netoptions revision 54458
1#!/bin/sh - 2# 3# $FreeBSD: head/etc/rc.d/netoptions 54458 1999-12-12 01:58:30Z obrien $ 4# From: @(#)netstart 5.9 (Berkeley) 3/30/91 5 6# Note that almost all of the user-configurable behavior is no longer in 7# this file, but rather in /etc/defaults/rc.conf. Please check that file 8# first before contemplating any changes here. If you do need to change 9# this file for some reason, we would like to know about it. 10 11# First pass startup stuff. 12# 13network_pass1() { 14 echo -n 'Doing initial network setup:' 15 16 # Set the host name if it is not already set 17 # 18 if [ -z "`hostname -s`" ]; then 19 hostname ${hostname} 20 echo -n ' hostname' 21 fi 22 23 # Set the domainname if we're using NIS 24 # 25 case ${nisdomainname} in 26 [Nn][Oo] | '') 27 ;; 28 *) 29 domainname ${nisdomainname} 30 echo -n ' domain' 31 ;; 32 esac 33 34 echo '.' 35 36 # Initial ATM interface configuration 37 # 38 case ${atm_enable} in 39 [Yy][Ee][Ss]) 40 if [ -r /etc/rc.atm ]; then 41 . /etc/rc.atm 42 atm_pass1 43 fi 44 ;; 45 esac 46 47 # ISDN subsystem startup 48 # 49 case ${isdn_enable} in 50 [Yy][Ee][Ss]) 51 if [ -r /etc/rc.isdn ]; then 52 . /etc/rc.isdn 53 fi 54 ;; 55 esac 56 57 # Special options for sppp(4) interfaces go here. These need 58 # to go _before_ the general ifconfig section, since in the case 59 # of hardwired (no link1 flag) but required authentication, you 60 # cannot pass auth parameters down to the already running interface. 61 # 62 for ifn in ${sppp_interfaces}; do 63 eval spppcontrol_args=\$spppconfig_${ifn} 64 if [ -n "${spppcontrol_args}" ]; then 65 # The auth secrets might contain spaces; in order 66 # to retain the quotation, we need to eval them 67 # here. 68 eval spppcontrol ${ifn} ${spppcontrol_args} 69 fi 70 done 71 72 # Set up all the network interfaces, calling startup scripts if needed 73 # 74 case ${network_interfaces} in 75 [Aa][Uu][Tt][Oo]) 76 network_interfaces="`ifconfig -l`" 77 ;; 78 esac 79 80 dhcp_interfaces="" 81 for ifn in ${network_interfaces}; do 82 if [ -r /etc/start_if.${ifn} ]; then 83 . /etc/start_if.${ifn} 84 eval showstat_$ifn=1 85 fi 86 87 # Do the primary ifconfig if specified 88 # 89 eval ifconfig_args=\$ifconfig_${ifn} 90 91 case ${ifconfig_args} in 92 '') 93 ;; 94 [Dd][Hh][Cc][Pp]) 95 # DHCP inits are done all in one go below 96 dhcp_interfaces="$dhcp_interfaces $ifn" 97 eval showstat_$ifn=1 98 ;; 99 *) 100 ifconfig ${ifn} ${ifconfig_args} 101 eval showstat_$ifn=1 102 ;; 103 esac 104 done 105 106 if [ ! -z "${dhcp_interfaces}" ]; then 107 ${dhcp_program:-/sbin/dhclient} ${dhcp_flags} ${dhcp_interfaces} 108 fi 109 110 for ifn in ${network_interfaces}; do 111 # Check to see if aliases need to be added 112 # 113 alias=0 