etc/rc.network

   1 #!/bin/sh -
   2 #
   3 # Copyright (c) 1993  The FreeBSD Project
   4 # All rights reserved.
   5 #
   6 # Redistribution and use in source and binary forms, with or without
   7 # modification, are permitted provided that the following conditions
   8 # are met:
   9 # 1. Redistributions of source code must retain the above copyright
  10 #    notice, this list of conditions and the following disclaimer.
  11 # 2. Redistributions in binary form must reproduce the above copyright
  12 #    notice, this list of conditions and the following disclaimer in the
  13 #    documentation and/or other materials provided with the distribution.
  14 #
  15 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  16 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  18 # ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  19 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  21 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  24 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  25 # SUCH DAMAGE.
  26 #
  27 # $FreeBSD$
  28 #       From: @(#)netstart      5.9 (Berkeley) 3/30/91
  29 #
  30
  31 # Note that almost all of the user-configurable behavior is no longer in
  32 # this file, but rather in /etc/defaults/rc.conf.  Please check that file
  33 # first before contemplating any changes here.  If you do need to change
  34 # this file for some reason, we would like to know about it.
  35
  36 # First pass startup stuff.
  37 #
  38 network_pass1() {
  39         echo -n 'Doing initial network setup:'
  40
  41         # Generate host.conf for compatibility
  42         #
  43         if [ -f "/etc/nsswitch.conf" ]; then
  44                 echo -n ' host.conf'
  45                 generate_host_conf /etc/nsswitch.conf /etc/host.conf
  46         fi
  47
  48         # Convert host.conf to nsswitch.conf if necessary
  49         #
  50         if [ -f "/etc/host.conf" -a ! -f "/etc/nsswitch.conf" ]; then
  51                 echo ''
  52                 echo 'Warning: /etc/host.conf is no longer used'
  53                 echo '  /etc/nsswitch.conf will be created for you'
  54                 convert_host_conf /etc/host.conf /etc/nsswitch.conf
  55         fi
  56
  57         # Set the host name if it is not already set
  58         #
  59         if [ -z "`hostname -s`" ]; then
  60                 hostname ${hostname}
  61                 echo -n ' hostname'
  62         fi
  63
  64         # Establish ipfilter ruleset as early as possible (best in
  65         # addition to IPFILTER_DEFAULT_BLOCK in the kernel config file)
  66
  67         # check whether ipfilter and/or ipnat is enabled
  68         ipfilter_active="NO"
  69         case ${ipfilter_enable} in
  70         [Yy][Ee][Ss])
  71                 ipfilter_active="YES"
  72                 ;;
  73         esac
  74         case ${ipnat_enable} in
  75         [Yy][Ee][Ss])
  76                 ipfilter_active="YES"
  77                 ;;
  78         esac
  79         case ${ipfilter_active} in
  80         [Yy][Ee][Ss])
  81                 # load ipfilter kernel module if needed
  82                 if ! sysctl net.inet.ipf.fr_pass > /dev/null 2>&1; then
  83                         if kldload ipl; then
  84                                 echo 'IP-filter module loaded.'
  85                         else
  86                                 echo 'Warning: IP-filter module failed to load.'
