slash check added

netmask checking for jail ip
rdr disable directive fix
2023-10-17 12:35:25 -07:00 · 2023-10-17 08:52:32 -07:00 · 2023-10-04 10:13:08 -07:00 · 2023-07-14 21:59:49 -06:00 · 2023-07-14 21:53:02 -06:00 · 2023-07-14 21:35:18 -06:00
52 changed files with 1055 additions and 320 deletions
--- a/2
+++ b/2
@@ -1,6 +1,6 @@
 BSD 3-Clause License

-Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 All rights reserved.

 Redistribution and use in source and binary forms, with or without
--- a/8
+++ b/8
@@ -1,3 +1,5 @@
+BASTILLE_VERSION=$$(git rev-parse HEAD)
+
 .PHONY: all
 all:
 	@echo "Nothing to be done. Please use make install or make uninstall"
@@ -5,9 +7,13 @@ all:
 install:
 	@echo "Installing Bastille"
 	@echo
+	@echo "Updating Bastille version to match git revision."
+	@echo "BASTILLE_VERSION: ${BASTILLE_VERSION}"
+	@sed -i.orig "s/BASTILLE_VERSION=.*/BASTILLE_VERSION=${BASTILLE_VERSION}/" usr/local/bin/bastille
 	@cp -Rv usr /
 	@echo
-	@echo "This method is for testing / development."
+	@echo "This method is for testing & development."
+	@echo "Please report any issues to https://github.com/BastilleBSD/bastille/issues"

 .PHONY: uninstall
 uninstall:
--- a/README.md
+++ b/README.md
@@ -39,7 +39,7 @@ Bastille is an open-source system for automating deployment and management of
 containerized applications on FreeBSD.

 Usage:
-  bastille command TARGET args
+  bastille command TARGET [args]

 Available Commands:
  bootstrap   Bootstrap a FreeBSD release for container base.
@@ -47,31 +47,33 @@ Available Commands:
  cmd         Execute arbitrary command on targeted container(s).
  config      Get or set a config value for the targeted container(s).
  console     Console into a running container.
-  convert     Convert a thin container into a thick container.
+  convert     Convert a Thin container into a Thick container.
  cp          cp(1) files from host to targeted container(s).
-  create      Create a new thin or thick container.
-  destroy     Destroy a stopped container or a bootstrapped release.
+  create      Create a new thin container or a thick container if -T|--thick option specified.
+  destroy     Destroy a stopped container or a FreeBSD release.
  edit        Edit container configuration files (advanced).
-  export      Exports a container archive or image.
-  help        Help about any command
+  export      Exports a specified container.
+  help        Help about any command.
  htop        Interactive process viewer (requires htop).
-  import      Import a container archive or image.
+  import      Import a specified container.
  limits      Apply resources limits to targeted container(s). See rctl(8).
-  list        List containers, releases, templates, logs, limits or backups.
+  list        List containers (running and stopped).
  mount       Mount a volume inside the targeted container(s).
  pkg         Manipulate binary packages within targeted container(s). See pkg(8).
  rdr         Redirect host port to container port.
+  rename      Rename a container.
  restart     Restart a running container.
  service     Manage services within targeted container(s).
  start       Start a stopped container.
  stop        Stop a running container.
  sysrc       Safely edit rc files within targeted container(s).
-  template    Apply automation templates to targeted container(s).
+  tags        Add or remove tags to targeted container(s).
+  template    Apply file templates to targeted container(s).
  top         Display and update information about the top(1) cpu processes.
  umount      Unmount a volume from within the targeted container(s).
  update      Update container base -pX release.
  upgrade     Upgrade container release to X.Y-RELEASE.
-  verify      Verify bootstrapped release or automation template.
+  verify      Compare release against a "known good" index.
  zfs         Manage (get|set) ZFS attributes on targeted container(s).

 Use "bastille -v|--version" for version information.
@@ -182,7 +184,7 @@ The `rdr-anchor "rdr/*"` enables dynamic rdr rules to be setup using the
  bastille rdr <jail> clear       # Clear dynamic rdr rules
 ```

-  Note that if you are rediirecting ports where the host is also listening
+  Note that if you are redirecting ports where the host is also listening
  (eg. ssh) you should make sure that the host service is not listening on
  the cloned interface - eg. for ssh set sshd_flags in rc.conf

@@ -236,8 +238,8 @@ not using ZFS and can safely ignore these settings.
 bastille bootstrap
 ------------------
 Before you can begin creating containers, Bastille needs to "bootstrap" a
-release.  Current supported releases are 11.4-RELEASE, 12.2-RELEASE and
-13.0-RELEASE.
+release.  Current supported releases are 12.3-RELEASE, 12.4-RELEASE and
+13.1-RELEASE.

 **Important: If you need ZFS support see the above section BEFORE
 bootstrapping.**
@@ -245,14 +247,14 @@ bootstrapping.**
 To `bootstrap` a release, run the bootstrap sub-command with the
 release version as the argument.

-**FreeBSD 11.4-RELEASE**
+**FreeBSD 12.4-RELEASE**
 ```shell
-ishmael ~ # bastille bootstrap 11.4-RELEASE
+ishmael ~ # bastille bootstrap 12.4-RELEASE
 ```

-**FreeBSD 12.2-RELEASE**
+**FreeBSD 13.1-RELEASE**
 ```shell
-ishmael ~ # bastille bootstrap 12.2-RELEASE
+ishmael ~ # bastille bootstrap 13.1-RELEASE
 ```

 **HardenedBSD 11-STABLE-BUILD-XX**
@@ -380,7 +382,7 @@ Valid: (em0).
 NAME: vnettest0.
 IP: 192.168.87.55/24.
 INTERFACE: em0.
-RELEASE: 12.1-RELEASE.
+RELEASE: 12.2-RELEASE.

