From 7620d61e495aea42091caa3da7fbd68419a06892 Mon Sep 17 00:00:00 2001 From: Jose Date: Sun, 2 Feb 2020 02:42:22 -0400 Subject: [PATCH] Add HardenedBSD CURRENT and LATEST download options, and code improvements --- usr/local/etc/bastille/bastille.conf | 4 +- usr/local/share/bastille/bootstrap.sh | 101 +++++++++++++++----------- usr/local/share/bastille/create.sh | 56 ++++++++------ usr/local/share/bastille/destroy.sh | 82 +++++++++++---------- usr/local/share/bastille/list.sh | 2 +- 5 files changed, 142 insertions(+), 103 deletions(-) diff --git a/usr/local/etc/bastille/bastille.conf b/usr/local/etc/bastille/bastille.conf index 1eec0c9..6503ae0 100644 --- a/usr/local/etc/bastille/bastille.conf +++ b/usr/local/etc/bastille/bastille.conf @@ -24,8 +24,8 @@ bastille_tzdata="etc/UTC" ## default bastille_resolv_conf="/etc/resolv.conf" ## default: "/etc/resolv.conf" ## bootstrap urls -bastille_url_freebsd="http://ftp.freebsd.org/pub/FreeBSD/releases/" ## default: "http://ftp.freebsd.org/pub/FreeBSD/releases/" -bastille_url_hardenedbsd="https://installer.hardenedbsd.org/pub/HardenedBSD/releases/" ## default: "https://installer.hardenedbsd.org/pub/HardenedBSD/releases/" +bastille_url_freebsd="http://ftp.freebsd.org/pub/FreeBSD/releases/" ## default: "http://ftp.freebsd.org/pub/FreeBSD/releases/" +bastille_url_hardenedbsd="http://installer.hardenedbsd.org/pub/hardenedbsd/" ## default: "https://installer.hardenedbsd.org/pub/HardenedBSD/releases/" ## ZFS options bastille_zfs_enable="" ## default: "" diff --git a/usr/local/share/bastille/bootstrap.sh b/usr/local/share/bastille/bootstrap.sh index 9627242..db4e7d0 100644 --- a/usr/local/share/bastille/bootstrap.sh +++ b/usr/local/share/bastille/bootstrap.sh @@ -66,6 +66,21 @@ if [ "${bastille_zfs_enable}" = "YES" ]; then fi fi +validate_release_url() { + ## check upstream url, else switch to alternate url + if [ -n "${NAME_VERIFY}" ]; then + RELEASE="${NAME_VERIFY}" + if ! fetch -qo /dev/null "${UPSTREAM_URL}/MANIFEST" 2>/dev/null; then + ## try an alternate url + UPSTREAM_URL="${UPSTREAM_ALT}" + fi + bootstrap_directories + bootstrap_release + else + usage + fi +} + bootstrap_network_interfaces() { ## test for both options empty @@ -408,50 +423,54 @@ RELEASE="${1}" ## Filter sane release names case "${1}" in *-RELEASE|*-release|*-RC1|*-rc1|*-RC2|*-rc2) -## check for FreeBSD releases name -NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])$' | tr '[:lower:]' '[:upper:]') -if [ -n "${NAME_VERIFY}" ]; then - RELEASE="${NAME_VERIFY}" - UPSTREAM_URL="${bastille_url_freebsd}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${RELEASE}" - if ! fetch -qo /dev/null "${UPSTREAM_URL}/MANIFEST" 2>/dev/null; then - ## try an alternate url - UPSTREAM_URL="ftp://ftp.freebsd.org/pub/FreeBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/${RELEASE}" - fi - bootstrap_directories - bootstrap_release -else - usage -fi + ## check for FreeBSD releases name + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])$' | tr '[:lower:]' '[:upper:]') + UPSTREAM_URL="${bastille_url_freebsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/${RELEASE}" + UPSTREAM_ALT="ftp://ftp.freebsd.org/pub/FreeBSD/releases/${HW_MACHINE}/${HW_MACHINE_ARCH}/${RELEASE}" + validate_release_url ;; *-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST) -## check for HardenedBSD releases name -NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-LAST|-STABLE-last|-stable-last|-STABLE-LAST)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g') -if [ -n "${NAME_VERIFY}" ]; then - RELEASE="${NAME_VERIFY}" - UPSTREAM_URL="${bastille_url_hardenedbsd}/${HW_MACHINE}/${HW_MACHINE_ARCH}/hardenedbsd-${RELEASE}" - bootstrap_directories - bootstrap_release -else - usage -fi + ## check for HardenedBSD releases name(previous infrastructure, keep for reference) + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-LAST|-STABLE-last|-stable-last|-STABLE-LAST)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g') + UPSTREAM_URL="${bastille_url_hardenedbsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/hardenedbsd-${RELEASE}" + UPSTREAM_ALT="http://ftp.freebsd.org/pub/FreeBSD/releases/" + validate_release_url ;; -*-stable-build-*|*-STABLE-BUILD-*) -## check for HardenedBSD(for current changes) -NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build|-STABLE-BUILD)-([0-9]{1,2})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g') -NAME_RELEASE=$(echo ${NAME_VERIFY} | sed 's/-build-[0-9]\{1,2\}//g') -NAME_BUILD=$(echo ${NAME_VERIFY} | sed 's/[0-9]\{1,2\}-stable-//g') -if [ -n "${NAME_VERIFY}" ]; then - RELEASE="${NAME_VERIFY}" - UPSTREAM_URL="http://installer.hardenedbsd.org/pub/hardenedbsd/${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}" - if ! fetch -qo /dev/null "${UPSTREAM_URL}/MANIFEST" 2>/dev/null; then - ## try an alternate url - UPSTREAM_URL="http://ci-01.nyi.hardenedbsd.org/pub/hardenedbsd/${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}" - fi - bootstrap_directories - bootstrap_release -else - usage -fi +*-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*) + ## check for HardenedBSD(specific stable build releases) + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build|-STABLE-BUILD)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g') + NAME_RELEASE=$(echo ${NAME_VERIFY} | sed 's/-build-[0-9]\{1,2\}//g') + NAME_BUILD=$(echo ${NAME_VERIFY} | sed 's/[0-9]\{1,2\}-stable-//g') + UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}" + UPSTREAM_ALT="http://ci-01.nyi.hardenedbsd.org/pub/hardenedbsd/${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}" + validate_release_url + ;; +*-stable-build-latest|*-STABLE-BUILD-LATEST) + ## check for HardenedBSD(latest stable build release) + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest|-STABLE-BUILD-LATEST)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g') + NAME_RELEASE=$(echo ${NAME_VERIFY} | sed 's/-BUILD-LATEST//g') + NAME_BUILD=$(echo ${NAME_VERIFY} | sed 's/[0-9]\{1,2\}-stable-//g') + UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}" + UPSTREAM_URL="http://ci-01.nyi.hardenedbsd.org/pub/hardenedbsd/${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}" + validate_release_url + ;; +*-current-build-[0-9]*|*-CURRENT-BUILD-[0-9]*) + ## check for HardenedBSD(specific current build releases) + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-current-build|-CURRENT-BUILD)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g') + NAME_RELEASE=$(echo ${NAME_VERIFY} | sed 's/[0-9]\{1,2\}-current-.*/current/g') + NAME_BUILD=$(echo ${NAME_VERIFY} | sed 's/[0-9]\{1,2\}-current-//g') + UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}" + UPSTREAM_ALT="http://ci-01.nyi.hardenedbsd.org/pub/hardenedbsd/${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}" + validate_release_url + ;; +*-current-build-latest|*-CURRENT-BUILD-LATEST) + ## check for HardenedBSD(latest current build release) + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-current-build-latest|-CURRENT-BUILD-LATEST)$' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g') + NAME_RELEASE=$(echo ${NAME_VERIFY} | sed 's/[0-9]\{1,2\}-current-.*/current/g') + NAME_BUILD=$(echo ${NAME_VERIFY} | sed 's/[0-9]\{1,2\}-current-//g') + UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}" + UPSTREAM_ALT="http://ci-01.nyi.hardenedbsd.org/pub/hardenedbsd/${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}" + validate_release_url ;; http?://github.com/*/*|http?://gitlab.com/*/*) BASTILLE_TEMPLATE_URL=${1} diff --git a/usr/local/share/bastille/create.sh b/usr/local/share/bastille/create.sh index d3104f2..d0984fc 100644 --- a/usr/local/share/bastille/create.sh +++ b/usr/local/share/bastille/create.sh @@ -96,6 +96,15 @@ validate_netconf() { fi } +validate_release() { + ## check release name match, else show usage + if [ -n "${NAME_VERIFY}" ]; then + RELEASE="${NAME_VERIFY}" + else + usage + fi +} + create_jail() { bastille_jail_base="${bastille_jailsdir}/${NAME}/root/.bastille" ## dir bastille_jail_template="${bastille_jailsdir}/${NAME}/root/.template" ## dir @@ -327,31 +336,34 @@ fi ## verify release case "${RELEASE}" in *-RELEASE|*-release|*-RC1|*-rc1|*-RC2|*-rc2) -## check for FreeBSD releases