Project

General

Profile

Download (14.2 KB) Statistics
| Branch: | Tag: | Revision:
1
#!/usr/local/bin/php-cgi -f
2
<?php
3
/*
4
 * rc.bootup
5
 *
6
 * originally based on m0n0wall (http://m0n0.ch/wall)
7
 * Copyright (c) 2003-2004 Manuel Kasper <mk@neon1.net>.
8
 * Copyright (c) 2009 Erik Kristensen
9
 * Copyright (c) 2005-2013 BSD Perimeter
10
 * Copyright (c) 2013-2016 Electric Sheep Fencing
11
 * Copyright (c) 2014-2022 Rubicon Communications, LLC (Netgate)
12
 * All rights reserved.
13
 *
14
 * Licensed under the Apache License, Version 2.0 (the "License");
15
 * you may not use this file except in compliance with the License.
16
 * You may obtain a copy of the License at
17
 *
18
 * http://www.apache.org/licenses/LICENSE-2.0
19
 *
20
 * Unless required by applicable law or agreed to in writing, software
21
 * distributed under the License is distributed on an "AS IS" BASIS,
22
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
23
 * See the License for the specific language governing permissions and
24
 * limitations under the License.
25
 */
26

    
27
require_once("pkg-utils.inc");
28

    
29
echo " done.\n";
30

    
31
echo "Initializing...";
32
echo ".";
33
require_once("/etc/inc/globals.inc");
34
echo ".";
35
require_once("/etc/inc/led.inc");
36
led_normalize();
37
echo ".";
38
if (led_count() >= 3) {
39
	led_kitt();
40
}
41

    
42
/* let the other functions know we're booting */
43
$pkg_interface = 'console';
44
$g['booting'] = true;
45

    
46
/* parse the configuration and include all functions used below */
47
require_once("/etc/inc/config.inc");
48
echo ".";
49
require_once("/etc/inc/config.console.inc");
50
echo ".";
51
require_once("/etc/inc/auth.inc");
52
echo ".";
53
require_once("/etc/inc/functions.inc");
54
echo ".";
55
require_once("/etc/inc/filter.inc");
56
echo ".";
57
require_once("/etc/inc/shaper.inc");
58
echo ".";
59
require_once("/etc/inc/ipsec.inc");
60
echo ".";
61
require_once("/etc/inc/vpn.inc");
62
echo ".";
63
require_once("/etc/inc/openvpn.inc");
64
echo ".";
65
require_once("/etc/inc/captiveportal.inc");
66
echo ".";
67
require_once("/etc/inc/rrd.inc");
68
echo ".";
69
require_once("/etc/inc/pfsense-utils.inc");
70
echo ".";
71

    
72
/* get system memory amount */
73
$memory = get_memory();
74
$physmem = $memory[0];
75
$realmem = $memory[1];
76
echo " done.\n";
77

    
78

    
79
/* save dmesg output to file */
80
system_dmesg_save();
81

    
82
/* check whether config reset is desired (via hardware button on WRAP/ALIX) */
83
system_check_reset_button();
84

    
85
/* remove previous firmware upgrade if present */
86
if (file_exists("/root/firmware.tgz")) {
87
	unlink("/root/firmware.tgz");
88
}
89

    
90
/* restore RRD, SSH keys and extra data on bsdinstall config restore
91
 * see https://redmine.pfsense.org/issues/12518 */
92
if (file_exists("{$g['conf_path']}/installer_copied_config") &&
93
    file_exists("{$g['conf_path']}/restore_config_data")) {
94
	copy("/cf/conf/config.xml", "{$g['tmp_path']}/config_to_restore.xml");
95
	restore_backup("{$g['tmp_path']}/config_to_restore.xml");
96
	@unlink("{$g['tmp_path']}/config_to_restore.xml");
97
	@unlink("{$g['conf_path']}/installer_copied_config");
98
	@unlink("{$g['conf_path']}/restore_config_data");
99
}
100

