From f68ed2ecfdf8a8c6fcd225c5d1b4f6d1172f9bbe Mon Sep 17 00:00:00 2001
From: Jose <joserprg@gmail.com>
Date: Mon, 2 Dec 2019 03:10:45 -0400
Subject: [PATCH 1/5] Added support for HardenedBSD new link structure

---
 usr/local/share/bastille/bootstrap.sh | 14 ++++++++++++++
 usr/local/share/bastille/create.sh    |  9 +++++++++
 usr/local/share/bastille/destroy.sh   | 12 ++++++++++--
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/usr/local/share/bastille/bootstrap.sh b/usr/local/share/bastille/bootstrap.sh
index 2e21289..ada5cb8 100644
--- a/usr/local/share/bastille/bootstrap.sh
+++ b/usr/local/share/bastille/bootstrap.sh
@@ -458,6 +458,20 @@ if [ -n "${NAME_VERIFY}" ]; then
     bootstrap_release
 else
     usage
+fi
+	;;
+*-stable-build-*|*-STABLE-BUILD-*)
+## check for HardenedBSD(for current changes)
+NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build|-STABLE-BUILD)-([0-9]{1,2})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
+NAME_RELEASE=$(echo ${NAME_VERIFY} | sed 's/-build-[0-9]\{1,2\}//g')
+NAME_BUILD=$(echo ${NAME_VERIFY} | sed 's/[0-9]\{1,2\}-stable-//g')
+if [ -n "${NAME_VERIFY}" ]; then
+    RELEASE="${NAME_VERIFY}"
+    UPSTREAM_URL="http://ci-01.nyi.hardenedbsd.org/pub/hardenedbsd/${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
+    bootstrap_directories
+    bootstrap_release
+else
+    usage
 fi
     ;;
 http?://github.com/*/*|http?://gitlab.com/*/*)
diff --git a/usr/local/share/bastille/create.sh b/usr/local/share/bastille/create.sh
index 918e64d..fe8fd75 100644
--- a/usr/local/share/bastille/create.sh
+++ b/usr/local/share/bastille/create.sh
@@ -333,6 +333,15 @@ fi
 *-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)
 ## check for HardenedBSD releases name
 NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-LAST|-STABLE-last|-stable-last|-STABLE-LAST)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g')
+if [ -n "${NAME_VERIFY}" ]; then
+    RELEASE="${NAME_VERIFY}"
+else
+    usage
+fi
+    ;;
+*-stable-build-*|*-STABLE-BUILD-*)
+## check for HardenedBSD(for current changes)
+NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build|-STABLE-BUILD)-([0-9]{1,2})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
 if [ -n "${NAME_VERIFY}" ]; then
     RELEASE="${NAME_VERIFY}"
 else
diff --git a/usr/local/share/bastille/destroy.sh b/usr/local/share/bastille/destroy.sh
index e899b83..5f2659b 100644
--- a/usr/local/share/bastille/destroy.sh
+++ b/usr/local/share/bastille/destroy.sh
@@ -146,7 +146,6 @@ case "${NAME}" in
         usage
     fi
     ;;
-
 *-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)
     ## check for HardenedBSD releases name
     NAME_VERIFY=$(echo "${NAME}" | grep -iwE '^([1-9]{2,2})(-stable-LAST|-STABLE-last|-stable-last|-STABLE-LAST)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g')
@@ -157,8 +156,17 @@ case "${NAME}" in
         usage
     fi
     ;;
+*-stable-build-*|*-STABLE-BUILD-*)
+## check for HardenedBSD(for current changes)
+NAME_VERIFY=$(echo "${NAME}" | grep -iwE '([0-9]{1,2})(-stable-build|-STABLE-BUILD)-([0-9]{1,2})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
+    if [ -n "${NAME_VERIFY}" ]; then
+        NAME="${NAME_VERIFY}"
+        destroy_rel
+    else
+        usage
+    fi
+    ;;
 *)
-
     ## just destroy a jail
     destroy_jail
     ;;

From 9a30610d1aa7bebcddd0f70529e9d497f7f60019 Mon Sep 17 00:00:00 2001
From: Jose <joserprg@gmail.com>
Date: Tue, 3 Dec 2019 00:57:47 -0400
Subject: [PATCH 2/5] Provide alternative fetch urls

