defaultroute revision 54739
1258945Sroberto#!/bin/sh - 2258945Sroberto# 3258945Sroberto# $FreeBSD: head/etc/rc.d/routing 54739 1999-12-17 13:36:40Z roberto $ 4258945Sroberto# From: @(#)netstart 5.9 (Berkeley) 3/30/91 5258945Sroberto 6258945Sroberto# Note that almost all of the user-configurable behavior is no longer in 7258945Sroberto# this file, but rather in /etc/defaults/rc.conf. Please check that file 8258945Sroberto# first before contemplating any changes here. If you do need to change 9258945Sroberto# this file for some reason, we would like to know about it. 10258945Sroberto 11258945Sroberto# First pass startup stuff. 12258945Sroberto# 13258945Srobertonetwork_pass1() { 14258945Sroberto echo -n 'Doing initial network setup:' 15258945Sroberto 16258945Sroberto # Set the host name if it is not already set 17258945Sroberto # 18280849Scy if [ -z "`hostname -s`" ]; then 19258945Sroberto hostname ${hostname} 20258945Sroberto echo -n ' hostname' 21258945Sroberto fi 22258945Sroberto 23258945Sroberto # Set the domainname if we're using NIS 24258945Sroberto # 25258945Sroberto case ${nisdomainname} in 26258945Sroberto [Nn][Oo] | '') 27258945Sroberto ;; 28258945Sroberto *) 29258945Sroberto domainname ${nisdomainname} 30258945Sroberto echo -n ' domain' 31258945Sroberto ;; 32258945Sroberto esac 33258945Sroberto 34258945Sroberto echo '.' 35258945Sroberto 36258945Sroberto # Initial ATM interface configuration 37258945Sroberto # 38258945Sroberto case ${atm_enable} in 39258945Sroberto [Yy][Ee][Ss]) 40258945Sroberto if [ -r /etc/rc.atm ]; then 41258945Sroberto . /etc/rc.atm 42258945Sroberto atm_pass1 43258945Sroberto fi 44258945Sroberto ;; 45258945Sroberto esac 46258945Sroberto 47258945Sroberto # ISDN subsystem startup 48258945Sroberto # 49258945Sroberto case ${isdn_enable} in 50258945Sroberto [Yy][Ee][Ss]) 51258945Sroberto if [ -r /etc/rc.isdn ]; then 52258945Sroberto . /etc/rc.isdn 53258945Sroberto fi 54258945Sroberto ;; 55258945Sroberto esac 56258945Sroberto 57258945Sroberto # Special options for sppp(4) interfaces go here. These need 58258945Sroberto # to go _before_ the general ifconfig section, since in the case 59258945Sroberto # of hardwired (no link1 flag) but required authentication, you 60258945Sroberto # cannot pass auth parameters down to the already running interface. 61258945Sroberto # 62258945Sroberto for ifn in ${sppp_interfaces}; do 63258945Sroberto eval spppcontrol_args=\$spppconfig_${ifn} 64258945Sroberto if [ -n "${spppcontrol_args}" ]; then 65258945Sroberto # The auth secrets might contain spaces; in order 66258945Sroberto # to retain the quotation, we need to eval them 67258945Sroberto # here. 68258945Sroberto eval spppcontrol ${ifn} ${spppcontrol_args} 69258945Sroberto fi 70258945Sroberto done 71258945Sroberto 72258945Sroberto # Set up all the network interfaces, calling startup scripts if needed 73258945Sroberto # 74258945Sroberto case ${network_interfaces} in 75258945Sroberto [Aa][Uu][Tt][Oo]) 76258945Sroberto network_interfaces="`ifconfig -l`" 77258945Sroberto ;; 78258945Sroberto esac 79258945Sroberto 80258945Sroberto dhcp_interfaces="" 81258945Sroberto for ifn in ${network_interfaces}; do 82258945Sroberto if [ -r /etc/start_if.