network.subr revision 41371
125184Sjkh#!/bin/sh -
225184Sjkh#
341371Sjkoshy#	$Id: rc.network,v 1.35 1998/11/15 20:30:04 msmith Exp $
425184Sjkh#	From: @(#)netstart	5.9 (Berkeley) 3/30/91
525184Sjkh
625184Sjkh# Note that almost all the user-configurable behavior is no longer in
725184Sjkh# this file, but rather in /etc/rc.conf.  Please check that file
825184Sjkh# first before contemplating any changes here.  If you do need to change
925184Sjkh# this file for some reason, we would like to know about it.
1025184Sjkh
1125184Sjkh# First pass startup stuff.
1225184Sjkh
1325184Sjkhnetwork_pass1() {
1425184Sjkh    echo -n 'Doing initial network setup:'
1525184Sjkh    # Set the host name if it is not already set
1625184Sjkh    if [ -z "`hostname -s`" ] ; then
1725184Sjkh	    hostname $hostname
1825184Sjkh	    echo -n ' hostname'
1925184Sjkh    fi
2025184Sjkh
2125184Sjkh    # Set the domainname if we're using NIS
2225184Sjkh    if [ -n "$nisdomainname" -a "x$nisdomainname" != "xNO" ] ; then
2325184Sjkh	    domainname $nisdomainname
2425184Sjkh	    echo -n ' domain'
2525184Sjkh    fi
2625184Sjkh    echo '.'
2725184Sjkh
2840006Sphk    # Initial ATM interface configuration
2940006Sphk    if [ "X${atm_enable}" = X"YES" -a -f /etc/rc.atm ]; then
3040006Sphk	    . /etc/rc.atm
3140006Sphk	    atm_pass1
3240006Sphk    fi
3340006Sphk
3425184Sjkh    # Set up all the network interfaces, calling startup scripts if needed
3525184Sjkh    for ifn in ${network_interfaces}; do
3625184Sjkh	    if [ -e /etc/start_if.${ifn} ]; then
3733682Sbrian		    . /etc/start_if.${ifn}
3825184Sjkh	    fi
3925184Sjkh	    # Do the primary ifconfig if specified
4025184Sjkh	    eval ifconfig_args=\$ifconfig_${ifn}
4125184Sjkh	    if [ -n "${ifconfig_args}" ] ; then
4225184Sjkh		    ifconfig ${ifn} ${ifconfig_args}
4325184Sjkh	    fi
4425184Sjkh	    # Check to see if aliases need to be added
4525184Sjkh	    alias=0
4625184Sjkh	    while :
4725184Sjkh	    do
4825184Sjkh		    eval ifconfig_args=\$ifconfig_${ifn}_alias${alias}
4925184Sjkh		    if [ -n "${ifconfig_args}" ]; then
5025184Sjkh			    ifconfig ${ifn} ${ifconfig_args} alias
5125184Sjkh			    alias=`expr ${alias} + 1`
5225184Sjkh		    else
5325184Sjkh			    break;
5425184Sjkh		    fi
5525184Sjkh	    done
5625184Sjkh	    # Do ipx address if specified
5725184Sjkh	    eval ifconfig_args=\$ifconfig_${ifn}_ipx
5825184Sjkh	    if [ -n "${ifconfig_args}" ]; then
5925184Sjkh		    ifconfig ${ifn} ${ifconfig_args}
6025184Sjkh	    fi
6125184Sjkh	    ifconfig ${ifn}
6225184Sjkh    done
6329300Sdanny
6429300Sdanny    # Initialize IP filtering using ipfw
6529300Sdanny    echo ""
6629300Sdanny    /sbin/ipfw -q flush > /dev/null 2>&1
6732382Salex    if [ $? = 0 ] ; then
6832382Salex	firewall_in_kernel=1
6932382Salex    else 
7029300Sdanny	firewall_in_kernel=0
7129300Sdanny    fi
7229300Sdanny
7329300Sdanny    if [ $firewall_in_kernel = 0 -a "x$firewall_enable"  = "xYES" ] ; then
7441077Speter	if kldload ipfw; then
7529300Sdanny		firewall_in_kernel=1		# module loaded successfully
7629300Sdanny		echo "Kernel firewall module loaded."
7729300Sdanny	else
7829300Sdanny		echo "Warning: firewall kernel module failed to load."