  87                                 # avoid further errors
  88                                 ipfilter_active="NO"
  89                                 ipmon_enable="NO"
  90                                 ipfilter_enable="NO"
  91                                 ipnat_enable="NO"
  92                                 ipfs_enable="NO"
  93                         fi
  94                 fi
  95                 # start ipmon before loading any rules
  96                 case "${ipmon_enable}" in
  97                 [Yy][Ee][Ss])
  98                         echo -n ' ipmon'
  99                         ${ipmon_program:-/sbin/ipmon} ${ipmon_flags}
 100                         ;;
 101                 esac
 102                 case "${ipfilter_enable}" in
 103                 [Yy][Ee][Ss])
 104                         if [ -r "${ipfilter_rules}" ]; then
 105                                 echo -n ' ipfilter'
 106                                 ${ipfilter_program:-/sbin/ipf} -Fa -f \
 107                                     "${ipfilter_rules}" ${ipfilter_flags}
 108                         else
 109                                 ipfilter_enable="NO"
 110                                 echo -n ' NO IPF RULES'
 111                         fi
 112                         ;;
 113                 esac
 114                 case "${ipnat_enable}" in
 115                 [Yy][Ee][Ss])
 116                         if [ -r "${ipnat_rules}" ]; then
 117                                 echo -n ' ipnat'
 118                                 eval ${ipnat_program:-/sbin/ipnat} -CF -f \
 119                                     "${ipnat_rules}" ${ipnat_flags}
 120                         else
 121                                 ipnat_enable="NO"
 122                                 echo -n ' NO IPNAT RULES'
 123                         fi
 124                         ;;
 125                 esac
 126                 # restore filter/NAT state tables after loading the rules
 127                 case "${ipfs_enable}" in
 128                 [Yy][Ee][Ss])
 129                         if [ -r "/var/db/ipf/ipstate.ipf" ]; then
 130                                 echo -n ' ipfs'
 131                                 ${ipfs_program:-/sbin/ipfs} -R ${ipfs_flags}
 132                                 # remove files to avoid reloading old state
 133                                 # after an ungraceful shutdown
 134                                 rm -f /var/db/ipf/ipstate.ipf
 135                                 rm -f /var/db/ipf/ipnat.ipf
 136                         fi
 137                         ;;
 138                 esac
 139                 ;;
 140         esac
 141
 142         # Set the domainname if we're using NIS
 143         #
 144         case ${nisdomainname} in
 145         [Nn][Oo] | '')
 146                 ;;
 147         *)
 148                 domainname ${nisdomainname}
 149                 echo -n ' domain'
 150                 ;;
 151         esac
 152
 153         echo '.'
 154
 155         # Initial ATM interface configuration
 156         #
 157         case ${atm_enable} in
 158         [Yy][Ee][Ss])
 159                 if [ -r /etc/rc.atm ]; then
 160                         . /etc/rc.atm
 161                         atm_pass1
 162                 fi
 163                 ;;
 164         esac
 165
 166         # Attempt to create cloned interfaces.
 167         for ifn in ${cloned_interfaces}; do
 168                 ifconfig ${ifn} create
 169         done
 170
 171         # Special options for sppp(4) interfaces go here.  These need
 172         # to go _before_ the general ifconfig section, since in the case
 173         # of hardwired (no link1 flag) but required authentication, you
 174         # cannot pass auth parameters down to the already running interface.
 175         #
 176         for ifn in ${sppp_interfaces}; do
 177                 eval spppcontrol_args=\$spppconfig_${ifn}
 178                 if [ -n "${spppcontrol_args}" ]; then
 179                         # The auth secrets might contain spaces; in order
 180                         # to retain the quotation, we need to eval them
 181                         # here.
 182                         eval spppcontrol ${ifn} ${spppcontrol_args}
 183                 fi
 184         done
 185
 186         # gifconfig
 187         network_gif_setup
 188
 189         # Set up all the network interfaces, calling startup scripts if needed
 190         #
 191         case ${network_interfaces} in
 192         [Aa][Uu][Tt][Oo])
 193                 network_interfaces="`ifconfig -l`"
 194                 ;;
 195         *)
 196                 network_interfaces="${network_interfaces} ${cloned_interfaces}"
 197                 ;;
 198         esac
 199
 200         dhcp_interfaces=""
 201         for ifn in ${network_interfaces}; do
 202                 if [ -r /etc/start_if.${ifn} ]; then
 203                         . /etc/start_if.${ifn}
 204                         eval showstat_$ifn=1
 205                 fi
 206
 207                 # Do the primary ifconfig if specified
 208                 #
 209                 eval ifconfig_args=\$ifconfig_${ifn}
 210
 211                 case ${ifconfig_args} in
 212                 '')
 213                         ;;
 214                 [Dd][Hh][Cc][Pp])
 215                         # DHCP inits are done all in one go below
 216                         dhcp_interfaces="$dhcp_interfaces $ifn"
 217                         eval showstat_$ifn=1
 218                         ;;
 219                 *)
 220                         ifconfig ${ifn} ${ifconfig_args}
 221                         eval showstat_$ifn=1
 222                         ;;
 223                 esac
 224         done
 225
 226         if [ ! -z "${dhcp_interfaces}" ]; then
 227                 ${dhcp_program:-/sbin/dhclient} ${dhcp_flags} ${dhcp_interfaces}
 228         fi
 229
 230         for ifn in ${network_interfaces}; do
 231                 # Check to see if aliases need to be added
 232                 #
 233                 alias=0
 234                 while : ; do
 235                         eval ifconfig_args=\$ifconfig_${ifn}_alias${alias}
 236                         if [ -n "${ifconfig_args}" ]; then
 237                                 ifconfig ${ifn} ${ifconfig_args} alias
 238                                 eval showstat_$ifn=1
 239                                 alias=$((${alias} + 1))
 240                         else
 241                                 break;
 242                         fi
 243                 done
 244
 245                 # Do ipx address if specified
 246                 #
 247                 eval ifconfig_args=\$ifconfig_${ifn}_ipx
 248                 if [ -n "${ifconfig_args}" ]; then
 249                         ifconfig ${ifn} ${ifconfig_args}
 250                         eval showstat_$ifn=1
 251                 fi
 252         done
 253
 254         for ifn in ${network_interfaces}; do
 255                 eval showstat=\$showstat_${ifn}
 256                 if [ ! -z ${showstat} ]; then
 257                         ifconfig ${ifn}
 258                 fi
 259         done
 260
 261         # ISDN subsystem startup
 262         #
 263         case ${isdn_enable} in
 264         [Yy][Ee][Ss])
 265                 if [ -r /etc/rc.isdn ]; then
 266                         . /etc/rc.isdn
 267                 fi
 268                 ;;
 269         esac
 270
 271         # Start user ppp if required.  This must happen before natd.
