pfSense

#!/bin/sh

# pfSense-rc

#

# part of pfSense (https://www.pfsense.org)

# Copyright (c) 2013-2016 Electric Sheep Fencing

#

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

#/bin/stty status '^T'

#/bin/stty susp '^-' intr '^-' quit '^-'

#trap : 2

#trap : 3

HOME=/

{

	# Set our current version

	version=`/bin/cat /etc/version`

	# Version patch

	version_patch="0"

	if [ -f /etc/version.patch ]; then

		version_patch=`/bin/cat /etc/version.patch`

	fi

		version_patch=""

	else

		version_patch=" (Patch ${version_patch})"

	fi

}

# Use php -n here because we are not ready to load extensions yet

product_name=$(/usr/local/bin/php -n /usr/local/sbin/read_global_var product_name pfSense)

product_label=$(/usr/local/bin/php -n /usr/local/sbin/read_global_var product_label pfSense)

echo "Configuring crash dumps..."

		if [ $? -eq 0 ]; then

			echo "Clearing ZFS label before expanding"

			/sbin/zpool labelclear /dev/mmcsd0

		fi

# Pending changes can keep the file system dirty until all the cached data is

# flushed to the disk.

#

/sbin/mount -ur /

fsck_forced_iterations=`/bin/kenv -q pfsense.fsck.force`

if [ ! -z "${fsck_forced_iterations}" ]; then

	echo "Forcing filesystem check (${fsck_forced_iterations} times)..."

	while [ ${fsck_forced_iterations} -gt 0 ]; do

	done

fi

unset fsck_fix_count

if [ -f ${fsck_fix_flag_file} ]; then

	if ! awk '{print $3}' /etc/fstab | grep -q ufs; then

		echo "Fix for FreeBSD-SA-19:10.ufs is not needed in this system"

		skip_fsck_fix=1

	else

		fsck_fix_count=$(cat ${fsck_fix_flag_file})

		echo "Applying fix for FreeBSD-SA-19:10.ufs"

		/sbin/fsck -t ufs -f -p -T ufs:-z >/dev/null 2>&1

		if [ $? -eq 0 ]; then

			fsck_fix_applied=1

		fi

fsck_fix_count=${fsck_fix_count:-0}

0)

	echo "Filesystems are clean, continuing..."

	echo "Mounting filesystems..."

	;;

	FSCK_ACTION_NEEDED=1

	;;

*)

	echo "Stopping boot is recommended because filesystem manual action is needed, nevertheless automated repair of the filesystem will be attempted."

	FSCK_ACTION_NEEDED=1

	;;

esac

if [ ${FSCK_ACTION_NEEDED} = 1 ]; then

	echo "WARNING: Trying to recover filesystem from inconsistency..."

mount_rc=$?

attempts=0

	mount_rc=$?

done

	echo "ERROR: Impossible to mount filesystem, use interactive shell to attempt to recover it"

	/bin/sh

	/sbin/reboot

fi

if /sbin/kldstat -qm zfs; then

	if [ $ZFSFSAVAILABLE -eq 0 ]; then

		/sbin/kldunload zfs

		USE_ZFS=1

		ZFSROOT=$(/sbin/zfs mount | /usr/bin/awk '$2 == "/" {print $1}')

		if [ -n "$ZFSROOT" ]; then

		fi

		# See https://redmine.pfsense.org/issues/8063

		if [ -d /bootpool ]; then

			/sbin/zpool import -f bootpool

		fi

fi

if [ -d "/conf" ]; then

	# If item is not a symlink then rm and recreate

	CONFPOINTSTO=`readlink /conf`

	if ! test "x$CONFPOINTSTO" = "x/cf/conf"; then

		/bin/rm -rf /conf

		/bin/ln -s /cf/conf /conf

/etc/rc.checkclock

if ramdisk_check_enabled; then

	USE_RAMDISK=true

if [ -z "${USE_ZFS}" ]; then

	ramdisk_relocate_pkgdb_all

fi

if [ -n "${USE_ZFS}" -a -n "${USE_RAMDISK}" ]; then

if [ -n "${USE_RAMDISK}" ]; then

	if [ -n "${USE_ZFS}" ]; then

		_be_mount_zfs

	fi

		ramdisk_link_pkgdb

	fi

# If activating RAM disks failed, then undo some of the above actions

if [ -n "${USE_RAMDISK}" ] && ramdisk_failed; then

	if [ -z "${USE_ZFS}" ]; then

		ramdisk_relocate_pkgdb disk

	fi

	ramdisk_reset_status

if [ ! -z "`sysctl -Nq debug.ddb.scripting.scripts`" ]; then

/etc/rc.restore_ramdisk_store

[ -d /home ] \

	|| mkdir /home

/bin/rm -f /root/TRIM_unset

	/etc/rc.disable_hdd_apm

fi

CDDEVICE=`dmesg |egrep -ie "($MANUFACTURER)" | awk -F: '/cd/ {print $1}'`

if [ "$CDDEVICE" != "" ]; then

	cdcontrol -f /dev/"$CDDEVICE" eject

fi

varrunpath=$(/usr/local/bin/php -n /usr/local/sbin/read_global_var varrun_path "/var/run")