    
101
/* Triggering of the initial setup wizard after reboot has been requested */
102
if (file_exists("{$g['conf_path']}/trigger_initial_wizard_after_reboot")) {
103
	touch("{$g['conf_path']}/trigger_initial_wizard");
104
	@unlink("{$g['conf_path']}/trigger_initial_wizard_after_reboot");
105
}
106

    
107
/* start devd (dhclient now uses it) */
108
echo "Starting device manager (devd)...";
109
mute_kernel_msgs();
110
start_devd();
111
set_device_perms();
112
unmute_kernel_msgs();
113
echo "done.\n";
114

    
115
echo "Loading configuration...";
116
parse_config_bootup();
117
echo "done.\n";
118

    
119
mwexec("/usr/sbin/gnid > {$g['vardb_path']}/uniqueid 2>/dev/null");
120

    
121
/* run any early shell commands specified in config.xml */
122
system_do_shell_commands(1);
123

    
124
// Only do the alternate interface checks if:
125
// 1) The user has not yet run the initial wizard; and
126
// 2) The user has not used the console menu to setup interface assignments
127
if (file_exists("{$g['conf_path']}/trigger_initial_wizard") && !file_exists("{$g['conf_path']}/assign_complete")) {
128
	check_for_alternate_interfaces();
129
}
130

    
131
/* Convert configuration
132
 * This must happen before the interface mismatch test, see
133
 * https://redmine.pfsense.org/issues/7809 */
134
echo "Updating configuration...";
135
convert_config();
136
echo "done.\n";
137

    
138
/*
139
 *	Determine if we need to throw a interface exception
140
 *	and ask the user to reassign interfaces.  This will
141
 *	avoid a reboot and that is a good thing.
142
 */
143
while (is_interface_mismatch() == true) {
144
	led_assigninterfaces();
145
	if (isset($config['revision'])) {
146
		if (file_exists("{$g['tmp_path']}/missing_interfaces")) {
147
			echo "Warning: Configuration references interfaces that do not exist: " . file_get_contents("{$g['tmp_path']}/missing_interfaces") . "\n";
148
		}
149
		echo "\nNetwork interface mismatch -- Running interface assignment option.\n";
150
	} else {
151
		echo "\nDefault interfaces not found -- Running interface assignment option.\n";
152
	}
153
	$ifaces = get_interface_list();
154
	if (is_array($ifaces)) {
155
		foreach ($ifaces as $iface => $ifdata) {
156
			interfaces_bring_up($iface);
157
		}
158
	}
159
	if (set_networking_interfaces_ports() == -1) {
160
		echo "\npfSense cannot continue without at least one Network Interface Card.\n";
161
		echo "\nHalting the system.\n";
162
		system("/sbin/shutdown -h now");
163
		exit(0);
164
	}
165
	reload_interfaces_sync();
166
	led_kitt();
167
}
168

    
169
echo "Checking config backups consistency...";
170
cleanup_backupcache(true);
171
echo "done.\n";
172

    
173
/* read in /etc/sysctl.conf and set values if needed */
174
echo "Setting up extended sysctls...";
175
system_setup_sysctl();
176
echo "done.\n";
177

    
178
/* enable optional crypto modules */
179
load_crypto();
180

    
181
/* enable optional thermal sensor modules */
182
load_thermal_hardware();
183

