Skip to content

Commit 9332d32

Browse files
committed
Allow starting jails with ip[46] set to inherit
Either or both ip4 and ip6 can be set to inherit. For example I have used the following config: ``` interface = vtnet0; ip4 = inherit; ip6 = new; ip6.addr = 2a01:xxxx:xxxx:xxx::1; ```
1 parent 21a0ce7 commit 9332d32

File tree

1 file changed

+35
-15
lines changed

1 file changed

+35
-15
lines changed

usr/local/share/bastille/start.sh

+35-15
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,21 @@ usage() {
3535
error_exit "Usage: bastille start TARGET"
3636
}
3737

38+
# indicate if an IP configurtaion value (e.g. a value given for ip4 or ip6)
39+
# requires extra configuration external to the jail
40+
#
41+
# success if it does, failure if it does not
42+
ip_require_config() {
43+
44+
case "${1}" in
45+
disable|inherit|"not set")
46+
return 1
47+
;;
48+
esac
49+
50+
return 0
51+
}
52+
3853
# Handle special-case commands first.
3954
case "$1" in
4055
help|-h|--help)
@@ -67,24 +82,29 @@ for _jail in ${JAILS}; do
6782

6883
## test if not running
6984
elif [ ! "$(/usr/sbin/jls name | awk "/^${_jail}$/")" ]; then
70-
# Verify that the configured interface exists. -- cwells
71-
if [ "$(bastille config $_jail get vnet)" != 'enabled' ]; then
72-
_interface=$(bastille config $_jail get interface)
73-
if ! ifconfig | grep "^${_interface}:" >/dev/null; then
74-
error_notify "Error: ${_interface} interface does not exist."
75-
continue
85+
## if networking is entirely inherited we can skip any setup
86+
_ip4=$(bastille config $_jail get ip4)
87+
_ip6=$(bastille config $_jail get ip6)
88+
if ip_require_config "${_ip4}" || ip_require_config "${_ip6}"; then
89+
# Verify that the configured interface exists. -- cwells
90+
if [ "$(bastille config $_jail get vnet)" != 'enabled' ]; then
91+
_interface=$(bastille config $_jail get interface)
92+
if ! ifconfig | grep "^${_interface}:" >/dev/null; then
93+
error_notify "Error: ${_interface} interface does not exist."
94+
continue
95+
fi
7696
fi
77-
fi
7897

79-
## warn if matching configured (but not online) ip4.addr, ignore if there's no ip4.addr entry
80-
ip=$(grep 'ip4.addr' "${bastille_jailsdir}/${_jail}/jail.conf" | awk '{print $3}' | sed 's/\;//g')
81-
if [ -n "${ip}" ]; then
82-
if ifconfig | grep -w "${ip}" >/dev/null; then
83-
error_notify "Error: IP address (${ip}) already in use."
84-
continue
98+
## warn if matching configured (but not online) ip4.addr, ignore if there's no ip4.addr entry
99+
ip=$(grep 'ip4.addr' "${bastille_jailsdir}/${_jail}/jail.conf" | awk '{print $3}' | sed 's/\;//g')
100+
if [ -n "${ip}" ]; then
101+
if ifconfig | grep -w "${ip}" >/dev/null; then
102+
error_notify "Error: IP address (${ip}) already in use."
103+
continue
104+
fi
105+
## add ip4.addr to firewall table:jails
106+
pfctl -q -t jails -T add "${ip}"
85107
fi
86-
## add ip4.addr to firewall table:jails
87-
pfctl -q -t jails -T add "${ip}"
88108
fi
89109

90110
## start the container

0 commit comments

Comments
 (0)