 272         #
 273         case ${ppp_enable} in
 274         [Yy][Ee][Ss])
 275                 # Establish ppp mode.
 276                 #
 277                 if [ "${ppp_mode}" != "ddial" -a "${ppp_mode}" != "direct" \
 278                         -a "${ppp_mode}" != "dedicated" \
 279                         -a "${ppp_mode}" != "background" ]; then
 280                         ppp_mode="auto"
 281                 fi
 282
 283                 ppp_command="/usr/sbin/ppp -quiet -${ppp_mode}"
 284
 285                 # Switch on NAT mode?
 286                 #
 287                 case ${ppp_nat} in
 288                 [Yy][Ee][Ss])
 289                         ppp_command="${ppp_command} -nat"
 290                         ;;
 291                 esac
 292
 293                 ppp_command="${ppp_command} ${ppp_profile}"
 294
 295                 echo "Starting ppp as \"${ppp_user}\""
 296                 su -m ${ppp_user} -c "exec ${ppp_command}"
 297                 ;;
 298         esac
 299
 300         # Re-Sync ipfilter so it picks up any new network interfaces
 301         #
 302         case ${ipfilter_active} in
 303         [Yy][Ee][Ss])
 304                 ${ipfilter_program:-/sbin/ipf} -y ${ipfilter_flags} >/dev/null
 305                 ;;
 306         esac
 307         unset ipfilter_active
 308
 309         # Initialize IP filtering using ipfw
 310         #
 311         if /sbin/ipfw -q flush > /dev/null 2>&1; then
 312                 firewall_in_kernel=1
 313         else
 314                 firewall_in_kernel=0
 315         fi
 316
 317         case ${firewall_enable} in
 318         [Yy][Ee][Ss])
 319                 if [ "${firewall_in_kernel}" -eq 0 ] && kldload ipfw; then
 320                         firewall_in_kernel=1
 321                         echo 'Kernel firewall module loaded'
 322                 elif [ "${firewall_in_kernel}" -eq 0 ]; then
 323                         echo 'Warning: firewall kernel module failed to load'
 324                 fi
 325                 ;;
 326         esac
 327
 328         # Load the filters if required
 329         #
 330         case ${firewall_in_kernel} in
 331         1)
 332                 if [ -z "${firewall_script}" ]; then
 333                         firewall_script=/etc/rc.firewall
 334                 fi
 335
 336                 case ${firewall_enable} in
 337                 [Yy][Ee][Ss])
 338                         if [ -r "${firewall_script}" ]; then
 339                                 . "${firewall_script}"
 340                                 echo -n 'Firewall rules loaded, starting divert daemons:'
 341
 342                                 # Network Address Translation daemon
 343                                 #
 344                                 case ${natd_enable} in
 345                                 [Yy][Ee][Ss])
 346                                         if [ -n "${natd_interface}" ]; then
 347                                                 if echo ${natd_interface} | \
 348                                                         grep -q -E '^[0-9]+(\.[0-9]+){0,3}$'; then
 349                                                         natd_flags="$natd_flags -a ${natd_interface}"
 350                                                 else
 351                                                         natd_flags="$natd_flags -n ${natd_interface}"
 352                                                 fi
 353                                         fi
 354                                         echo -n ' natd'; ${natd_program:-/sbin/natd} ${natd_flags}
 355                                         ;;
 356                                 esac
 357
 358                                 echo '.'