${ifn} ]; then 83258945Sroberto . /etc/start_if.${ifn} 84258945Sroberto eval showstat_$ifn=1 85258945Sroberto fi 86258945Sroberto 87258945Sroberto # Do the primary ifconfig if specified 88258945Sroberto # 89258945Sroberto eval ifconfig_args=\$ifconfig_${ifn} 90258945Sroberto 91258945Sroberto case ${ifconfig_args} in 92258945Sroberto '') 93258945Sroberto ;; 94258945Sroberto [Dd][Hh][Cc][Pp]) 95258945Sroberto # DHCP inits are done all in one go below 96258945Sroberto dhcp_interfaces="$dhcp_interfaces $ifn" 97258945Sroberto eval showstat_$ifn=1 98258945Sroberto ;; 99258945Sroberto *) 100258945Sroberto ifconfig ${ifn} ${ifconfig_args} 101258945Sroberto eval showstat_$ifn=1 102258945Sroberto ;; 103258945Sroberto esac 104258945Sroberto done 105258945Sroberto 106258945Sroberto if [ ! -z "${dhcp_interfaces}" ]; then 107258945Sroberto ${dhcp_program:-/sbin/dhclient} ${dhcp_flags} ${dhcp_interfaces} 108258945Sroberto fi 109258945Sroberto 110258945Sroberto for ifn in ${network_interfaces}; do 111258945Sroberto # Check to see if aliases need to be added 112258945Sroberto # 113258945Sroberto alias=0 114258945Sroberto while : ; do 115258945Sroberto eval ifconfig_args=\$ifconfig_${ifn}_alias${alias} 116258945Sroberto if [ -n "${ifconfig_args}" ]; then 117258945Sroberto ifconfig ${ifn} ${ifconfig_args} alias 118258945Sroberto eval showstat_$ifn=1 119258945Sroberto alias=`expr ${alias} + 1` 120258945Sroberto else 121258945Sroberto break; 122258945Sroberto fi 123258945Sroberto done 124258945Sroberto 125258945Sroberto # Do ipx address if specified 126258945Sroberto # 127258945Sroberto eval ifconfig_args=\$ifconfig_${ifn}_ipx 128258945Sroberto if [ -n "${ifconfig_args}" ]; then 129258945Sroberto ifconfig ${ifn} ${ifconfig_args} 130258945Sroberto eval showstat_$ifn=1 131258945Sroberto fi 132258945Sroberto done 133258945Sroberto 134258945Sroberto for ifn in ${network_interfaces}; do 135258945Sroberto eval showstat=\$showstat_${ifn} 136258945Sroberto if [ ! -z ${showstat} ]; then 137258945Sroberto ifconfig ${ifn} 138258945Sroberto fi 139258945Sroberto done 140258945Sroberto 141258945Sroberto # Warm up user ppp if required, must happen before natd. 142258945Sroberto # 143258945Sroberto case ${ppp_enable} in 144258945Sroberto [Yy][Ee][Ss]) 145258945Sroberto # Establish ppp mode. 146258945Sroberto # 147258945Sroberto if [ "${ppp_mode}" != "ddial" -a "${ppp_mode}" != "direct" \ 148258945Sroberto -a "${ppp_mode}" != "dedicated" \ 149258945Sroberto -a "${ppp_mode}" != "background" ]; then 150258945Sroberto ppp_mode="auto"; 151258945Sroberto fi 152258945Sroberto 153258945Sroberto ppp_command="-${ppp_mode} "; 154258945Sroberto 155258945Sroberto # Switch on alias mode? 156258945Sroberto # 157258945Sroberto case ${ppp_nat} in 158258945Sroberto [Yy][Ee][Ss]) 159258945Sroberto ppp_command="${ppp_command} -nat"; 160258945Sroberto ;; 161258945Sroberto esac 162258945Sroberto 163258945Sroberto echo -n 'Starting ppp: '; ppp ${ppp_command} -quiet ${ppp_profile} 164258945Sroberto ;; 165258945Sroberto esac 166258945Sroberto 167258945Sroberto # Initialize IP filtering using ipfw 168258945Sroberto # 169258945Sroberto echo '' 170258945Sroberto 171 if /sbin/ipfw -q flush > /dev/null 2>&1; then 172 firewall_in_kernel=1 173 else 174 firewall_in_kernel=0 175 fi 176 177 case ${firewall_enable} in 178 [Yy][Ee][Ss]) 179 if [ "${firewall_in_kernel}" -eq 0 ] && kldload ipfw; then 180 firewall_in_kernel=1 181 echo "Kernel firewall module loaded." 