etc/rc.d/network1

   1 #!/bin/sh -
   2 #
   3 # $FreeBSD$
   4 #       From: @(#)netstart      5.9 (Berkeley) 3/30/91
   5
   6 # Note that almost all of the user-configurable behavior is no longer in
   7 # this file, but rather in /etc/defaults/rc.conf.  Please check that file
   8 # first before contemplating any changes here.  If you do need to change
   9 # this file for some reason, we would like to know about it.
  10
  11 # First pass startup stuff.
  12 #
  13 network_pass1() {
  14         echo -n 'Doing initial network setup:'
  15
  16         # Set the host name if it is not already set
  17         #
  18         if [ -z "`hostname -s`" ]; then
  19                 hostname ${hostname}
  20                 echo -n ' hostname'
  21         fi
  22
  23         # Set the domainname if we're using NIS
  24         #
  25         case ${nisdomainname} in
  26         [Nn][Oo] | '')
  27                 ;;
  28         *)
  29                 domainname ${nisdomainname}
  30                 echo -n ' domain'
  31                 ;;
  32         esac
  33
  34         echo '.'
  35
  36         # Initial ATM interface configuration
  37         #
  38         case ${atm_enable} in
  39         [Yy][Ee][Ss])
  40                 if [ -r /etc/rc.atm ]; then
  41                         . /etc/rc.atm
  42                         atm_pass1
  43                 fi
  44                 ;;
  45         esac
  46
  47         # Special options for sppp(4) interfaces go here.  These need
  48         # to go _before_ the general ifconfig section, since in the case
  49         # of hardwired (no link1 flag) but required authentication, you
  50         # cannot pass auth parameters down to the already running interface.
  51         #
  52         for ifn in ${sppp_interfaces}; do
  53                 eval spppcontrol_args=\$spppconfig_${ifn}
  54                 if [ -n "${spppcontrol_args}" ]; then
  55                         # The auth secrets might contain spaces; in order
  56                         # to retain the quotation, we need to eval them
  57                         # here.
  58                         eval spppcontrol ${ifn} ${spppcontrol_args}
  59                 fi
  60         done
  61
  62         # Set up all the network interfaces, calling startup scripts if needed
  63         #
  64         case ${network_interfaces} in
  65         [Aa][Uu][Tt][Oo])
  66                 network_interfaces="`ifconfig -l`"
  67                 ;;
  68         esac
  69
  70         dhcp_interfaces=""
  71         for ifn in ${network_interfaces}; do
  72                 if [ -r /etc/start_if.${ifn} ]; then
  73                         . /etc/start_if.${ifn}
  74                         eval showstat_$ifn=1
  75                 fi
  76
  77                 # Do the primary ifconfig if specified
  78                 #
  79                 eval ifconfig_args=\$ifconfig_${ifn}
  80
  81                 case ${ifconfig_args} in
  82                 '')
  83                         ;;
  84                 [Dd][Hh][Cc][Pp])
  85                         # DHCP inits are done all in one go below
  86                         dhcp_interfaces="$dhcp_interfaces $ifn"
  87                         eval showstat_$ifn=1
  88                         ;;
  89                 *)
  90                         ifconfig ${ifn} ${ifconfig_args}
  91                         eval showstat_$ifn=1
  92                         ;;
  93                 esac
  94         done
  95
  96         if [ ! -z "${dhcp_interfaces}" ]; then
  97                 ${dhcp_program:-/sbin/dhclient} ${dhcp_flags} ${dhcp_interfaces}
  98         fi
  99
 100         for ifn in ${network_interfaces}; do
 101                 # Check to see if aliases need to be added
 102                 #
 103                 alias=0
 104                 while : ; do
 105                         eval ifconfig_args=\$ifconfig_${ifn}_alias${alias}
 106                         if [ -n "${ifconfig_args}" ]; then
 107                                 ifconfig ${ifn} ${ifconfig_args} alias
 108                                 eval showstat_$ifn=1
 109                                 alias=`expr ${alias} + 1`
 110                         else
 111                                 break;
 112                         fi
 113                 done
 114
 115                 # Do ipx address if specified
 116                 #
 117                 eval ifconfig_args=\$ifconfig_${ifn}_ipx
 118                 if [ -n "${ifconfig_args}" ]; then
 119                         ifconfig ${ifn} ${ifconfig_args}
 120                         eval showstat_$ifn=1
 121                 fi
 122         done
 123
 124         for ifn in ${network_interfaces}; do
 125                 eval showstat=\$showstat_${ifn}
 126                 if [ ! -z ${showstat} ]; then
 127                         ifconfig ${ifn}
 128                 fi
 129         done
 130
 131         # ISDN subsystem startup
 132         #
 133         case ${isdn_enable} in
 134         [Yy][Ee][Ss])
 135                 if [ -r /etc/rc.isdn ]; then
 136                         . /etc/rc.isdn
 137                 fi
 138                 ;;
 139         esac
 140
 141         # Warm up user ppp if required, must happen before natd.
