working copy; work in progress

fix logic for rc.conf + bastille.conf ZFS check

.readthedocs.yaml

@@ -3,7 +3,7 @@ version: 2
 sphinx:
   configuration: docs/conf.py
 
-python:
-  version: 3.7
-  install:
-    - requirements: docs/requirements.txt
+build:
+  os: "ubuntu-22.04"
+  tools:
+    python: "3.11"

docs/chapters/gcp.rst

@@ -90,4 +90,4 @@ Set the default network gateway for new jails as described in the Networking cha
   echo "nameserver 8.8.8.8" > /usr/local/etc/bastille/resolv.conf
   sysrc -f /usr/local/etc/bastille/bastille.conf bastille_resolv_conf="/usr/local/etc/bastille/resolv.conf"
 
-You can now create a VNET jail with ``bastille create -V myjail 13.1-RELEASE 192.168.1.50/24 vtnet0``
+You can now create a VNET jail with ``bastille create -V myjail 13.2-RELEASE 192.168.1.50/24 vtnet0``

docs/chapters/installation.rst

@@ -4,7 +4,7 @@ Bastille is available in the official FreeBSD ports tree at
 `sysutils/bastille`. Binary packages available in `quarterly` and `latest`
 repositories.
 
-Current version is `0.10.20230714`.
+Current version is `0.10.20231125`.
 
 To install from the FreeBSD package repository:
 
@@ -18,6 +18,8 @@ PKG
 .. code-block:: shell
 
   pkg install bastille
+  sysrc bastille_enable=YES
+  sysrc bastille_rcorder=YES
 
 
 To install from source (don't worry, no compiling):
@@ -28,6 +30,8 @@ ports
 .. code-block:: shell
 
   make -C /usr/ports/sysutils/bastille install clean
+  sysrc bastille_enable=YES
+  sysrc bastille_rcorder=YES
 
 
 GIT
@@ -38,7 +42,14 @@ GIT
   git clone https://github.com/BastilleBSD/bastille.git
   cd bastille
   make install
+  sysrc bastille_enable=YES
+  sysrc bastille_rcorder=YES
 
 This method will install the latest files from GitHub directly onto your
 system. It is verbose about the files it installs (for later removal), and also
-has a `make uninstall` target.
+has a `make uninstall` target. You may need to manually copy the `.sample`
+config into place before Bastille will run. (ie;
+`/usr/local/etc/bastille/bastille.conf.sample`)
+
+Note: installing using this method overwrites the version variable to match
+that of the source revision commit hash.

docs/chapters/migration.rst

@@ -0,0 +1,36 @@
+Stop the running jail and export it:
+
+.. code-block:: shell
+
+     iocage stop jailname
+     iocage export jailname
+
+Move the backup files (.zip and .sha256) into Bastille backup dir (default: /usr/local/bastille/backups/):
+
+.. code-block:: shell
+
+     mv /iocage/images/jailname_$(date +%F).* /usr/local/bastille/backups/
+
+for remote systems you could use rsync:
+
+.. code-block:: shell
+
+     rsync -avh /iocage/images/jailname_$(date +%F).* root@10.0.1.10:/usr/local/bastille/backups/
+
+     
+Import the iocage backup file (use zip file name)
+
+.. code-block:: shell
+
+     bastille import jailname_$(date +%F).zip
+
+Set your new ip address and interface:
+
+.. code-block:: shell
+
+     vim /usr/local/bastille/jails/jailname/jail.conf
+     interface = bastille0;
+     ip4.addr = "192.168.0.1";
+
+
+You can use you primary network interface instead of the virtual bastille0 interface as well if you know what you’re doing.

docs/chapters/networking.rst

@@ -3,37 +3,40 @@ Network Requirements
 Here's the scenario. You've installed Bastille at home or in the cloud and want
 to get started putting applications in secure little containers, but how do you
 get these containers on the network?  Bastille tries to be flexible about how to 
-network containerized applications.   Four methods are described here.  
+network containerized applications. Four methods are described here.
 
 1. Home or Small Office
 
 2. Cloud with IPV4 and multiple IPV6
 
-3. Could with single IPV4 (internatl bridge)
+3. Cloud with single IPV4 (internal bridge)
 
-4. Cloud with a single IPV4 (external bridge) 
+4. Cloud with a single IPV4 (external bridge)
 
+Please choose the option which is most appropriate for your environment.
 
-Please choose the option which is most appropriate for your environment. 
-
-
-First a few notes.  Bastille tries to verify that the interface name you provide is a valid
-interface. In FreeBSD network interfaces have different names, but look something like
-`em0`, `bge0`, `re0`,  `vtnet0` etc. Running the ifconfig commend will tell you the name
-of your existing interfaces. Bastille also checks for a valid syntax IP4 or IP6 address.    
-When you are testing calling out from your containers,  please note that the ping command is disabled within the containers, because raw socket access are a security hole.  Instead I install and test with wget instead. 
+First a few notes. Bastille tries to verify that the interface name you provide
+is a valid interface. In FreeBSD network interfaces have different names, but
+look something like `em0`, `bge0`, `re0`, `vtnet0` etc. Running the ifconfig
+commend will tell you the name of your existing interfaces. Bastille also
+checks for a valid syntax IP4 or IP6 address. When you are testing calling out
+from your containers, please note that the ping command is disabled within the
+containers, because raw socket access are a security hole. Instead, install and
+test with `wget`/`curl`/`fetch` instead.
 
 Shared Interface on Home or Small Office Network
 ================================================
-If you have just one computer, or a home or small office network, 
-where you are separated from the rest of the internet by a router.  So you are free to use
-`private IP addresses <https://www.lifewire.com/what-is-a-private-ip-address-2625970>`.
+If you have just one computer, or a home or small office network, where you are
+separated from the rest of the internet by a router.  So you are free to use
+`private IP addresses
+<https://www.lifewire.com/what-is-a-private-ip-address-2625970>`_.
 
-In this environment, to use Bastille, just create the container, give it a unique private ip address, and attach its ip address to your primary interface.  
+In this environment, to use Bastille, just create the container, give it a
+unique private ip address, and attach its ip address to your primary interface.
 
 .. code-block:: shell
 
-  bastille create alcatraz 13.1-RELEASE 192.168.1.50 em0 
+  bastille create alcatraz 13.2-RELEASE 192.168.1.50 em0
 
 You may have to change em0
 
@@ -46,50 +49,54 @@ This method is the simplest. All you need to know is the name of your network
 interface and a free IP on your local network.
 
 Shared Interface on IPV6 network (vultr.com)
-=======================================
-Some ISP's, such as `vultr.com <https://Vultr.com>`, give you a single ipv4 address, and a large block of ipv6 addresses. You can then assign a unique ipv6 address to each Bastille Container.  
+============================================ 
+Some ISP's, such as `Vultr <https://vultr.com>`_, give you a single ipv4 address,
+and a large block of ipv6 addresses. You can then assign a unique ipv6 address
+to each Bastille Container.
 
-On a virtual machine such as vultr.com the virtual interface may be `vtnet0`. 
+On a virtual machine such as vultr.com the virtual interface may be `vtnet0`.
 So we issue the command:
 
 .. code-block:: shell
 
- bastille create alcatraz 13.1-RELEASE  2001:19f0:6c01:114c::100 vtnet0
+ bastille create alcatraz 13.2-RELEASE 2001:19f0:6c01:114c::100 vtnet0
 
-We could also write the ipv6 address as 2001:19f0:6c01:114c:0:100 
+We could also write the ipv6 address as 2001:19f0:6c01:114c:0:100
 
-The tricky part are the ipv6 addresses. IPV6 is a string of 8 4 digit 
+The tricky part are the ipv6 addresses. IPV6 is a string of 8 4 digit
 hexadecimal characters.  At vultr they said:
 
 Your server was assigned the following six section subnet:
 
 2001:19f0:6c01:114c:: / 64
 
-The `vultr ipv6 subnet calculator <https://www.vultr.com/resources/subnet-calculator-ipv6/?prefix_length=64&display=long&ipv6_address=2001%3Adb8%3Aacad%3Ae%3A%3A%2F64>` is helpful in making sense of that ipv6 address. 
+The `vultr ipv6 subnet calculator
+<https://www.vultr.com/resources/subnet-calculator-ipv6/?prefix_length=64&display=long&ipv6_address=2001%3Adb8%3Aacad%3Ae%3A%3A%2F64>`_
+is helpful in making sense of that ipv6 address. 
 
 We could have also written that IPV6 address as 2001:19f0:6c01:114c:0:0 
 
-Where the /64 basicaly means that the first 64 bits of the address (4x4 character hexadecimal) values define the network, and the remaining characters, we can assign as we want to the Bastille Container. In the actual bastille create command given above, it was defined to be 100.   But we also have to tell the host operating system that we are now using this address.  This is done on freebsd with the following command
+Where the /64 basicaly means that the first 64 bits of the address (4x4
+character hexadecimal) values define the network, and the remaining characters,
+we can assign as we want to the Bastille Container. In the actual bastille
+create command given above, it was defined to be 100. But we also have to tell
+the host operating system that we are now using this address. This is done on
+freebsd with the following command
 
 .. code-block:: shell
 
-  ifconfig_vtnet0_alias0="inet6 2001:19f0:6c01:114c::100  prefixlen 64"
+  ifconfig_vtnet0_alias0="inet6 2001:19f0:6c01:114c::100 prefixlen 64"
 
-At that point your container can talk to the world, and the world can ping your container.  Of course when you reboot the machine, that command will be forgotten  To make it permanent, 
-you have to add it to the file /etc/rc.conf
-
-Just remember you cannot ping out from the container. Instead I installed and used wget to test the connectivity. 
-
-Use the bastille pkg command to install wget. 
-
-.. code-block:: shell
-
-   bastille pkg alcatraz install wget
+At that point your container can talk to the world, and the world can ping your
+container.  Of course when you reboot the machine, that command will be
+forgotten. To make it permanent, prefix the same command with `sysrc`
 
+Just remember you cannot ping out from the container. Instead, install and
+use `wget`/`curl`/`fetch` to test the connectivity.
 