    
184
/* set up our timezone */
185
system_timezone_configure();
186

    
187
/* set up our hostname */
188
system_hostname_configure();
189

    
190
/* make hosts file */
191
system_hosts_generate();
192

    
193
/* configure loopback interface */
194
interfaces_loopback_configure();
195

    
196
/* Setup Local CA Trust Store */
197
ca_setup_trust_store();
198

    
199
/* If the system uses ZFS and has compression enabled for /var/log, disable log
200
 * compression by default. See https://redmine.pfsense.org/issues/12011
201
 */
202
$varlog_compression_state = 'off';
203
if (is_module_loaded('zfs.ko')) {
204
	exec("/sbin/zfs get -H compression /var/log | /usr/bin/awk '{print $3;}'", $varlog_compression_state);
205
	$varlog_compression_state = $varlog_compression_state[0];
206
}
207
if (file_exists("{$g['conf_path']}/trigger_initial_wizard") &&
208
    (trim($varlog_compression_state) != 'off')) {
209
	touch("{$g['conf_path']}/syslog_default_uncompressed");
210
}
211
/* start syslogd */
212
system_syslogd_start();
213

    
214
/* set pam shell authentication backend */
215
set_pam_auth();
216

    
217
/* Log the RAM disk restore messages. */
218
if (file_exists("/var/log/restore_ramdisk_store.boot")) {
219
	exec("/usr/bin/logger -f /var/log/restore_ramdisk_store.boot");
220
}
221

    
222
init_config_arr(array('system', 'ssh'));
223
if (isset($config['system']['ssh']['enable'])) {
224
	echo "Starting Secure Shell Services...";
225
	send_event("service reload sshd");
226
	echo "done.\n";
227
}
228

    
229
/* setup interface microcode which improves tcp/ip speed */
230
echo "Setting up interfaces microcode...";
231
setup_microcode();
232
echo "done.\n";
233

    
234
if (isset($config['system']['mds_disable']) &&
235
    (strlen($config['system']['mds_disable']) > 0)) {
236
	set_single_sysctl("hw.mds_disable" , (int)$config['system']['mds_disable']);
237
}
238

    
239
/* remove leftover dhcp6c lock file if it exist */
240
if (file_exists("/tmp/dhcp6c_lock")) {
241
	@unlink("/tmp/dhcp6c_lock");
242
	echo("Removed leftover dhcp6c lock file: /tmp/dhcp6c_lock\n");
243
}
244
if (file_exists("/tmp/dhcp6c_ifs")) {
245
	@unlink("/tmp/dhcp6c_ifs");
246
}
247

    
248
/* set up interfaces */
249
if (!$debugging) {
250
	mute_kernel_msgs();
251
}
252
interfaces_configure();
253
interfaces_sync_setup();
254
if (!$debugging) {
255
	unmute_kernel_msgs();
256
}
257

    
258
/* re-make hosts file after configuring interfaces */
259
system_hosts_generate();
260

    
261
/* start OpenVPN server & clients */
262
echo "Syncing OpenVPN settings...";
263
openvpn_resync_all();
264
echo "done.\n";
265

    
266
/* generate resolv.conf */
267
system_resolvconf_generate();
268

    
269
/* setup altq + pf */
270
filter_configure_sync();
271

    
272
/* start pflog */
273
echo "Starting PFLOG...";
274
filter_pflog_start();
275
echo "done.\n";
276

    
277
/* reconfigure our gateway monitor */
278
setup_gateways_monitor();
279

    
280
/* set up static routes */
281
echo "Setting up static routes...";
282
system_routing_configure();
283
echo "done.\n";
284

    
285
init_config_arr(array('unbound'));
286
init_config_arr(array('dnsmasq'));
287
if (isset($config['unbound']['enable']) ||
288
    isset($config['dnsmasq']['enable'])) {
289
	echo "Setting up DNSs...\n";
290
	/* start dnsmasq service */
291
	services_dnsmasq_configure();
292

    
293
	/* start unbound service */
294
	services_unbound_configure();
295
}
296

    
297
echo "Synchronizing user settings...";
298
local_reset_accounts();
299
echo "done.\n";
300

    
301
/* configure cron service */
302
echo "Configuring CRON...";
303
configure_cron();
304
echo "done.\n";
305