182 elif [ "${firewall_in_kernel}" -eq 0 ]; then 183 echo "Warning: firewall kernel module failed to load." 184 fi 185 ;; 186 esac 187 188 # Load the filters if required 189 # 190 case ${firewall_in_kernel} in 191 1) 192 if [ -z "${firewall_script}" ]; then 193 firewall_script=/etc/rc.firewall 194 fi 195 196 case ${firewall_enable} in 197 [Yy][Ee][Ss]) 198 if [ -r "${firewall_script}" ]; then 199 . "${firewall_script}" 200 echo -n 'Firewall rules loaded, starting divert daemons:' 201 202 # Network Address Translation daemon 203 # 204 case ${natd_enable} in 205 [Yy][Ee][Ss]) 206 if [ -n "${natd_interface}" ]; then 207 if echo ${natd_interface} | \ 208 grep -q -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then 209 natd_ifarg="-a ${natd_interface}" 210 else 211 natd_ifarg="-n ${natd_interface}" 212 fi 213 214 echo -n ' natd'; ${natd_program:-/sbin/natd} ${natd_flags} ${natd_ifarg} 215 fi 216 ;; 217 esac 218 219 echo '.' 220 221 elif [ "`ipfw l 65535`" = "65535 deny ip from any to any" ]; then 222 echo -n "Warning: kernel has firewall functionality, " 223 echo "but firewall rules are not enabled." 224 echo " All ip services are disabled." 225 fi 226 ;; 227 esac 228 ;; 229 esac 230 231 # Additional ATM interface configuration 232 # 233 if [ -n "${atm_pass1_done}" ]; then 234 atm_pass2 235 fi 236 237 # Configure routing 238 # 239 case ${defaultrouter} in 240 [Nn][Oo] | '') 241 ;; 242 *) 243 static_routes="default ${static_routes}" 244 route_default="default ${defaultrouter}" 245 ;; 246 esac 247 248 # Set up any static routes. This should be done before router discovery. 249 # 250 if [ -n "${static_routes}" ]; then 251 for i in ${static_routes}; do 252 eval route_args=\$route_${i} 253 route add ${route_args} 254 done 255 fi 256 257 echo -n 'Additional routing options:' 258 case ${tcp_extensions} in 259 [Yy][Ee][Ss] | '') 260 ;; 261 *) 262 echo -n ' tcp extensions=NO' 263 sysctl -w net.inet.tcp.rfc1323=0 >/dev/null 264 ;; 265 esac 266 267 case ${icmp_bmcastecho} in 268 [Yy][Ee][Ss]) 269 echo -n ' broadcast ping responses=YES' 270 sysctl -w net.inet.icmp.bmcastecho=1 >/dev/null 271 ;; 272 esac 273 274 case ${icmp_drop_redirect} in 275 [Yy][Ee][Ss]) 276 echo -n ' ignore ICMP redirect=YES' 277 sysctl -w net.inet.icmp.drop_redirect=1 >/dev/null 278 ;; 279 esac 280 281 case ${icmp_log_redirect} in 282 [Yy][Ee][Ss]) 283 echo -n ' log ICMP redirect=YES' 284 sysctl -w net.inet.icmp.log_redirect=1 >/dev/null 285 ;; 286 esac 287 288 case ${gateway_enable} in 289 [Yy][Ee][Ss]) 290 echo -n ' IP gateway=YES' 291 sysctl -w net.inet.ip.forwarding=1 >/dev/null 292 ;; 293 esac 294 295 case ${forward_sourceroute} in 296 [Yy][Ee][Ss]) 297 echo -n ' do source routing=YES' 298 sysctl -w net.inet.ip.sourceroute=1 >/dev/null 299 ;; 300 esac 301 302 case ${accept_sourceroute} in 303 [Yy][Ee][Ss]) 304 echo -n ' accept source routing=YES' 305 sysctl -w net.inet.ip.accept_sourceroute=1 >/dev/null 306 ;; 307 esac 308 