|
1
|
#!/usr/local/bin/php-cgi -f
|
|
2
|
<?php
|
|
3
|
/*
|
|
4
|
* rc.bootup
|
|
5
|
*
|
|
6
|
* originally based on m0n0wall (http://m0n0.ch/wall)
|
|
7
|
* Copyright (c) 2003-2004 Manuel Kasper <mk@neon1.net>.
|
|
8
|
* Copyright (c) 2009 Erik Kristensen
|
|
9
|
* Copyright (c) 2005-2013 BSD Perimeter
|
|
10
|
* Copyright (c) 2013-2016 Electric Sheep Fencing
|
|
11
|
* Copyright (c) 2014-2022 Rubicon Communications, LLC (Netgate)
|
|
12
|
* All rights reserved.
|
|
13
|
*
|
|
14
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
15
|
* you may not use this file except in compliance with the License.
|
|
16
|
* You may obtain a copy of the License at
|
|
17
|
*
|
|
18
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
19
|
*
|
|
20
|
* Unless required by applicable law or agreed to in writing, software
|
|
21
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
22
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
23
|
* See the License for the specific language governing permissions and
|
|
24
|
* limitations under the License.
|
|
25
|
*/
|
|
26
|
|
|
27
|
require_once("pkg-utils.inc");
|
|
28
|
|
|
29
|
echo " done.\n";
|
|
30
|
|
|
31
|
echo "Initializing...";
|
|
32
|
echo ".";
|
|
33
|
require_once("/etc/inc/globals.inc");
|
|
34
|
echo ".";
|
|
35
|
require_once("/etc/inc/led.inc");
|
|
36
|
led_normalize();
|
|
37
|
echo ".";
|
|
38
|
if (led_count() >= 3) {
|
|
39
|
led_kitt();
|
|
40
|
}
|
|
41
|
|
|
42
|
/* let the other functions know we're booting */
|
|
43
|
$pkg_interface = 'console';
|
|
44
|
$g['booting'] = true;
|
|
45
|
|
|
46
|
/* parse the configuration and include all functions used below */
|
|
47
|
require_once("/etc/inc/config.inc");
|
|
48
|
echo ".";
|
|
49
|
require_once("/etc/inc/config.console.inc");
|
|
50
|
echo ".";
|
|
51
|
require_once("/etc/inc/auth.inc");
|
|
52
|
echo ".";
|
|
53
|
require_once("/etc/inc/functions.inc");
|
|
54
|
echo ".";
|
|
55
|
require_once("/etc/inc/filter.inc");
|
|
56
|
echo ".";
|
|
57
|
require_once("/etc/inc/shaper.inc");
|
|
58
|
echo ".";
|
|
59
|
require_once("/etc/inc/ipsec.inc");
|
|
60
|
echo ".";
|
|
61
|
require_once("/etc/inc/vpn.inc");
|
|
62
|
echo ".";
|
|
63
|
require_once("/etc/inc/openvpn.inc");
|
|
64
|
echo ".";
|
|
65
|
require_once("/etc/inc/captiveportal.inc");
|
|
66
|
echo ".";
|
|
67
|
require_once("/etc/inc/rrd.inc");
|
|
68
|
echo ".";
|
|
69
|
require_once("/etc/inc/pfsense-utils.inc");
|
|
70
|
echo ".";
|
|
71
|
|
|
72
|
/* get system memory amount */
|
|
73
|
$memory = get_memory();
|
|
74
|
$physmem = $memory[0];
|
|
75
|
$realmem = $memory[1];
|
|
76
|
echo " done.\n";
|
|
77
|
|
|
78
|
|
|
79
|
/* save dmesg output to file */
|
|
80
|
system_dmesg_save();