 
 Virtual Network (VNET)
-========================
+======================
 (Added in 0.6.x) VNET is supported on FreeBSD 12+ only.
 
 Virtual Network (VNET) creates a private network interface for a container.
@@ -101,12 +108,12 @@ external interface.
 
 .. code-block:: shell
 
-  bastille create -V azkaban 13.1-RELEASE 192.168.1.50/24 em0
+  bastille create -V azkaban 13.2-RELEASE 192.168.1.50/24 em0
 
 Bastille will automagically create the bridge interface and connect /
 disconnect containers as they are started and stopped. A new interface will be
 created on the host matching the pattern `interface0bridge`. In the example
-here, `em0bridge`. 
+here, `em0bridge`.
 
 The `em0` interface will be attached to the bridge along with the unique
 container interfaces as they are started and stopped. These interface names
@@ -121,6 +128,11 @@ host system:
   ## /etc/devfs.rules (NOT .conf)
   
   [bastille_vnet=13]
+  add include $devfsrules_hide_all
+  add include $devfsrules_unhide_basic
+  add include $devfsrules_unhide_login
+  add include $devfsrules_jail
+  add include $devfsrules_jail_vnet
   add path 'bpf*' unhide
 
 Lastly, you may want to consider these three `sysctl` values:
@@ -131,12 +143,29 @@ Lastly, you may want to consider these three `sysctl` values:
   net.link.bridge.pfil_onlyip=0
   net.link.bridge.pfil_member=0
 
+Below is the definition of what these three parameters are used for and mean:
+
+
+       net.link.bridge.pfil_onlyip  Controls  the  handling  of	non-IP packets
+				    which are not passed to pfil(9).  Set to 1
+				    to only allow IP packets to	pass  (subject
+				    to	firewall  rules), set to 0 to uncondi-
+				    tionally pass all non-IP Ethernet frames.
+
+       net.link.bridge.pfil_member  Set	to 1 to	enable filtering on the	incom-
+				    ing	and outgoing member interfaces,	set to
+				    0 to disable it.
+
+       net.link.bridge.pfil_bridge  Set	to 1 to	enable filtering on the	bridge
+				    interface, set to 0	to disable it.
+
+  
 **Regarding Routes**
 
 Bastille will attempt to auto-detect the default route from the host system and
 assign it to the VNET container. This auto-detection may not always be accurate
-for your needs for the particular container. In this case you'll need to add
-a default route manually or define the preferred default route in the
+for your needs for the particular container. In this case you'll need to add a
+default route manually or define the preferred default route in the
 `bastille.conf`.
 
 .. code-block:: shell
@@ -155,23 +184,23 @@ This config change will apply the defined gateway to any new containers.
 Existing containers will need to be manually updated.
 
 Virtual Network (VNET) on External Bridge
-=======================================
-To create a VNET based container and attach it to an external, already existing bridge, use the `-B` option, an IP/netmask and
-external bridge.
+=========================================
+To create a VNET based container and attach it to an external, already existing
+bridge, use the `-B` option, an IP/netmask and external bridge.
 
 .. code-block:: shell
 
-  bastille create -B azkaban 13.1-RELEASE 192.168.1.50/24 bridge0
+  bastille create -B azkaban 13.2-RELEASE 192.168.1.50/24 bridge0
 
-Bastille will automagically create the interface, attach it to the specified bridge and connect /
-disconnect containers as they are started and stopped. 
+Bastille will automagically create the interface, attach it to the specified
+bridge and connect / disconnect containers as they are started and stopped.
 The bridge needs to be created/enabled before creating and starting the jail.
 
 Public Network
 ==============
 In this section we describe how to network containers in a public network
 such as a cloud hosting provider who only provides you with a single ip address. 
-(AWS, digital ocean, etc)  (The exception is vultr.com, which does 
+(AWS, Digital Ocean, etc) (The exception is vultr.com, which does 
 provide you with lots of IPV6 addresses and does a great job supporting FreeBSD!)  
 
 So if you only have a single IP address and if you want to create multiple
@@ -239,7 +268,7 @@ to containers are:
 
 .. code-block:: shell
 
-  nat on $ext_if from <jails> to any -> ($ext_if)
+  nat on $ext_if from <jails> to any -> ($ext_if:0)
 
 The `nat` routes traffic from the loopback interface to the external
 interface for outbound access.
@@ -253,16 +282,18 @@ The `rdr-anchor "rdr/*"` enables dynamic rdr rules to be setup using the
 
 .. code-block:: shell
 
-  bastille rdr <jail> tcp 2001 22 # Redirects tcp port 2001 on host to 22 on jail
-  bastille rdr <jail> udp 2053 53 # Same for udp
-  bastille rdr <jail> list        # List dynamic rdr rules
-  bastille rdr <jail> clear       # Clear dynamic rdr rules
+  bastille rdr TARGET tcp 2001 22 # Redirects tcp port 2001 on host to 22 on jail
+  bastille rdr TARGET udp 2053 53 # Same for udp
+  bastille rdr TARGET list        # List dynamic rdr rules
+  bastille rdr TARGET clear       # Clear dynamic rdr rules
 
 Note that if you are redirecting ports where the host is also listening (eg.
 ssh) you should make sure that the host service is not listening on the cloned
 interface - eg. for ssh set sshd_flags in rc.conf
 
-  sshd_flags="-o ListenAddress=<hostname>"
+.. code-block:: shell
+
+  sshd_flags="-o ListenAddress=<host-address>"
 
 Finally, start up the firewall:
 

docs/chapters/subcommands/bootstrap.rst

@@ -27,8 +27,8 @@ release version as the argument.
 
 .. code-block:: shell
 
-  ishmael ~ # bastille bootstrap 12.3-RELEASE [update]
-  ishmael ~ # bastille bootstrap 13.1-RELEASE
+  ishmael ~ # bastille bootstrap 14.0-RELEASE [update]
+  ishmael ~ # bastille bootstrap 13.2-RELEASE [update]
 
 To `bootstrap` a HardenedBSD release, run the bootstrap sub-command with the
 build version as the argument.
@@ -43,6 +43,21 @@ download the requested release. For each requested release, `bootstrap` will
 download the base.txz. These files are verified (sha256 via MANIFEST file)
 before they are extracted for use.
 
+EOL Releases
+------------
+
+It is sometimes necessary to run end-of-life releases for testing or legacy
+application support. Dy default Bastille will only install supported releases
+but you can bootstrap EOL / unsupported releases with a simple trick.
+
+.. code-block:: shell
+
+   ishmael ~ # export BASTILLE_URL_FREEBSD=http://ftp-archive.freebsd.org/pub/FreeBSD-Archive/old-releases/
+   ishmael ~ # bastille bootstrap 11.2-RELEASE
+
+By overriding the BASTILLE_URL_FREEBSD variable you can now bootstrap archived
+releases from the FTP archive.
+
 Tips
 ----
 

docs/chapters/subcommands/create.rst

@@ -22,6 +22,15 @@ bootstrapped release and a private (rfc1918) IP address.
 This command will create a 11.3-RELEASE container assigning the 10.17.89.10 ip
 address to the new system.
 
+.. code-block:: shell
+
+   ishmael ~ # bastille create alcatraz 13.2-RELEASE 10.17.89.113/24
+
+
+The above code will create a jail with a /24 mask.  At the time of this documentation you 
+can only use CIDR notation, and not use a netmask 255.255.255.0 to accomplish this.
+
+
 I recommend using private (rfc1918) ip address ranges for your container.  These
 ranges include:
 
@@ -31,3 +40,13 @@ ranges include:
 
 Bastille does its best to validate the submitted ip is valid. This has not been
 thouroughly tested--I generally use the 10/8 range.
+
+A couple of notes about the created jails.  First, MOTD has been disabled inside 
+of the jails because it does not give information about the jail, but about the host 
+system.  This caused confusion for some users, so we implemented the .hushlogin which 
+silences the MOTD at login. 
+
+Also, uname does not work from within a jail.  Much like MOTD, it gives you the version 
+information about the host system instead of the jail.  If you need to check the version
+of freebsd running on the jail use the freebsd-version command to get accurate information.
+

docs/chapters/subcommands/index.rst

@@ -23,9 +23,11 @@ Bastille sub-commands
    rename
    restart
    service
+   setup
    start
    stop
    sysrc
+   tags
    top
    umount
    update

docs/chapters/subcommands/pkg.rst

@@ -10,31 +10,7 @@ To manage binary packages within the container use `bastille pkg`.
   [folsom]:
   The package management tool is not yet installed on your system.
   Do you want to fetch and install it now? [y/N]: y
-  Bootstrapping pkg from pkg+http://pkg.FreeBSD.org/FreeBSD:10:amd64/quarterly, please wait...
-  Verifying signature with trusted certificate pkg.freebsd.org.2013102301... done
-  [folsom] Installing pkg-1.10.5_5...
-  [folsom] Extracting pkg-1.10.5_5: 100%
-  Updating FreeBSD repository catalogue...
-  pkg: Repository FreeBSD load error: access repo file(/var/db/pkg/repo-FreeBSD.sqlite) failed: No such file or directory
-  [folsom] Fetching meta.txz: 100%    944 B   0.9kB/s    00:01
-  [folsom] Fetching packagesite.txz: 100%    6 MiB   3.4MB/s    00:02
-  Processing entries: 100%
-  FreeBSD repository update completed. 32550 packages processed.
-  All repositories are up to date.
-  Updating database digests format: 100%
-  The following 10 package(s) will be affected (of 0 checked):
-
-  New packages to be INSTALLED:
-      vim-console: 8.1.0342
-      git-lite: 2.19.1
-      zsh: 5.6.2
-      expat: 2.2.6_1
-      curl: 7.61.1
-      libnghttp2: 1.33.0
-      ca_root_nss: 3.40
-      pcre: 8.42
-      gettext-runtime: 0.19.8.1_1
-      indexinfo: 0.3.1
+  ...[snip]...
 