 syslogd_flags: -s -> -ss
 sendmail_enable: NO -> NONE
--- a/docs/chapters/gcp.rst
+++ b/docs/chapters/gcp.rst
@@ -0,0 +1,93 @@
+Bastille VNET on GCP
+====================
+
+Bastille VNET runs on GCP with a few small tweaks. In summary, they are:
+
+- change MTU setting in jib script
+- add an IP address to the bridge interface
+- configure host pf to NAT and allow bridge traffic
+- set defaultrouter and nameserver in the host
+
+## Change MTU in the jib script
+
+GCP uses ``vtnet`` with MTU 1460, which [jib fails on](https://github.com/BastilleBSD/bastille/issues/538).
+
+Apply the below patch to set the correct MTU. You may need to ``cp /usr/share/examples/jails/jib /usr/local/bin/`` first.
+
+``patch /usr/local/bin/jib jib.patch``
+
+.. code-block:: text
+  --- /usr/local/bin/jib	2022-07-31 03:27:04.163245000 +0000
+  +++ jib.fixed	2022-07-31 03:41:16.710401000 +0000
+  @@ -299,14 +299,14 @@
+   
+   		# Make sure the interface has been bridged
+   		if ! ifconfig "$iface$bridge" > /dev/null 2>&1; then
+  -			new=$( ifconfig bridge create ) || return
+  +			new=$( ifconfig bridge create mtu 1460 ) || return
+   			ifconfig $new addm $iface || return
+   			ifconfig $new name "$iface$bridge" || return
+   			ifconfig "$iface$bridge" up || return
+   		fi
+   
+   		# Create a new interface to the bridge
+  -		new=$( ifconfig epair create ) || return
+  +		new=$( ifconfig epair create mtu 1460 ) || return
+   		ifconfig "$iface$bridge" addm $new || return
+   
+   		# Rename the new interface
+
+## Configure bridge interface
+
+Configure the bridge interface in /etc/rc.conf so it is available in the firewall rules.
+
+.. code-block:: shell
+  sysrc cloned_interfaces="bridge0"
+  sysrc ifconfig_bridge0="inet 192.168.1.1/24 mtu 1460 addm vtnet0 name vtnet0bridge up"
+  sysrc gateway_enable="yes"
+  sysrc pf_enable="yes"
+
+## Configure host pf
+
+This basic /etc/pf.conf allow incoming packets on the bridge interface, and NATs them through the external interface:
+
+.. code-block:: text
+  ext_if="vtnet0"
+  bridge_if="vtnet0bridge"
+  
+  set skip on lo
+  scrub in
+
+  # permissive NAT allows jail bridge and wireguard tunnels
+  nat on $ext_if inet from !($ext_if) -> ($ext_if:0)
+  
+  block in
+  pass out
+  
+  pass in proto tcp to port {22}
+  pass in inet proto icmp icmp-type { echoreq }
+  pass in on $bridge_if
+
+Restart the host and make sure everything comes up correctly. You should see the following ifconfig:
+
+.. code-block:: text
+  vtnet0bridge: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1460
+  	ether 58:9c:fc:10:ff:90
+  	inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
+  	id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
+  	maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
+  	root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
+  	member: vtnet0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
+  	        ifmaxaddr 0 port 1 priority 128 path cost 2000
+  	groups: bridge
+
+## Configure router and resolver for new jails
+
+Set the default network gateway for new jails as described in the Networking chapter, and configure a default resolver.
+
+.. code-block:: shell
+  sysrc -f /usr/local/etc/bastille/bastille.conf bastille_network_gateway="192.168.1.1"
+  echo "nameserver 8.8.8.8" > /usr/local/etc/bastille/resolv.conf
+  sysrc -f /usr/local/etc/bastille/bastille.conf bastille_resolv_conf="/usr/local/etc/bastille/resolv.conf"
+
+You can now create a VNET jail with ``bastille create -V myjail 13.1-RELEASE 192.168.1.50/24 vtnet0``
--- a/docs/chapters/installation.rst
+++ b/docs/chapters/installation.rst
@@ -4,7 +4,7 @@ Bastille is available in the official FreeBSD ports tree at
 `sysutils/bastille`. Binary packages available in `quarterly` and `latest`
 repositories.

-Current version is `0.9.20220714`.
+Current version is `0.10.20230714`.

 To install from the FreeBSD package repository:

--- a/docs/chapters/networking.rst
+++ b/docs/chapters/networking.rst
@@ -1,36 +1,41 @@
 Network Requirements
 ====================
 Here's the scenario. You've installed Bastille at home or in the cloud and want
-to get started putting applications in secure little containers, but how do I
-get these containers on the network?
+to get started putting applications in secure little containers, but how do you
+get these containers on the network?  Bastille tries to be flexible about how to 
+network containerized applications.   Four methods are described here.  

-Bastille tries to be flexible about how to network containerized applications.
-Three methods are described here. Consider each options when deciding
-which design work best for your needs. One of the methods works better in the 
-cloud while the others are simpler if used in local area networks.
+1. Home or Small Office

-**Note: if you are running in the cloud and only have a single public IP you
-may want the Public Network option. See below.**
+2. Cloud with IPV4 and multiple IPV6
+
+3. Could with single IPV4 (internatl bridge)
+
+4. Cloud with a single IPV4 (external bridge) 


-Local Area Network
-==================
-I will cover the local area network (LAN) method first. This method is simpler
-to get going and works well in a home network (or similar) where adding alias
-IP addresses is no problem.
+Please choose the option which is most appropriate for your environment. 

-Shared Interface (IP alias)
---------------------------
-In FreeBSD network interfaces have different names, but look something like
-`em0`, `bge0`, `re0`, etc. On a virtual machine it may be `vtnet0`. You get the
-idea...