---
 usr/local/share/bastille/bootstrap.sh | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/usr/local/share/bastille/bootstrap.sh b/usr/local/share/bastille/bootstrap.sh
index ada5cb8..0480102 100644
--- a/usr/local/share/bastille/bootstrap.sh
+++ b/usr/local/share/bastille/bootstrap.sh
@@ -441,7 +441,13 @@ case "${1}" in
 NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])$' | tr '[:lower:]' '[:upper:]')
 if [ -n "${NAME_VERIFY}" ]; then
     RELEASE="${NAME_VERIFY}"
-    UPSTREAM_URL="http://ftp.freebsd.org/pub/FreeBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/${RELEASE}"
+    if [ "$(ping -c1 ftp.freebsd.org 2>/dev/null)" ]; then
+        ## main http
+        UPSTREAM_URL="http://ftp.freebsd.org/pub/FreeBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/${RELEASE}"
+    else
+        ## main ftp
+        UPSTREAM_URL="ftp://ftp.freebsd.org/pub/FreeBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/${RELEASE}"
+    fi
     bootstrap_directories
     bootstrap_release
 else
@@ -467,7 +473,13 @@ NAME_RELEASE=$(echo ${NAME_VERIFY} | sed 's/-build-[0-9]\{1,2\}//g')
 NAME_BUILD=$(echo ${NAME_VERIFY} | sed 's/[0-9]\{1,2\}-stable-//g')
 if [ -n "${NAME_VERIFY}" ]; then
     RELEASE="${NAME_VERIFY}"
-    UPSTREAM_URL="http://ci-01.nyi.hardenedbsd.org/pub/hardenedbsd/${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
+    if [ "$(ping -c1 installer.hardenedbsd.org 2>/dev/null)" ]; then
+        ## main site
+        UPSTREAM_URL="http://installer.hardenedbsd.org/pub/hardenedbsd/${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
+    else
+        ## alternate mirror
+        UPSTREAM_URL="http://ci-01.nyi.hardenedbsd.org/pub/hardenedbsd/${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
+    fi
     bootstrap_directories
     bootstrap_release
 else

From 6e8279ecd47d1ceab37d14844bc8dbd2daa99de9 Mon Sep 17 00:00:00 2001
From: Jose <joserprg@gmail.com>
Date: Tue, 3 Dec 2019 01:20:34 -0400
Subject: [PATCH 3/5] Wait just 2 secs before switch to a mirror and be quite

---
 usr/local/share/bastille/bootstrap.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/usr/local/share/bastille/bootstrap.sh b/usr/local/share/bastille/bootstrap.sh
index 0480102..5f91d1a 100644
--- a/usr/local/share/bastille/bootstrap.sh
+++ b/usr/local/share/bastille/bootstrap.sh
@@ -441,7 +441,7 @@ case "${1}" in
 NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])$' | tr '[:lower:]' '[:upper:]')
 if [ -n "${NAME_VERIFY}" ]; then
     RELEASE="${NAME_VERIFY}"
-    if [ "$(ping -c1 ftp.freebsd.org 2>/dev/null)" ]; then
+    if ping -c1 -t2 ftp.freebsd.org >/dev/null 2>&1; then
         ## main http
         UPSTREAM_URL="http://ftp.freebsd.org/pub/FreeBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/${RELEASE}"
     else
@@ -473,7 +473,7 @@ NAME_RELEASE=$(echo ${NAME_VERIFY} | sed 's/-build-[0-9]\{1,2\}//g')
 NAME_BUILD=$(echo ${NAME_VERIFY} | sed 's/[0-9]\{1,2\}-stable-//g')
 if [ -n "${NAME_VERIFY}" ]; then
     RELEASE="${NAME_VERIFY}"
-    if [ "$(ping -c1 installer.hardenedbsd.org 2>/dev/null)" ]; then
+    if ping -c1 -t2 installer.hardenedbsd.org >/dev/null 2>&1; then
         ## main site
         UPSTREAM_URL="http://installer.hardenedbsd.org/pub/hardenedbsd/${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
     else

From cfcad20f4aec7a02625f9b7776692f7e6b18572f Mon Sep 17 00:00:00 2001
From: Jose <joserprg@gmail.com>
Date: Thu, 5 Dec 2019 03:38:33 -0400
Subject: [PATCH 4/5] Simplify URL validation, don't use ping/ICMP