   Number of packages to be installed: 10
 
@@ -42,41 +18,7 @@ To manage binary packages within the container use `bastille pkg`.
   17 MiB to be downloaded.
 
   Proceed with this action? [y/N]: y
-  [folsom] [1/10] Fetching vim-console-8.1.0342.txz: 100%    5 MiB   5.8MB/s    00:01
-  [folsom] [2/10] Fetching git-lite-2.19.1.txz: 100%    4 MiB   2.1MB/s    00:02
-  [folsom] [3/10] Fetching zsh-5.6.2.txz: 100%    4 MiB   4.4MB/s    00:01
-  [folsom] [4/10] Fetching expat-2.2.6_1.txz: 100%  109 KiB 111.8kB/s    00:01
-  [folsom] [5/10] Fetching curl-7.61.1.txz: 100%    1 MiB   1.2MB/s    00:01
-  [folsom] [6/10] Fetching libnghttp2-1.33.0.txz: 100%  107 KiB 109.8kB/s    00:01
-  [folsom] [7/10] Fetching ca_root_nss-3.40.txz: 100%  287 KiB 294.3kB/s    00:01
-  [folsom] [8/10] Fetching pcre-8.42.txz: 100%    1 MiB   1.2MB/s    00:01
-  [folsom] [9/10] Fetching gettext-runtime-0.19.8.1_1.txz: 100%  148 KiB 151.3kB/s    00:01
-  [folsom] [10/10] Fetching indexinfo-0.3.1.txz: 100%    6 KiB   5.7kB/s    00:01
-  Checking integrity... done (0 conflicting)
-  [folsom] [1/10] Installing libnghttp2-1.33.0...
-  [folsom] [1/10] Extracting libnghttp2-1.33.0: 100%
-  [folsom] [2/10] Installing ca_root_nss-3.40...
-  [folsom] [2/10] Extracting ca_root_nss-3.40: 100%
-  [folsom] [3/10] Installing indexinfo-0.3.1...
-  [folsom] [3/10] Extracting indexinfo-0.3.1: 100%
-  [folsom] [4/10] Installing expat-2.2.6_1...
-  [folsom] [4/10] Extracting expat-2.2.6_1: 100%
-  [folsom] [5/10] Installing curl-7.61.1...
-  [folsom] [5/10] Extracting curl-7.61.1: 100%
-  [folsom] [6/10] Installing pcre-8.42...
-  [folsom] [6/10] Extracting pcre-8.42: 100%
-  [folsom] [7/10] Installing gettext-runtime-0.19.8.1_1...
-  [folsom] [7/10] Extracting gettext-runtime-0.19.8.1_1: 100%
-  [folsom] [8/10] Installing vim-console-8.1.0342...
-  [folsom] [8/10] Extracting vim-console-8.1.0342: 100%
-  [folsom] [9/10] Installing git-lite-2.19.1...
-  ===> Creating groups.
-  Creating group 'git_daemon' with gid '964'.
-  ===> Creating users
-  Creating user 'git_daemon' with uid '964'.
-  [folsom] [9/10] Extracting git-lite-2.19.1: 100%
-  [folsom] [10/10] Installing zsh-5.6.2...
-  [folsom] [10/10] Extracting zsh-5.6.2: 100%
+  ...[snip]...
 
 
 The PKG sub-command can, of course, do more than just `install`. The
@@ -146,7 +88,7 @@ expectation is that you can fully leverage the pkg manager. This means,
   The following 1 package(s) will be affected (of 0 checked):
 
   Installed packages to be UPGRADED:
-      nginx-lite: 1.14.0_14,2 -> 1.14.1,2
+      nginx-lite: 1.23.0 -> 1.24.0_12,3
 
   Number of packages to be upgraded: 1
 
@@ -155,10 +97,10 @@ expectation is that you can fully leverage the pkg manager. This means,
   Proceed with this action? [y/N]: y
   [nginx] [1/1] Fetching nginx-lite-1.14.1,2.txz: 100%  315 KiB 322.8kB/s    00:01
   Checking integrity... done (0 conflicting)
-  [nginx] [1/1] Upgrading nginx-lite from 1.14.0_14,2 to 1.14.1,2...
+  [nginx] [1/1] Upgrading nginx-lite from 1.23.0 to 1.24.0_12,3...
   ===> Creating groups.
   Using existing group 'www'.
   ===> Creating users
   Using existing user 'www'.
-  [nginx] [1/1] Extracting nginx-lite-1.14.1,2: 100%
+  [nginx] [1/1] Extracting nginx-lite-1.24.0_12: 100%
   You may need to manually remove /usr/local/etc/nginx/nginx.conf if it is no longer needed.

docs/chapters/subcommands/setup.rst

@@ -0,0 +1,16 @@
+=====
+setup
+=====
+
+The `setup` sub-command attempts to automatically configure a host system for
+Bastille containers. This allows you to configure networking, firewall, and storage
+options for a Bastille host with one command.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille setup -h        ## display setup help
+  ishmael ~ # bastille setup bastille0 ## only configure loopback interface
+  ishmael ~ # bastille setup pf        ## only configure default firewall
+  ishmael ~ # bastille setup zfs       ## only configure ZFS storage
+  ishmael ~ # bastille setup vnet      ## only configure VNET bridge
+  ishmael ~ # bastille setup           ## configure all of the above

docs/chapters/subcommands/tags.rst

@@ -0,0 +1,13 @@
+====
+tags
+====
+
+The `tags` sub-command adds, removes or lists arbitrary tags on your containers.
+
+.. code-block:: shell
+
+  ishmael ~ # bastille tags -h                    ## display tags help
+  ishmael ~ # bastille tags TARGET add tag1,tag2  ## add the tags "tag1" and "tag2" to TARGET
+  ishmael ~ # bastille tags TARGET delete tag2    ## delete tag "tag2" from TARGET
+  ishmael ~ # bastille tags TARGET list           ## list tags assigned to TARGET
+  ishmael ~ # bastille tags ALL list              ## list tags from ALL containers

docs/chapters/subcommands/update.rst

@@ -10,14 +10,14 @@ If no updates are available, a message will be shown:
 
 .. code-block:: shell
 
-  ishmael ~ # bastille update 11.2-RELEASE
+  ishmael ~ # bastille update 11.4-RELEASE
   Looking up update.FreeBSD.org mirrors... 2 mirrors found.
-  Fetching metadata signature for 11.2-RELEASE from update4.freebsd.org... done.
+  Fetching metadata signature for 11.4-RELEASE from update4.freebsd.org... done.
   Fetching metadata index... done.
   Inspecting system... done.
   Preparing to download files... done.
 
-  No updates needed to update system to 11.2-RELEASE-p4.
+  No updates needed to update system to 11.4-RELEASE-p4.
   No updates are available to install.
 
 
@@ -25,9 +25,9 @@ The older the release, however, the more updates will be available:
 
 .. code-block:: shell
 
-  ishmael ~ # bastille update 10.4-RELEASE
+  ishmael ~ # bastille update 13.2-RELEASE
   Looking up update.FreeBSD.org mirrors... 2 mirrors found.
-  Fetching metadata signature for 10.4-RELEASE from update1.freebsd.org... done.
+  Fetching metadata signature for 13.2-RELEASE from update1.freebsd.org... done.
   Fetching metadata index... done.
   Fetching 2 metadata patches.. done.
   Applying metadata patches... done.
@@ -35,7 +35,7 @@ The older the release, however, the more updates will be available:
   Inspecting system... done.
   Preparing to download files... done.
 
-  The following files will be added as part of updating to 10.4-RELEASE-p13:
+  The following files will be added as part of updating to 13.2-RELEASE-p4:
   ...[snip]...
 
 To be safe, you may want to restart any containers that have been updated live.

docs/chapters/subcommands/upgrade.rst

@@ -1,10 +0,0 @@
-=======
-upgrade
-=======
-
-This command lets you upgrade a release to a new release. Depending on the
-workflow this can be similar to a `bootstrap`.
-
-.. code-block:: shell
-
-  ishmael ~ # bastille upgrade 13.0-RELEASE 13.1-RELEASE

docs/chapters/targeting.rst

@@ -42,7 +42,7 @@ Examples: Containers
 +----+------+----+---+------------------+--------------+----------------------------------------------+
 | cp | bastion03 | /tmp/resolv.conf-cf etc/resolv.conf | copy host-path to container-path in bastion03|
 +----+------+----+---+---------------------------------+----------------------------------------------+
-| create    | folsom | 13.1-RELEASE 10.17.89.10        | create 13.1 container named `folsom` with IP |
+| create    | folsom | 13.2-RELEASE 10.17.89.10        | create 13.2 container named `folsom` with IP |
 +-----------+--------+---------------------------------+----------------------------------------------+
 
 
@@ -56,11 +56,9 @@ Examples: Releases
 +-----------+--------------+--------------+-------------------------------------------------------------+
 | command   | target       | args         | description                                                 |
 +===========+==============+==============+=============================================================+
-| bootstrap | 13.1-RELEASE | ---          | bootstrap 13.1-RELEASE release                              |
+| bootstrap | 13.2-RELEASE | ---          | bootstrap 13.2-RELEASE release                              |
 +-----------+--------------+--------------+-------------------------------------------------------------+
-| update    | 11.4-RELEASE | ---          | update 11.4-RELEASE release                                 |
+| update    | 12.4-RELEASE | ---          | update 12.4-RELEASE release                                 |
 +-----------+--------------+--------------+-------------------------------------------------------------+
-| upgrade   | 11.3-RELEASE | 11.4-RELEASE | upgrade 11.3-RELEASE release to 11.4-RELEASE                |
-+-----------+--------------+--------------+-------------------------------------------------------------+
-| verify    | 11.4-RELEASE | ---          | verify 11.4-RELEASE release                                 |
+| verify    | 12.4-RELEASE | ---          | verify 12.4-RELEASE release                                 |
 +-----------+--------------+--------------+-------------------------------------------------------------+

docs/chapters/template.rst

@@ -70,7 +70,7 @@ use, be sure to include `usr` in the template OVERLAY definition. eg;
 
 .. code-block:: shell
 
-  echo "CP usr" >> /usr/local/bastille/templates/username/template/Bastillefile
+  echo "CP usr /" >> /usr/local/bastille/templates/username/template/Bastillefile
 
 The above example "usr" will include anything under "usr" inside the template.
 You do not need to list individual files. Just include the top-level directory
@@ -140,3 +140,36 @@ directory names in the `bastille/templates` directory.
   Template Complete.
 