114 while : ; do 115 eval ifconfig_args=\$ifconfig_${ifn}_alias${alias} 116 if [ -n "${ifconfig_args}" ]; then 117 ifconfig ${ifn} ${ifconfig_args} alias 118 eval showstat_$ifn=1 119 alias=`expr ${alias} + 1` 120 else 121 break; 122 fi 123 done 124 125 # Do ipx address if specified 126 # 127 eval ifconfig_args=\$ifconfig_${ifn}_ipx 128 if [ -n "${ifconfig_args}" ]; then 129 ifconfig ${ifn} ${ifconfig_args} 130 eval showstat_$ifn=1 131 fi 132 done 133 134 for ifn in ${network_interfaces}; do 135 eval showstat=\$showstat_${ifn} 136 if [ ! -z ${showstat} ]; then 137 ifconfig ${ifn} 138 fi 139 done 140 141 # Warm up user ppp if required, must happen before natd. 142 # 143 case ${ppp_enable} in 144 [Yy][Ee][Ss]) 145 # Establish ppp mode. 146 # 147 if [ "${ppp_mode}" != "ddial" -a "${ppp_mode}" != "direct" \ 148 -a "${ppp_mode}" != "dedicated" \ 149 -a "${ppp_mode}" != "background" ]; then 150 ppp_mode="auto"; 151 fi 152 153 ppp_command="-${ppp_mode} "; 154 155 # Switch on alias mode? 156 # 157 case ${ppp_nat} in 158 [Yy][Ee][Ss]) 159 ppp_command="${ppp_command} -nat"; 160 ;; 161 esac 162 163 echo -n 'Starting ppp: '; ppp ${ppp_command} -quiet ${ppp_profile} 164 ;; 165 esac 166 167 # Initialize IP filtering using ipfw 168 # 169 echo '' 170 171 if /sbin/ipfw -q flush > /dev/null 2>&1; then 172 firewall_in_kernel=1 173 else 174 firewall_in_kernel=0 175 fi 176 177 case ${firewall_enable} in 178 [Yy][Ee][Ss]) 179 if [ "${firewall_in_kernel}" -eq 0 ] && kldload ipfw; then 180 firewall_in_kernel=1 181 echo "Kernel firewall module loaded." 182 elif [ "${firewall_in_kernel}" -eq 0 ]; then 183 echo "Warning: firewall kernel module failed to load." 184 fi 185 ;; 186 esac 187 188 # Load the filters if required 189 # 190 case ${firewall_in_kernel} in 191 1) 192 if [ -z "${firewall_script}" ]; then 193 firewall_script=/etc/rc.firewall 194 fi 195 196 case ${firewall_enable} in 197 [Yy][Ee][Ss]) 198 if [ -r "${firewall_script}" ]; then 199 . "${firewall_script}" 200 echo -n 'Firewall rules loaded, starting divert daemons:' 201 202 # Network Address Translation daemon 203 # 204 case ${natd_enable} in 205 [Yy][Ee][Ss]) 206 if [ -n "${natd_interface}" ]; then 207 if echo ${natd_interface} | \ 208 grep -q -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then 209 natd_ifarg="-a ${natd_interface}" 210 else 211 natd_ifarg="-n ${natd_interface}" 212 fi 213 214 echo -n ' natd'; ${natd_program:-/sbin/natd} ${natd_flags} ${natd_ifarg} 215 fi 216 ;; 217 esac 218 219 echo '.' 220 221 elif [ "`ipfw l 65535`" = "65535 deny ip from any to any" ]; then 222 echo -n "Warning: kernel has firewall functionality, " 223 echo "but firewall rules are not enabled." 224 echo " All ip services are disabled." 