|
|
81
|
|
|
82
|
/* check whether config reset is desired (via hardware button on WRAP/ALIX) */
|
|
83
|
system_check_reset_button();
|
|
84
|
|
|
85
|
/* remove previous firmware upgrade if present */
|
|
86
|
if (file_exists("/root/firmware.tgz")) {
|
|
87
|
unlink("/root/firmware.tgz");
|
|
88
|
}
|
|
89
|
|
|
90
|
/* restore RRD, SSH keys and extra data on bsdinstall config restore
|
|
91
|
* see https://redmine.pfsense.org/issues/12518 */
|
|
92
|
if (file_exists("{$g['conf_path']}/installer_copied_config") &&
|
|
93
|
file_exists("{$g['conf_path']}/restore_config_data")) {
|
|
94
|
copy("/cf/conf/config.xml", "{$g['tmp_path']}/config_to_restore.xml");
|
|
95
|
restore_backup("{$g['tmp_path']}/config_to_restore.xml");
|
|
96
|
@unlink("{$g['tmp_path']}/config_to_restore.xml");
|
|
97
|
@unlink("{$g['conf_path']}/installer_copied_config");
|
|
98
|
@unlink("{$g['conf_path']}/restore_config_data");
|
|
99
|
}
|
|
100
|
|
|
101
|
/* Triggering of the initial setup wizard after reboot has been requested */
|
|
102
|
if (file_exists("{$g['conf_path']}/trigger_initial_wizard_after_reboot")) {
|
|
103
|
touch("{$g['conf_path']}/trigger_initial_wizard");
|
|
104
|
@unlink("{$g['conf_path']}/trigger_initial_wizard_after_reboot");
|
|
105
|
}
|
|
106
|
|
|
107
|
/* start devd (dhclient now uses it) */
|
|
108
|
echo "Starting device manager (devd)...";
|
|
109
|
mute_kernel_msgs();
|
|
110
|
start_devd();
|
|
111
|
set_device_perms();
|
|
112
|
unmute_kernel_msgs();
|
|
113
|
echo "done.\n";
|
|
114
|
|
|
115
|
echo "Loading configuration...";
|
|
116
|
parse_config_bootup();
|
|
117
|
echo "done.\n";
|
|
118
|
|
|
119
|
mwexec("/usr/sbin/gnid > {$g['vardb_path']}/uniqueid 2>/dev/null");
|
|
120
|
|
|
121
|
/* run any early shell commands specified in config.xml */
|
|
122
|
system_do_shell_commands(1);
|
|
123
|
|
|
124
|
// Only do the alternate interface checks if:
|
|
125
|
// 1) The user has not yet run the initial wizard; and
|
|
126
|
// 2) The user has not used the console menu to setup interface assignments
|
|
127
|
if (file_exists("{$g['conf_path']}/trigger_initial_wizard") && !file_exists("{$g['conf_path']}/assign_complete")) {
|
|
128
|
check_for_alternate_interfaces();
|
|
129
|
}
|
|
130
|
|
|
131
|
/* Convert configuration
|
|
132
|
* This must happen before the interface mismatch test, see
|
|
133
|
* https://redmine.pfsense.org/issues/7809 */
|
|
134
|
echo "Updating configuration...";
|
|
135
|
convert_config();
|
|
136
|
echo "done.\n";
|
|
137
|
|
|
138
|
/*
|
|
139
|
* Determine if we need to throw a interface exception
|
|
140
|
* and ask the user to reassign interfaces. This will
|
|
141
|
* avoid a reboot and that is a good thing.
