network.subr revision 58710
1#!/bin/sh - 2# 3# $FreeBSD: head/etc/network.subr 58710 2000-03-27 21:38:35Z dillon $ 4# From: @(#)netstart 5.9 (Berkeley) 3/30/91 5 6# Note that almost all of the user-configurable behavior is no longer in 7# this file, but rather in /etc/defaults/rc.conf. Please check that file 8# first before contemplating any changes here. If you do need to change 9# this file for some reason, we would like to know about it. 10 11# First pass startup stuff. 12# 13network_pass1() { 14 echo -n 'Doing initial network setup:' 15 16 # Set the host name if it is not already set 17 # 18 if [ -z "`hostname -s`" ]; then 19 hostname ${hostname} 20 echo -n ' hostname' 21 fi 22 23 # Set the domainname if we're using NIS 24 # 25 case ${nisdomainname} in 26 [Nn][Oo] | '') 27 ;; 28 *) 29 domainname ${nisdomainname} 30 echo -n ' domain' 31 ;; 32 esac 33 34 echo '.' 35 36 # Initial ATM interface configuration 37 # 38 case ${atm_enable} in 39 [Yy][Ee][Ss]) 40 if [ -r /etc/rc.atm ]; then 41 . /etc/rc.atm 42 atm_pass1 43 fi 44 ;; 45 esac 46 47 # Special options for sppp(4) interfaces go here. These need 48 # to go _before_ the general ifconfig section, since in the case 49 # of hardwired (no link1 flag) but required authentication, you 50 # cannot pass auth parameters down to the already running interface. 51 # 52 for ifn in ${sppp_interfaces}; do 53 eval spppcontrol_args=\$spppconfig_${ifn} 54 if [ -n "${spppcontrol_args}" ]; then 55 # The auth secrets might contain spaces; in order 56 # to retain the quotation, we need to eval them 57 # here. 58 eval spppcontrol ${ifn} ${spppcontrol_args} 59 fi 60 done 61 62 # Set up all the network interfaces, calling startup scripts if needed 63 # 64 case ${network_interfaces} in 65 [Aa][Uu][Tt][Oo]) 66 network_interfaces="`ifconfig -l`" 67 ;; 68 esac 69 70 dhcp_interfaces="" 71 for ifn in ${network_interfaces}; do 72 if [ -r /etc/start_if.${ifn} ]; then 73 . /etc/start_if.${ifn} 74 eval showstat_$ifn=1 75 fi 76 77 # Do the primary ifconfig if specified 78 # 79 eval ifconfig_args=\$ifconfig_${ifn} 80 81 case ${ifconfig_args} in 82 '') 83 ;; 84 [Dd][Hh][Cc][Pp]) 85 # DHCP inits are done all in one go below 86 dhcp_interfaces="$dhcp_interfaces $ifn" 87 eval showstat_$ifn=1 88 ;; 89 *) 90 ifconfig ${ifn} ${ifconfig_args} 91 eval showstat_$ifn=1 92 ;; 93 esac 94 done 95 96 if [ ! -z "${dhcp_interfaces}" ]; then 97 ${dhcp_program:-/sbin/dhclient} ${dhcp_flags} ${dhcp_interfaces} 98 fi 99 100 for ifn in ${network_interfaces}; do 101 # Check to see if aliases need to be added 102 # 103 alias=0 104 while : ; do 105 eval ifconfig_args=\$ifconfig_${ifn}_alias${alias} 106 if [ -n "${ifconfig_args}" ]; then 107 ifconfig ${ifn} ${ifconfig_args} alias 108 eval showstat_$ifn=1 109 alias=`expr ${alias} + 1` 110 else 111 break; 112 fi 113 done 114 115 # Do ipx address if