-Bastille allows you to define the interface you want the IP attached to when
-you create it. An example:
+First a few notes.  Bastille tries to verify that the interface name you provide is a valid
+interface. In FreeBSD network interfaces have different names, but look something like
+`em0`, `bge0`, `re0`,  `vtnet0` etc. Running the ifconfig commend will tell you the name
+of your existing interfaces. Bastille also checks for a valid syntax IP4 or IP6 address.    
+When you are testing calling out from your containers,  please note that the ping command is disabled within the containers, because raw socket access are a security hole.  Instead I install and test with wget instead. 
+
+Shared Interface on Home or Small Office Network
+================================================
+If you have just one computer, or a home or small office network, 
+where you are separated from the rest of the internet by a router.  So you are free to use
+`private IP addresses <https://www.lifewire.com/what-is-a-private-ip-address-2625970>`.
+
+In this environment, to use Bastille, just create the container, give it a unique private ip address, and attach its ip address to your primary interface.  

 .. code-block:: shell

-  bastille create alcatraz 12.1-RELEASE 192.168.1.50 em0
+  bastille create alcatraz 13.1-RELEASE 192.168.1.50 em0 
+
+You may have to change em0

 When the `alcatraz` container is started it will add `192.168.1.50` as an IP
 alias to the `em0` interface. It will then simply be another member of the
@@ -38,13 +43,53 @@ hosts network. Other networked systems (firewall permitting) should be able to
 reach services at that address.

 This method is the simplest. All you need to know is the name of your network
-interface and a free IP on your current network.
+interface and a free IP on your local network.
+
+Shared Interface on IPV6 network (vultr.com)
+=======================================
+Some ISP's, such as `vultr.com <https://Vultr.com>`, give you a single ipv4 address, and a large block of ipv6 addresses. You can then assign a unique ipv6 address to each Bastille Container.  
+
+On a virtual machine such as vultr.com the virtual interface may be `vtnet0`. 
+So we issue the command:
+
+.. code-block:: shell
+
+ bastille create alcatraz 13.1-RELEASE  2001:19f0:6c01:114c::100 vtnet0
+
+We could also write the ipv6 address as 2001:19f0:6c01:114c:0:100 
+
+The tricky part are the ipv6 addresses. IPV6 is a string of 8 4 digit 
+hexadecimal characters.  At vultr they said:
+
+Your server was assigned the following six section subnet:
+
+2001:19f0:6c01:114c:: / 64
+
+The `vultr ipv6 subnet calculator <https://www.vultr.com/resources/subnet-calculator-ipv6/?prefix_length=64&display=long&ipv6_address=2001%3Adb8%3Aacad%3Ae%3A%3A%2F64>` is helpful in making sense of that ipv6 address. 
+
+We could have also written that IPV6 address as 2001:19f0:6c01:114c:0:0 
+
+Where the /64 basicaly means that the first 64 bits of the address (4x4 character hexadecimal) values define the network, and the remaining characters, we can assign as we want to the Bastille Container. In the actual bastille create command given above, it was defined to be 100.   But we also have to tell the host operating system that we are now using this address.  This is done on freebsd with the following command
+
+.. code-block:: shell
+
+  ifconfig_vtnet0_alias0="inet6 2001:19f0:6c01:114c::100  prefixlen 64"
+
+At that point your container can talk to the world, and the world can ping your container.  Of course when you reboot the machine, that command will be forgotten  To make it permanent, 
+you have to add it to the file /etc/rc.conf
+
+Just remember you cannot ping out from the container. Instead I installed and used wget to test the connectivity. 
+
+Use the bastille pkg command to install wget. 
+
+.. code-block:: shell
+
+   bastille pkg alcatraz install wget
+

-Bastille tries to verify that the interface name you provide it is a valid
-interface. It also checks for a valid syntax IP4 or IP6 address.

 Virtual Network (VNET)
----------------------
+========================
 (Added in 0.6.x) VNET is supported on FreeBSD 12+ only.

 Virtual Network (VNET) creates a private network interface for a container.
@@ -56,7 +101,7 @@ external interface.

 .. code-block:: shell

-  bastille create -V azkaban 12.1-RELEASE 192.168.1.50/24 em0
+  bastille create -V azkaban 13.1-RELEASE 192.168.1.50/24 em0

 Bastille will automagically create the bridge interface and connect /
 disconnect containers as they are started and stopped. A new interface will be
@@ -110,13 +155,13 @@ This config change will apply the defined gateway to any new containers.
 Existing containers will need to be manually updated.

 Virtual Network (VNET) on External Bridge
--------------------------------------
+=======================================
 To create a VNET based container and attach it to an external, already existing bridge, use the `-B` option, an IP/netmask and
 external bridge.

 .. code-block:: shell

-  bastille create -B azkaban 12.1-RELEASE 192.168.1.50/24 bridge0
+  bastille create -B azkaban 13.1-RELEASE 192.168.1.50/24 bridge0

 Bastille will automagically create the interface, attach it to the specified bridge and connect /
 disconnect containers as they are started and stopped. 
@@ -124,17 +169,18 @@ The bridge needs to be created/enabled before creating and starting the jail.

 Public Network
 ==============
-In this section I'll describe how to network containers in a public network
-such as a cloud hosting provider (AWS, digital ocean, vultr, etc)
+In this section we describe how to network containers in a public network
+such as a cloud hosting provider who only provides you with a single ip address. 
+(AWS, digital ocean, etc)  (The exception is vultr.com, which does 
+provide you with lots of IPV6 addresses and does a great job supporting FreeBSD!)  

-In the public cloud you don't often have access to multiple private IP
-addresses for your virtual machines. This means if you want to create multiple
-containers and assign them all IP addresses, you'll need to create a new
+So if you only have a single IP address and if you want to create multiple
+containers and assign them all unique IP addresses, you'll need to create a new
 network.