---
 usr/local/share/bastille/bootstrap.sh | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/usr/local/share/bastille/bootstrap.sh b/usr/local/share/bastille/bootstrap.sh
index 5f91d1a..a9b63fd 100644
--- a/usr/local/share/bastille/bootstrap.sh
+++ b/usr/local/share/bastille/bootstrap.sh
@@ -441,11 +441,9 @@ case "${1}" in
 NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])$' | tr '[:lower:]' '[:upper:]')
 if [ -n "${NAME_VERIFY}" ]; then
     RELEASE="${NAME_VERIFY}"
-    if ping -c1 -t2 ftp.freebsd.org >/dev/null 2>&1; then
-        ## main http
-        UPSTREAM_URL="http://ftp.freebsd.org/pub/FreeBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/${RELEASE}"
-    else
-        ## main ftp
+    UPSTREAM_URL="http://ftp.freebsd.org/pub/FreeBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/${RELEASE}"
+    if ! fetch -qo /dev/null "${UPSTREAM_URL}/MANIFEST" 2>/dev/null; then
+        ## try an alternate url
         UPSTREAM_URL="ftp://ftp.freebsd.org/pub/FreeBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/${RELEASE}"
     fi
     bootstrap_directories
@@ -465,7 +463,7 @@ if [ -n "${NAME_VERIFY}" ]; then
 else
     usage
 fi
-	;;
+    ;;
 *-stable-build-*|*-STABLE-BUILD-*)
 ## check for HardenedBSD(for current changes)
 NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build|-STABLE-BUILD)-([0-9]{1,2})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g')
@@ -473,11 +471,9 @@ NAME_RELEASE=$(echo ${NAME_VERIFY} | sed 's/-build-[0-9]\{1,2\}//g')
 NAME_BUILD=$(echo ${NAME_VERIFY} | sed 's/[0-9]\{1,2\}-stable-//g')
 if [ -n "${NAME_VERIFY}" ]; then
     RELEASE="${NAME_VERIFY}"
-    if ping -c1 -t2 installer.hardenedbsd.org >/dev/null 2>&1; then
-        ## main site
-        UPSTREAM_URL="http://installer.hardenedbsd.org/pub/hardenedbsd/${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
-    else
-        ## alternate mirror
+    UPSTREAM_URL="http://installer.hardenedbsd.org/pub/hardenedbsd/${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
+    if ! fetch -qo /dev/null "${UPSTREAM_URL}/MANIFEST" 2>/dev/null; then
+        ## try an alternate url
         UPSTREAM_URL="http://ci-01.nyi.hardenedbsd.org/pub/hardenedbsd/${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
     fi
     bootstrap_directories

From 172baa8c32483bc6be115ef4dc7f74026dfc5f38 Mon Sep 17 00:00:00 2001
From: Jose <joserprg@gmail.com>
Date: Thu, 5 Dec 2019 16:52:57 -0400
Subject: [PATCH 5/5] Validate user/shell to prevent stuck login

---
 usr/local/share/bastille/console.sh | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/usr/local/share/bastille/console.sh b/usr/local/share/bastille/console.sh
index 536e46c..f0b11b3 100644
--- a/usr/local/share/bastille/console.sh
+++ b/usr/local/share/bastille/console.sh
@@ -57,10 +57,27 @@ if [ "${TARGET}" != 'ALL' ]; then
     JAILS=$(jls name | grep -w "${TARGET}")
 fi
 
+validate_user() {
+    if jexec -l ${_jail} id "${USER}" >/dev/null 2>&1; then
+        USER_SHELL="$(jexec -l ${_jail} getent passwd "${USER}" | cut -d: -f7)"
+        if [ -n "${USER_SHELL}" ]; then
+            if jexec -l ${_jail} grep -qwF "${USER_SHELL}" /etc/shells; then
+                jexec -l ${_jail} /usr/bin/login -f "${USER}"
+            else
+                echo "Invalid shell for user ${USER}"
+            fi
+        else
+            echo "User ${USER} has no shell"
+        fi
+    else
+        echo "Unknown user ${USER}"
+    fi
+}
+
 for _jail in ${JAILS}; do
     echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}"
     if [ ! -z "${USER}" ]; then
-        jexec -l ${_jail} /usr/bin/login -f "${USER}"
+        validate_user
     else
         jexec -l ${_jail} /usr/bin/login -f root
     fi