7929300Sdanny	fi
8029300Sdanny    fi
8129300Sdanny
8229300Sdanny    # Load the filters if required
8329300Sdanny    if [ $firewall_in_kernel = 1 ]; then
8429300Sdanny	if [ -n "$firewall_enable" -a -f /etc/rc.firewall -a \
8529300Sdanny		"x$firewall_enable" = "xYES" ] ; then
8625364Sjkh	    . /etc/rc.firewall
8729300Sdanny	    echo "Firewall rules loaded."
8829300Sdanny	else
8933337Salex	    IPFW_DEFAULT=`ipfw l 65535`
9033337Salex	    if [ "$IPFW_DEFAULT" = "65535 deny ip from any to any" ]; then
9133149Salex		echo -n "Warning: kernel has firewall functionality, "
9233149Salex		echo "but firewall rules are not enabled."
9333149Salex		echo "         All ip services are disabled."
9433149Salex	    fi
9529300Sdanny	fi
9625184Sjkh    fi
9725184Sjkh
9840006Sphk    # Additional ATM interface configuration
9940006Sphk    if [ -n "${atm_pass1_done}" ]; then
10040006Sphk	    atm_pass2
10140006Sphk    fi
10240006Sphk
10329300Sdanny    # Configure routing
10429300Sdanny
10525184Sjkh    if [ "x$defaultrouter" != "xNO" ] ; then
10625184Sjkh	    static_routes="default ${static_routes}"
10725184Sjkh	    route_default="default ${defaultrouter}"
10825184Sjkh    fi
10925184Sjkh    
11025184Sjkh    # Set up any static routes.  This should be done before router discovery.
11125184Sjkh    if [ "x${static_routes}" != "x" ]; then
11225184Sjkh	    for i in ${static_routes}; do
11325184Sjkh		    eval route_args=\$route_${i}
11425184Sjkh		    route add ${route_args}
11525184Sjkh	    done
11625184Sjkh    fi
11725184Sjkh
11825184Sjkh    echo -n 'Additional routing options:'
11927218Spst    if [ -n "$tcp_extensions" -a "x$tcp_extensions" != "xYES" ] ; then
12027218Spst	    echo -n ' tcp extensions=NO'
12127218Spst	    sysctl -w net.inet.tcp.rfc1323=0 >/dev/null 2>&1
12227218Spst    fi
12327218Spst
12439267Sjkoshy    if [ X"$icmp_bmcastecho" = X"YES" ]; then
12539267Sjkoshy	    echo -n ' broadcast ping responses=YES'
12639267Sjkoshy	    sysctl -w net.inet.icmp.bmcastecho=1 >/dev/null 2>&1
12739267Sjkoshy    fi
12839267Sjkoshy
12925184Sjkh    if [ "X$gateway_enable" = X"YES" ]; then
13025365Sjkh	    echo -n ' IP gateway=YES'
13125184Sjkh	    sysctl -w net.inet.ip.forwarding=1 >/dev/null 2>&1
13225184Sjkh    fi
13325184Sjkh    
13433439Sguido    if [ "X$forward_sourceroute" = X"YES" ]; then
13533439Sguido	    echo -n ' do source routing=YES'
13633439Sguido	    sysctl -w net.inet.ip.sourceroute=1 >/dev/null 2>&1
13733439Sguido    fi
13833439Sguido
13933439Sguido    if [ "X$accept_sourceroute" = X"YES" ]; then
14033439Sguido	    echo -n ' accept source routing=YES'
14133439Sguido	    sysctl -w net.inet.ip.accept_sourceroute=1 >/dev/null 2>&1
14233439Sguido    fi
14333439Sguido
14425184Sjkh    if [ "X$ipxgateway_enable" = X"YES" ]; then
14525365Sjkh	    echo -n ' IPX gateway=YES'
14625184Sjkh	    sysctl -w net.ipx.ipx.ipxforwarding=1 >/dev/null 2>&1
14725184Sjkh    fi
14825184Sjkh    
14936174Sjkh    if [ "X$arpproxy_all" = X"YES" ]; then
15036174Sjkh	    echo -n ' enabling ARP_PROXY_ALL: '
15136174Sjkh	    sysctl -w net.link.ether.inet.proxyall=1 2>&1
15236174Sjkh    fi
15336174Sjkh    echo '.'