 359
 360                         elif [ "`ipfw l 65535`" = "65535 deny ip from any to any" ]; then
 361                                 echo 'Warning: kernel has firewall functionality,' \
 362                                      'but firewall rules are not enabled.'
 363                                 echo '           All ip services are disabled.'
 364                         fi
 365
 366                         case ${firewall_logging} in
 367                         [Yy][Ee][Ss] | '')
 368                                 echo 'Firewall logging=YES'
 369                                 sysctl net.inet.ip.fw.verbose=1 >/dev/null
 370                                 ;;
 371                         *)
 372                                 ;;
 373                         esac
 374
 375                         ;;
 376                 esac
 377                 ;;
 378         esac
 379
 380         # Additional ATM interface configuration
 381         #
 382         if [ -n "${atm_pass1_done}" ]; then
 383                 atm_pass2
 384         fi
 385
 386         # Configure routing
 387         #
 388         case ${defaultrouter} in
 389         [Nn][Oo] | '')
 390                 ;;
 391         *)
 392                 static_routes="default ${static_routes}"
 393                 route_default="default ${defaultrouter}"
 394                 ;;
 395         esac
 396
 397         # Set up any static routes.  This should be done before router discovery.
 398         #
 399         if [ -n "${static_routes}" ]; then
 400                 for i in ${static_routes}; do
 401                         eval route_args=\$route_${i}
 402                         route add ${route_args}
 403                 done
 404         fi
 405
 406         echo -n 'Additional routing options:'
 407         case ${tcp_extensions} in
 408         [Yy][Ee][Ss] | '')
 409                 ;;
 410         *)
 411                 echo -n ' tcp extensions=NO'
 412                 sysctl net.inet.tcp.rfc1323=0 >/dev/null
 413                 ;;
 414         esac
 415
 416         case ${icmp_bmcastecho} in
 417         [Yy][Ee][Ss])
 418                 echo -n ' broadcast ping responses=YES'
 419                 sysctl net.inet.icmp.bmcastecho=1 >/dev/null
 420                 ;;
 421         esac
 422
 423         case ${icmp_drop_redirect} in
 424         [Yy][Ee][Ss])
 425                 echo -n ' ignore ICMP redirect=YES'
 426                 sysctl net.inet.icmp.drop_redirect=1 >/dev/null
 427                 ;;
 428         esac
 429
 430         case ${icmp_log_redirect} in
 431         [Yy][Ee][Ss])
 432                 echo -n ' log ICMP redirect=YES'
 433                 sysctl net.inet.icmp.log_redirect=1 >/dev/null
 434                 ;;
 435         esac
 436
 437         case ${gateway_enable} in
 438         [Yy][Ee][Ss])
 439                 echo -n ' IP gateway=YES'
 440                 sysctl net.inet.ip.forwarding=1 >/dev/null
 441                 ;;
 442         esac
 443
 444         case ${forward_sourceroute} in
 445         [Yy][Ee][Ss])
 446                 echo -n ' do source routing=YES'
 447                 sysctl net.inet.ip.sourceroute=1 >/dev/null
 448                 ;;
 449         esac
 450
 451         case ${accept_sourceroute} in
 452         [Yy][Ee][Ss])
 453                 echo -n ' accept source routing=YES'
 454                 sysctl net.inet.ip.accept_sourceroute=1 >/dev/null
 455                 ;;
 456         esac
 457
 458         case ${tcp_keepalive} in
 459         [Nn][Oo])
 460                 echo -n ' TCP keepalive=NO'
 461                 sysctl net.inet.tcp.always_keepalive=0 >/dev/null
 462                 ;;
 463         esac
 464
 465         case ${tcp_drop_synfin} in
 466         [Yy][Ee][Ss])
 467                 echo -n ' drop SYN+FIN packets=YES'
 468                 sysctl net.inet.tcp.drop_synfin=1 >/dev/null
 469                 ;;
 470         esac
 471
 472         case ${ipxgateway_enable} in
 473         [Yy][Ee][Ss])
 474                 echo -n ' IPX gateway=YES'
 475                 sysctl net.ipx.ipx.ipxforwarding=1 >/dev/null
 476                 ;;
 477         esac
 478
 479         case ${arpproxy_all} in
 480         [Yy][Ee][Ss])
 481                 echo -n ' ARP proxyall=YES'
 482                 sysctl net.link.ether.inet.proxyall=1 >/dev/null
 483                 ;;
 484         esac
 485
 486         case ${ip_portrange_first} in
 487         [Nn][Oo] | '')
 488                 ;;
 489         *)
 490                 echo -n " ip_portrange_first=$ip_portrange_first"
 491                 sysctl net.inet.ip.portrange.first=$ip_portrange_first >/dev/null
 492                 ;;
 493         esac
 494
 495         case ${ip_portrange_last} in
 496         [Nn][Oo] | '')
 497                 ;;
 498         *)
 499                 echo -n " ip_portrange_last=$ip_portrange_last"
 500                 sysctl net.inet.ip.portrange.last=$ip_portrange_last >/dev/null
 501                 ;;
 502         esac
 503
 504         echo '.'