 loopback (bastille0)
 --------------------
-What I recommend is creating a cloned loopback interface (`bastille0`) and
+What we recommend is creating a cloned loopback interface (`bastille0`) and
 assigning all the containers private (rfc1918) addresses on that interface. The
 setup I develop on and use Bastille day-to-day uses the `10.0.0.0/8` address
 range. I have the ability to use whatever address I want within that range
--- a/docs/chapters/subcommands/bootstrap.rst
+++ b/docs/chapters/subcommands/bootstrap.rst
@@ -27,8 +27,8 @@ release version as the argument.

 .. code-block:: shell

-  ishmael ~ # bastille bootstrap 11.4-RELEASE [update]
-  ishmael ~ # bastille bootstrap 12.1-RELEASE
+  ishmael ~ # bastille bootstrap 12.3-RELEASE [update]
+  ishmael ~ # bastille bootstrap 13.1-RELEASE

 To `bootstrap` a HardenedBSD release, run the bootstrap sub-command with the
 build version as the argument.
--- a/docs/chapters/subcommands/export.rst
+++ b/docs/chapters/subcommands/export.rst
@@ -16,4 +16,16 @@ can be exported only when the jail is not running.

 .. code-block:: shell

-  Usage: bastille export TARGET
+  Usage:  bastille export | option(s) | TARGET | PATH
+
+Available options are:
+
+.. code-block:: shell
+
+         --gz       -- Export a ZFS jail using GZIP(.gz) compressed image.
+    -r | --raw      -- Export a ZFS jail to an uncompressed RAW image.
+    -s | --safe     -- Safely stop and start a ZFS jail before the exporting process.
+         --tgz      -- Export a jail using simple .tgz compressed archive instead.
+         --txz      -- Export a jail using simple .txz compressed archive instead.
+    -v | --verbose  -- Be more verbose during the ZFS send operation.
+         --xz       -- Export a ZFS jail using XZ(.xz) compressed image.
--- a/docs/chapters/subcommands/upgrade.rst
+++ b/docs/chapters/subcommands/upgrade.rst
@@ -7,4 +7,4 @@ workflow this can be similar to a `bootstrap`.

 .. code-block:: shell

-  ishmael ~ # bastille upgrade 12.0-RELEASE 12.1-RELEASE
+  ishmael ~ # bastille upgrade 13.0-RELEASE 13.1-RELEASE
--- a/docs/chapters/targeting.rst
+++ b/docs/chapters/targeting.rst
@@ -42,7 +42,7 @@ Examples: Containers
 +----+------+----+---+------------------+--------------+----------------------------------------------+
 | cp | bastion03 | /tmp/resolv.conf-cf etc/resolv.conf | copy host-path to container-path in bastion03|
 +----+------+----+---+---------------------------------+----------------------------------------------+
-| create    | folsom | 12.1-RELEASE 10.17.89.10        | create 12.1 container named `folsom` with IP |
+| create    | folsom | 13.1-RELEASE 10.17.89.10        | create 13.1 container named `folsom` with IP |
 +-----------+--------+---------------------------------+----------------------------------------------+


@@ -56,7 +56,7 @@ Examples: Releases
 +-----------+--------------+--------------+-------------------------------------------------------------+
 | command   | target       | args         | description                                                 |
 +===========+==============+==============+=============================================================+
-| bootstrap | 12.1-RELEASE | ---          | bootstrap 12.1-RELEASE release                              |
+| bootstrap | 13.1-RELEASE | ---          | bootstrap 13.1-RELEASE release                              |
 +-----------+--------------+--------------+-------------------------------------------------------------+
 | update    | 11.4-RELEASE | ---          | update 11.4-RELEASE release                                 |
 +-----------+--------------+--------------+-------------------------------------------------------------+
--- a/docs/chapters/template.rst
+++ b/docs/chapters/template.rst
@@ -1,8 +1,7 @@
 ========
 Template
 ========
-Looking for ready made CI/CD validated [Bastille
-Templates](https://gitlab.com/BastilleBSD-Templates)?
+Looking for ready made CI/CD validated `Bastille Templates`_?

 Bastille supports a templating system allowing you to apply files, pkgs and
 execute commands inside the containers automatically.
@@ -139,3 +138,5 @@ directory names in the `bastille/templates` directory.
  Executing final command(s).
  chsh: user information updated
  Template Complete.
+
+.. _Bastille Templates: https://gitlab.com/BastilleBSD-Templates
--- a/docs/chapters/upgrading.rst
+++ b/docs/chapters/upgrading.rst
@@ -0,0 +1,39 @@
+=========
+Upgrading
+=========
+This document outlines upgrading jails hosted using Bastille.
+
+Bastille can "bootstrap" multiple versions of FreeBSD to be used by jails. All jails do not NEED to be the same version (even if they often are), the only requirement here is that the "bootstrapped" versions are less than or equal to the host version of FreeBSD.
+
+To upgrade Bastille jails for a minor release (ie; 13.1→13.2) you can do the following:
+
+1. ensure the new release version is bootstrapped and updated to the latest patch release: `bastille bootstrap 13.2-RELEASE update`
+2. stop the jail(s) that need to be updated.
+3. use `bastille edit TARGET fstab` to manually update the jail mounts from 13.1 to 13.2 release path.
+4. start the jail(s) that were edited
+5. upgrade complete!
+
+To upgrade Bastille jails for a major release (ie; 12.4→13.2) you can do the following:
+
+1. ensure the new version is bootstrapped and update to the latest patch release: `bastille bootstrap 13.2-RELEASE update`
+2. stop the jail(s) that need to be updated.
+3. use `bastille edit TARGET fstab` to manually update the jail mounts from 12.4 to 13.2 release path.
+4. start the jail(s) that were edited
+5. Force the reinstallation or upgrade of all installed packages (ABI change): `pkg upgrade -f` within each jail (or `bastille pkg ALL upgrade -f`)
+6. restart the affected jail(s)
+7. upgrade complete!
+
+Revert Upgrade / Downgrade Process
+----------------------------------
+The downgrade process (not usually needed) is similar to the upgrade process only in reverse.