 .. _Bastille Templates: https://gitlab.com/BastilleBSD-Templates
+
+Using Ports in Templates
+------------------------
+
+Sometimes when you make a template you need special options for a package, or you need a newer version than what is in the pkgs.  The solution for these cases, or a case like minecraft server that has NO compiled option, is to use the ports.  A working example of this is the minecraft server template in the template repo.  The main lines needed to use this is first to mount the ports directory, then compile the port.  Below is an example of the minecraft template where this was used.
+
+.. code-block:: shell
+
+  ARG MINECRAFT_MEMX="1024M"
+  ARG MINECRAFT_MEMS="1024M"
+  ARG MINECRAFT_ARGS=""
+  CONFIG set enforce_statfs=1;
+  CONFIG set allow.mount.fdescfs;
+  CONFIG set allow.mount.procfs;
+  RESTART
+  PKG dialog4ports tmux openjdk17
+  MOUNT /usr/ports usr/ports nullfs ro 0 0
+  CP etc /
+  CP var /
+  CMD make -C /usr/ports/games/minecraft-server install clean
+  CP usr /
+  SYSRC minecraft_enable=YES
+  SYSRC minecraft_memx=${MINECRAFT_MEMX}
+  SYSRC minecraft_mems=${MINECRAFT_MEMS}
+  SYSRC minecraft_args=${MINECRAFT_ARGS}
+  SERVICE minecraft restart
+  RDR tcp 25565 25565
+
+The MOUNT line mounts the ports directory, then the CMD make line makes the port.  This can be modified to use any port in the port tree.
+
+
+
+

docs/chapters/upgrading.rst

@@ -35,5 +35,7 @@ Old Releases
 ----------------------------------
 After upgrading all jails from one release to the next you may find that you now have bootstrapped a release that is no longer used. Once you've decided that you no longer need the option to revert the change you can destroy the old release.
 
+
 `bastille list releases` to list all bootstrapped releases.
-`bastille destroy X.Y-RELEASE` to fully delete the release. 
+
+`bastille destroy X.Y-RELEASE` to fully delete the release. 

docs/conf.py

@@ -12,9 +12,9 @@ copyright = '2018-2023, Christer Edwards'
 author = 'Christer Edwards'
 
 # The short X.Y version
-version = '0.10.20230714'
+version = '0.10.20231125'
 # The full version, including alpha/beta/rc tags
-release = '0.10.20230714-beta'
+release = '0.10.20231125-beta'
 
 
 # -- General configuration ---------------------------------------------------
@@ -26,10 +26,10 @@ templates_path = ['_templates']
 
 source_suffix = ['.rst', '.md']
 
-from recommonmark.parser import CommonMarkParser
-source_parsers = {
-    '.md': CommonMarkParser,
-}
+#from recommonmark.parser import CommonMarkParser
+#source_parsers = {
+#    '.md': CommonMarkParser,
+#}
 
 master_doc = 'index'
 language = None

docs/index.rst

@@ -16,11 +16,13 @@ https://docs.bastillebsd.org.
    chapters/networking
    chapters/usage
    chapters/targeting
+   chapters/upgrading
    chapters/subcommands/index
    chapters/template
    chapters/jail-config
    chapters/zfs-support
    chapters/gcp
+   chapters/migration
 
    copyright
 

usr/local/bin/bastille

@@ -62,7 +62,7 @@ bastille_perms_check() {
 bastille_perms_check
 
 ## version
-BASTILLE_VERSION="0.10.20230714"
+BASTILLE_VERSION="0.10.20231125"
 
 usage() {
     cat << EOF
@@ -91,10 +91,12 @@ Available Commands:
   list        List containers (running and stopped).
   mount       Mount a volume inside the targeted container(s).
   pkg         Manipulate binary packages within targeted container(s). See pkg(8).
+  rcp         reverse cp(1) files from a single container to the host.
   rdr         Redirect host port to container port.
   rename      Rename a container.
   restart     Restart a running container.
   service     Manage services within targeted container(s).
+  setup       Attempt to auto-configure network, firewall and storage on new installs.
   start       Start a stopped container.
   stop        Stop a running container.
   sysrc       Safely edit rc files within targeted container(s).
@@ -148,7 +150,7 @@ help|-h|--help)
 bootstrap|create|destroy|export|import|list|rdr|restart|setup|start|update|upgrade|verify)
     # Nothing "extra" to do for these commands. -- cwells
     ;;
-clone|config|cmd|console|convert|cp|edit|htop|limits|mount|pkg|rename|service|stop|sysrc|tags|template|top|umount|zfs)
+clone|config|cmd|console|convert|cp|edit|htop|limits|mount|pkg|rcp|rename|service|stop|sysrc|tags|template|top|umount|zfs)
     # Parse the target and ensure it exists. -- cwells
     if [ $# -eq 0 ]; then # No target was given, so show the command's help. -- cwells
         PARAMS='help'

usr/local/etc/bastille/bastille.conf.sample

@@ -49,6 +49,7 @@ bastille_compress_xz_options="-0 -v"                                  ## default
 bastille_decompress_xz_options="-c -d -v"                             ## default "-c -d -v"
 bastille_compress_gz_options="-1 -v"                                  ## default "-1 -v"
 bastille_decompress_gz_options="-k -d -c -v"                          ## default "-k -d -c -v"
+bastille_export_options=""                                            ## default "" predefined export options, e.g. "--safe --gz"
 
 ## Networking
 bastille_network_loopback="bastille0"                                 ## default: "bastille0"

usr/local/etc/rc.d/bastille

@@ -8,10 +8,19 @@
 
 # Add the following to /etc/rc.conf[.local] to enable this service
 #
-# bastille_enable (bool):          Set to NO by default.
-#               Set it to YES to enable bastille.
-# bastille_list (string):        Set to "ALL" by default.
-#               Space separated list of jails to start.
+# bastille_enable (bool): Set to "NO" by default.
+#               Set it to "YES" to enable bastille.
+# bastille_conf (bool):   Set to "/usr/local/etc/bastille/bastille.conf" by default.
+#               Path to bastile.conf file. Used if bastille_rcorder="YES".
+# bastille_list (string): Set to "ALL" by default.
+#               Space separated list of jails to start or "ALL" to start all
+#               jails.
+# bastille_rcorder (bool):       Set to "NO" by default.
+#               Set it to "YES" to start all jails in order, defined by
+#               rcorder(8). It starts all jails, except jails with "KEYWORD:
+#               nostart" in jail.conf. Value of bastille_list is ignored in this
+#               case, requires correct path to bastile.conf in bastille_conf
+#               var.
 #
 
 . /etc/rc.subr
@@ -19,24 +28,36 @@
 name=bastille
 rcvar=${name}_enable
 
-: ${bastille_enable:=NO}
+: ${bastille_enable:="NO"}
+: ${bastille_conf:="/usr/local/etc/bastille/bastille.conf"}
 : ${bastille_list:="ALL"}
+: ${bastille_rcorder:="NO"}
 
 command=/usr/local/bin/${name}
 start_cmd="bastille_start"
 stop_cmd="bastille_stop"
 restart_cmd="bastille_stop && bastille_start"
 
+rcordered_list() {
+    local _jailsdir
+    _jailsdir=$(. $bastille_conf; echo $bastille_jailsdir)
+    bastille_ordered_list=$(rcorder -s nostart ${_jailsdir}/*/jail.conf | xargs dirname | xargs basename | tr "\n" " ")
+}
+
 bastille_start()
 {
-    if [ -z "${bastille_list}" ]; then
-        echo "bastille_list is undefined"
-        return 1
-    fi
-
     local _jail
 
-    for _jail in ${bastille_list}; do
+    if checkyesno bastille_rcorder; then
+        rcordered_list
+    elif [ -z "${bastille_list}" ]; then
+        echo "bastille_list is undefined"
+        return 1
+    else
+        bastille_ordered_list=${bastille_list}
+    fi
+
+    for _jail in ${bastille_ordered_list}; do
         echo "Starting Bastille Container: ${_jail}"
         ${command} start ${_jail}
     done
@@ -44,16 +65,20 @@ bastille_start()
 
 bastille_stop()
 {
-    if [ -z "${bastille_list}" ]; then
+    local _jail _revlist
+
+    if checkyesno bastille_rcorder; then
+        rcordered_list
+    elif [ -z "${bastille_list}" ]; then
         echo "bastille_list is undefined"
         return 1
+    else
+        bastille_ordered_list=${bastille_list}
     fi
 