 505
 506         case ${ipsec_enable} in
 507         [Yy][Ee][Ss])
 508                 if [ -f ${ipsec_file} ]; then
 509                     echo ' ipsec: enabled'
 510                     setkey -f ${ipsec_file}
 511                 else
 512                     echo ' ipsec: file not found'
 513                 fi
 514                 ;;
 515         esac
 516
 517         echo -n 'Routing daemons:'
 518         case ${router_enable} in
 519         [Yy][Ee][Ss])
 520                 echo -n " ${router}";   ${router} ${router_flags}
 521                 ;;
 522         esac
 523
 524         case ${ipxrouted_enable} in
 525         [Yy][Ee][Ss])
 526                 echo -n ' IPXrouted'
 527                 IPXrouted ${ipxrouted_flags} > /dev/null 2>&1
 528                 ;;
 529         esac
 530
 531         case ${mrouted_enable} in
 532         [Yy][Ee][Ss])
 533                 echo -n ' mrouted';     mrouted ${mrouted_flags}
 534                 ;;
 535         esac
 536
 537         case ${rarpd_enable} in
 538         [Yy][Ee][Ss])
 539                 echo -n ' rarpd';       rarpd ${rarpd_flags}
 540                 ;;
 541         esac
 542         echo '.'
 543
 544         # Let future generations know we made it.
 545         #
 546         network_pass1_done=YES
 547 }
 548
 549 network_pass2() {
 550         echo -n 'Doing additional network setup:'
 551         case ${named_enable} in
 552         [Yy][Ee][Ss])
 553                 echo -n ' named';       ${named_program:-named} ${named_flags}
 554                 ;;
 555         esac
 556
 557         case ${ntpdate_enable} in
 558         [Yy][Ee][Ss])
 559                 echo -n ' ntpdate'
 560                 ${ntpdate_program:-ntpdate} ${ntpdate_flags} >/dev/null 2>&1
 561                 ;;
 562         esac
 563
 564         case ${ntpd_enable} in
 565         [Yy][Ee][Ss])
 566                 echo -n ' ntpd';        ${ntpd_program:-ntpd} ${ntpd_flags}
 567                 ;;
 568         esac
 569
 570         case ${timed_enable} in
 571         [Yy][Ee][Ss])
 572                 echo -n ' timed';       timed ${timed_flags}
 573                 ;;
 574         esac
 575
 576         case ${rpcbind_enable} in
 577         [Yy][Ee][Ss])
 578                 echo -n ' rpcbind';     ${rpcbind_program:-/usr/sbin/rpcbind} \
 579                         ${rpcbind_flags}
 580
 581                 # Start ypserv if we're an NIS server.
 582                 # Run rpc.ypxfrd and rpc.yppasswdd only on the NIS master server.
