac
 553
 554         # If /var/db/mounttab exists, some nfs-server has not been
 555         # sucessfully notified about a previous client shutdown.
 556         # If there is no /var/db/mounttab, we do nothing.
 557         if [ -f /var/db/mounttab ]; then
 558                 rpc.umntall -k
 559         fi
 560
 561         case ${amd_enable} in
 562         [Yy][Ee][Ss])
 563                 echo -n ' amd'
 564                 case ${amd_map_program} in
 565                 [Nn][Oo] | '')
 566                         ;;
 567                 *)
 568                         amd_flags="${amd_flags} `eval ${amd_map_program}`"
 569                         ;;
 570                 esac
 571
 572                 if [ -n "${amd_flags}" ]; then
 573                         amd -p ${amd_flags} > /var/run/amd.pid 2> /dev/null
 574                 else
 575                         amd 2> /dev/null
 576                 fi
 577                 ;;
 578         esac
 579
 580         case ${rwhod_enable} in
 581         [Yy][Ee][Ss])
 582                 echo -n ' rwhod';       rwhod ${rwhod_flags}
 583                 ;;
 584         esac
 585
 586         # Kerberos runs ONLY on the Kerberos server machine
 587         case ${kerberos_server_enable} in
 588         [Yy][Ee][Ss])
 589                 case ${kerberos_stash} in
 590                 [Yy][Ee][Ss])
 591                         stash_flag=-n
 592                         ;;
 593                 *)
 594                         stash_flag=
 595                         ;;
 596                 esac
 597
 598                 echo -n ' kerberos'
 599                 kerberos ${stash_flag} >> /var/log/kerberos.log &
 600
 601                 case ${kadmind_server_enable} in
 602                 [Yy][Ee][Ss])
 603                         echo -n ' kadmind'
 604                         (sleep 20; kadmind ${stash_flag} >/dev/null 2>&1 &) &
 605                         ;;
 606                 esac
 607                 unset stash_flag
 608                 ;;
 609         esac
 610
 611         case ${pppoed_enable} in
 612         [Yy][Ee][Ss])
 613                 if [ -n "${pppoed_provider}" ]; then
 614                         pppoed_flags="${pppoed_flags} -p ${pppoed_provider}"
 615                 fi
 616                 echo -n ' pppoed';
 617                 /usr/libexec/pppoed ${pppoed_flags} ${pppoed_interface}
 618                 ;;
 619         esac
 620
 621         case ${sshd_enable} in
 622         [Yy][Ee][Ss])
 623                 if [ ! -f /etc/ssh/ssh_host_key ]; then
 624                         echo ' creating ssh RSA host key';
 625                         /usr/bin/ssh-keygen -N "" -f /etc/ssh/ssh_host_key
 626                 fi
 627                 ;;
 628                 if [ ! -f /etc/ssh/ssh_host_dsa_key ]; then
 629                         echo ' creating ssh DSA host key';
 630                         /usr/bin/ssh-keygen -d -N "" -f /etc/ssh/ssh_host_dsa_key
 631                 fi
 632                 ;;
 633         esac
 634
 635         echo '.'
 636         network_pass3_done=YES
 637 }
 638
 639 network_pass4() {
 640         echo -n 'Additional TCP options:'
 641         case ${log_in_vain} in
 642         [Nn][Oo] | '')
 643                 ;;
 644         *)
 645                 echo -n ' log_in_vain=YES'
 646                 sysctl -w net.inet.tcp.log_in_vain=1 >/dev/null
 647                 sysctl -w net.inet.udp.log_in_vain=1 >/dev/null
 648                 ;;
 649         esac
 650
 651         echo '.'
 652         network_pass4_done=YES
 653 }