+
+If you did a minor upgrade changing the release path from 13.1 to 13.2, stop the jail and revert that change. Downgrade complete.
+
+If you did a major upgrade changing the release path from 12.4 to 13.2, stop the jail and revert that change. The pkg reinstallation will also need to be repeated after the jail restarts on the previous release.
+
+Old Releases
+----------------------------------
+After upgrading all jails from one release to the next you may find that you now have bootstrapped a release that is no longer used. Once you've decided that you no longer need the option to revert the change you can destroy the old release.
+
+`bastille list releases` to list all bootstrapped releases.
+`bastille destroy X.Y-RELEASE` to fully delete the release. 
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -8,13 +8,13 @@ else:
 # -- Project information -----------------------------------------------------

 project = 'Bastille'
-copyright = '2018-2022, Christer Edwards'
+copyright = '2018-2023, Christer Edwards'
 author = 'Christer Edwards'

 # The short X.Y version
-version = '0.9.20220714'
+version = '0.10.20230714'
 # The full version, including alpha/beta/rc tags
-release = '0.9.20220714-beta'
+release = '0.10.20230714-beta'


 # -- General configuration ---------------------------------------------------
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -12,6 +12,7 @@ https://docs.bastillebsd.org.
   :caption: Contents:

   chapters/installation
+   chapters/upgrading
   chapters/networking
   chapters/usage
   chapters/targeting
@@ -19,6 +20,7 @@ https://docs.bastillebsd.org.
   chapters/template
   chapters/jail-config
   chapters/zfs-support
+   chapters/gcp

   copyright

--- a/usr/local/bin/bastille
+++ b/usr/local/bin/bastille
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -32,17 +32,6 @@ PATH=${PATH}:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin

 . /usr/local/share/bastille/common.sh

-## root check first.
-bastille_root_check() {
-    if [ "$(id -u)" -ne 0 ]; then
-        ## permission denied
-        error_notify "Bastille: Permission Denied"
-        error_exit "root / sudo / doas required"
-    fi
-}
-
-bastille_root_check
-
 ## check for config existance
 bastille_conf_check() {
    if [ ! -r "/usr/local/etc/bastille/bastille.conf" ]; then
@@ -54,6 +43,9 @@ bastille_conf_check

 ## we only load the config if conf_check passes
 . /usr/local/etc/bastille/bastille.conf
+# Set default values for config properties added during the current major version:
+: "${bastille_network_pf_ext_if:=ext_if}"
+: "${bastille_network_pf_table:=jails}"

 ## bastille_prefix should be 0750
 ## this restricts file system access to privileged users
@@ -70,7 +62,7 @@ bastille_perms_check() {
 bastille_perms_check

 ## version
-BASTILLE_VERSION="0.9.20220714"
+BASTILLE_VERSION="0.10.20230714"

 usage() {
    cat << EOF
@@ -82,8 +74,8 @@ Usage:

 Available Commands:
  bootstrap   Bootstrap a FreeBSD release for container base.
-  cmd         Execute arbitrary command on targeted container(s).
  clone       Clone an existing container.
+  cmd         Execute arbitrary command on targeted container(s).
  config      Get or set a config value for the targeted container(s).
  console     Console into a running container.
  convert     Convert a Thin container into a Thick container.
@@ -106,6 +98,7 @@ Available Commands:
  start       Start a stopped container.
  stop        Stop a running container.
  sysrc       Safely edit rc files within targeted container(s).
+  tags        Add or remove tags to targeted container(s).
  template    Apply file templates to targeted container(s).
  top         Display and update information about the top(1) cpu processes.
  umount      Unmount a volume from within the targeted container(s).
@@ -126,6 +119,23 @@ EOF
 CMD=$1
 shift

+target_all_jails() {
+  _JAILS=$(/usr/sbin/jls name)
+  JAILS=""
+  for _jail in ${_JAILS}; do
+      _JAILPATH=$(/usr/sbin/jls -j "${_jail}" path)
+      if [ -z ${_JAILPATH##${bastille_jailsdir}*} ]; then
+          JAILS="${JAILS} ${_jail}"
+      fi
+  done
+}
+
+check_target_is_running() {
+  if [ ! "$(/usr/sbin/jls name | awk "/^${TARGET}$/")" ]; then
+      error_exit "[${TARGET}]: Not started. See 'bastille start ${TARGET}'."
+  fi
+}
+
 # Handle special-case commands first.
 case "${CMD}" in
 version|-v|--version)
@@ -135,10 +145,10 @@ version|-v|--version)
 help|-h|--help)
    usage
    ;;
-bootstrap|create|destroy|export|import|list|rdr|restart|start|update|upgrade|verify)
+bootstrap|create|destroy|export|import|list|rdr|restart|setup|start|update|upgrade|verify)
    # Nothing "extra" to do for these commands. -- cwells
    ;;
-clone|config|cmd|console|convert|cp|edit|htop|limits|mount|pkg|rename|service|stop|sysrc|template|top|umount|zfs)
+clone|config|cmd|console|convert|cp|edit|htop|limits|mount|pkg|rename|service|stop|sysrc|tags|template|top|umount|zfs)
    # Parse the target and ensure it exists. -- cwells
    if [ $# -eq 0 ]; then # No target was given, so show the command's help. -- cwells
        PARAMS='help'
@@ -147,24 +157,17 @@ clone|config|cmd|console|convert|cp|edit|htop|limits|mount|pkg|rename|service|st
        shift

        if [ "${TARGET}" = 'ALL' ]; then
-            _JAILS=$(/usr/sbin/jls name)
-            JAILS=""
-            for _jail in ${_JAILS}; do
-                _JAILPATH=$(/usr/sbin/jls -j "${_jail}" path)
-                if [ -z ${_JAILPATH##${bastille_jailsdir}*} ]; then
-                    JAILS="${JAILS} ${_jail}"
-                fi
-            done
+            target_all_jails
        elif [ "${CMD}" = "pkg" ] && [ "${TARGET}" = '-H' ] || [ "${TARGET}" = '--host' ]; then
            TARGET="${1}"
            USE_HOST_PKG=1
-            JAILS="${TARGET}"
-            shift
-
-            # Require the target to be running
-            if [ ! "$(/usr/sbin/jls name | awk "/^${TARGET}$/")" ]; then
-                error_exit "[${TARGET}]: Not started. See 'bastille start ${TARGET}'."