specified 116 # 117 eval ifconfig_args=\$ifconfig_${ifn}_ipx 118 if [ -n "${ifconfig_args}" ]; then 119 ifconfig ${ifn} ${ifconfig_args} 120 eval showstat_$ifn=1 121 fi 122 done 123 124 for ifn in ${network_interfaces}; do 125 eval showstat=\$showstat_${ifn} 126 if [ ! -z ${showstat} ]; then 127 ifconfig ${ifn} 128 fi 129 done 130 131 # ISDN subsystem startup 132 # 133 case ${isdn_enable} in 134 [Yy][Ee][Ss]) 135 if [ -r /etc/rc.isdn ]; then 136 . /etc/rc.isdn 137 fi 138 ;; 139 esac 140 141 # Warm up user ppp if required, must happen before natd. 142 # 143 case ${ppp_enable} in 144 [Yy][Ee][Ss]) 145 # Establish ppp mode. 146 # 147 if [ "${ppp_mode}" != "ddial" -a "${ppp_mode}" != "direct" \ 148 -a "${ppp_mode}" != "dedicated" \ 149 -a "${ppp_mode}" != "background" ]; then 150 ppp_mode="auto"; 151 fi 152 153 ppp_command="-${ppp_mode} "; 154 155 # Switch on alias mode? 156 # 157 case ${ppp_nat} in 158 [Yy][Ee][Ss]) 159 ppp_command="${ppp_command} -nat"; 160 ;; 161 esac 162 163 echo -n 'Starting ppp: '; ppp ${ppp_command} -quiet ${ppp_profile} 164 ;; 165 esac 166 167 # Initialize IP filtering using ipfw 168 # 169 echo '' 170 171 if /sbin/ipfw -q flush > /dev/null 2>&1; then 172 firewall_in_kernel=1 173 else 174 firewall_in_kernel=0 175 fi 176 177 case ${firewall_enable} in 178 [Yy][Ee][Ss]) 179 if [ "${firewall_in_kernel}" -eq 0 ] && kldload ipfw; then 180 firewall_in_kernel=1 181 echo "Kernel firewall module loaded." 182 elif [ "${firewall_in_kernel}" -eq 0 ]; then 183 echo "Warning: firewall kernel module failed to load." 184 fi 185 ;; 186 esac 187 188 # Load the filters if required 189 # 190 case ${firewall_in_kernel} in 191 1) 192 if [ -z "${firewall_script}" ]; then 193 firewall_script=/etc/rc.firewall 194 fi 195 196 case ${firewall_enable} in 197 [Yy][Ee][Ss]) 198 if [ -r "${firewall_script}" ]; then 199 . "${firewall_script}" 200 echo -n 'Firewall rules loaded, starting divert daemons:' 201 202 # Network Address Translation daemon 203 # 204 case ${natd_enable} in 205 [Yy][Ee][Ss]) 206 if [ -n "${natd_interface}" ]; then 207 if echo ${natd_interface} | \ 208 grep -q -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then 209 natd_ifarg="-a ${natd_interface}" 210 else 211 natd_ifarg="-n ${natd_interface}" 212 fi 213 214 echo -n ' natd'; ${natd_program:-/sbin/natd} ${natd_flags} ${natd_ifarg} 215 fi 216 ;; 217 esac 218 219 echo '.' 220 221 elif [ "`ipfw l 65535`" = "65535 deny ip from any to any" ]; then 222 echo -n "Warning: kernel has firewall functionality, " 223 echo "but firewall rules are not enabled." 224 echo " All ip services are disabled." 225 fi 226 ;; 227 esac 228 ;; 229 esac 230 231 # Additional ATM interface configuration 232 # 233 if [ -n "${atm_pass1_done}" ]; then 234 atm_pass2 235 fi 236 237 # Configure routing 238 # 239 case ${defaultrouter} in 240 [Nn][Oo] | '') 241 ;; 242 *) 243 static_routes="default ${static_routes}" 244 route_default="default ${defaultrouter}" 245 ;; 246 esac 247 248 # Set up any static routes. This should be done before router discovery. 