|
|
142
|
*/
|
|
143
|
while (is_interface_mismatch() == true) {
|
|
144
|
led_assigninterfaces();
|
|
145
|
if (isset($config['revision'])) {
|
|
146
|
if (file_exists("{$g['tmp_path']}/missing_interfaces")) {
|
|
147
|
echo "Warning: Configuration references interfaces that do not exist: " . file_get_contents("{$g['tmp_path']}/missing_interfaces") . "\n";
|
|
148
|
}
|
|
149
|
echo "\nNetwork interface mismatch -- Running interface assignment option.\n";
|
|
150
|
} else {
|
|
151
|
echo "\nDefault interfaces not found -- Running interface assignment option.\n";
|
|
152
|
}
|
|
153
|
$ifaces = get_interface_list();
|
|
154
|
if (is_array($ifaces)) {
|
|
155
|
foreach ($ifaces as $iface => $ifdata) {
|
|
156
|
interfaces_bring_up($iface);
|
|
157
|
}
|
|
158
|
}
|
|
159
|
if (set_networking_interfaces_ports() == -1) {
|
|
160
|
echo "\npfSense cannot continue without at least one Network Interface Card.\n";
|
|
161
|
echo "\nHalting the system.\n";
|
|
162
|
system("/sbin/shutdown -h now");
|
|
163
|
exit(0);
|
|
164
|
}
|
|
165
|
reload_interfaces_sync();
|
|
166
|
led_kitt();
|
|
167
|
}
|
|
168
|
|
|
169
|
echo "Checking config backups consistency...";
|
|
170
|
cleanup_backupcache(true);
|
|
171
|
echo "done.\n";
|
|
172
|
|
|
173
|
/* read in /etc/sysctl.conf and set values if needed */
|
|
174
|
echo "Setting up extended sysctls...";
|
|
175
|
system_setup_sysctl();
|
|
176
|
echo "done.\n";
|
|
177
|
|
|
178
|
/* enable optional crypto modules */
|
|
179
|
load_crypto();
|
|
180
|
|
|
181
|
/* enable optional thermal sensor modules */
|
|
182
|
load_thermal_hardware();
|
|
183
|
|
|
184
|
/* set up our timezone */
|
|
185
|
system_timezone_configure();
|
|
186
|
|
|
187
|
/* set up our hostname */
|
|
188
|
system_hostname_configure();
|
|
189
|
|
|
190
|
/* make hosts file */
|
|
191
|
system_hosts_generate();
|
|
192
|
|
|
193
|
/* configure loopback interface */
|
|
194
|
interfaces_loopback_configure();
|
|
195
|
|
|
196
|
/* Setup Local CA Trust Store */
|
|
197
|
ca_setup_trust_store();
|
|
198
|
|
|
199
|
/* If the system uses ZFS and has compression enabled for /var/log, disable log
|
|
200
|
* compression by default. See https://redmine.pfsense.org/issues/12011
|
|
201
|
*/
|
|
202
|
$varlog_compression_state = 'off';
|
|
203
|
if (is_module_loaded('zfs.ko')) {
|
|
204
|
exec("/sbin/zfs get -H compression /var/log | /usr/bin/awk '{print $3;}'", $varlog_compression_state);
|
|
205
|
$varlog_compression_state = $varlog_compression_state[0];
|
|
206
|
}
|
|
207
|
if (file_exists("{$g['conf_path']}/trigger_initial_wizard") &&
|
|
208
|
(trim($varlog_compression_state) != 'off')) {
|
|
209
|
touch("{$g['conf_path']}/syslog_default_uncompressed");
|
|
210
|
}
|
|
211
|
/* start syslogd */
|
|
212
|
system_syslogd_start();
|
|
213
|
|
|
214
|
/* set pam shell authentication backend */
|
|
215
|
set_pam_auth();
|
|
216
|
|
|
217
|
/* Log the RAM disk restore messages. */
|
|
218
|
if (file_exists("/var/log/restore_ramdisk_store.boot")) {
|
|
219
|
exec("/usr/bin/logger -f /var/log/restore_ramdisk_store.boot");
|
|
220
|
}
|
|
221
|
|
|
222
|
init_config_arr(array('system', 'ssh'));
|
|
223
|
if (isset($config['system']['ssh']['enable'])) {
|
|
224
|
echo "Starting Secure Shell Services...";
|
|
225
|