+            if [ "${TARGET}" = 'ALL' ]; then
+              target_all_jails
+            else
+              JAILS="${TARGET}"
+              check_target_is_running
            fi
+            shift
        elif [ "${CMD}" = 'template' ] && [ "${TARGET}" = '--convert' ]; then
            # This command does not act on a jail, so we are temporarily bypassing the presence/started
            # checks. The command will simply convert a template from hooks to a Bastillefile. -- cwells
@@ -178,10 +181,7 @@ clone|config|cmd|console|convert|cp|edit|htop|limits|mount|pkg|rename|service|st

            case "${CMD}" in
            cmd|console|htop|pkg|service|stop|sysrc|template|top)
-                # Require the target to be running. -- cwells
-                if [ ! "$(/usr/sbin/jls name | awk "/^${TARGET}$/")" ]; then
-                    error_exit "[${TARGET}]: Not started. See 'bastille start ${TARGET}'."
-                fi
+                check_target_is_running
                ;;
            convert|rename)
                # Require the target to be stopped. -- cwells
--- a/usr/local/etc/bastille/bastille.conf.sample
+++ b/usr/local/etc/bastille/bastille.conf.sample
@@ -11,6 +11,9 @@ bastille_releasesdir="${bastille_prefix}/releases"                    ## default
 bastille_templatesdir="${bastille_prefix}/templates"                  ## default: "${bastille_prefix}/templates"
 bastille_logsdir="/var/log/bastille"                                  ## default: "/var/log/bastille"

+## pf configuration path
+bastille_pf_conf="/etc/pf.conf"                                       ## default: "/etc/pf.conf"
+
 ## bastille scripts directory (assumed by bastille pkg)
 bastille_sharedir="/usr/local/share/bastille"                         ## default: "/usr/local/share/bastille"

@@ -32,7 +35,7 @@ bastille_resolv_conf="/etc/resolv.conf"                               ## default

 ## bootstrap urls
 bastille_url_freebsd="http://ftp.freebsd.org/pub/FreeBSD/releases/"          ## default: "http://ftp.freebsd.org/pub/FreeBSD/releases/"
-bastille_url_hardenedbsd="http://installer.hardenedbsd.org/pub/hardenedbsd/" ## default: "https://installer.hardenedbsd.org/pub/HardenedBSD/releases/"
+bastille_url_hardenedbsd="https://installers.hardenedbsd.org/pub/" ## default: "https://installer.hardenedbsd.org/pub/HardenedBSD/releases/"
 bastille_url_midnightbsd="https://www.midnightbsd.org/ftp/MidnightBSD/releases/"          ## default: "https://www.midnightbsd.org/pub/MidnightBSD/releases/"

 ## ZFS options
@@ -49,6 +52,8 @@ bastille_decompress_gz_options="-k -d -c -v"                          ## default

 ## Networking
 bastille_network_loopback="bastille0"                                 ## default: "bastille0"
+bastille_network_pf_ext_if="ext_if"                                   ## default: "ext_if"
+bastille_network_pf_table="jails"                                     ## default: "jails"
 bastille_network_shared=""                                            ## default: ""
 bastille_network_gateway=""                                           ## default: ""
 bastille_network_gateway6=""                                          ## default: ""
--- a/usr/local/etc/rc.d/bastille
+++ b/usr/local/etc/rc.d/bastille
@@ -51,7 +51,9 @@ bastille_stop()

    local _jail

-    for _jail in ${bastille_list}; do
+    ## reverse order of list for shutdown ## fixes #389
+    bastille_revlist=$(echo "${bastille_list}" | awk '{ for (i=NF; i>1; i--) printf("%s ",$i); print $1; }')
+    for _jail in ${bastille_revlist}; do
        echo "Stopping Bastille Container: ${_jail}"
        ${command} stop ${_jail}
    done
--- a/usr/local/man/man8/bastille.8.gz
+++ b/usr/local/man/man8/bastille.8.gz
--- a/usr/local/share/bastille/bootstrap.sh
+++ b/usr/local/share/bastille/bootstrap.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -42,6 +42,8 @@ help|-h|--help)
    ;;
 esac

+bastille_root_check
+
 #Validate if ZFS is enabled in rc.conf and bastille.conf.