 583                 #
 584                 case ${nis_server_enable} in
 585                 [Yy][Ee][Ss])
 586                         echo -n ' ypserv'; ypserv ${nis_server_flags}
 587
 588                         case ${nis_ypxfrd_enable} in
 589                         [Yy][Ee][Ss])
 590                                 echo -n ' rpc.ypxfrd'
 591                                 rpc.ypxfrd ${nis_ypxfrd_flags}
 592                                 ;;
 593                         esac
 594
 595                         case ${nis_yppasswdd_enable} in
 596                         [Yy][Ee][Ss])
 597                                 echo -n ' rpc.yppasswdd'
 598                                 rpc.yppasswdd ${nis_yppasswdd_flags}
 599                                 ;;
 600                         esac
 601                         ;;
 602                 esac
 603
 604                 # Start ypbind if we're an NIS client
 605                 #
 606                 case ${nis_client_enable} in
 607                 [Yy][Ee][Ss])
 608                         echo -n ' ypbind'; ypbind ${nis_client_flags}
 609                         case ${nis_ypset_enable} in
 610                         [Yy][Ee][Ss])
 611                                 echo -n ' ypset';       ypset ${nis_ypset_flags}
 612                                 ;;
 613                         esac
 614                         ;;
 615                 esac
 616
 617                 # Start keyserv if we are running Secure RPC
 618                 #
 619                 case ${keyserv_enable} in
 620                 [Yy][Ee][Ss])
 621                         echo -n ' keyserv';     keyserv ${keyserv_flags}
 622                         ;;
 623                 esac
 624
 625                 # Start ypupdated if we are running Secure RPC
 626                 # and we are NIS master
 627                 #
 628                 case ${rpc_ypupdated_enable} in
 629                 [Yy][Ee][Ss])
 630                         echo -n ' rpc.ypupdated';       rpc.ypupdated
 631                         ;;
 632                 esac
 633                 ;;
 634         esac
 635
 636         # Start ATM daemons
 637         if [ -n "${atm_pass2_done}" ]; then
 638                 atm_pass3
 639         fi
 640
 641         echo '.'
 642         network_pass2_done=YES
 643 }
 644
 645 network_pass3() {
 646         echo -n 'Starting final network daemons:'
 647
 648         case ${rpcbind_enable} in
 649         [Yy][Ee][Ss])
 650                 case ${nfs_server_enable} in
 651                 [Yy][Ee][Ss])
 652                         # Handle absent nfs server support
 653                         nfsserver_in_kernel=0
 654                         if sysctl vfs.nfsrv >/dev/null 2>&1; then
 655                                 nfsserver_in_kernel=1
 656                         else
 657                                 kldload nfsserver && nfsserver_in_kernel=1
 658                         fi
 659
 660                         if [ -r /etc/exports -a \
 661                             ${nfsserver_in_kernel} -eq 1 ]; then
 662                                 echo -n ' mountd'
 663
 664                                 case ${weak_mountd_authentication} in
 665                                 [Yy][Ee][Ss])
 666                                         mountd_flags="${mountd_flags} -n"
 667                                         ;;
 668                                 esac
 669
 670                                 mountd ${mountd_flags}
 671
 672                                 case ${nfs_reserved_port_only} in
 673                                 [Yy][Ee][Ss])
 674                                         echo -n ' NFS on reserved port only=YES'
 675                                         sysctl vfs.nfsrv.nfs_privport=1 > /dev/null
 676                                         ;;
 677                                 esac
 678
 679                                 echo -n ' nfsd';        nfsd ${nfs_server_flags}
 680
 681                                 case ${rpc_statd_enable} in
 682                                 [Yy][Ee][Ss])
 683                                         echo -n ' rpc.statd';   rpc.statd
 684                                         ;;
 685                                 esac
 686
 687                                 case ${rpc_lockd_enable} in
 688                                 [Yy][Ee][Ss])
 689                                         echo -n ' rpc.lockd';   rpc.lockd
 690                                         ;;
 691                                 esac
 692                         else
 693                                 echo -n ' Warning: nfs server failed'
 694                         fi
 695                         ;;
 696                 *)
 697                         case ${mountd_enable} in
 698                         [Yy][Ee][Ss])
 699                                 if [ -r /etc/exports ]; then
 700                                         echo -n ' mountd'
 701
 702                                         case ${weak_mountd_authentication} in
 703                                         [Yy][Ee][Ss])
 704                                                 mountd_flags="-n"
 705                                                 ;;
 706                                         esac
 707
 708                                         mountd ${mountd_flags}
 709                                 fi
 710                                 ;;
 711                         esac
 712                         ;;
 713                 esac
 714
 715                 case ${nfs_client_enable} in
 716                 [Yy][Ee][Ss])
 717                         nfsclient_in_kernel=0
 718                         # Handle absent nfs client support
 719                         if sysctl vfs.nfs >/dev/null 2>&1; then
 720                                 nfsclient_in_kernel=1
 721                         else
 722                                 kldload nfsclient && nfsclient_in_kernel=1
 723                         fi
 724
 725                         if [ ${nfsclient_in_kernel} -eq 1 ]
 726                         then
 727                                 if [ -n "${nfs_access_cache}" ]; then
 728                                         echo -n " NFS access cache time=${nfs_access_cache}"
 729                                         sysctl vfs.nfs.access_cache_timeout=${nfs_access_cache} >/dev/null
 730                                 fi