send_event("service reload sshd");
|
|
226
|
echo "done.\n";
|
|
227
|
}
|
|
228
|
|
|
229
|
/* setup interface microcode which improves tcp/ip speed */
|
|
230
|
echo "Setting up interfaces microcode...";
|
|
231
|
setup_microcode();
|
|
232
|
echo "done.\n";
|
|
233
|
|
|
234
|
if (isset($config['system']['mds_disable']) &&
|
|
235
|
(strlen($config['system']['mds_disable']) > 0)) {
|
|
236
|
set_single_sysctl("hw.mds_disable" , (int)$config['system']['mds_disable']);
|
|
237
|
}
|
|
238
|
|
|
239
|
/* remove leftover dhcp6c lock files if they exist */
|
|
240
|
foreach ($config['interfaces'] as $interface) {
|
|
241
|
if ($interface['ipaddrv6'] == "dhcp6") {
|
|
242
|
if (file_exists("/tmp/dhcp6c_" . $interface['if'] . "_lock")) {
|
|
243
|
@unlink("/tmp/dhcp6c_" . $interface['if'] . "_lock");
|
|
244
|
echo("Removed leftover dhcp6c lock file: " . "/tmp/dhcp6c_" . $interface['if'] . "_lock\n");
|
|
245
|
}
|
|
246
|
}
|
|
247
|
}
|
|
248
|
|
|
249
|
/* set up interfaces */
|
|
250
|
if (!$debugging) {
|
|
251
|
mute_kernel_msgs();
|
|
252
|
}
|
|
253
|
interfaces_configure();
|
|
254
|
interfaces_sync_setup();
|
|
255
|
if (!$debugging) {
|
|
256
|
unmute_kernel_msgs();
|
|
257
|
}
|
|
258
|
|
|
259
|
/* re-make hosts file after configuring interfaces */
|
|
260
|
system_hosts_generate();
|
|
261
|
|
|
262
|
/* start OpenVPN server & clients */
|
|
263
|
echo "Syncing OpenVPN settings...";
|
|
264
|
openvpn_resync_all();
|
|
265
|
echo "done.\n";
|
|
266
|
|
|
267
|
/* generate resolv.conf */
|
|
268
|
system_resolvconf_generate();
|
|
269
|
|
|
270
|
/* setup altq + pf */
|
|
271
|
filter_configure_sync();
|
|
272
|
|
|
273
|
/* start pflog */
|
|
274
|
echo "Starting PFLOG...";
|
|
275
|
filter_pflog_start();
|
|
276
|
echo "done.\n";
|
|
277
|
|
|
278
|
/* reconfigure our gateway monitor */
|
|
279
|
setup_gateways_monitor();
|
|
280
|
|
|
281
|
/* set up static routes */
|
|
282
|
echo "Setting up static routes...";
|
|
283
|
system_routing_configure();
|
|
284
|
echo "done.\n";
|
|
285
|
|
|
286
|
init_config_arr(array('unbound'));
|
|
287
|
init_config_arr(array('dnsmasq'));
|
|
288
|
if (isset($config['unbound']['enable']) ||
|
|
289
|
isset($config['dnsmasq']['enable'])) {
|
|
290
|
echo "Setting up DNSs...\n";
|
|
291
|
/* start dnsmasq service */
|
|
292
|
services_dnsmasq_configure();
|
|
293
|
|
|
294
|
/* start unbound service */
|
|
295
|
services_unbound_configure();
|
|
296
|
}
|
|
297
|
|
|
298
|
echo "Synchronizing user settings...";
|
|
299
|
local_reset_accounts();
|
|
300
|
echo "done.\n";
|
|
301
|
|
|
302
|
/* configure cron service */
|
|
303
|
echo "Configuring CRON...";
|
|
304
|
configure_cron();
|
|
305
|
echo "done.\n";
|
|
306
|
|
|
307
|
/* enable routing */
|
|
308
|
system_routing_enable();
|
|
309
|
|
|
310
|
/* Set initial time by using IP addresses in case DNS is not available
|
|
311
|
* This works around issues with DNSSEC and gives the firewall a better chance
|
|
312
|
* of having a highly accurate clock at boot.
|
|
313
|
* NG 7352, NG 7447
|
|
314
|
*/
|
|
315
|
|
|
316
|
/* Default to Google Public NTP servers */
|
|
317
|
$ntp_boot_time_servers = '216.239.35.0 216.239.35.4 216.239.35.8 216.239.35.12';
|
|
318
|
/* File to allow users to override default behavior.