309 case ${tcp_keepalive} in 310 [Yy][Ee][Ss]) 311 echo -n ' TCP keepalive=YES' 312 sysctl -w net.inet.tcp.always_keepalive=1 >/dev/null 313 ;; 314 esac 315 316 case ${tcp_restrict_rst} in 317 [Yy][Ee][Ss]) 318 echo -n ' restrict TCP reset=YES' 319 sysctl -w net.inet.tcp.restrict_rst=1 >/dev/null 320 ;; 321 esac 322 323 case ${tcp_drop_synfin} in 324 [Yy][Ee][Ss]) 325 echo -n ' drop SYN+FIN packets=YES' 326 sysctl -w net.inet.tcp.drop_synfin=1 >/dev/null 327 ;; 328 esac 329 330 case ${ipxgateway_enable} in 331 [Yy][Ee][Ss]) 332 echo -n ' IPX gateway=YES' 333 sysctl -w net.ipx.ipx.ipxforwarding=1 >/dev/null 334 ;; 335 esac 336 337 case ${arpproxy_all} in 338 [Yy][Ee][Ss]) 339 echo -n ' ARP proxyall=YES' 340 sysctl -w net.link.ether.inet.proxyall=1 >/dev/null 341 ;; 342 esac 343 echo '.' 344 345 echo -n 'routing daemons:' 346 case ${router_enable} in 347 [Yy][Ee][Ss]) 348 echo -n " ${router}"; ${router} ${router_flags} 349 ;; 350 esac 351 352 case ${ipxrouted_enable} in 353 [Yy][Ee][Ss]) 354 echo -n ' IPXrouted' 355 IPXrouted ${ipxrouted_flags} > /dev/null 2>&1 356 ;; 357 esac 358 359 case ${mrouted_enable} in 360 [Yy][Ee][Ss]) 361 echo -n ' mrouted'; mrouted ${mrouted_flags} 362 ;; 363 esac 364 365 case ${rarpd_enable} in 366 [Yy][Ee][Ss]) 367 echo -n ' rarpd'; rarpd ${rarpd_flags} 368 ;; 369 esac 370 echo '.' 371 372 # Let future generations know we made it. 373 # 374 network_pass1_done=YES 375} 376 377network_pass2() { 378 echo -n 'Doing additional network setup:' 379 case ${named_enable} in 380 [Yy][Ee][Ss]) 381 echo -n ' named'; ${named_program:-named} ${named_flags} 382 ;; 383 esac 384 385 case ${ntpdate_enable} in 386 [Yy][Ee][Ss]) 387 echo -n ' ntpdate' 388 ${ntpdate_program:-ntpdate} ${ntpdate_flags} >/dev/null 2>&1 389 ;; 390 esac 391 392 case ${xntpd_enable} in 393 [Yy][Ee][Ss]) 394 echo -n ' ntpd'; ${xntpd_program:-ntpd} ${xntpd_flags} 395 ;; 396 esac 397 398 case ${timed_enable} in 399 [Yy][Ee][Ss]) 400 echo -n ' timed'; timed ${timed_flags} 401 ;; 402 esac 403 404 case ${portmap_enable} in 405 [Yy][Ee][Ss]) 406 echo -n ' portmap'; ${portmap_program:-/usr/sbin/portmap} ${portmap_flags} 407 ;; 408 esac 409 410 # Start ypserv if we're an NIS server. 411 # Run rpc.ypxfrd and rpc.yppasswdd only on the NIS master server. 412 # 413 case ${nis_server_enable} in 414 [Yy][Ee][Ss]) 415 echo -n ' ypserv'; ypserv ${nis_server_flags} 416 417 case ${nis_ypxfrd_enable} in 418 [Yy][Ee][Ss]) 419 echo -n ' rpc.ypxfrd' 420 rpc.ypxfrd ${nis_ypxfrd_flags} 421 ;; 422 esac 423 424 case ${nis_yppasswdd_enable} in 425 [Yy][Ee][Ss]) 426 echo -n ' rpc.yppasswdd' 427 rpc.yppasswdd ${nis_yppasswdd_flags} 428 ;; 429 esac 430 ;; 431 esac 432 433 # Start ypbind if we're an NIS client 434 # 435 case ${nis_client_enable} in 436 [Yy][Ee][Ss]) 437 echo -n ' ypbind'; ypbind ${nis_client_flags} 438 case ${nis_ypset_enable} in 439 [Yy][Ee][Ss]) 440 echo -n ' ypset'; ypset ${nis_ypset_flags} 441 ;; 442 esac 443 ;; 444 esac 445 446 # Start keyserv if we are running Secure RPC 447 # 448 case ${keyserv_enable} in 449 [Yy][Ee][Ss]) 450 echo -n ' keyserv'; keyserv ${keyserv_flags} 451 ;; 452 esac 453 454 # Start ypupdated if we are running Secure RPC and we are NIS master 455 # 456 case ${rpc_ypupdated_enable} in 457 [Yy][Ee][Ss]) 458 echo -n ' rpc.ypupdated'; rpc.ypupdated 459 ;; 460 esac 461 462 # Start ATM daemons 463 if [ -n "${atm_pass2_done}" ]; then 464 atm_pass3 465 fi 466 467 echo '.' 