    
306
/* enable routing */
307
system_routing_enable();
308

    
309
/* Set initial time by using IP addresses in case DNS is not available
310
 * This works around issues with DNSSEC and gives the firewall a better chance
311
 * of having a highly accurate clock at boot.
312
 * NG 7352, NG 7447
313
 */
314

    
315
/* Default to Google Public NTP servers */
316
$ntp_boot_time_servers = '216.239.35.0 216.239.35.4 216.239.35.8 216.239.35.12';
317
/* File to allow users to override default behavior.
318
 * Servers must be a single line with space-separated IP address entries ONLY as
319
 * DNS may not be functional. */
320
$ntp_boot_time_servers_override = '/conf/ntp-boot-time-servers';
321

    
322
/* Handle user override of NTP bootstrap behavior */
323
if (file_exists($ntp_boot_time_servers_override)) {
324
	if (filesize($ntp_boot_time_servers_override) > 0) {
325
		/* Read servers from file if the file is not empty. */
326
		$servers = file_get_contents($ntp_boot_time_servers_override);
327
		$checkservers = explode(' ', trim($servers));
328
		$goodservers = array();
329
		/* Only add entries which are valid IP addresses. */
330
		foreach ($checkservers as $ntpserver) {
331
			if (is_ipaddr($ntpserver)) {
332
				$goodservers[] = escapeshellarg($ntpserver);
333
			}
334
		}
335
		$ntp_boot_time_servers = implode(' ', $goodservers);
336
	} else {
337
		/* Disable check if the file exists but is empty. */
338
		$ntp_boot_time_servers = '';
339
	}
340
}
341

    
342
if (!empty($ntp_boot_time_servers)) {
343
	echo gettext("Bootstrapping clock...");
344
	mwexec("/usr/bin/timeout -k 45 30 /usr/local/sbin/ntpd -g -q -c /dev/null {$ntp_boot_time_servers}");
345
	echo gettext("done.") . "\n";
346
}
347

    
348
/* Enable ntpd */
349
system_ntp_configure();
350

    
351
if ($realmem > 0 and $realmem < 65) {
352
	echo "System has less than 65 megabytes of ram {$realmem}.  Delaying webConfigurator startup.\n";
353
	/* start webConfigurator up on final pass */
354
	mwexec("/usr/local/sbin/pfSctl -c 'service restart webgui'");
355
} else {
356
	/* start web server */
357
	system_webgui_start();
358
}
359

    
360
/* Configure console (and serial port - if necessary). */
361
console_configure();
362

    
363
/* start DHCP service */
364
services_dhcpd_configure();
365

    
366
/* start dhcpleases dhcp hosts leases program */
367
system_dhcpleases_configure();
368

    
369
/* start DHCP relay */
370
services_dhcrelay_configure();
371

    
372
/* start DHCP6 relay */
373
services_dhcrelay6_configure();
374

    
375
/* dyndns service updates */
376
send_event("service reload dyndnsall");
377

    
378
/* Run a filter configure now that most all services have started */
379
filter_configure_sync();
380

    
381
/* setup pppoe and pptp */
382
vpn_setup();
383

    
384
/* start the captive portal */
385
captiveportal_configure();
386

    
387
/* start Voucher support */
388
voucher_configure();
389

    
390
/* run any shell commands specified in config.xml */
391
system_do_shell_commands();
392

    
393
/* start IPsec tunnels */
394
$ipsec_dynamic_hosts = ipsec_configure();
395

    
396
/* start SNMP service */
397
services_snmpd_configure();
398

    
399
/* power down hard drive if needed/set */
400
system_set_harddisk_standby();
401

    
402
/* lock down console if necessary */
403
reload_ttys();
404

    
405
/* load graphing functions */
406
enable_rrd_graphing();
407

    
408
/* enable watchdog if supported */
409
enable_watchdog();
410

    
411
/* if <system><afterbootupshellcmd> exists, execute the command */
412
if ($config['system']['afterbootupshellcmd'] <> "") {
413
	echo "Running afterbootupshellcmd {$config['system']['afterbootupshellcmd']}\n";
414
	mwexec($config['system']['afterbootupshellcmd']);
415
}
416