15436174Sjkh
15536174Sjkh    echo -n 'routing daemons:'
15636174Sjkh    if [ "X$router_enable" = X"YES" ]; then
15736174Sjkh	    echo -n " ${router}";	${router} ${router_flags}
15836174Sjkh    fi
15936174Sjkh    
16025184Sjkh    if [ "X$ipxrouted_enable" = X"YES" ]; then
16136174Sjkh	    echo -n ' IPXrouted'
16225184Sjkh	    IPXrouted ${ipxrouted_flags} > /dev/null 2>&1
16325184Sjkh    fi
16425765Sjkh    
16536174Sjkh    if [ "X${mrouted_enable}" = X"YES" ]; then
16636174Sjkh	    echo -n ' mrouted'; mrouted ${mrouted_flags}
16725765Sjkh    fi
16836174Sjkh
16934395Sjkh    if [ "X$rarpd_enable" = X"YES" ]; then
17034395Sjkh	    echo -n ' rarpd';     rarpd ${rarpd_flags}
17134395Sjkh    fi
17225184Sjkh    echo '.'
17325184Sjkh    network_pass1_done=YES	# Let future generations know we made it.
17425184Sjkh}
17525184Sjkh
17625184Sjkhnetwork_pass2() {
17725184Sjkh    echo -n 'Doing additional network setup:'
17825184Sjkh    if [ "X${named_enable}" = X"YES" ]; then
17932949Swollman	    echo -n ' named';		${named_program-"named"} ${named_flags}
18025184Sjkh    fi
18125184Sjkh
18231472Sobrien    if [ "X${ntpdate_enable}" = X"YES" ]; then
18335787Sandreas	    echo -n ' ntpdate';	${ntpdate_program} ${ntpdate_flags} >/dev/null 2>&1
18431472Sobrien    fi
18525184Sjkh
18631472Sobrien    if [ "X${xntpd_enable}" = X"YES" ]; then
18735787Sandreas	    echo -n ' xntpd';	${xntpd_program} ${xntpd_flags}
18825184Sjkh    fi
18925184Sjkh
19025184Sjkh    if [ "X${timed_enable}" = X"YES" ]; then
19125184Sjkh	    echo -n ' timed';		timed ${timed_flags}
19225184Sjkh    fi
19325184Sjkh
19425184Sjkh    if [ "X${portmap_enable}" = X"YES" ]; then
19525184Sjkh	    echo -n ' portmap';		portmap ${portmap_flags}
19625184Sjkh    fi
19725184Sjkh
19825184Sjkh    # Start ypserv if we're an NIS server.
19925184Sjkh    # Run rpc.ypxfrd and rpc.yppasswdd only on the NIS master server.
20025184Sjkh    if [ "X${nis_server_enable}" = X"YES" ]; then
20125184Sjkh	    echo -n ' ypserv'; ypserv ${nis_server_flags}
20225184Sjkh	    
20325184Sjkh	    if [ "X${nis_ypxfrd_enable}" = X"YES" ]; then
20425184Sjkh		    echo -n ' rpc.ypxfrd'; rpc.ypxfrd ${nis_ypxfrd_flags}
20525184Sjkh	    fi
20625184Sjkh	    
20725184Sjkh	    if [ "X${nis_yppasswdd_enable}" = X"YES" ]; then
20825184Sjkh		    echo -n ' rpc.yppasswdd'; rpc.yppasswdd ${nis_yppasswdd_flags}
20925184Sjkh	    fi
21025184Sjkh    fi
21125184Sjkh
21225184Sjkh    # Start ypbind if we're an NIS client
21325184Sjkh    if [ "X${nis_client_enable}" = X"YES" ]; then
21425184Sjkh	    echo -n ' ypbind'; ypbind ${nis_client_flags}
21525184Sjkh	    if [ "X${nis_ypset_enable}" = X"YES" ]; then
21625184Sjkh		    echo -n ' ypset'; ypset ${nis_ypset_flags}
21725184Sjkh	    fi
21825184Sjkh    fi
21925184Sjkh
22035149Smarkm    # Start keyserv if we are running Secure RPC
22135149Smarkm    if [ "X${keyserv_enable}" = X"YES" ]; then
22235149Smarkm	    echo -n ' keyserv';		keyserv ${keyserv_flags}
22335149Smarkm    fi
22435149Smarkm    # Start ypupdated if we are running Secure RPC and we are NIS master
22535149Smarkm    if [ "X$rpc_ypupdated_enable" = X"YES" ]; then
22635149Smarkm	    echo -n ' rpc.ypupdated';	rpc.ypupdated
22735149Smarkm    fi
22835149Smarkm
22940006Sphk    # Start ATM daemons
23040006Sphk    if [ -n "${atm_pass2_done}" ]; then
23140006Sphk	    atm_pass3
23240006Sphk    fi
23340006Sphk
23425184Sjkh    echo '.'