echo

	if ! [ -c ${SWAPDEVICE} ]; then

		echo "${SWAPDEVICE}	none	swap	sw	0	0" >> /tmp/fstab.swap

		# The swap device in fstab does not exist, look for other valid entries and update fstab

		for SWAPLABEL in /dev/label/swap* /dev/mirror/swap*; do

			if [ -c ${SWAPLABEL} ]; then

				echo "${SWAPLABEL}	none	swap	sw	0	0" >> /tmp/fstab.swap

			fi

	else

		/bin/cp /etc/fstab /tmp/fstab.swap

	fi

	/sbin/swapon -F /tmp/fstab.swap -a 2>/dev/null >/dev/null

fi

# turn off the immutable flag, set /var/empty to read-only, make it immutable again

chflags noschg /var/empty

/bin/rm -rf /var/etc/*

# strongswan pkg upgrade

if [ -L /usr/local/etc/ipsec.d ]; then

	rm -f /usr/local/etc/ipsec.d

fi

if [ -L /usr/local/etc/ipsec.conf ]; then

	rm -f /usr/local/etc/ipsec.conf

fi

	rm -f /usr/local/etc/strongswan.d

fi

	rm -f /usr/local/etc/strongswan.conf

fi

for f in /etc/hosts \

    /etc/resolv.conf \

    /etc/resolvconf.conf \

    /etc/syslog.conf; do

	if [ -L "${f}" ]; then

		rm -f ${f}

trap "echo 'Reboot interrupted'; exit 1" 3

if [ "$DEVFS" = "0" ]; then

	mount_devfs devfs /dev

# Create an initial utmp file

if [ -f "/dev/kbdmux0" ]; then

	echo -n "."

	/usr/sbin/kbdcontrol -k /dev/kbdmux0 < /dev/console

	[ -c "/dev/atkbd0" ] && kbdcontrol -a atkbd0 < /dev/console

	[ -c "/dev/ukbd0" ] && kbdcontrol -a ukbd0 < /dev/console

fi

if [ -f /dist/uniondirs ]; then

	echo -n "."

	/etc/rc.d/unionfs start

	|| mkdir -p /etc/ssl

	&& cp -f /usr/local/share/${product_name}/ssl/openssl.cnf /etc/ssl

ln -sf /etc/ssl/openssl.cnf \

	/usr/local/openssl/openssl.cnf

	&& cp -f /usr/local/share/${product_name}/ssl/netgate-ca.pem /etc/ssl

	/bin/echo -n "Launching /etc/rc.custom_boot_early...";

	/etc/rc.custom_boot_early

	echo "Done"

fi

/usr/bin/touch $varrunpath/booting

	cp -f /usr/local/share/${product_name}/custom_logos/*svg \

[ -x /usr/local/etc/rc.d/microcode_update ] \

	&& /usr/local/etc/rc.d/microcode_update onestart

	rm -f ${fsck_fix_flag_file}

elif [ -f ${fsck_fix_flag_file} ]; then

	# fsck fix already applied

	if [ -n "${fsck_fix_applied}" ]; then

		touch /cf/conf/applied_fix_for_SA-19-10.ufs

		rm -f ${fsck_fix_flag_file}

	elif [ ${fsck_fix_count} -ge 3 ]; then

		echo "ERROR: fsck fix for SA-19-10 failed to apply..."

		sleep 5

		rm -f ${fsck_fix_flag_file}

	else

		# if / is UFS, reroot instead of reboot

		root_fstype=$(mount -p / | awk '{print $3}')

		unset reroot

		if [ "${root_fstype}" = "ufs" ]; then

			reroot="-r"

		fi

		# fsck fix failed, increment escape counter to avoid infinite

		# loop on a system with a broken filesystem

		fsck_fix_count=$((fsck_fix_count+1))

		echo "${fsck_fix_count}" > ${fsck_fix_flag_file}

		# fsck binary was old and didn't have -z option, then reboot

		# and run again

		echo "fsck needs to run to fix SA-10-10. Rebooting..."

		/etc/rc.reboot ${reroot}

		exit 0

	fi

fi

# Be sure the file is removed to not create troubles after

if [ -f $varrunpath/booting ]; then

	/bin/rm $varrunpath/booting

fi

	if [ ! -f /.no_zfs_reservation ]; then

		zpool list -o name zroot > /dev/null 2>&1 && ZPOOL=zroot

		if [ -n "${ZPOOL}" ]; then

			zfs list -Hp -o name -t filesystem | grep -q ${ZPOOL}/reservation

			if [ $? -ne 0 ]; then

				AVAIL=$( zfs list -Hpo avail ${ZPOOL} )

				RESSIZE=$( zfs list -Hpo avail,used ${ZPOOL} | awk -v CONVFMT='%.0f' '{printf ( $1 + $2 ) * 0.1 "\n"}' )

				if [ $(( ${AVAIL} / 2 )) -gt ${RESSIZE} ]; then

					logger "Creating ZFS reservation of ${RESSIZE} bytes on ${ZPOOL}"

					zfs create -o reservation=${RESSIZE} ${ZPOOL}/reservation

				else

					logger "Not enough space to create reservation on ${ZPOOL};  ${AVAIL} / 2 is not greater than ${RESSIZE} bytes"

				fi

		fi

	fi

fi

/usr/local/bin/minicron 300 $varrunpath/ipsec_keepalive.pid /usr/local/bin/ipsec_keepalive.php

GMIRROR_STATUS=`/sbin/gmirror status`

if [ "${GMIRROR_STATUS}" != "" ]; then

	# Using a flag file at bootup saves an expensive exec/check on each page load.

	/usr/bin/touch /var/run/gmirror_active

	# Setup monitoring/notifications

	/usr/local/bin/minicron 60 /var/run/gmirror_status_check.pid /usr/local/sbin/gmirror_status_check.php

fi

	&& /usr/local/sbin/fcgicli -f /etc/rc.start_packages

/etc/rc.update_pkg_metadata now

ARCH=`uname -m`