 142         #
 143         case ${ppp_enable} in
 144         [Yy][Ee][Ss])
 145                 # Establish ppp mode.
 146                 #
 147                 if [ "${ppp_mode}" != "ddial" -a "${ppp_mode}" != "direct" \
 148                         -a "${ppp_mode}" != "dedicated" \
 149                         -a "${ppp_mode}" != "background" ]; then
 150                         ppp_mode="auto";
 151                 fi
 152
 153                 ppp_command="-${ppp_mode} ";
 154
 155                 # Switch on alias mode?
 156                 #
 157                 case ${ppp_nat} in
 158                 [Yy][Ee][Ss])
 159                         ppp_command="${ppp_command} -nat";
 160                         ;;
 161                 esac
 162
 163                 echo -n 'Starting ppp: '; ppp ${ppp_command} -quiet ${ppp_profile}
 164                 ;;
 165         esac
 166
 167         # Initialize IP filtering using ipfw
 168         #
 169         echo ''
 170
 171         if /sbin/ipfw -q flush > /dev/null 2>&1; then
 172                 firewall_in_kernel=1
 173         else
 174                 firewall_in_kernel=0
 175         fi
 176
 177         case ${firewall_enable} in
 178         [Yy][Ee][Ss])
 179                 if [ "${firewall_in_kernel}" -eq 0 ] && kldload ipfw; then
 180                         firewall_in_kernel=1
 181                         echo "Kernel firewall module loaded."
 182                 elif [ "${firewall_in_kernel}" -eq 0 ]; then
 183                         echo "Warning: firewall kernel module failed to load."
 184                 fi
 185                 ;;
 186         esac
 187
 188         # Load the filters if required
 189         #
 190         case ${firewall_in_kernel} in
 191         1)
 192                 if [ -z "${firewall_script}" ]; then
 193                         firewall_script=/etc/rc.firewall
 194                 fi
 195
 196                 case ${firewall_enable} in
 197                 [Yy][Ee][Ss])
 198                         if [ -r "${firewall_script}" ]; then
 199                                 . "${firewall_script}"
 200                                 echo -n 'Firewall rules loaded, starting divert daemons:'
 201
 202                                 # Network Address Translation daemon
 203                                 #
 204                                 case ${natd_enable} in
 205                                 [Yy][Ee][Ss])
 206                                         if [ -n "${natd_interface}" ]; then
 207                                                 if echo ${natd_interface} | \
 208                                                         grep -q -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
 209                                                         natd_ifarg="-a ${natd_interface}"
 210                                                 else
 211                                                         natd_ifarg="-n ${natd_interface}"
 212                                                 fi
 213
 214                                                 echo -n ' natd'; ${natd_program:-/sbin/natd} ${natd_flags} ${natd_ifarg}
 215                                         fi
 216                                         ;;
 217                                 esac
 218
 219                                 echo '.'
 220
 221                         elif [ "`ipfw l 65535`" = "65535 deny ip from any to any" ]; then
 222                                 echo -n "Warning: kernel has firewall functionality, "
 223                                 echo "but firewall rules are not enabled."
 224                                 echo "           All ip services are disabled."
 225                         fi
 226                         ;;
 227                 esac
 228                 ;;
 229         esac
 230
 231         # Additional ATM interface configuration
 232         #
 233         if [ -n "${atm_pass1_done}" ]; then
 234                 atm_pass2
 235         fi
 236
 237         # Configure routing
 238         #
 239         case ${defaultrouter} in
 240         [Nn][Oo] | '')
 241                 ;;
 242         *)
 243                 static_routes="default ${static_routes}"
 244                 route_default="default ${defaultrouter}"
 245                 ;;
 246         esac
 247
 248         # Set up any static routes.  This should be done before router discovery.