 if [ "$(sysrc -n zfs_enable)" = "YES" ] && [ ! "${bastille_zfs_enable}" = "YES" ]; then
    warn "ZFS is enabled in rc.conf but not bastille.conf. Do you want to continue? (N|y)"
@@ -397,7 +399,7 @@ debootstrap_release() {
    fi

    case "${LINUX_FLAVOR}" in
-        bionic|stretch|buster|bullseye)
+        bionic|focal|jammy|buster|bullseye|bookworm)
        info "Increasing APT::Cache-Start"
        echo "APT::Cache-Start 251658240;" > "${bastille_releasesdir}"/${DIR_BOOTSTRAP}/etc/apt/apt.conf.d/00aptitude
        ;;
@@ -425,7 +427,7 @@ bootstrap_template() {
    ## define basic variables
    _url=${BASTILLE_TEMPLATE_URL}
    _user=${BASTILLE_TEMPLATE_USER}
-    _repo=${BASTILLE_TEMPLATE_REPO}
+    _repo=${BASTILLE_TEMPLATE_REPO%.*} # Remove the trailing ".git"
    _template=${bastille_templatesdir}/${_user}/${_repo}

    ## support for non-git
@@ -514,8 +516,8 @@ case "${1}" in
    ## check for HardenedBSD(latest stable build release)
    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '([0-9]{1,2})(-stable-build-latest)$' | sed 's/STABLE/stable/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
    NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/-BUILD-LATEST//g')
-    NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/[0-9]\{1,2\}-stable-//g')
-    UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
+    NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/[0-9]\{1,2\}-stable-BUILD-//g')
+    UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/installer/${NAME_BUILD}"
    PLATFORM_OS="HardenedBSD"
    validate_release_url
    ;;
@@ -532,8 +534,8 @@ current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST)
    ## check for HardenedBSD(latest current build release)
    NAME_VERIFY=$(echo "${RELEASE}" | grep -iwE '(current-build-latest)' | sed 's/CURRENT/current/g' | sed 's/build/BUILD/g' | sed 's/latest/LATEST/g')
    NAME_RELEASE=$(echo "${NAME_VERIFY}" | sed 's/current-.*/current/g')
-    NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/current-//g')
-    UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/${NAME_BUILD}"
+    NAME_BUILD=$(echo "${NAME_VERIFY}" | sed 's/current-BUILD-//g')
+    UPSTREAM_URL="${bastille_url_hardenedbsd}${NAME_RELEASE}/${HW_MACHINE}/${HW_MACHINE_ARCH}/installer/${NAME_BUILD}"
    PLATFORM_OS="HardenedBSD"
    validate_release_url
    ;;
@@ -543,6 +545,13 @@ http?://*/*/*)
    BASTILLE_TEMPLATE_REPO=$(echo "${1}" | awk -F / '{ print $5 }')
    bootstrap_template
    ;;
+git@*:*/*)
+    BASTILLE_TEMPLATE_URL=${1}
+    git_repository=$(echo "${1}" | awk -F : '{ print $2 }')
+    BASTILLE_TEMPLATE_USER=$(echo "${git_repository}" | awk -F / '{ print $1 }')
+    BASTILLE_TEMPLATE_REPO=$(echo "${git_repository}" | awk -F / '{ print $2 }')
+    bootstrap_template
+    ;;
 #adding Ubuntu Bionic as valid "RELEASE" for POC @hackacad
 ubuntu_bionic|bionic|ubuntu-bionic)
    PLATFORM_OS="Ubuntu/Linux"
@@ -558,10 +567,10 @@ ubuntu_focal|focal|ubuntu-focal)
    ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX}
    debootstrap_release
    ;;
-debian_stretch|stretch|debian-stretch)
-    PLATFORM_OS="Debian/Linux"
-    LINUX_FLAVOR="stretch"
-    DIR_BOOTSTRAP="Debian9"
+ubuntu_jammy|jammy|ubuntu-jammy)
+    PLATFORM_OS="Ubuntu/Linux"
+    LINUX_FLAVOR="jammy"
+    DIR_BOOTSTRAP="Ubuntu_2204"
    ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX}
    debootstrap_release
    ;;
@@ -579,6 +588,13 @@ debian_bullseye|bullseye|debian-bullseye)
    ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX}
    debootstrap_release
    ;;
+debian_bookworm|bookworm|debian-bookworm)
+    PLATFORM_OS="Debian/Linux"
+    LINUX_FLAVOR="bookworm"
+    DIR_BOOTSTRAP="Debian12"
+    ARCH_BOOTSTRAP=${HW_MACHINE_ARCH_LINUX}
+    debootstrap_release
+    ;;
 *)
    usage
    ;;
--- a/usr/local/share/bastille/clone.sh
+++ b/usr/local/share/bastille/clone.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -ne 2 ]; then
    usage
 fi

+bastille_root_check
+
 NEWNAME="${1}"
 IP="${2}"

@@ -68,7 +70,7 @@ validate_ip() {
                    error_exit "Invalid: (${TEST_IP})"
                fi
            done
-            if ifconfig | grep -qw "${TEST_IP}"; then
+            if ifconfig | grep -qwF "${TEST_IP}"; then
                warn "Warning: IP address already in use (${TEST_IP})."
            else
                info "Valid: (${IP})."
@@ -109,7 +111,11 @@ update_jailconf_vnet() {
        if [ -n "${jail_list}" ]; then
            if ! grep -q "e0b_bastille${_num}" "${bastille_jailsdir}"/*/jail.conf; then
                uniq_epair="bastille${_num}"
+                # Update the exec.* with uniq_epair when cloning jails.
                sed -i '' "s|vnet.interface = e0b_bastille.*;|vnet.interface = e0b_${uniq_epair};|" "${JAIL_CONFIG}"
+                sed -i '' "s|exec.prestart += \"jib addm bastille[0-9]|exec.prestart += \"jib addm ${uniq_epair}|" "${JAIL_CONFIG}"
+                sed -i '' "s|exec.prestart += \"ifconfig e0a_bastille[0-9].*|exec.prestart += \"ifconfig e0a_${uniq_epair} description \\\\\"vnet host interface for Bastille jail ${NEWNAME}\\\\\"\";|" "${JAIL_CONFIG}"
+                sed -i '' "s|exec.poststop += \"jib destroy bastille[0-9]\";|exec.poststop += \"jib destroy ${uniq_epair}\";|" "${JAIL_CONFIG}"
                break
            fi
        fi
--- a/usr/local/share/bastille/cmd.sh
+++ b/usr/local/share/bastille/cmd.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -eq 0 ]; then
    usage
 fi

+bastille_root_check
+
 COUNT=0
 RETURN=0

@@ -53,7 +55,7 @@ for _jail in ${JAILS}; do
    COUNT=$(($COUNT+1))
    info "[${_jail}]:"

-    if grep -qw "linsysfs" "${bastille_jailsdir}/${TARGET}/fstab"; then
+    if grep -qw "linsysfs" "${bastille_jailsdir}/${_jail}/fstab"; then
        # Allow executing commands on Linux jails.
        jexec -l -u root "${_jail}" "$@"
    else
--- a/usr/local/share/bastille/common.sh
+++ b/usr/local/share/bastille/common.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -33,12 +33,21 @@ COLOR_GREEN=
 COLOR_YELLOW=
 COLOR_RESET=

+bastille_root_check() {
+    if [ "$(id -u)" -ne 0 ]; then
+        ## permission denied
+        error_notify "Bastille: Permission Denied"
+        error_exit "root / sudo / doas required"
+    fi
+}
+
 enable_color() {
    . /usr/local/share/bastille/colors.pre.sh
 }

-# If "NO_COLOR" environment variable is present, disable output colors.