225 fi 226 ;; 227 esac 228 ;; 229 esac 230 231 # Additional ATM interface configuration 232 # 233 if [ -n "${atm_pass1_done}" ]; then 234 atm_pass2 235 fi 236 237 # Configure routing 238 # 239 case ${defaultrouter} in 240 [Nn][Oo] | '') 241 ;; 242 *) 243 static_routes="default ${static_routes}" 244 route_default="default ${defaultrouter}" 245 ;; 246 esac 247 248 # Set up any static routes. This should be done before router discovery. 249 # 250 if [ -n "${static_routes}" ]; then 251 for i in ${static_routes}; do 252 eval route_args=\$route_${i} 253 route add ${route_args} 254 done 255 fi 256 257 echo -n 'Additional routing options:' 258 case ${tcp_extensions} in 259 [Yy][Ee][Ss] | '') 260 ;; 261 *) 262 echo -n ' tcp extensions=NO' 263 sysctl -w net.inet.tcp.rfc1323=0 >/dev/null 264 ;; 265 esac 266 267 case ${icmp_bmcastecho} in 268 [Yy][Ee][Ss]) 269 echo -n ' broadcast ping responses=YES' 270 sysctl -w net.inet.icmp.bmcastecho=1 >/dev/null 271 ;; 272 esac 273 274 case ${icmp_drop_redirect} in 275 [Yy][Ee][Ss]) 276 echo -n ' ignore ICMP redirect=YES' 277 sysctl -w net.inet.icmp.drop_redirect=1 >/dev/null 278 ;; 279 esac 280 281 case ${icmp_log_redirect} in 282 [Yy][Ee][Ss]) 283 echo -n ' log ICMP redirect=YES' 284 sysctl -w net.inet.icmp.log_redirect=1 >/dev/null 285 ;; 286 esac 287 288 case ${gateway_enable} in 289 [Yy][Ee][Ss]) 290 echo -n ' IP gateway=YES' 291 sysctl -w net.inet.ip.forwarding=1 >/dev/null 292 ;; 293 esac 294 295 case ${forward_sourceroute} in 296 [Yy][Ee][Ss]) 297 echo -n ' do source routing=YES' 298 sysctl -w net.inet.ip.sourceroute=1 >/dev/null 299 ;; 300 esac 301 302 case ${accept_sourceroute} in 303 [Yy][Ee][Ss]) 304 echo -n ' accept source routing=YES' 305 sysctl -w net.inet.ip.accept_sourceroute=1 >/dev/null 306 ;; 307 esac 308 309 case ${tcp_keepalive} in 310 [Yy][Ee][Ss]) 311 echo -n ' TCP keepalive=YES' 312 sysctl -w net.inet.tcp.always_keepalive=1 >/dev/null 313 ;; 314 esac 315 316 case ${tcp_restrict_rst} in 317 [Yy][Ee][Ss]) 318 echo -n ' restrict TCP reset=YES' 319 sysctl -w net.inet.tcp.restrict_rst=1 >/dev/null 320 ;; 321 esac 322 323 case ${tcp_drop_synfin} in 324 [Yy][Ee][Ss]) 325 echo -n ' drop SYN+FIN packets=YES' 326 sysctl -w net.inet.tcp.drop_synfin=1 >/dev/null 327 ;; 328 esac 329 330 case ${ipxgateway_enable} in 331 [Yy][Ee][Ss]) 332 echo -n ' IPX gateway=YES' 333 sysctl -w net.ipx.ipx.ipxforwarding=1 >/dev/null 334 ;; 335 esac 336 337 case ${arpproxy_all} in 338 [Yy][Ee][Ss]) 339 echo -n ' ARP proxyall=YES' 340 sysctl -w net.link.ether.inet.proxyall=1 >/dev/null 341 ;; 342 esac 343 echo '.' 