name -NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])$' | tr '[:lower:]' '[:upper:]') -if [ -n "${NAME_VERIFY}" ]; then - RELEASE="${NAME_VERIFY}" -else - usage -fi + ## check for FreeBSD releases name + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])$' | tr '[:lower:]' '[:upper:]') + validate_release ;; *-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST) -## check for HardenedBSD releases name -NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-LAST|-STABLE-last|-stable-last|-STABLE-LAST)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g') -if [ -n "${NAME_VERIFY}" ]; then - RELEASE="${NAME_VERIFY}" -else - usage -fi + ## check for HardenedBSD releases name(previous infrastructure) + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})(-stable-LAST|-STABLE-last|-stable-last|-STABLE-LAST)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g') + validate_release ;; -*-stable-build-*|*-STABLE-BUILD-*) -## check for HardenedBSD(for current changes) -NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build|-STABLE-BUILD)-([0-9]{1,2})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g') -if [ -n "${NAME_VERIFY}" ]; then - RELEASE="${NAME_VERIFY}" -else - usage -fi +*-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*) + ## check for HardenedBSD(specific stable build releases) + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build|-STABLE-BUILD)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g') + validate_release + ;; +*-stable-build-latest|*-STABLE-BUILD-LATEST) + ## check for HardenedBSD(latest stable build release) + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest|-STABLE-BUILD-LATEST)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g') + validate_release + ;; +*-current-build-[0-9]*|*-CURRENT-BUILD-[0-9]*) + ## check for HardenedBSD(specific current build releases) + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-current-build|-CURRENT-BUILD)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g') + validate_release + ;; +*-current-build-latest|*-CURRENT-BUILD-LATEST) + ## check for HardenedBSD(latest current build release) + NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-current-build-latest|-CURRENT-BUILD-LATEST)$' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g') + validate_release ;; *) echo -e "${COLOR_RED}Unknown Release.${COLOR_RESET}" diff --git a/usr/local/share/bastille/destroy.sh b/usr/local/share/bastille/destroy.sh index 87f4dc6..4f25c23 100644 --- a/usr/local/share/bastille/destroy.sh +++ b/usr/local/share/bastille/destroy.sh @@ -37,12 +37,12 @@ usage() { } destroy_jail() { - bastille_jail_base="${bastille_jailsdir}/${NAME}" ## dir - bastille_jail_log="${bastille_logsdir}/${NAME}_console.log" ## file + bastille_jail_base="${bastille_jailsdir}/${TARGET}" ## dir + bastille_jail_log="${bastille_logsdir}/${TARGET}_console.log" ## file - if [ "$(jls name | awk "/^${NAME}$/")" ]; then + if [ "$(jls name | awk "/^${TARGET}$/")" ]; then echo -e "${COLOR_RED}Jail running.${COLOR_RESET}" - echo -e "${COLOR_RED}See 'bastille stop ${NAME}'.${COLOR_RESET}" + echo -e "${COLOR_RED}See 'bastille stop ${TARGET}'.${COLOR_RESET}" exit 1 fi @@ -52,12 +52,12 @@ destroy_jail() { fi if [ -d "${bastille_jail_base}" ]; then - echo -e "${COLOR_GREEN}Deleting Jail: ${NAME}.${COLOR_RESET}" + echo -e "${COLOR_GREEN}Deleting Jail: ${TARGET}.${COLOR_RESET}" if [ "${bastille_zfs_enable}" = "YES" ]; then if [ ! -z "${bastille_zfs_zpool}" ]; then - if [ ! -z "${NAME}" ]; then + if [ ! -z "${TARGET}" ]; then ## remove jail zfs dataset recursively - zfs destroy -r ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${NAME} + zfs destroy -r ${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${TARGET} fi fi fi @@ -81,15 +81,23 @@ destroy_jail() { } destroy_rel() { - bastille_rel_base="${bastille_releasesdir}/${NAME}" ## dir + ## check release name match before destroy + if [ -n "${NAME_VERIFY}" ]; then + TARGET="${NAME_VERIFY}" + break + else + usage + fi + + bastille_rel_base="${bastille_releasesdir}/${TARGET}" ## dir ## check if this release have containers child BASE_HASCHILD="0" if [ -d "${bastille_jailsdir}" ]; then JAIL_LIST=$(ls "${bastille_jailsdir}" | sed "s/\n//g") for _jail in ${JAIL_LIST}; do - if grep -qwo "${NAME}" ${bastille_jailsdir}/${_jail}/fstab 2>/dev/null; then - echo -e "${COLOR_RED}Notice: (${_jail}) depends on ${NAME} base.