 731                                 if [ -n "${nfs_bufpackets}" ]; then
 732                                         sysctl vfs.nfs.bufpackets=${nfs_bufpackets} > /dev/null
 733                                 fi
 734                                 case ${rpc_statd_enable} in
 735                                 [Yy][Ee][Ss])
 736                                         echo -n ' rpc.statd';   rpc.statd
 737                                         ;;
 738                                 esac
 739
 740                                 case ${rpc_lockd_enable} in
 741                                 [Yy][Ee][Ss])
 742                                         echo -n ' rpc.lockd';   rpc.lockd
 743                                         ;;
 744                                 esac
 745
 746                                 case ${amd_enable} in
 747                                 [Yy][Ee][Ss])
 748                                         echo -n ' amd'
 749                                         case ${amd_map_program} in
 750                                         [Nn][Oo] | '')
 751                                                 ;;
 752                                         *)
 753                                                 amd_flags="${amd_flags} `eval\
 754                                                         ${amd_map_program}`"
 755                                                 ;;
 756                                         esac
 757
 758                                         case "${amd_flags}" in
 759                                         '')
 760                                                 if [ -r /etc/amd.conf ]; then
 761                                                         amd &
 762                                                 else
 763                                                         echo ''
 764                         echo 'Warning: amd will not load without arguments'
 765                                                 fi
 766                                                 ;;
 767                                         *)
 768                                                 amd -p ${amd_flags} \
 769                                                          >/var/run/amd.pid \
 770                                                         2>/dev/null &
 771                                                 ;;
 772                                         esac
 773                                         ;;
 774                                 esac
 775                         else
 776                                 echo 'Warning: NFS client kernel module failed to load'
 777                                 nfs_client_enable=NO
 778                         fi
 779                         ;;
 780                 esac
 781
 782                 # If /var/db/mounttab exists, some nfs-server has not been
 783                 # successfully notified about a previous client shutdown.
 784                 # If there is no /var/db/mounttab, we do nothing.
 785                 if [ -f /var/db/mounttab ]; then
 786                         rpc.umntall -k
 787                 fi
 788
 789                 ;;
 790         esac
 791
 792         case ${rwhod_enable} in
 793         [Yy][Ee][Ss])
 794                 echo -n ' rwhod';       rwhod ${rwhod_flags}
 795                 ;;
 796         esac
 797
 798         # Kerberos servers run ONLY on the Kerberos server machine
 799         case ${kerberos4_server_enable} in
 800         [Yy][Ee][Ss])
 801                 case ${kerberos_stash} in
 802                 [Yy][Ee][Ss])
 803                         stash=-n
 804                         ;;
 805                 *)
 806                         stash=
 807                         ;;
 808                 esac
 809
 810                 echo -n ' kerberosIV'
 811                 ${kerberos4_server} ${stash} >> /var/log/kerberos.log &
 812
 813                 case ${kadmind4_server_enable} in
 814                 [Yy][Ee][Ss])
 815                         echo -n ' kadmindIV'
 816                         (
 817                                 sleep 20;
 818                                 ${kadmind4_server} ${stash} >/dev/null 2>&1 &
 819                         ) &
 820                         ;;
 821                 esac
 822                 unset stash_flag
 823                 ;;
 824         esac
 825
 826         case ${kerberos5_server_enable} in
 827         [Yy][Ee][Ss])
 828                 echo -n ' kerberos5'
 829                 ${kerberos5_server} &
 830
 831                 case ${kadmind5_server_enable} in
 832                 [Yy][Ee][Ss])
 833                         echo -n ' kadmind5'
 834                         ${kadmind5_server} &
 835                         ;;
 836                 esac
 837                 ;;
 838         esac
 839
 840         case ${pppoed_enable} in
 841         [Yy][Ee][Ss])
 842                 if [ -n "${pppoed_provider}" ]; then
 843                         pppoed_flags="${pppoed_flags} -p ${pppoed_provider}"
 844                 fi
 845                 echo -n ' pppoed';
 846                 _opts=$-; set -f
 847                 /usr/libexec/pppoed ${pppoed_flags} ${pppoed_interface}
 848                 set +f; set -${_opts}
 849                 ;;
 850         esac
 851
 852         case ${sshd_enable} in
 853         [Yy][Ee][Ss])
 854                 if [ -x /usr/bin/ssh-keygen ]; then
 855                         if [ ! -f /etc/ssh/ssh_host_key ]; then
 856                                 echo ' creating ssh1 RSA host key';
 857                                 /usr/bin/ssh-keygen -t rsa1 -N "" \
 858                                         -f /etc/ssh/ssh_host_key
 859                         fi
 860                         if [ ! -f /etc/ssh/ssh_host_rsa_key ]; then
 861                                 echo ' creating ssh2 RSA host key';
 862                                 /usr/bin/ssh-keygen -t rsa -N "" \
 863                                         -f /etc/ssh/ssh_host_rsa_key
 864                         fi
 865                         if [ ! -f /etc/ssh/ssh_host_dsa_key ]; then
 866                                 echo ' creating ssh2 DSA host key';
 867                                 /usr/bin/ssh-keygen -t dsa -N "" \
 868                                         -f /etc/ssh/ssh_host_dsa_key
 869                         fi
 870                 fi
 871                 ;;
 872         esac
 873
 874         echo '.'