 249         #
 250         if [ -n "${static_routes}" ]; then
 251                 for i in ${static_routes}; do
 252                         eval route_args=\$route_${i}
 253                         route add ${route_args}
 254                 done
 255         fi
 256
 257         echo -n 'Additional routing options:'
 258         case ${tcp_extensions} in
 259         [Yy][Ee][Ss] | '')
 260                 ;;
 261         *)
 262                 echo -n ' tcp extensions=NO'
 263                 sysctl -w net.inet.tcp.rfc1323=0 >/dev/null
 264                 ;;
 265         esac
 266
 267         case ${icmp_bmcastecho} in
 268         [Yy][Ee][Ss])
 269                 echo -n ' broadcast ping responses=YES'
 270                 sysctl -w net.inet.icmp.bmcastecho=1 >/dev/null
 271                 ;;
 272         esac
 273
 274         case ${icmp_drop_redirect} in
 275         [Yy][Ee][Ss])
 276                 echo -n ' ignore ICMP redirect=YES'
 277                 sysctl -w net.inet.icmp.drop_redirect=1 >/dev/null
 278                 ;;
 279         esac
 280
 281         case ${icmp_log_redirect} in
 282         [Yy][Ee][Ss])
 283                 echo -n ' log ICMP redirect=YES'
 284                 sysctl -w net.inet.icmp.log_redirect=1 >/dev/null
 285                 ;;
 286         esac
 287
 288         case ${gateway_enable} in
 289         [Yy][Ee][Ss])
 290                 echo -n ' IP gateway=YES'
 291                 sysctl -w net.inet.ip.forwarding=1 >/dev/null
 292                 ;;
 293         esac
 294
 295         case ${forward_sourceroute} in
 296         [Yy][Ee][Ss])
 297                 echo -n ' do source routing=YES'
 298                 sysctl -w net.inet.ip.sourceroute=1 >/dev/null
 299                 ;;
 300         esac
 301
 302         case ${accept_sourceroute} in
 303         [Yy][Ee][Ss])
 304                 echo -n ' accept source routing=YES'
 305                 sysctl -w net.inet.ip.accept_sourceroute=1 >/dev/null
 306                 ;;
 307         esac
 308
 309         case ${tcp_keepalive} in
 310         [Yy][Ee][Ss])
 311                 echo -n ' TCP keepalive=YES'
 312                 sysctl -w net.inet.tcp.always_keepalive=1 >/dev/null
 313                 ;;
 314         esac
 315
 316         case ${tcp_restrict_rst} in
 317         [Yy][Ee][Ss])
 318                 echo -n ' restrict TCP reset=YES'
 319                 sysctl -w net.inet.tcp.restrict_rst=1 >/dev/null
 320                 ;;
 321         esac
 322
 323         case ${tcp_drop_synfin} in
 324         [Yy][Ee][Ss])
 325                 echo -n ' drop SYN+FIN packets=YES'
 326                 sysctl -w net.inet.tcp.drop_synfin=1 >/dev/null
 327                 ;;
 328         esac
 329
 330         case ${ipxgateway_enable} in
 331         [Yy][Ee][Ss])
 332                 echo -n ' IPX gateway=YES'
 333                 sysctl -w net.ipx.ipx.ipxforwarding=1 >/dev/null
 334                 ;;
 335         esac
 336
 337         case ${arpproxy_all} in
 338         [Yy][Ee][Ss])
 339                 echo -n ' ARP proxyall=YES'
 340                 sysctl -w net.link.ether.inet.proxyall=1 >/dev/null
 341                 ;;
 342         esac
 343         echo '.'
 344
 345         echo -n 'routing daemons:'
 346         case ${router_enable} in
 347         [Yy][Ee][Ss])
 348                 echo -n " ${router}";   ${router} ${router_flags}
 349                 ;;
 350         esac
 351
 352         case ${ipxrouted_enable} in
 353         [Yy][Ee][Ss])
 354                 echo -n ' IPXrouted'
 355                 IPXrouted ${ipxrouted_flags} > /dev/null 2>&1
 356                 ;;
 357         esac
 358
 359         case ${mrouted_enable} in
 360         [Yy][Ee][Ss])
 361                 echo -n ' mrouted';     mrouted ${mrouted_flags}
 362                 ;;
 363         esac
 364
 365         case ${rarpd_enable} in
 366         [Yy][Ee][Ss])
 367                 echo -n ' rarpd';       rarpd ${rarpd_flags}
 368                 ;;
 369         esac
 370         echo '.'
 371
 372         # Let future generations know we made it.