|
|
319
|
* Servers must be a single line with space-separated IP address entries ONLY as
|
|
320
|
* DNS may not be functional. */
|
|
321
|
$ntp_boot_time_servers_override = '/conf/ntp-boot-time-servers';
|
|
322
|
|
|
323
|
/* Handle user override of NTP bootstrap behavior */
|
|
324
|
if (file_exists($ntp_boot_time_servers_override)) {
|
|
325
|
if (filesize($ntp_boot_time_servers_override) > 0) {
|
|
326
|
/* Read servers from file if the file is not empty. */
|
|
327
|
$servers = file_get_contents($ntp_boot_time_servers_override);
|
|
328
|
$checkservers = explode(' ', trim($servers));
|
|
329
|
$goodservers = array();
|
|
330
|
/* Only add entries which are valid IP addresses. */
|
|
331
|
foreach ($checkservers as $ntpserver) {
|
|
332
|
if (is_ipaddr($ntpserver)) {
|
|
333
|
$goodservers[] = escapeshellarg($ntpserver);
|
|
334
|
}
|
|
335
|
}
|
|
336
|
$ntp_boot_time_servers = implode(' ', $goodservers);
|
|
337
|
} else {
|
|
338
|
/* Disable check if the file exists but is empty. */
|
|
339
|
$ntp_boot_time_servers = '';
|
|
340
|
}
|
|
341
|
}
|
|
342
|
|
|
343
|
if (!empty($ntp_boot_time_servers)) {
|
|
344
|
echo gettext("Bootstrapping clock...");
|
|
345
|
mwexec("/usr/bin/timeout -k 45 30 /usr/local/sbin/ntpd -g -q -c /dev/null {$ntp_boot_time_servers}");
|
|
346
|
echo gettext("done.") . "\n";
|
|
347
|
}
|
|
348
|
|
|
349
|
/* Enable ntpd */
|
|
350
|
system_ntp_configure();
|
|
351
|
|
|
352
|
if ($realmem > 0 and $realmem < 65) {
|
|
353
|
echo "System has less than 65 megabytes of ram {$realmem}. Delaying webConfigurator startup.\n";
|
|
354
|
/* start webConfigurator up on final pass */
|
|
355
|
mwexec("/usr/local/sbin/pfSctl -c 'service restart webgui'");
|
|
356
|
} else {
|
|
357
|
/* start web server */
|
|
358
|
system_webgui_start();
|
|
359
|
}
|
|
360
|
|
|
361
|
/* Configure console (and serial port - if necessary). */
|
|
362
|
console_configure();
|
|
363
|
|
|
364
|
/* start DHCP service */
|
|
365
|
services_dhcpd_configure();
|
|
366
|
|
|
367
|
/* start dhcpleases dhcp hosts leases program */
|
|
368
|
system_dhcpleases_configure();
|
|
369
|
|
|
370
|
/* start DHCP relay */
|
|
371
|
services_dhcrelay_configure();
|
|
372
|
|
|
373
|
/* start DHCP6 relay */
|
|
374
|
services_dhcrelay6_configure();
|
|
375
|
|
|
376
|
/* dyndns service updates */
|
|
377
|
send_event("service reload dyndnsall");
|
|
378
|
|
|
379
|
/* Run a filter configure now that most all services have started */
|
|
380
|
filter_configure_sync();
|
|
381
|
|
|
382
|
/* setup pppoe and pptp */
|
|
383
|
vpn_setup();
|
|
384
|
|
|
385
|
/* start the captive portal */
|
|
386
|
captiveportal_configure();
|
|
387
|
|
|
388
|
/* start Voucher support */
|
|
389
|
voucher_configure();
|
|
390
|
|
|
391
|
/* run any shell commands specified in config.xml */
|
|
392
|
system_do_shell_commands();
|
|
393
|
|
|
394
|
/* start IPsec tunnels */
|
|
395
|
$ipsec_dynamic_hosts = ipsec_configure();
|
|
396
|
|
|
397
|
/* start SNMP service */
|
|
398
|
services_snmpd_configure();
|
|
399
|
|
|
400
|
/* power down hard drive if needed/set */
|
|
401
|
system_set_harddisk_standby();
|
|
402
|
|
|
403
|
/* lock down console if necessary */
|
|
404
|
reload_ttys();
|
|
405
|
|
|
406
|
/* load graphing functions */
|
|
407
|
enable_rrd_graphing();
|
|
408
|
|
|
409
|