-    local _jail
-
     ## reverse order of list for shutdown ## fixes #389
-    bastille_revlist=$(echo "${bastille_list}" | awk '{ for (i=NF; i>1; i--) printf("%s ",$i); print $1; }')
-    for _jail in ${bastille_revlist}; do
+    _revlist=$(echo "${bastille_ordered_list}" | awk '{ for (i=NF; i>1; i--) printf("%s ",$i); print $1; }')
+    for _jail in ${_revlist}; do
         echo "Stopping Bastille Container: ${_jail}"
         ${command} stop ${_jail}
     done

usr/local/share/bastille/bootstrap.sh

@@ -45,7 +45,7 @@ esac
 bastille_root_check
 
 #Validate if ZFS is enabled in rc.conf and bastille.conf.
-if [ "$(sysrc -n zfs_enable)" = "YES" ] && [ ! "${bastille_zfs_enable}" = "YES" ]; then
+if [ "$(sysrc -n zfs_enable)" = "YES" ] && ! checkyesno bastille_zfs_enable; then
     warn "ZFS is enabled in rc.conf but not bastille.conf. Do you want to continue? (N|y)"
     read answer
     case $answer in
@@ -57,7 +57,7 @@ if [ "$(sysrc -n zfs_enable)" = "YES" ] && [ ! "${bastille_zfs_enable}" = "YES"
 fi
 
 # Validate ZFS parameters.
-if [ "${bastille_zfs_enable}" = "YES" ]; then
+if checkyesno bastille_zfs_enable; then
     ## check for the ZFS pool and bastille prefix
     if [ -z "${bastille_zfs_zpool}" ]; then
         error_exit "ERROR: Missing ZFS parameters. See bastille_zfs_zpool."
@@ -102,7 +102,7 @@ bootstrap_directories() {
 
     ## ${bastille_prefix}
     if [ ! -d "${bastille_prefix}" ]; then
-        if [ "${bastille_zfs_enable}" = "YES" ];then
+        if checkyesno bastille_zfs_enable; then
             if [ -n "${bastille_zfs_zpool}" ]; then
                 zfs create ${bastille_zfs_options} -o mountpoint="${bastille_prefix}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}"
             fi
@@ -114,7 +114,7 @@ bootstrap_directories() {
 
     ## ${bastille_backupsdir}
     if [ ! -d "${bastille_backupsdir}" ]; then
-        if [ "${bastille_zfs_enable}" = "YES" ];then
+        if checkyesno bastille_zfs_enable; then
             if [ -n "${bastille_zfs_zpool}" ]; then
                 zfs create ${bastille_zfs_options} -o mountpoint="${bastille_backupsdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/backups"
             fi
@@ -126,7 +126,7 @@ bootstrap_directories() {
 
     ## ${bastille_cachedir}
     if [ ! -d "${bastille_cachedir}" ]; then
-        if [ "${bastille_zfs_enable}" = "YES" ]; then
+        if checkyesno bastille_zfs_enable; then
             if [ -n "${bastille_zfs_zpool}" ]; then
                 zfs create ${bastille_zfs_options} -o mountpoint="${bastille_cachedir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache"
                 # Don't create unused/stale cache/RELEASE directory on Linux jails creation.
@@ -145,7 +145,7 @@ bootstrap_directories() {
     elif [ ! -d "${bastille_cachedir}/${RELEASE}" ]; then
         # Don't create unused/stale cache/RELEASE directory on Linux jails creation.
         if [ -z "${NOCACHEDIR}" ]; then
-            if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if checkyesno bastille_zfs_enable; then
                 if [ -n "${bastille_zfs_zpool}" ]; then
                     zfs create ${bastille_zfs_options} -o mountpoint="${bastille_cachedir}/${RELEASE}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}"
                 fi
@@ -157,7 +157,7 @@ bootstrap_directories() {
 
     ## ${bastille_jailsdir}
     if [ ! -d "${bastille_jailsdir}" ]; then
-        if [ "${bastille_zfs_enable}" = "YES" ]; then
+        if checkyesno bastille_zfs_enable; then
             if [ -n "${bastille_zfs_zpool}" ]; then
                 zfs create ${bastille_zfs_options} -o mountpoint="${bastille_jailsdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails"
             fi
@@ -168,7 +168,7 @@ bootstrap_directories() {
 
     ## ${bastille_logsdir}
     if [ ! -d "${bastille_logsdir}" ]; then
-        if [ "${bastille_zfs_enable}" = "YES" ]; then
+        if checkyesno bastille_zfs_enable; then
             if [ -n "${bastille_zfs_zpool}" ]; then
                 zfs create ${bastille_zfs_options} -o mountpoint="${bastille_logsdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/logs"
             fi
@@ -179,7 +179,7 @@ bootstrap_directories() {
 
     ## ${bastille_templatesdir}
     if [ ! -d "${bastille_templatesdir}" ]; then
-        if [ "${bastille_zfs_enable}" = "YES" ]; then
+        if checkyesno bastille_zfs_enable; then
             if [ -n "${bastille_zfs_zpool}" ]; then
                 zfs create ${bastille_zfs_options} -o mountpoint="${bastille_templatesdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/templates"
             fi
@@ -190,7 +190,7 @@ bootstrap_directories() {
 
     ## ${bastille_releasesdir}
     if [ ! -d "${bastille_releasesdir}" ]; then
-        if [ "${bastille_zfs_enable}" = "YES" ]; then
+        if checkyesno bastille_zfs_enable; then
             if [ -n "${bastille_zfs_zpool}" ]; then
                 zfs create ${bastille_zfs_options} -o mountpoint="${bastille_releasesdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases"
                 zfs create ${bastille_zfs_options} -o mountpoint="${bastille_releasesdir}/${RELEASE}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"
@@ -201,7 +201,7 @@ bootstrap_directories() {
 
     ## create subsequent releases/XX.X-RELEASE datasets
     elif [ ! -d "${bastille_releasesdir}/${RELEASE}" ]; then
-        if [ "${bastille_zfs_enable}" = "YES" ]; then
+        if checkyesno bastille_zfs_enable; then
             if [ -n "${bastille_zfs_zpool}" ]; then
                 zfs create ${bastille_zfs_options} -o mountpoint="${bastille_releasesdir}/${RELEASE}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${RELEASE}"
             fi
@@ -249,7 +249,7 @@ bootstrap_release() {
 
             if [ "${FETCH_VALIDATION}" -ne "0" ]; then
                 ## perform cleanup only for stale/empty directories on failure
-                if [ "${bastille_zfs_enable}" = "YES" ]; then
+                if checkyesno bastille_zfs_enable; then
                     if [ -n "${bastille_zfs_zpool}" ]; then
                         if [ ! "$(ls -A "${bastille_cachedir}/${RELEASE}")" ]; then
                             zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/cache/${RELEASE}"
@@ -383,7 +383,7 @@ debootstrap_release() {
     info "Bootstrapping ${PLATFORM_OS} distfiles..."
     if ! debootstrap --foreign --arch=${ARCH_BOOTSTRAP} --no-check-gpg ${LINUX_FLAVOR} "${bastille_releasesdir}"/${DIR_BOOTSTRAP}; then
         ## perform cleanup only for stale/empty directories on failure
-        if [ "${bastille_zfs_enable}" = "YES" ]; then
+        if checkyesno bastille_zfs_enable; then
             if [ -n "${bastille_zfs_zpool}" ]; then
                 if [ ! "$(ls -A "${bastille_releasesdir}/${DIR_BOOTSTRAP}")" ]; then
                     zfs destroy "${bastille_zfs_zpool}/${bastille_zfs_prefix}/releases/${DIR_BOOTSTRAP}"
@@ -414,7 +414,7 @@ bootstrap_template() {
 
     ## ${bastille_templatesdir}
     if [ ! -d "${bastille_templatesdir}" ]; then
-        if [ "${bastille_zfs_enable}" = "YES" ]; then
+        if checkyesno bastille_zfs_enable; then
             if [ -n "${bastille_zfs_zpool}" ]; then
                 zfs create ${bastille_zfs_options} -o mountpoint="${bastille_templatesdir}" "${bastille_zfs_zpool}/${bastille_zfs_prefix}/templates"
             fi
@@ -473,6 +473,11 @@ if [ -n "${OPTION}" ] && [ "${OPTION}" != "${HW_MACHINE}" ] && [ "${OPTION}" !=
     fi
 fi
 
+## allow override bootstrap URLs via environment variables
+[ -n "${BASTILLE_URL_FREEBSD}" ] && bastille_url_freebsd="${BASTILLE_URL_FREEBSD}"
+[ -n "${BASTILLE_URL_HARDENEDBSD}" ] && bastille_url_hardenedbsd="${BASTILLE_URL_HARDENEDBSD}"
+[ -n "${BASTILLE_URL_MIDNIGHTBSD}" ] && bastille_url_midnightbsd="${BASTILLE_URL_MIDNIGHTBSD}"
+
 ## Filter sane release names
 case "${1}" in
 2.[0-9]*)
@@ -489,9 +494,9 @@ case "${1}" in
     PLATFORM_OS="FreeBSD"
     validate_release_url
     ;;
-*-RELEASE|*-release|*-RC1|*-rc1|*-RC2|*-rc2|*-RC3|*-rc3|*-RC4|*-rc4|*-RC5|*-rc5|*-BETA1|*-BETA2|*-BETA3|*-BETA4|*-BETA5)
+*-RELEASE|*-release|*-RC[1-9]|*-rc[1-9]|*-BETA[1-9])
     ## check for FreeBSD releases name
-    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-5]|-BETA[1-5])$' | tr '[:lower:]' '[:upper:]')
+    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([0-9]{1,2})\.[0-9](-RELEASE|-RC[1-9]|-BETA[1-9])$' | tr '[:lower:]' '[:upper:]')
     UPSTREAM_URL="${bastille_url_freebsd}${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_VERIFY}"
     PLATFORM_OS="FreeBSD"
     validate_release_url