 875         network_pass3_done=YES
 876 }
 877
 878 network_pass4() {
 879         echo -n 'Additional TCP options:'
 880         case ${log_in_vain} in
 881         [Nn][Oo] | '')
 882                 log_in_vain=0
 883                 ;;
 884         [Yy][Ee][Ss])
 885                 log_in_vain=1
 886                 ;;
 887         [0-9]*)
 888                 ;;
 889         *)
 890                 echo " invalid log_in_vain setting: ${log_in_vain}"
 891                 log_in_vain=0
 892                 ;;
 893         esac
 894
 895         [ "${log_in_vain}" -ne 0 ] && (
 896             echo -n " log_in_vain=${log_in_vain}"
 897             sysctl net.inet.tcp.log_in_vain="${log_in_vain}" >/dev/null
 898             sysctl net.inet.udp.log_in_vain="${log_in_vain}" >/dev/null
 899         )
 900         echo '.'
 901         network_pass4_done=YES
 902 }
 903
 904 network_gif_setup() {
 905         case ${gif_interfaces} in
 906         [Nn][Oo] | '')
 907                 ;;
 908         *)
 909                 for i in ${gif_interfaces}; do
 910                         eval peers=\$gifconfig_$i
 911                         case ${peers} in
 912                         '')
 913                                 continue
 914                                 ;;
 915                         *)
 916                                 ifconfig $i create >/dev/null 2>&1
 917                                 ifconfig $i tunnel ${peers}
 918                                 ifconfig $i up
 919                                 ;;
 920                         esac
 921                 done
 922                 ;;
 923         esac
 924 }
 925
 926 convert_host_conf() {
 927     host_conf=$1; shift;
 928     nsswitch_conf=$1; shift;
 929     awk '                                                                   \
 930         /^[:blank:]*#/       { next }                                       \
 931         /(hosts|local|file)/ { nsswitch[c] = "files"; c++; next }           \
 932         /(dns|bind)/         { nsswitch[c] = "dns";   c++; next }           \
 933         /nis/                { nsswitch[c] = "nis";   c++; next }           \
 934         { printf "Warning: unrecognized line [%s]", $0 > "/dev/stderr" }    \
 935         END {                                                               \
 936                 printf "hosts: ";                                           \
 937                 for (i in nsswitch) printf "%s ", nsswitch[i];              \
 938                 printf "\n";                                                \
 939         }' < $host_conf > $nsswitch_conf
 940 }
 941
 942 generate_host_conf() {
 943     nsswitch_conf=$1; shift;
 944     host_conf=$1; shift;
 945
 946     awk '
 947 BEGIN {
 948     xlat["files"] = "hosts";
 949     xlat["dns"] = "bind";
 950     xlat["nis"] = "nis";
 951     cont = 0;
 952 }
 953 sub(/^[\t ]*hosts:/, "") || cont {
 954     if (!cont)
 955         srcs = ""
 956     sub(/#.*/, "")
 957     gsub(/[][]/, " & ")
 958     cont = sub(/\\$/, "")
 959     srcs = srcs " " $0
 960 }
 961 END {
 962     print "# Auto-generated from nsswitch.conf, do not edit"
 963     ns = split(srcs, s)
 964     for (n = 1; n <= ns; ++n) {
 965         if (s[n] in xlat)
 966             print xlat[s[n]]
 967     }
 968 }
 969 ' <$nsswitch_conf >$host_conf
 970 }