344 345 echo -n 'routing daemons:' 346 case ${router_enable} in 347 [Yy][Ee][Ss]) 348 echo -n " ${router}"; ${router} ${router_flags} 349 ;; 350 esac 351 352 case ${ipxrouted_enable} in 353 [Yy][Ee][Ss]) 354 echo -n ' IPXrouted' 355 IPXrouted ${ipxrouted_flags} > /dev/null 2>&1 356 ;; 357 esac 358 359 case ${mrouted_enable} in 360 [Yy][Ee][Ss]) 361 echo -n ' mrouted'; mrouted ${mrouted_flags} 362 ;; 363 esac 364 365 case ${rarpd_enable} in 366 [Yy][Ee][Ss]) 367 echo -n ' rarpd'; rarpd ${rarpd_flags} 368 ;; 369 esac 370 echo '.' 371 372 # Let future generations know we made it. 373 # 374 network_pass1_done=YES 375} 376 377network_pass2() { 378 echo -n 'Doing additional network setup:' 379 case ${named_enable} in 380 [Yy][Ee][Ss]) 381 echo -n ' named'; ${named_program:-named} ${named_flags} 382 ;; 383 esac 384 385 case ${ntpdate_enable} in 386 [Yy][Ee][Ss]) 387 echo -n ' ntpdate' 388 ${ntpdate_program:-ntpdate} ${ntpdate_flags} >/dev/null 2>&1 389 ;; 390 esac 391 392 case ${xntpd_enable} in 393 [Yy][Ee][Ss]) 394 echo -n ' xntpd'; ${xntpd_program:-xntpd} ${xntpd_flags} 395 ;; 396 esac 397 398 case ${timed_enable} in 399 [Yy][Ee][Ss]) 400 echo -n ' timed'; timed ${timed_flags} 401 ;; 402 esac 403 404 case ${portmap_enable} in 405 [Yy][Ee][Ss]) 406 echo -n ' portmap'; ${portmap_program:-/usr/sbin/portmap} ${portmap_flags} 407 ;; 408 esac 409 410 # Start ypserv if we're an NIS server. 411 # Run rpc.ypxfrd and rpc.yppasswdd only on the NIS master server. 412 # 413 case ${nis_server_enable} in 414 [Yy][Ee][Ss]) 415 echo -n ' ypserv'; ypserv ${nis_server_flags} 416 417 case ${nis_ypxfrd_enable} in 418 [Yy][Ee][Ss]) 419 echo -n ' rpc.ypxfrd' 420 rpc.ypxfrd ${nis_ypxfrd_flags} 421 ;; 422 esac 423 424 case ${nis_yppasswdd_enable} in 425 [Yy][Ee][Ss]) 426 echo -n ' rpc.yppasswdd' 427 rpc.yppasswdd ${nis_yppasswdd_flags} 428 ;; 429 esac 430 ;; 431 esac 432 433 # Start ypbind if we're an NIS client 434 # 435 case ${nis_client_enable} in 436 [Yy][Ee][Ss]) 437 echo -n ' ypbind'; ypbind ${nis_client_flags} 438 case ${nis_ypset_enable} in 439 [Yy][Ee][Ss]) 440 echo -n ' ypset'; ypset ${nis_ypset_flags} 441 ;; 442 esac 443 ;; 444 esac 445 446 # Start keyserv if we are running Secure RPC 447 # 448 case ${keyserv_enable} in 449 [Yy][Ee][Ss]) 450 echo -n ' keyserv'; keyserv ${keyserv_flags} 451 ;; 452 esac 453 454 # Start ypupdated if we are running Secure RPC and we are NIS master 455 # 456 case ${rpc_ypupdated_enable} in 457 [Yy][Ee][Ss]) 458 echo -n ' rpc.ypupdated'; rpc.ypupdated 459 ;; 460 esac 461 462 # Start ATM daemons 463 if [ -n "${atm_pass2_done}" ]; then 464 atm_pass3 465 fi 466 467 echo '.' 