23525184Sjkh    network_pass2_done=YES
23625184Sjkh}
23725184Sjkh
23825184Sjkhnetwork_pass3() {
23925184Sjkh    echo -n 'Starting final network daemons:'
24025184Sjkh
24125184Sjkh    if [ "X${nfs_server_enable}" = X"YES" -a -r /etc/exports ]; then
24225184Sjkh	    echo -n ' mountd'
24325184Sjkh	    if [ "X${weak_mountd_authentication}" = X"YES" ]; then
24425184Sjkh		    mountd_flags="-n"
24525184Sjkh	    fi
24625184Sjkh	    mountd ${mountd_flags}
24725184Sjkh	    if [ "X${nfs_reserved_port_only}" = X"YES" ]; then
24825184Sjkh		    sysctl -w vfs.nfs.nfs_privport=1 >/dev/null 2>&1
24925184Sjkh	    fi
25025916Sjkh	    echo -n ' nfsd';		nfsd ${nfs_server_flags}
25125184Sjkh	    if [ "X$rpc_lockd_enable" = X"YES" ]; then
25225184Sjkh		echo -n ' rpc.lockd';		rpc.lockd
25325184Sjkh	    fi
25425184Sjkh	    if [ "X$rpc_statd_enable" = X"YES" ]; then
25525184Sjkh		echo -n ' rpc.statd';		rpc.statd
25625184Sjkh	    fi
25725184Sjkh    fi
25825184Sjkh    
25925184Sjkh    if [ "X${nfs_client_enable}" = X"YES" ]; then
26025916Sjkh	    echo -n ' nfsiod';		nfsiod ${nfs_client_flags}
26141371Sjkoshy	    if [ "X${nfs_access_cache}" != X ]; then
26241371Sjkoshy		sysctl -w vfs.nfs.access_cache_timeout=${nfs_access_cache} \
26341371Sjkoshy			>/dev/null 2>&1
26441185Smsmith	    fi
26525184Sjkh    fi
26625184Sjkh
26725184Sjkh    if [ "X${amd_enable}" = X"YES" ]; then
26825184Sjkh	    echo -n ' amd'
26935459Sphk	    if [ "X${amd_map_program}" != X"NO" ]; then
27039380Scracauer		amd_flags="${amd_flags} `eval ${amd_map_program}`"
27135459Sphk	    fi
27225184Sjkh	    amd -p ${amd_flags} > /var/run/amd.pid 2> /dev/null
27325184Sjkh    fi
27425184Sjkh
27525184Sjkh    if [ "X${rwhod_enable}" = X"YES" ]; then
27625184Sjkh	    echo -n ' rwhod';	rwhod
27725184Sjkh    fi
27825184Sjkh
27925184Sjkh    # Kerberos runs ONLY on the Kerberos server machine
28025184Sjkh    if [ "X${kerberos_server_enable}" = X"YES" ]; then
28131033Ssef	    if [ "X${kerberos_stash}" = "XYES" ]; then
28231033Ssef		stash_flag=-n
28331033Ssef	    else
28431033Ssef		stash_flag=
28531033Ssef	    fi
28631033Ssef	    echo -n ' kerberos'; \
28738316Sphk		kerberos ${stash_flag} >> /var/log/kerberos.log &
28831033Ssef	    if [ "X${kadmind_server_enable}" = "XYES" ]; then
28931033Ssef		echo -n ' kadmind'; \
29038316Sphk		(sleep 20; kadmind ${stash_flag} >/dev/null 2>&1 &) &
29131033Ssef	    fi
29231033Ssef	    unset stash_flag
29325184Sjkh    fi
29425184Sjkh    
29535267Sbrian    # Network Address Translation daemon
29637514Snectar       if [ "X${natd_enable}" = X"YES" -a X"${natd_interface}" != X"" \
29737514Snectar               -a X"${firewall_enable}" = X"YES" ]; then
29837514Snectar               if echo ${natd_interface} | \
29937514Snectar                       grep -q -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
30037514Snectar                       natd_ifarg="-a ${natd_interface}"
30137514Snectar               else
30237514Snectar                       natd_ifarg="-n ${natd_interface}"
30337514Snectar               fi
30437514Snectar               echo -n ' natd'; natd ${natd_flags} ${natd_ifarg}
30537514Snectar       fi
30635267Sbrian
30725184Sjkh    echo '.'
30825184Sjkh    network_pass3_done=YES
30925184Sjkh}
310