 373         #
 374         network_pass1_done=YES
 375 }
 376
 377 network_pass2() {
 378         echo -n 'Doing additional network setup:'
 379         case ${named_enable} in
 380         [Yy][Ee][Ss])
 381                 echo -n ' named';       ${named_program:-named} ${named_flags}
 382                 ;;
 383         esac
 384
 385         case ${ntpdate_enable} in
 386         [Yy][Ee][Ss])
 387                 echo -n ' ntpdate'
 388                 ${ntpdate_program:-ntpdate} ${ntpdate_flags} >/dev/null 2>&1
 389                 ;;
 390         esac
 391
 392         case ${xntpd_enable} in
 393         [Yy][Ee][Ss])
 394                 echo -n ' ntpd';        ${xntpd_program:-ntpd} ${xntpd_flags}
 395                 ;;
 396         esac
 397
 398         case ${timed_enable} in
 399         [Yy][Ee][Ss])
 400                 echo -n ' timed';       timed ${timed_flags}
 401                 ;;
 402         esac
 403
 404         case ${portmap_enable} in
 405         [Yy][Ee][Ss])
 406                 echo -n ' portmap';     ${portmap_program:-/usr/sbin/portmap} ${portmap_flags}
 407                 ;;
 408         esac
 409
 410         # Start ypserv if we're an NIS server.
 411         # Run rpc.ypxfrd and rpc.yppasswdd only on the NIS master server.
 412         #
 413         case ${nis_server_enable} in
 414         [Yy][Ee][Ss])
 415                 echo -n ' ypserv'; ypserv ${nis_server_flags}
 416
 417                 case ${nis_ypxfrd_enable} in
 418                 [Yy][Ee][Ss])
 419                         echo -n ' rpc.ypxfrd'
 420                         rpc.ypxfrd ${nis_ypxfrd_flags}
 421                         ;;
 422                 esac
 423
 424                 case ${nis_yppasswdd_enable} in
 425                 [Yy][Ee][Ss])
 426                         echo -n ' rpc.yppasswdd'
 427                         rpc.yppasswdd ${nis_yppasswdd_flags}
 428                         ;;
 429                 esac
 430                 ;;
 431         esac
 432
 433         # Start ypbind if we're an NIS client
 434         #
 435         case ${nis_client_enable} in
 436         [Yy][Ee][Ss])
 437                 echo -n ' ypbind'; ypbind ${nis_client_flags}
 438                 case ${nis_ypset_enable} in
 439                 [Yy][Ee][Ss])
 440                         echo -n ' ypset';       ypset ${nis_ypset_flags}
 441                         ;;
 442                 esac
 443                 ;;
 444         esac
 445
 446         # Start keyserv if we are running Secure RPC
 447         #
 448         case ${keyserv_enable} in
 449         [Yy][Ee][Ss])
 450                 echo -n ' keyserv';     keyserv ${keyserv_flags}
 451                 ;;
 452         esac
 453
 454         # Start ypupdated if we are running Secure RPC and we are NIS master
 455         #
 456         case ${rpc_ypupdated_enable} in
 457         [Yy][Ee][Ss])
 458                 echo -n ' rpc.ypupdated';       rpc.ypupdated
 459                 ;;
 460         esac
 461
 462         # Start ATM daemons
 463         if [ -n "${atm_pass2_done}" ]; then
 464                 atm_pass3
 465         fi
 466
 467         echo '.'
 468         network_pass2_done=YES
 469 }
 470
 471 network_pass3() {
 472         echo -n 'Starting final network daemons:'
 473
 474         case ${nfs_server_enable} in
 475         [Yy][Ee][Ss])
 476                 if [ -r /etc/exports ]; then
 477                         echo -n ' mountd'
 478
 479                         case ${weak_mountd_authentication} in
 480                         [Yy][Ee][Ss])
 481                                 mountd_flags="-n"
 482                                 ;;
 483                         esac
 484
 485                         mountd ${mountd_flags}
 486
 487                         case ${nfs_reserved_port_only} in
 488                         [Yy][Ee][Ss])
 489                                 echo -n ' NFS on reserved port only=YES'
 490                                 sysctl -w vfs.nfs.nfs_privport=1 >/dev/null
 491                                 ;;
 492                         esac
 493
 494                         echo -n ' nfsd';        nfsd ${nfs_server_flags}
 495
 496                         case ${rpc_lockd_enable} in
 497                         [Yy][Ee][Ss])
 498                                 echo -n ' rpc.lockd';   rpc.lockd
 499                                 ;;
 500                         esac
 501
 502                         case ${rpc_statd_enable} in
 503                         [Yy][Ee][Ss])
 504                                 echo -n ' rpc.statd';   rpc.statd
 505                                 ;;
 506                         esac
 507                 fi
 508                 ;;
 509         *)
 510                 case ${single_mountd_enable} in
 511                 [Yy][Ee][Ss])
 512                         if [ -r /etc/exports ]; then
 513                                 echo -n ' mountd'
 514
 515                                 case ${weak_mountd_authentication} in
 516                                 [Yy][Ee][Ss])
 517                                         mountd_flags="-n"
 518                                         ;;
 519                                 esac
 520
 521                                 mountd ${mountd_flags}
 522                         fi
 523                         ;;
 524                 esac
 525                 ;;
 526         esac
 527
 528         case ${nfs_client_enable} in
 529         [Yy][Ee][Ss])
 530                 echo -n ' nfsiod';      nfsiod ${nfs_client_flags}
 531                 if [ -n "${nfs_access_cache}" ]; then
 532                 echo -n " NFS access cache time=${nfs_access_cache}"
 533                 sysctl -w vfs.nfs.access_cache_timeout=${nfs_access_cache} \
 534                         >/dev/null
 535                 fi
 536                 ;;
 537         esac
 538
 539         # If /var/db/mounttab exists, some nfs-server has not been
 540         # sucessfully notified about a previous client shutdown.