468 network_pass2_done=YES 469} 470 471network_pass3() { 472 echo -n 'Starting final network daemons:' 473 474 case ${nfs_server_enable} in 475 [Yy][Ee][Ss]) 476 if [ -r /etc/exports ]; then 477 echo -n ' mountd' 478 479 case ${weak_mountd_authentication} in 480 [Yy][Ee][Ss]) 481 mountd_flags="-n" 482 ;; 483 esac 484 485 mountd ${mountd_flags} 486 487 case ${nfs_reserved_port_only} in 488 [Yy][Ee][Ss]) 489 echo -n ' NFS on reserved port only=YES' 490 sysctl -w vfs.nfs.nfs_privport=1 >/dev/null 491 ;; 492 esac 493 494 echo -n ' nfsd'; nfsd ${nfs_server_flags} 495 496 case ${rpc_lockd_enable} in 497 [Yy][Ee][Ss]) 498 echo -n ' rpc.lockd'; rpc.lockd 499 ;; 500 esac 501 502 case ${rpc_statd_enable} in 503 [Yy][Ee][Ss]) 504 echo -n ' rpc.statd'; rpc.statd 505 ;; 506 esac 507 fi 508 ;; 509 *) 510 case ${single_mountd_enable} in 511 [Yy][Ee][Ss]) 512 if [ -r /etc/exports ]; then 513 echo -n ' mountd' 514 515 case ${weak_mountd_authentication} in 516 [Yy][Ee][Ss]) 517 mountd_flags="-n" 518 ;; 519 esac 520 521 mountd ${mountd_flags} 522 fi 523 ;; 524 esac 525 ;; 526 esac 527 528 case ${nfs_client_enable} in 529 [Yy][Ee][Ss]) 530 echo -n ' nfsiod'; nfsiod ${nfs_client_flags} 531 if [ -n "${nfs_access_cache}" ]; then 532 echo -n " NFS access cache time=${nfs_access_cache}" 533 sysctl -w vfs.nfs.access_cache_timeout=${nfs_access_cache} \ 534 >/dev/null 535 fi 536 ;; 537 esac 538 539 case ${amd_enable} in 540 [Yy][Ee][Ss]) 541 echo -n ' amd' 542 case ${amd_map_program} in 543 [Nn][Oo] | '') 544 ;; 545 *) 546 amd_flags="${amd_flags} `eval ${amd_map_program}`" 547 ;; 548 esac 549 550 if [ -n "${amd_flags}" ]; then 551 amd -p ${amd_flags} > /var/run/amd.pid 2> /dev/null 552 else 553 amd 2> /dev/null 554 fi 555 ;; 556 esac 557 558 case ${rwhod_enable} in 559 [Yy][Ee][Ss]) 560 echo -n ' rwhod'; rwhod ${rwhod_flags} 561 ;; 562 esac 563 564 # Kerberos runs ONLY on the Kerberos server machine 565 case ${kerberos_server_enable} in 566 [Yy][Ee][Ss]) 567 case ${kerberos_stash} in 568 [Yy][Ee][Ss]) 569 stash_flag=-n 570 ;; 571 *) 572 stash_flag= 573 ;; 574 esac 575 576 echo -n ' kerberos' 577 kerberos ${stash_flag} >> /var/log/kerberos.log & 578 579 case ${kadmind_server_enable} in 580 [Yy][Ee][Ss]) 581 echo -n ' kadmind' 582 (sleep 20; kadmind ${stash_flag} >/dev/null 2>&1 &) & 583 ;; 584 esac 585 unset stash_flag 586 ;; 587 esac 588 589 case ${pppoed_enable} in 590 [Yy][Ee][Ss]) 591 if [ -n "${pppoed_provider}" ]; then 592 pppoed_flags="${pppoed_flags} -p ${pppoed_provider}" 593 fi 594 echo -n ' pppoed'; 595 /usr/libexec/pppoed ${pppoed_flags} ${pppoed_interface} 596 ;; 597 esac 598 599 echo '.' 600 network_pass3_done=YES 601} 602 603network_pass4() { 604 echo -n 'Additional TCP options:' 605 case ${log_in_vain} in 606 [Nn][Oo] | '') 607 ;; 608 *) 609 echo -n ' log_in_vain=YES' 610 sysctl -w net.inet.tcp.log_in_vain=1 >/dev/null 611 sysctl -w net.inet.udp.log_in_vain=1 >/dev/null 612 ;; 613 esac 614 615 echo '.' 616 network_pass4_done=YES 617} 618