249 # 250 if [ -n "${static_routes}" ]; then 251 for i in ${static_routes}; do 252 eval route_args=\$route_${i} 253 route add ${route_args} 254 done 255 fi 256 257 echo -n 'Additional routing options:' 258 case ${tcp_extensions} in 259 [Yy][Ee][Ss] | '') 260 ;; 261 *) 262 echo -n ' tcp extensions=NO' 263 sysctl -w net.inet.tcp.rfc1323=0 >/dev/null 264 ;; 265 esac 266 267 case ${icmp_bmcastecho} in 268 [Yy][Ee][Ss]) 269 echo -n ' broadcast ping responses=YES' 270 sysctl -w net.inet.icmp.bmcastecho=1 >/dev/null 271 ;; 272 esac 273 274 case ${icmp_drop_redirect} in 275 [Yy][Ee][Ss]) 276 echo -n ' ignore ICMP redirect=YES' 277 sysctl -w net.inet.icmp.drop_redirect=1 >/dev/null 278 ;; 279 esac 280 281 case ${icmp_log_redirect} in 282 [Yy][Ee][Ss]) 283 echo -n ' log ICMP redirect=YES' 284 sysctl -w net.inet.icmp.log_redirect=1 >/dev/null 285 ;; 286 esac 287 288 case ${gateway_enable} in 289 [Yy][Ee][Ss]) 290 echo -n ' IP gateway=YES' 291 sysctl -w net.inet.ip.forwarding=1 >/dev/null 292 ;; 293 esac 294 295 case ${forward_sourceroute} in 296 [Yy][Ee][Ss]) 297 echo -n ' do source routing=YES' 298 sysctl -w net.inet.ip.sourceroute=1 >/dev/null 299 ;; 300 esac 301 302 case ${accept_sourceroute} in 303 [Yy][Ee][Ss]) 304 echo -n ' accept source routing=YES' 305 sysctl -w net.inet.ip.accept_sourceroute=1 >/dev/null 306 ;; 307 esac 308 309 case ${tcp_keepalive} in 310 [Yy][Ee][Ss]) 311 echo -n ' TCP keepalive=YES' 312 sysctl -w net.inet.tcp.always_keepalive=1 >/dev/null 313 ;; 314 esac 315 316 case ${tcp_restrict_rst} in 317 [Yy][Ee][Ss]) 318 echo -n ' restrict TCP reset=YES' 319 sysctl -w net.inet.tcp.restrict_rst=1 >/dev/null 320 ;; 321 esac 322 323 case ${tcp_drop_synfin} in 324 [Yy][Ee][Ss]) 325 echo -n ' drop SYN+FIN packets=YES' 326 sysctl -w net.inet.tcp.drop_synfin=1 >/dev/null 327 ;; 328 esac 329 330 case ${ipxgateway_enable} in 331 [Yy][Ee][Ss]) 332 echo -n ' IPX gateway=YES' 333 sysctl -w net.ipx.ipx.ipxforwarding=1 >/dev/null 334 ;; 335 esac 336 337 case ${arpproxy_all} in 338 [Yy][Ee][Ss]) 339 echo -n ' ARP proxyall=YES' 340 sysctl -w net.link.ether.inet.proxyall=1 >/dev/null 341 ;; 342 esac 343 echo '.' 344 345 echo -n 'routing daemons:' 346 case ${router_enable} in 347 [Yy][Ee][Ss]) 348 echo -n " ${router}"; ${router} ${router_flags} 349 ;; 350 esac 351 352 case ${ipxrouted_enable} in 353 [Yy][Ee][Ss]) 354 echo -n ' IPXrouted' 355 IPXrouted ${ipxrouted_flags} > /dev/null 2>&1 356 ;; 357 esac 358 359 case ${mrouted_enable} in 360 [Yy][Ee][Ss]) 361 echo -n ' mrouted'; mrouted ${mrouted_flags} 362 ;; 363 esac 364 365 case ${rarpd_enable} in 366 [Yy][Ee][Ss]) 367 echo -n ' rarpd'; rarpd ${rarpd_flags} 368 ;; 369 esac 370 echo '.' 