usr/local/share/bastille/clone.sh

@@ -136,7 +136,7 @@ update_fstab() {
     # Update fstab to use the new name
     FSTAB_CONFIG="${bastille_jailsdir}/${NEWNAME}/fstab"
     if [ -f "${FSTAB_CONFIG}" ]; then
-        FSTAB_RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-5]|-BETA[1-5]|-CURRENT)|([0-9]{1,2}(-stable-build-[0-9]{1,3}|-stable-LAST))|(current-build)-([0-9]{1,3})|(current-BUILD-LATEST)|([0-9]{1,2}-stable-BUILD-LATEST)' "${FSTAB_CONFIG}" | uniq)
+        FSTAB_RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-9]|-BETA[1-9]|-CURRENT)|([0-9]{1,2}(-stable-build-[0-9]{1,3}|-stable-LAST))|(current-build)-([0-9]{1,3})|(current-BUILD-LATEST)|([0-9]{1,2}-stable-BUILD-LATEST)' "${FSTAB_CONFIG}" | uniq)
         FSTAB_CURRENT=$(grep -w ".*/releases/.*/jails/${TARGET}/root/.bastille" "${FSTAB_CONFIG}")
         FSTAB_NEWCONF="${bastille_releasesdir}/${FSTAB_RELEASE} ${bastille_jailsdir}/${NEWNAME}/root/.bastille nullfs ro 0 0"
         if [ -n "${FSTAB_CURRENT}" ] && [ -n "${FSTAB_NEWCONF}" ]; then
@@ -154,7 +154,7 @@ clone_jail() {
     # Attempt container clone
     info "Attempting to clone '${TARGET}' to ${NEWNAME}..."
     if ! [ -d "${bastille_jailsdir}/${NEWNAME}" ]; then
-        if [ "${bastille_zfs_enable}" = "YES" ]; then
+        if checkyesno bastille_zfs_enable; then
             if [ -n "${bastille_zfs_zpool}" ]; then
                 # Replicate the existing container
                 DATE=$(date +%F-%H%M%S)

usr/local/share/bastille/common.sh

@@ -117,3 +117,24 @@ EOF
 EOF
     fi
 }
+
+checkyesno() {
+    ## copied from /etc/rc.subr -- cedwards (20231125)
+    ## issue #368 (lowercase values should be parsed)
+    ## now used for all bastille_zfs_enable=YES|NO tests
+    ## example: if checkyesno bastille_zfs_enable; then ...
+    ## returns 0 for enabled; returns 1 for disabled
+    eval _value=\$${1}
+    case $_value in
+    [Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]|[Oo][Nn]|1)
+        return 0
+        ;;
+    [Nn][Oo]|[Ff][Aa][Ll][Ss][Ee]|[Oo][Ff][Ff]|0)
+        return 1
+        ;;
+    *)
+        warn "\$${1} is not set properly - see rc.conf(5)."
+        return 1
+        ;;
+    esac
+}

usr/local/share/bastille/create.sh

@@ -39,12 +39,13 @@ usage() {
     cat << EOF
     Options:
 
-    -E | --empty  -- Creates an empty container, intended for custom jail builds (thin/thick/linux or unsupported).
-    -L | --linux  -- This option is intended for testing with Linux jails, this is considered experimental.
-    -T | --thick  -- Creates a thick container, they consume more space as they are self contained and independent.
-    -V | --vnet   -- Enables VNET, VNET containers are attached to a virtual bridge interface for connectivity.
-    -C | --clone  -- Creates a clone container, they are duplicates of the base release, consume low space and preserves changing data.
-    -B | --bridge -- Enables VNET, VNET containers are attached to a specified, already existing external bridge.
+    -B | --bridge -- Enables VNET. VNET containers are attached to a bridge interface. (DIY)
+    -C | --clone  -- Creates a ZFS clone container. Clones are ZFS snapshots of the release, consuming minimal storage.
+    -E | --empty  -- Creates an empty container. Intended for custom jail builds and experimentation.
+    -L | --linux  -- This option is intended for testing with Linux jails. This is considered experimental.
+    -N | --nested -- Creates a Nested container. Nesting containers provides support for "pods", poudriere, etc.
+    -T | --thick  -- Creates a thick container. Thick containers consume more space as they are full copies of a release.
+    -V | --vnet   -- Enables VNET. VNET containers are attached to a bridge interface (FreeBSD jib).
 
 EOF
     exit 1
@@ -178,6 +179,7 @@ ${NAME} {
   mount.fstab = ${bastille_jail_fstab};
   path = ${bastille_jail_path};
   securelevel = 2;
+  osrelease = ${RELEASE};
 
   interface = ${bastille_jail_conf_interface};
   ${IP4_DEFINITION}
@@ -225,12 +227,51 @@ ${NAME} {
   mount.fstab = ${bastille_jail_fstab};
   path = ${bastille_jail_path};
   securelevel = 2;
+  osrelease = ${RELEASE};
 
 ${NETBLOCK}
 }
 EOF
 }
 
+generate_nested_vnet_jail_conf() {
+    NETBLOCK=$(generate_vnet_jail_netblock "$NAME" "${VNET_JAIL_BRIDGE}" "${bastille_jail_conf_interface}")
+    cat << EOF > "${bastille_jail_conf}"
+${NAME} {
+  devfs_ruleset = 13;
+  enforce_statfs = 1;
+  exec.clean;
+  exec.consolelog = ${bastille_jail_log};
+  exec.start = '/bin/sh /etc/rc';
+  exec.stop = '/bin/sh /etc/rc.shutdown';
+  host.hostname = ${NAME};
+  mount.devfs;
+  mount.fstab = ${bastille_jail_fstab};
+  path = ${bastille_jail_path};
+  securelevel = 2;
+  osrelease = ${RELEASE};
+
+  children.max = 16;
+
+  allow.chflags;
+  allow.mount;
+  allow.mount.devfs;
+  allow.mount.fdescfs;
+  allow.mount.linprocfs;
+  allow.mount.nullfs;
+  allow.mount.procfs;
+  allow.mount.tmpfs;
+  allow.mount.zfs;
+  allow.raw_sockets;
+  allow.set_hostname;
+  ## nested params
+
+${NETBLOCK}
+}
+EOF
+}
+
+
 post_create_jail() {
     # Common config checks and settings.
 
@@ -260,7 +301,9 @@ post_create_jail() {
     fi
 
     # Generate the jail configuration file.
-    if [ -n "${VNET_JAIL}" ]; then
+    if [ -n "${NESTED_JAIL}" ] && [ -n "${VNET_JAIL}" ]; then
+        generate_nested_vnet_jail_conf
+    elif [ -n "${VNET_JAIL}" ]; then
         generate_vnet_jail_conf
     else
         generate_jail_conf
@@ -279,7 +322,7 @@ create_jail() {
     bastille_jail_resolv_conf="${bastille_jailsdir}/${NAME}/root/etc/resolv.conf" ## file
 
     if [ ! -d "${bastille_jailsdir}/${NAME}" ]; then
-        if [ "${bastille_zfs_enable}" = "YES" ]; then
+        if checkyesno bastille_zfs_enable; then
             if [ -n "${bastille_zfs_zpool}" ]; then
                 ## create required zfs datasets, mountpoint inherited from system
                 if [ -z "${CLONE_JAIL}" ]; then
@@ -386,7 +429,7 @@ create_jail() {
                 fi
             done
         else
-            if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if checkyesno bastille_zfs_enable; then
                 if [ -n "${bastille_zfs_zpool}" ]; then
                     if [ -n "${CLONE_JAIL}" ]; then
                         info "Creating a clonejail...\n"
@@ -499,7 +542,7 @@ create_jail() {
     if [ -n "${VNET_JAIL}" ]; then
         if [ -n "${bastille_template_vnet}" ]; then
             ## rename interface to generic vnet0
-            uniq_epair=$(grep vnet.interface "${bastille_jailsdir}/${NAME}/jail.conf" | awk '{print $3}' | sed 's/;//')
+            uniq_epair=$(grep vnet.interface "${bastille_jailsdir}/${NAME}/jail.conf" | awk '{print $3}' | sed 's/;//; s/-/_/g')
 