 541         # If there is no /var/db/mounttab, we do nothing.
 542         if [ -f /var/db/mounttab ]; then
 543                 rpc.umntall -k
 544         fi
 545
 546         case ${amd_enable} in
 547         [Yy][Ee][Ss])
 548                 echo -n ' amd'
 549                 case ${amd_map_program} in
 550                 [Nn][Oo] | '')
 551                         ;;
 552                 *)
 553                         amd_flags="${amd_flags} `eval ${amd_map_program}`"
 554                         ;;
 555                 esac
 556
 557                 if [ -n "${amd_flags}" ]; then
 558                         amd -p ${amd_flags} > /var/run/amd.pid 2> /dev/null
 559                 else
 560                         amd 2> /dev/null
 561                 fi
 562                 ;;
 563         esac
 564
 565         case ${rwhod_enable} in
 566         [Yy][Ee][Ss])
 567                 echo -n ' rwhod';       rwhod ${rwhod_flags}
 568                 ;;
 569         esac
 570
 571         # Kerberos runs ONLY on the Kerberos server machine
 572         case ${kerberos_server_enable} in
 573         [Yy][Ee][Ss])
 574                 case ${kerberos_stash} in
 575                 [Yy][Ee][Ss])
 576                         stash_flag=-n
 577                         ;;
 578                 *)
 579                         stash_flag=
 580                         ;;
 581                 esac
 582
 583                 echo -n ' kerberos'
 584                 kerberos ${stash_flag} >> /var/log/kerberos.log &
 585
 586                 case ${kadmind_server_enable} in
 587                 [Yy][Ee][Ss])
 588                         echo -n ' kadmind'
 589                         (sleep 20; kadmind ${stash_flag} >/dev/null 2>&1 &) &
 590                         ;;
 591                 esac
 592                 unset stash_flag
 593                 ;;
 594         esac
 595
 596         case ${pppoed_enable} in
 597         [Yy][Ee][Ss])
 598                 if [ -n "${pppoed_provider}" ]; then
 599                         pppoed_flags="${pppoed_flags} -p ${pppoed_provider}"
 600                 fi
 601                 echo -n ' pppoed';
 602                 /usr/libexec/pppoed ${pppoed_flags} ${pppoed_interface}
 603                 ;;
 604         esac
 605
 606         case ${sshd_enable} in
 607         [Yy][Ee][Ss])
 608                 if [ ! -f /etc/ssh/ssh_host_key ]; then
 609                         echo ' creating ssh host key';
 610                         /usr/bin/ssh-keygen -N "" -f /etc/ssh/ssh_host_key
 611                 fi
 612                 ;;
 613         esac
 614
 615         echo '.'
 616         network_pass3_done=YES
 617 }
 618
 619 network_pass4() {
 620         echo -n 'Additional TCP options:'
 621         case ${log_in_vain} in
 622         [Nn][Oo] | '')
 623                 ;;
 624         *)
 625                 echo -n ' log_in_vain=YES'
 626                 sysctl -w net.inet.tcp.log_in_vain=1 >/dev/null
 627                 sysctl -w net.inet.udp.log_in_vain=1 >/dev/null
 628                 ;;
 629         esac
 630
 631         echo '.'
 632         network_pass4_done=YES
 633 }