371 372 # Let future generations know we made it. 373 # 374 network_pass1_done=YES 375} 376 377network_pass2() { 378 echo -n 'Doing additional network setup:' 379 case ${named_enable} in 380 [Yy][Ee][Ss]) 381 echo -n ' named'; ${named_program:-named} ${named_flags} 382 ;; 383 esac 384 385 case ${ntpdate_enable} in 386 [Yy][Ee][Ss]) 387 echo -n ' ntpdate' 388 ${ntpdate_program:-ntpdate} ${ntpdate_flags} >/dev/null 2>&1 389 ;; 390 esac 391 392 case ${xntpd_enable} in 393 [Yy][Ee][Ss]) 394 echo -n ' ntpd'; ${xntpd_program:-ntpd} ${xntpd_flags} 395 ;; 396 esac 397 398 case ${timed_enable} in 399 [Yy][Ee][Ss]) 400 echo -n ' timed'; timed ${timed_flags} 401 ;; 402 esac 403 404 case ${portmap_enable} in 405 [Yy][Ee][Ss]) 406 echo -n ' portmap'; ${portmap_program:-/usr/sbin/portmap} ${portmap_flags} 407 ;; 408 esac 409 410 # Start ypserv if we're an NIS server. 411 # Run rpc.ypxfrd and rpc.yppasswdd only on the NIS master server. 412 # 413 case ${nis_server_enable} in 414 [Yy][Ee][Ss]) 415 echo -n ' ypserv'; ypserv ${nis_server_flags} 416 417 case ${nis_ypxfrd_enable} in 418 [Yy][Ee][Ss]) 419 echo -n ' rpc.ypxfrd' 420 rpc.ypxfrd ${nis_ypxfrd_flags} 421 ;; 422 esac 423 424 case ${nis_yppasswdd_enable} in 425 [Yy][Ee][Ss]) 426 echo -n ' rpc.yppasswdd' 427 rpc.yppasswdd ${nis_yppasswdd_flags} 428 ;; 429 esac 430 ;; 431 esac 432 433 # Start ypbind if we're an NIS client 434 # 435 case ${nis_client_enable} in 436 [Yy][Ee][Ss]) 437 echo -n ' ypbind'; ypbind ${nis_client_flags} 438 case ${nis_ypset_enable} in 439 [Yy][Ee][Ss]) 440 echo -n ' ypset'; ypset ${nis_ypset_flags} 441 ;; 442 esac 443 ;; 444 esac 445 446 # Start keyserv if we are running Secure RPC 447 # 448 case ${keyserv_enable} in 449 [Yy][Ee][Ss]) 450 echo -n ' keyserv'; keyserv ${keyserv_flags} 451 ;; 452 esac 453 454 # Start ypupdated if we are running Secure RPC and we are NIS master 455 # 456 case ${rpc_ypupdated_enable} in 457 [Yy][Ee][Ss]) 458 echo -n ' rpc.ypupdated'; rpc.ypupdated 459 ;; 460 esac 461 462 # Start ATM daemons 463 if [ -n "${atm_pass2_done}" ]; then 464 atm_pass3 465 fi 466 467 echo '.' 468 network_pass2_done=YES 469} 470 471network_pass3() { 472 echo -n 'Starting final network daemons:' 473 474 case ${nfs_server_enable} in 475 [Yy][Ee][Ss]) 476 if [ -r /etc/exports ]; then 477 echo -n ' mountd' 478 479 case ${weak_mountd_authentication} in 480 [Yy][Ee][Ss]) 481 mountd_flags="-n" 482 ;; 483 esac 484 485 mountd ${mountd_flags} 486 487 case ${nfs_reserved_port_only} in 488 [Yy][Ee][Ss]) 489 echo -n ' NFS on reserved port only=YES' 490 sysctl -w vfs.nfs.nfs_privport=1 >/dev/null 491 ;; 492 esac 493 494 echo -n ' nfsd'; nfsd ${nfs_server_flags} 495 496 if [ -n "${nfs_bufpackets}" ]; then 497 sysctl -w vfs.nfs.bufpackets=${nfs_bufpackets} \ 498 > /dev/null 499 fi 500 501 case ${rpc_lockd_enable} in 