             _gateway=''
             _gateway6=''
@@ -605,36 +648,97 @@ LINUX_JAIL=""
 # Handle and parse options
 while [ $# -gt 0 ]; do
     case "${1}" in
-        -E|--empty|empty)
-            EMPTY_JAIL="1"
-            shift
-            ;;
-        -L|--linux|linux)
-            LINUX_JAIL="1"
-            shift
-            ;;
-        -T|--thick|thick)
-            THICK_JAIL="1"
-            shift
-            ;;
-        -V|--vnet|vnet)
-            VNET_JAIL="1"
-            shift
-            ;;
-        -B|--bridge|bridge)
+        -B|--bridge)
             VNET_JAIL="1"
             VNET_JAIL_BRIDGE="1"
             shift
             ;;
-        -C|--clone|clone)
+        -C|--clone)
             CLONE_JAIL="1"
             shift
             ;;
+        -CB|-BC|--clone-bridge)
+            CLONE_JAIL="1"
+            VNET_JAIL="1"
+            VNET_JAIL_BRIDGE="1"
+            shift
+            ;;
+        -CV|-VC|--clone-vnet)
+            CLONE_JAIL="1"
+            VNET_JAIL="1"
+            shift
+            ;;
+        -CNB|--nested-clone-bridge)
+            CLONE_JAIL="1"
+            NESTED_JAIL="1"
+            VNET_JAIL="1"
+            VNET_JAIL_BRIDGE="1"
+            shift
+            ;;
+        -CNV|--nested-clone-vnet)
+            CLONE_JAIL="1"
+            NESTED_JAIL="1"
+            VNET_JAIL="1"
+            shift
+            ;;
+        -E|--empty)
+            EMPTY_JAIL="1"
+            shift
+            ;;
+        -EB|-BE|--empty-bridge)
+            EMPTY_JAIL="1"
+            VNET_JAIL="1"
+            VNET_JAIL_BRIDGE="1"
+            shift
+            ;;
+        -EV|-VE|--empty-vnet)
+            EMPTY_JAIL="1"
+            VNET_JAIL="1"
+            shift
+            ;;
+        -L|--linux)
+            LINUX_JAIL="1"
+            shift
+            ;;
+        -LB|-BL|--linux-bridge)
+            LINUX_JAIL="1"
+            VNET_JAIL="1"
+            VNET_JAIL_BRIDGE="1"
+            shift
+            ;;
+        -N|--nested)
+            NESTED_JAIL="1"
+            shift
+            ;;
+        -T|--thick)
+            THICK_JAIL="1"
+            shift
+            ;;
+        -TB|-BT|--thick-bridge)
+            THICK_JAIL="1"
+            VNET_JAIL="1"
+            VNET_JAIL_BRIDGE="1"
+            shift
+            ;;
+        -TV|-VT|--thick-vnet)
+            THICK_JAIL="1"
+            VNET_JAIL="1"
+            shift
+            ;;
+        -V|--vnet)
+            VNET_JAIL="1"
+            shift
+            ;;
+        -LV|-VL|--linux-vnet)
+            LINUX_JAIL="1"
+            VNET_JAIL="1"
+            shift
+            ;;
         -*|--*)
             error_notify "Unknown Option."
             usage
             ;;
-       *)
+        *)
             break
             ;;
     esac
@@ -719,9 +823,9 @@ if [ -z "${EMPTY_JAIL}" ]; then
         NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-CURRENT|-CURRENT-i386)$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g')
         validate_release
         ;;
-    *-RELEASE|*-RELEASE-I386|*-RELEASE-i386|*-release|*-RC1|*-rc1|*-RC2|*-rc2|*-BETA1|*-BETA2|*-BETA3|*-BETA4|*-BETA5)
+    *-RELEASE|*-RELEASE-I386|*-RELEASE-i386|*-release|*-RC[1-9]|*-rc[1-9]|*-BETA[1-9])
         ## check for FreeBSD releases name
-        NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-2]|-BETA[1-5])$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g')
+        NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-9]|-BETA[1-9])$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g')
         validate_release
         ;;
     *-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)

usr/local/share/bastille/destroy.sh

@@ -55,7 +55,7 @@ destroy_jail() {
 
     if [ -d "${bastille_jail_base}" ]; then
         info "Deleting Jail: ${TARGET}."
-        if [ "${bastille_zfs_enable}" = "YES" ]; then
+        if checkyesno bastille_zfs_enable; then
             if [ -n "${bastille_zfs_zpool}" ]; then
                 if [ -n "${TARGET}" ]; then
                     OPTIONS="-r"
@@ -118,7 +118,7 @@ destroy_rel() {
             if grep -qwo "${TARGET}" "${bastille_jailsdir}/${_jail}/fstab" 2>/dev/null; then
                 error_notify "Notice: (${_jail}) depends on ${TARGET} base."
                 BASE_HASCHILD="1"
-            elif [ "${bastille_zfs_enable}" = "YES" ]; then
+            elif checkyesno bastille_zfs_enable; then
                 if [ -n "${bastille_zfs_zpool}" ]; then
                     ## check if this release have child clones
                     if zfs list -H -t snapshot -r "${bastille_rel_base}" > /dev/null 2>&1; then
@@ -144,7 +144,7 @@ destroy_rel() {
     else
         if [ "${BASE_HASCHILD}" -eq "0" ]; then
             info "Deleting base: ${TARGET}"
-            if [ "${bastille_zfs_enable}" = "YES" ]; then
+            if checkyesno bastille_zfs_enable; then
                 if [ -n "${bastille_zfs_zpool}" ]; then
                     if [ -n "${TARGET}" ]; then
                         OPTIONS="-r"
@@ -219,9 +219,9 @@ case "${TARGET}" in
     NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]{2,2})\.[0-9](-CURRENT|-CURRENT-i386)$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g')
     destroy_rel
     ;;
-*-RELEASE|*-RELEASE-I386|*-RELEASE-i386|*-release|*-RC1|*-rc1|*-RC2|*-rc2|*-RC3|*-rc3|*-RC4|*-rc4|*-RC5|*-rc5|*-BETA1|*-BETA2|*-BETA3|*-BETA4|*-BETA5)
+*-RELEASE|*-RELEASE-I386|*-RELEASE-i386|*-release|*-RC[1-9]|*-rc[1-9]|*-BETA[1-9])
     ## check for FreeBSD releases name
-    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-5]|-BETA[1-5])$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g')
+    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '^([1-9]{2,2})\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-9]|-BETA[1-9])$' | tr '[:lower:]' '[:upper:]' | sed 's/I/i/g')
     destroy_rel
     ;;
 *-stable-LAST|*-STABLE-last|*-stable-last|*-STABLE-LAST)

usr/local/share/bastille/export.sh

@@ -75,7 +75,7 @@ bastille_root_check
 
 zfs_enable_check() {
     # Temporarily disable ZFS so we can create a standard backup archive
-    if [ "${bastille_zfs_enable}" = "YES" ]; then
+    if checkyesno bastille_zfs_enable; then
         bastille_zfs_enable="NO"
     fi
 }
@@ -212,7 +212,7 @@ if [ -n "${TXZ_EXPORT}" -o -n "${TGZ_EXPORT}" ] && [ -n "${SAFE_EXPORT}" ]; then
     error_exit "Error: Simple archive modes with safe ZFS export can't be used together."
 fi
 
-if [ -z "${bastille_zfs_enable}" ]; then
+if checkyesno bastille_zfs_enable; then
     if [ -n "${GZIP_EXPORT}" -o -n "${RAW_EXPORT}" -o -n "${SAFE_EXPORT}" -o "${OPT_ZSEND}" = "-Rv" ]; then
         error_exit "Options --gz, --raw, --safe, --verbose are valid for ZFS configured systems only."
     fi
@@ -294,7 +294,7 @@ export_check() {
         create_zfs_snap
     fi
 
-    if [ "${bastille_zfs_enable}" = "YES" ]; then
+    if checkyesno bastille_zfs_enable; then
         if [ -z "${USER_EXPORT}" ]; then
             info "Sending ZFS data stream..."
         fi
@@ -304,7 +304,7 @@ export_check() {
 jail_export() {
     # Attempt to export the container
     DATE=$(date +%F-%H%M%S)
-    if [ "${bastille_zfs_enable}" = "YES" ]; then
+    if checkyesno bastille_zfs_enable; then
         if [ -n "${bastille_zfs_zpool}" ]; then
             if [ -n "${RAW_EXPORT}" ]; then
                 FILE_EXT=""
@@ -384,7 +384,7 @@ if [ -n "${TARGET}" ]; then
     fi
 
     # Check if is a ZFS system
-    if [ "${bastille_zfs_enable}" != "YES" ]; then
+    if ! checkyesno bastille_zfs_enable; then
         # Check if container is running and ask for stop in non ZFS systems
         if [ -n "$(/usr/sbin/jls name | awk "/^${TARGET}$/")" ]; then
             error_exit "${TARGET} is running. See 'bastille stop'."

usr/local/share/bastille/import.sh

@@ -152,6 +152,11 @@ update_jailconf() {
             sed -i '' "s|path.*=.*;|path = ${bastille_jailsdir}/${TARGET_TRIM}/root;|" "${JAIL_CONFIG}"
             sed -i '' "s|mount.fstab.*=.*;|mount.fstab = ${bastille_jailsdir}/${TARGET_TRIM}/fstab;|" "${JAIL_CONFIG}"
         fi
+
+        # Check for the jib script
+        if grep -qw "vnet" "${JAIL_CONFIG}"; then
+            vnet_requirements
+        fi
     fi
 }
 
@@ -159,7 +164,7 @@ update_fstab() {
     # Update fstab .bastille mountpoint on thin containers only
     # Set some variables
     FSTAB_CONFIG="${bastille_jailsdir}/${TARGET_TRIM}/fstab"
-    FSTAB_RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-2])|([0-9]{1,2}-stable-build-[0-9]{1,3})|(current-build)-([0-9]{1,3})|(current-BUILD-LATEST)|([0-9]{1,2}-stable-BUILD-LATEST)|(current-BUILD-LATEST)' "${FSTAB_CONFIG}")
+    FSTAB_RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RELEASE-i386|-RC[1-9])|([0-9]{1,2}-stable-build-[0-9]{1,3})|(current-build)-([0-9]{1,3})|(current-BUILD-LATEST)|([0-9]{1,2}-stable-BUILD-LATEST)|(current-BUILD-LATEST)' "${FSTAB_CONFIG}")
     FSTAB_CURRENT=$(grep -w ".*/releases/.*/jails/${TARGET_TRIM}/root/.bastille" "${FSTAB_CONFIG}")
     FSTAB_NEWCONF="${bastille_releasesdir}/${FSTAB_RELEASE} ${bastille_jailsdir}/${TARGET_TRIM}/root/.bastille nullfs ro 0 0"
     if [ -n "${FSTAB_CURRENT}" ] && [ -n "${FSTAB_NEWCONF}" ]; then
@@ -209,6 +214,7 @@ generate_config() {
     # See if we need to generate a vnet network section
     if [ "${IS_VNET_JAIL:-0}" = "1" ]; then
         NETBLOCK=$(generate_vnet_jail_netblock "${TARGET_TRIM}" "" "${VNET_DEFAULT_INTERFACE}")
+        vnet_requirements
     else
         # If there are multiple IP/NIC let the user configure network
         if [ -n "${IPV4_CONFIG}" ]; then
@@ -335,6 +341,17 @@ workout_components() {
     fi
 }
 