468 network_pass2_done=YES 469} 470 471network_pass3() { 472 echo -n 'Starting final network daemons:' 473 474 case ${nfs_server_enable} in 475 [Yy][Ee][Ss]) 476 if [ -r /etc/exports ]; then 477 echo -n ' mountd' 478 479 case ${weak_mountd_authentication} in 480 [Yy][Ee][Ss]) 481 mountd_flags="-n" 482 ;; 483 esac 484 485 mountd ${mountd_flags} 486 487 case ${nfs_reserved_port_only} in 488 [Yy][Ee][Ss]) 489 echo -n ' NFS on reserved port only=YES' 490 sysctl -w vfs.nfs.nfs_privport=1 >/dev/null 491 ;; 492 esac 493 494 echo -n ' nfsd'; nfsd ${nfs_server_flags} 495 496 case ${rpc_lockd_enable} in 497 [Yy][Ee][Ss]) 498 echo -n ' rpc.lockd'; rpc.lockd 499 ;; 500 esac 501 502 case ${rpc_statd_enable} in 503 [Yy][Ee][Ss]) 504 echo -n ' rpc.statd'; rpc.statd 505 ;; 506 esac 507 fi 508 ;; 509 *) 510 case ${single_mountd_enable} in 511 [Yy][Ee][Ss]) 512 if [ -r /etc/exports ]; then 513 echo -n ' mountd' 514 515 case ${weak_mountd_authentication} in 516 [Yy][Ee][Ss]) 517 mountd_flags="-n" 518 ;; 519 esac 520 521 mountd ${mountd_flags} 522 fi 523 ;; 524 esac 525 ;; 526 esac 527 528 case ${nfs_client_enable} in 529 [Yy][Ee][Ss]) 530 echo -n ' nfsiod'; nfsiod ${nfs_client_flags} 531 if [ -n "${nfs_access_cache}" ]; then 532 echo -n " NFS access cache time=${nfs_access_cache}" 533 sysctl -w vfs.nfs.access_cache_timeout=${nfs_access_cache} \ 534 >/dev/null 535 fi 536 ;; 537 esac 538 539 case ${amd_enable} in 540 [Yy][Ee][Ss]) 541 echo -n ' amd' 542 case ${amd_map_program} in 543 [Nn][Oo] | '') 544 ;; 545 *) 546 amd_flags="${amd_flags} `eval ${amd_map_program}`" 547 ;; 548 esac 549 550 if [ -n "${amd_flags}" ]; then 551 amd -p ${amd_flags} > /var/run/amd.pid 2> /dev/null 552 else 553 amd 2> /dev/null 554 fi 555 ;; 556 esac 557 558 case ${rwhod_enable} in 559 [Yy][Ee][Ss]) 560 echo -n ' rwhod'; rwhod ${rwhod_flags} 561 ;; 562 esac 563 564 # Kerberos runs ONLY on the Kerberos server machine 565 case ${kerberos_server_enable} in 566 [Yy][Ee][Ss]) 567 case ${kerberos_stash} in 568 [Yy][Ee][Ss]) 569 stash_flag=-n 570 ;; 571 *) 572 stash_flag= 573 ;; 574 esac 575 576 echo -n ' kerberos' 577 kerberos ${stash_flag} >> /var/log/kerberos.log & 578 579 case ${kadmind_server_enable} in 580 [Yy][Ee][Ss]) 581 echo -n ' kadmind' 582 (sleep 20; kadmind ${stash_flag} >/dev/null 2>&1 &) & 583 ;; 584 esac 585 unset stash_flag 586 ;; 587 esac 588 589 case ${pppoed_enable} in 590 [Yy][Ee][Ss]) 591 if [ -n "${pppoed_provider}" ]; then 592 pppoed_flags="${pppoed_flags} -p ${pppoed_provider}" 593 fi 594 echo -n ' pppoed'; 595 /usr/libexec/pppoed ${pppoed_flags} ${pppoed_interface} 596 ;; 597 esac 598 599 echo '.' 600 network_pass3_done=YES 601} 602 603network_pass4() { 604 echo -n 'Additional TCP options:' 605 case ${log_in_vain} in 606 [Nn][Oo] | '') 607 ;; 608 *) 609 echo -n ' log_in_vain=YES' 610 sysctl -w net.inet.tcp.log_in_vain=1 >/dev/null 611 sysctl -w net.inet.udp.log_in_vain=1 >/dev/null 612 ;; 613 esac 614 615 echo '.' 616 network_pass4_done=YES 617} 618