${COLOR_RESET}" + if grep -qwo "${TARGET}" ${bastille_jailsdir}/${_jail}/fstab 2>/dev/null; then + echo -e "${COLOR_RED}Notice: (${_jail}) depends on ${TARGET} base.${COLOR_RESET}" BASE_HASCHILD="1" fi done @@ -100,10 +108,10 @@ destroy_rel() { exit 1 else if [ "${BASE_HASCHILD}" -eq "0" ]; then - echo -e "${COLOR_GREEN}Deleting base: ${NAME}.${COLOR_RESET}" + echo -e "${COLOR_GREEN}Deleting base: ${TARGET}.${COLOR_RESET}" if [ "${bastille_zfs_enable}" = "YES" ]; then if [ ! -z "${bastille_zfs_zpool}" ]; then - zfs destroy ${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${NAME} + zfs destroy ${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${TARGET} fi fi @@ -132,39 +140,39 @@ if [ $# -gt 1 ] || [ $# -lt 1 ]; then usage fi -NAME="$1" +TARGET="$1" ## check what should we clean -case "${NAME}" in +case "${TARGET}" in *-RELEASE|*-release|*-RC1|*-rc1|*-RC2|*-rc2) ## check for FreeBSD releases name - NAME_VERIFY=$(echo "${NAME}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])$' | tr '[:lower:]' '[:upper:]') - if [ -n "${NAME_VERIFY}" ]; then - NAME="${NAME_VERIFY}" - destroy_rel - else - usage - fi + NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])$' | tr '[:lower:]' '[:upper:]') + destroy_rel ;; *-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST) ## check for HardenedBSD releases name - NAME_VERIFY=$(echo "${NAME}" | grep -iwE '^([1-9]{2,2})(-stable-LAST|-STABLE-last|-stable-last|-STABLE-LAST)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g') - if [ -n "${NAME_VERIFY}" ]; then - NAME="${NAME_VERIFY}" - destroy_rel - else - usage - fi + NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]{2,2})(-stable-LAST|-STABLE-last|-stable-last|-STABLE-LAST)$' | sed 's/STABLE/stable/g' | sed 's/last/LAST/g') + destroy_rel ;; -*-stable-build-*|*-STABLE-BUILD-*) -## check for HardenedBSD(for current changes) -NAME_VERIFY=$(echo "${NAME}" | grep -iwE '([0-9]{1,2})(-stable-build|-STABLE-BUILD)-([0-9]{1,2})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g') - if [ -n "${NAME_VERIFY}" ]; then - NAME="${NAME_VERIFY}" - destroy_rel - else - usage - fi +*-stable-build-[0-9]*|*-STABLE-BUILD-[0-9]*) + ## check for HardenedBSD(specific stable build releases) + NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '([0-9]{1,2})(-stable-build|-STABLE-BUILD)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/STABLE/stable/g') + destroy_rel + ;; +*-stable-build-latest|*-STABLE-BUILD-LATEST) + ## check for HardenedBSD(latest stable build release) + NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '([0-9]{1,2})(-stable-build-latest|-STABLE-BUILD-LATEST)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g') + destroy_rel + ;; +*-current-build-[0-9]*|*-CURRENT-BUILD-[0-9]*) + ## check for HardenedBSD(specific current build releases) + NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '([0-9]{1,2})(-current-build|-CURRENT-BUILD)-([0-9]{1,3})$' | sed 's/BUILD/build/g' | sed 's/CURRENT/current/g') + destroy_rel + ;; +*-current-build-latest|*-CURRENT-BUILD-LATEST) + ## check for HardenedBSD(latest current build release) + NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '([0-9]{1,2})(-current-build-latest|-CURRENT-BUILD-LATEST)$' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g') + destroy_rel ;; *) ## just destroy a jail diff --git a/usr/local/share/bastille/list.sh b/usr/local/share/bastille/list.sh index d40a9aa..2868509 100644 --- a/usr/local/share/bastille/list.sh +++ b/usr/local/share/bastille/list.sh @@ -32,7 +32,7 @@ . /usr/local/etc/bastille/bastille.conf usage() { - echo -e "${COLOR_RED}Usage: bastille list [-j] [release|template|(jail|container)|log|limit].${COLOR_RESET}" + echo -e "${COLOR_RED}Usage: bastille list [-j] [release|template|(jail|container)|log|limit|(import|export|backup)].${COLOR_RESET}" exit 1 }