    
417
if ($physmem < $g['minimum_ram_warning']) {
418
	require_once("/etc/inc/notices.inc");
419
	file_notice("{$g['product_label']}MemoryRequirements", "{$g['product_label']} requires at least {$g['minimum_ram_warning_text']} of RAM.  Expect unusual performance.  This platform is not supported.", "Memory", "", 1);
420
	set_sysctl(array(
421
		"net.inet.tcp.recvspace" => "4096",
422
		"net.inet.tcp.sendspace" => "4096"
423
	));
424
}
425

    
426
if (file_exists("/conf/ram_disks_failed")) {
427
	require_once("/etc/inc/notices.inc");
428
	file_notice("RAM Disks", "RAM disk creation failed. Reverted to traditional storage. Check RAM disk sizes.", "RAM Disks");
429
}
430

    
431
/* if we are operating at 1000 then increase timeouts.
432
   this was never accounted for after moving to 1000 hz */
433
$kern_hz = get_single_sysctl('kern.clockrate');
434
$kern_hz = substr($kern_hz, strpos($kern_hz, "hz = ") + 5);
435
$kern_hz = substr($kern_hz, 0, strpos($kern_hz, ","));
436
if ($kern_hz == "1000") {
437
	set_single_sysctl("net.inet.tcp.rexmit_min" , "30");
438
}
439

    
440
/* start the igmpproxy daemon */
441
services_igmpproxy_configure();
442

    
443
/* start the upnp daemon if it is enabled */
444
upnp_start();
445

    
446
/* If powerd is enabled, lets launch it */
447
activate_powerd();
448

    
449
/* Set preferred protocol */
450
prefer_ipv4_or_ipv6();
451

    
452
/* Resync / Reinstall packages if need be */
453
if (file_exists("{$g['conf_path']}/needs_package_sync")) {
454
	echo "Triggering packages reinstallation in background\n";
455
	mwexec_bg("{$g['etc_path']}/rc.package_reinstall_all");
456
} else {
457
	/* Detect installed binary pkgs that are not registered in the system */
458
	register_all_installed_packages();
459
}
460

    
461
/* Give syslogd a kick after everything else has been initialized, otherwise it can occasionally
462
   fail to route syslog messages properly on both IPv4 and IPv6 */
463
system_syslogd_start();
464

    
465
/* done */
466
$g['booting'] = false;
467
@unlink("{$g['varrun_path']}/booting");
468

    
469
/* If there are ipsec dynamic hosts try again to reload the tunnels as rc.newipsecdns does */
470
if ($ipsec_dynamic_hosts) {
471
	echo gettext("Configuring IPsec VPN for dynamic hosts... ");
472
	ipsec_configure();
473

    
474
	/* restart dpinger if PH1 remote gateway == fqdn and PH2 mode == VTI
475
	 * see https://redmine.pfsense.org/issues/12763 */
476
	foreach ($config['ipsec']['phase1'] as $p1) {
477
		if (!isset($p1['mobile']) && !isset($p1['disabled']) && is_fqdn($p1['remote-gateway'])) {
478
			foreach ($config['ipsec']['phase2'] as $p2) {
479
				if (!isset($p2['disabled']) && ($p2['mode'] == 'vti')) {
480
					setup_gateways_monitor();
481
					break 2;
482
				}
483
			}
484
		}
485
	}
486

    
487
	echo gettext("done") . "\n";
488
}
489
if ($ipsec_dynamic_hosts || !empty($filterdns)) {
490
	echo gettext("Configuring filter for dynamic IPsec VPN hosts... ");
491
	filter_configure();
492
	echo gettext("done") . "\n";
493
}
494

    
495
led_normalize();
496

    
497
notify_all_remote("Bootup complete");
498
?>
(21-21/85)