/* enable watchdog if supported */
|
|
410
|
enable_watchdog();
|
|
411
|
|
|
412
|
/* if <system><afterbootupshellcmd> exists, execute the command */
|
|
413
|
if ($config['system']['afterbootupshellcmd'] <> "") {
|
|
414
|
echo "Running afterbootupshellcmd {$config['system']['afterbootupshellcmd']}\n";
|
|
415
|
mwexec($config['system']['afterbootupshellcmd']);
|
|
416
|
}
|
|
417
|
|
|
418
|
if ($physmem < $g['minimum_ram_warning']) {
|
|
419
|
require_once("/etc/inc/notices.inc");
|
|
420
|
file_notice("{$g['product_label']}MemoryRequirements", "{$g['product_label']} requires at least {$g['minimum_ram_warning_text']} of RAM. Expect unusual performance. This platform is not supported.", "Memory", "", 1);
|
|
421
|
set_sysctl(array(
|
|
422
|
"net.inet.tcp.recvspace" => "4096",
|
|
423
|
"net.inet.tcp.sendspace" => "4096"
|
|
424
|
));
|
|
425
|
}
|
|
426
|
|
|
427
|
if (file_exists("/conf/ram_disks_failed")) {
|
|
428
|
require_once("/etc/inc/notices.inc");
|
|
429
|
file_notice("RAM Disks", "RAM disk creation failed. Reverted to traditional storage. Check RAM disk sizes.", "RAM Disks");
|
|
430
|
}
|
|
431
|
|
|
432
|
/* if we are operating at 1000 then increase timeouts.
|
|
433
|
this was never accounted for after moving to 1000 hz */
|
|
434
|
$kern_hz = get_single_sysctl('kern.clockrate');
|
|
435
|
$kern_hz = substr($kern_hz, strpos($kern_hz, "hz = ") + 5);
|
|
436
|
$kern_hz = substr($kern_hz, 0, strpos($kern_hz, ","));
|
|
437
|
if ($kern_hz == "1000") {
|
|
438
|
set_single_sysctl("net.inet.tcp.rexmit_min" , "30");
|
|
439
|
}
|
|
440
|
|
|
441
|
/* start the igmpproxy daemon */
|
|
442
|
services_igmpproxy_configure();
|
|
443
|
|
|
444
|
/* start the upnp daemon if it is enabled */
|
|
445
|
upnp_start();
|
|
446
|
|
|
447
|
/* If powerd is enabled, lets launch it */
|
|
448
|
activate_powerd();
|
|
449
|
|
|
450
|
/* Set preferred protocol */
|
|
451
|
prefer_ipv4_or_ipv6();
|
|
452
|
|
|
453
|
/* Resync / Reinstall packages if need be */
|
|
454
|
if (file_exists("{$g['conf_path']}/needs_package_sync")) {
|
|
455
|
echo "Triggering packages reinstallation in background\n";
|
|
456
|
mwexec_bg("{$g['etc_path']}/rc.package_reinstall_all");
|
|
457
|
} else {
|
|
458
|
/* Detect installed binary pkgs that are not registered in the system */
|
|
459
|
register_all_installed_packages();
|
|
460
|
}
|
|
461
|
|
|
462
|
/* Give syslogd a kick after everything else has been initialized, otherwise it can occasionally
|
|
463
|
fail to route syslog messages properly on both IPv4 and IPv6 */
|
|
464
|
system_syslogd_start();
|
|
465
|
|
|
466
|
/* done */
|
|
467
|
unset($g['booting']);
|
|
468
|
@unlink("{$g['varrun_path']}/booting");
|
|
469
|
|
|
470
|
/* If there are ipsec dynamic hosts try again to reload the tunnels as rc.newipsecdns does */
|
|
471
|
if ($ipsec_dynamic_hosts) {
|
|
472
|
echo gettext("Configuring IPsec VPN for dynamic hosts... ");
|
|
473
|
ipsec_configure();
|
|
474
|
echo gettext("done") . "\n";
|
|
475
|
}
|
|
476
|
if ($ipsec_dynamic_hosts || !empty($filterdns)) {
|
|
477
|
echo gettext("Configuring filter for dynamic IPsec VPN hosts... ");
|
|
478
|
filter_configure();
|
|
479
|
echo gettext("done") . "\n";
|
|
480
|
}
|
|
481
|
|
|
482
|
led_normalize();
|
|
483
|
|
|
484
|
notify_all_remote("Bootup complete");
|
|
485
|
?>
|