502 [Yy][Ee][Ss]) 503 echo -n ' rpc.lockd'; rpc.lockd 504 ;; 505 esac 506 507 case ${rpc_statd_enable} in 508 [Yy][Ee][Ss]) 509 echo -n ' rpc.statd'; rpc.statd 510 ;; 511 esac 512 fi 513 ;; 514 *) 515 case ${single_mountd_enable} in 516 [Yy][Ee][Ss]) 517 if [ -r /etc/exports ]; then 518 echo -n ' mountd' 519 520 case ${weak_mountd_authentication} in 521 [Yy][Ee][Ss]) 522 mountd_flags="-n" 523 ;; 524 esac 525 526 mountd ${mountd_flags} 527 fi 528 ;; 529 esac 530 ;; 531 esac 532 533 case ${nfs_client_enable} in 534 [Yy][Ee][Ss]) 535 echo -n ' nfsiod'; nfsiod ${nfs_client_flags} 536 if [ -n "${nfs_access_cache}" ]; then 537 echo -n " NFS access cache time=${nfs_access_cache}" 538 sysctl -w vfs.nfs.access_cache_timeout=${nfs_access_cache} \ 539 >/dev/null 540 fi 541 ;; 542 esac 543 544 # If /var/db/mounttab exists, some nfs-server has not been 545 # sucessfully notified about a previous client shutdown. 546 # If there is no /var/db/mounttab, we do nothing. 547 if [ -f /var/db/mounttab ]; then 548 rpc.umntall -k 549 fi 550 551 case ${amd_enable} in 552 [Yy][Ee][Ss]) 553 echo -n ' amd' 554 case ${amd_map_program} in 555 [Nn][Oo] | '') 556 ;; 557 *) 558 amd_flags="${amd_flags} `eval ${amd_map_program}`" 559 ;; 560 esac 561 562 if [ -n "${amd_flags}" ]; then 563 amd -p ${amd_flags} > /var/run/amd.pid 2> /dev/null 564 else 565 amd 2> /dev/null 566 fi 567 ;; 568 esac 569 570 case ${rwhod_enable} in 571 [Yy][Ee][Ss]) 572 echo -n ' rwhod'; rwhod ${rwhod_flags} 573 ;; 574 esac 575 576 # Kerberos runs ONLY on the Kerberos server machine 577 case ${kerberos_server_enable} in 578 [Yy][Ee][Ss]) 579 case ${kerberos_stash} in 580 [Yy][Ee][Ss]) 581 stash_flag=-n 582 ;; 583 *) 584 stash_flag= 585 ;; 586 esac 587 588 echo -n ' kerberos' 589 kerberos ${stash_flag} >> /var/log/kerberos.log & 590 591 case ${kadmind_server_enable} in 592 [Yy][Ee][Ss]) 593 echo -n ' kadmind' 594 (sleep 20; kadmind ${stash_flag} >/dev/null 2>&1 &) & 595 ;; 596 esac 597 unset stash_flag 598 ;; 599 esac 600 601 case ${pppoed_enable} in 602 [Yy][Ee][Ss]) 603 if [ -n "${pppoed_provider}" ]; then 604 pppoed_flags="${pppoed_flags} -p ${pppoed_provider}" 605 fi 606 echo -n ' pppoed'; 607 /usr/libexec/pppoed ${pppoed_flags} ${pppoed_interface} 608 ;; 609 esac 610 611 case ${sshd_enable} in 612 [Yy][Ee][Ss]) 613 if [ ! -f /etc/ssh/ssh_host_key ]; then 614 echo ' creating ssh host key'; 615 /usr/bin/ssh-keygen -N "" -f /etc/ssh/ssh_host_key 616 fi 617 ;; 618 esac 619 620 echo '.' 621 network_pass3_done=YES 622} 623 624network_pass4() { 625 echo -n 'Additional TCP options:' 626 case ${log_in_vain} in 627 [Nn][Oo] | '') 628 ;; 629 *) 630 echo -n ' log_in_vain=YES' 631 sysctl -w net.inet.tcp.log_in_vain=1 >/dev/null 632 sysctl -w net.inet.udp.log_in_vain=1 >/dev/null 633 ;; 634 esac 635 636 echo '.' 637 network_pass4_done=YES 638} 639