+vnet_requirements() {
+    # VNET jib script requirement
+    if [ ! "$(command -v jib)" ]; then
+        if [ -f "/usr/share/examples/jails/jib" ] && [ ! -f "/usr/local/bin/jib" ]; then
+            install -m 0544 /usr/share/examples/jails/jib /usr/local/bin/jib
+        else
+            warn "Warning: Unable to locate/install jib script required by VNET jails."
+        fi
+    fi
+}
+
 config_netif() {
     # Get interface from bastille configuration
     if [ -n "${bastille_network_loopback}" ]; then
@@ -393,7 +410,7 @@ jail_import() {
     FILE_TRIM=$(echo "${TARGET}" | sed 's/\.xz//g;s/\.gz//g;s/\.tgz//g;s/\.txz//g;s/\.zip//g;s/\.tar\.gz//g;s/\.tar//g')
     FILE_EXT=$(echo "${TARGET}" | sed "s/${FILE_TRIM}//g")
     if [ -d "${bastille_jailsdir}" ]; then
-        if [ "${bastille_zfs_enable}" = "YES" ]; then
+        if checkyesno bastille_zfs_enable; then
             if [ -n "${bastille_zfs_zpool}" ]; then
                 if [ "${FILE_EXT}" = ".xz" ]; then
                     validate_archive

usr/local/share/bastille/list.sh

@@ -42,7 +42,7 @@ fi
 bastille_root_check
 
 if [ $# -eq 0 ]; then
-   /usr/sbin/jls -N
+   /usr/sbin/jls
 fi
 
 if [ "${1}" == "-j" ]; then

usr/local/share/bastille/rcp.sh

@@ -0,0 +1,77 @@
+#!/bin/sh
+#
+# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+#
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/common.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    error_exit "Usage: bastille rcp [OPTION] TARGET CONTAINER_PATH HOST_PATH"
+}
+
+CPSOURCE="${1}"
+CPDEST="${2}"
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+-q|--quiet)
+    OPTION="${1}"
+    CPSOURCE="${2}"
+    CPDEST="${3}"
+    ;;
+esac
+
+if [ $# -ne 2 ]; then
+    usage
+fi
+
+if [ "${TARGET}" = "ALL" ]; then
+    usage
+fi
+
+case "${OPTION}" in
+    -q|--quiet)
+        OPTION="-a"
+        ;;
+    *)
+        OPTION="-av"
+        ;;
+esac
+
+for _jail in ${JAILS}; do
+    info "[${_jail}]:"
+    bastille_jail_path="${bastille_jailsdir}/${_jail}/root"
+    cp "${OPTION}" "${bastille_jail_path}/${CPSOURCE}" "${CPDEST}"
+    RETURN="$?"
+    echo
+    return "${RETURN}"
+done

usr/local/share/bastille/rdr.sh

@@ -76,7 +76,7 @@ check_jail_validity() {
     fi
     # Check if jail ip6 address (ip6.addr) is valid (non-VNET only)
     if [ "$(bastille config $TARGET get vnet)" != 'enabled' ]; then
-        if [ "$(bastille config $TARGET get ip6)" != 'disabled' ] && [ "$(bastille config $TARGET get ip6)" != 'not set' ]; then
+        if [ "$(bastille config $TARGET get ip6)" != 'disable' ] && [ "$(bastille config $TARGET get ip6)" != 'not set' ]; then
             JAIL_IP6=$(/usr/sbin/jls -j "${TARGET}" ip6.addr 2>/dev/null)
         fi
     fi
@@ -88,9 +88,11 @@ check_jail_validity() {
     fi
 
     # Check if ext_if is defined in pf.conf
-    EXT_IF=$(grep "^[[:space:]]*${bastille_network_pf_ext_if}[[:space:]]*=" ${bastille_pf_conf})
-    if [ -z "${EXT_IF}" ]; then
-        error_exit "bastille_network_pf_ext_if (${bastille_network_pf_ext_if}) not defined in pf.conf"
+    if [ -n "${bastille_pf_conf}" ]; then
+        EXT_IF=$(grep "^[[:space:]]*${bastille_network_pf_ext_if}[[:space:]]*=" ${bastille_pf_conf})
+        if [ -z "${EXT_IF}" ]; then
+            error_exit "bastille_network_pf_ext_if (${bastille_network_pf_ext_if}) not defined in pf.conf"
+        fi
     fi
 }
 

usr/local/share/bastille/rename.sh

@@ -83,7 +83,7 @@ update_fstab() {
     if [ -f "${FSTAB_CONFIG}" ]; then
         # Skip if fstab is empty, e.g newly created thick or clone jails
         if [ -s "${FSTAB_CONFIG}" ]; then
-            FSTAB_RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-2])|([0-9]{1,2}-stable-build-[0-9]{1,3})|(current-build)-([0-9]{1,3})|(current-BUILD-LATEST)|([0-9]{1,2}-stable-BUILD-LATEST)|(current-BUILD-LATEST)' "${FSTAB_CONFIG}")
+            FSTAB_RELEASE=$(grep -owE '([1-9]{2,2})\.[0-9](-RELEASE|-RC[1-9])|([0-9]{1,2}-stable-build-[0-9]{1,3})|(current-build)-([0-9]{1,3})|(current-BUILD-LATEST)|([0-9]{1,2}-stable-BUILD-LATEST)|(current-BUILD-LATEST)' "${FSTAB_CONFIG}")
             FSTAB_CURRENT=$(grep -w ".*/releases/.*/jails/${TARGET}/root/.bastille" "${FSTAB_CONFIG}")
             FSTAB_NEWCONF="${bastille_releasesdir}/${FSTAB_RELEASE} ${bastille_jailsdir}/${NEWNAME}/root/.bastille nullfs ro 0 0"
             if [ -n "${FSTAB_CURRENT}" ] && [ -n "${FSTAB_NEWCONF}" ]; then
@@ -105,7 +105,7 @@ update_fstab() {
 change_name() {
     # Attempt container name change
     info "Attempting to rename '${TARGET}' to ${NEWNAME}..."
-    if [ "${bastille_zfs_enable}" = "YES" ]; then
+    if checkyesno bastille_zfs_enable; then
         if [ -n "${bastille_zfs_zpool}" ] && [ -n "${bastille_zfs_prefix}" ]; then
             # Check and rename container ZFS dataset accordingly
             # Perform additional checks in case of non-ZFS existing containers

usr/local/share/bastille/setup.sh

@@ -57,6 +57,19 @@ configure_vnet() {
 
     info "Bringing up new interface: bastille1"
     service netif cloneup
+
+    if [ ! -f /etc/devfs.rules ]; then
+        info "Creating bastille_vnet devfs.rules"
+        cat << EOF > /etc/devfs.rules
+[bastille_vnet=13]
+add include \$devfsrules_hide_all
+add include \$devfsrules_unhide_basic
+add include \$devfsrules_unhide_login
+add include \$devfsrules_jail
+add include \$devfsrules_jail_vnet
+add path 'bpf*' unhide
+EOF
+    fi
 }
 
 # Configure pf firewall
@@ -93,17 +106,19 @@ fi
 
 # Configure ZFS
 configure_zfs() {
-    if [ ! "$(kldstat -q -m zfs)" ]; then
+    if [ ! "$(kldstat -m zfs)" ]; then
         info "ZFS module not loaded; skipping..."
     else
+        ## attempt to determine bastille_zroot from `zpool list`
         bastille_zroot=$(zpool list | grep -v NAME | awk '{print $1}')
         sysrc -f "${bastille_prefix}/bastille.conf" bastille_zfs_enable=YES
         sysrc -f "${bastille_prefix}/bastille.conf" bastille_zfs_zpool="${bastille_zroot}"
     fi
 }
 
-# Run all functions if no args (default)
+# Run all base functions (w/o vnet) if no args
 if [ $# -eq 0 ]; then
+    sysrc bastille_enable=YES
     configure_bastille0
     configure_pf
     configure_zfs
@@ -117,10 +132,13 @@ help|-h|--help)
 pf|firewall)
     configure_pf
     ;;
-bastille0|network)
+bastille0|loopback)
     configure_bastille0
     ;;
-zfs)
+zfs|storage)
     configure_zfs
     ;;
+bastille1|vnet|bridge)
+    configure_vnet
+    ;;
 esac

usr/local/share/bastille/update.sh

@@ -118,7 +118,9 @@ release_update() {
         fi
 
         env PAGER="/bin/cat" freebsd-update ${OPTION} --not-running-from-cron -b "${bastille_releasesdir}/${TARGET}" \
-        fetch install --currently-running "${TARGET_TRIM}"
+        fetch --currently-running "${TARGET_TRIM}"
+        env PAGER="/bin/cat" freebsd-update ${OPTION} --not-running-from-cron -b "${bastille_releasesdir}/${TARGET}" \
+        install --currently-running "${TARGET_TRIM}"
     else
         error_exit "${TARGET} not found. See 'bastille bootstrap'."
     fi

usr/local/share/bastille/upgrade.sh

@@ -89,7 +89,7 @@ jail_check() {
 
 release_check() {
     # Validate the release
-    if ! echo "${NEWRELEASE}" | grep -q "[0-9]\{2\}.[0-9]-RELEASE"; then
+    if ! echo "${NEWRELEASE}" | grep -q "[0-9]\{2\}.[0-9]-[RELEASE,BETA,RC]"; then
         error_exit "${NEWRELEASE} is not a valid release."
     fi
 }

usr/local/share/bastille/verify.sh

@@ -157,7 +157,7 @@ fi
 bastille_root_check
 
 case "$1" in
-*-RELEASE|*-release|*-RC1|*-rc1|*-RC2|*-rc2)
+*-RELEASE|*-release|*-RC[1-9]|*-rc[1-9])
     RELEASE=$1
     verify_release
     ;;

usr/local/share/bastille/zfs.sh

@@ -85,7 +85,7 @@ esac
 bastille_root_check
 
 ## check ZFS enabled
-if [ ! "${bastille_zfs_enable}" = "YES" ]; then
+if ! checkyesno bastille_zfs_enable; then
     error_exit "ZFS not enabled."
 fi