-if [ -z "${NO_COLOR}" ]; then
+# If "NO_COLOR" environment variable is present, or we aren't speaking to a
+# tty, disable output colors.
+if [ -z "${NO_COLOR}" -a -t 1 ]; then
    enable_color
 fi

--- a/usr/local/share/bastille/config.sh
+++ b/usr/local/share/bastille/config.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -35,6 +35,15 @@ usage() {
    error_exit "Usage: bastille config TARGET get|set propertyName [newValue]"
 }

+# we need jail(8) to parse the config file so it can expand variables etc
+print_jail_conf() {
+
+    # we need to pass a literal \n to jail to get each parameter on its own
+    # line
+    jail -f "$1" -e '
+'
+} 
+
 # Handle special-case commands first.
 case "$1" in
 help|-h|--help)
@@ -46,6 +55,8 @@ if [ $# -eq 1 ] || [ $# -gt 3 ]; then
    usage
 fi

+bastille_root_check
+
 ACTION=$1
 shift

@@ -71,22 +82,39 @@ for _jail in ${JAILS}; do
        continue
    fi

-    ESCAPED_PROPERTY=$(echo "${PROPERTY}" | sed 's/\./\\\./g')
-    MATCH_LINE=$(grep "^[[:blank:]]*${ESCAPED_PROPERTY}[[:blank:]=;]" "${FILE}" 2>/dev/null)
-    MATCH_FOUND=$?
-
    if [ "${ACTION}" = 'get' ]; then
-        if [ "${MATCH_FOUND}" -ne 0 ]; then
-            warn "not set"
-        elif ! echo "${MATCH_LINE}" | grep '=' > /dev/null 2>&1; then
-            echo "enabled"
+        _output=$(
+            print_jail_conf "${FILE}" | awk -F= -v property="${PROPERTY}" '
+                $1 == property {
+                    # note that we have found the property
+                    found = 1;
+                    # check if there is a value for this property
+                    if (NF == 2) {
+                        # remove any quotes surrounding the string
+                        sub(/^"/, "", $2);
+                        sub(/"$/, "", $2);
+                        print $2;
+                    } else {
+                        # no value, just the property name
+                        print "enabled";
+                    }
+                    exit 0;
+                }
+                END {
+                    # if we have not found anything we need to print a special
+                    # string
+                    if (! found) {
+                        print("not set");
+                        #  let the caller know that this is a warn condition
+                        exit(120);
+                    }
+                }'
+            )
+        # check if our output is a warning or regular
+        if [ $? -eq 120 ]; then
+            warn "${_output}"
        else
-            VALUE=$(echo "${MATCH_LINE}" | sed -E 's/.+= *(.+) *;$/\1/' 2>/dev/null)
-            if [ $? -ne 0 ]; then
-                error_notify "Failed to get value."
-            else
-                echo "${VALUE}"
-            fi
+            echo "${_output}"
        fi
    else # Setting the value. -- cwells
        if [ -n "${VALUE}" ]; then
@@ -99,11 +127,40 @@ for _jail in ${JAILS}; do
            LINE="  ${PROPERTY};"
        fi

-        if [ "${MATCH_FOUND}" -ne 0 ]; then # No match, so insert the property at the end. -- cwells
-            echo "$(awk -v line="${LINE}" '$0 == "}" { print line; } 1 { print $0; }' "${FILE}")" > "${FILE}"
-        else # Replace the existing value. -- cwells
-            sed -i '' -E "s/ *${ESCAPED_PROPERTY}[ =;].*/${LINE}/" "${FILE}"
-        fi
+        # add the value to the config file, replacing any existing value or, if
+        # there is none, at the end
+        #
+        # awk doesn't have "inplace" editing so we use a temp file
+        _tmpfile=$(mktemp) || error_exit "unable to set because mktemp failed"
+        cp "${FILE}" "${_tmpfile}" && \
+        awk -F= -v line="${LINE}" -v property="${PROPERTY}" '
+            BEGIN {
+                # build RE as string as we can not expand vars in RE literals
+                prop_re = "^[[:space:]]*" property "[[:space:]]*$";
+            }
+            $1 ~ prop_re && !found {
+                # we already have an entry in the config for this property so
+                # we need to substitute our line here rather than keep the
+                # existing line
+                print(line);
+                # note we have already found the property
+                found = 1;
+                # move onto the next line
+                next;
+            }
+            $1 == "}" {
+                # reached the end of the stanza so if we have not already
+                # added our line we need to do so now
+                if (! found) {
+                    print(line);
+                }
+            }
+            {
+                # print each uninteresting line unchanged
+                print;
+            }
+        ' "${_tmpfile}" > "${FILE}"
+        rm "${_tmpfile}"
    fi
 done

--- a/usr/local/share/bastille/console.sh
+++ b/usr/local/share/bastille/console.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -gt 1 ]; then
    usage
 fi

+bastille_root_check
+
 USER="${1}"

 validate_user() {
--- a/usr/local/share/bastille/convert.sh
+++ b/usr/local/share/bastille/convert.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -ne 0 ]; then
    usage
 fi

+bastille_root_check
+
 convert_symlinks() {
    # Work with the symlinks, revert on first cp error
    if [ -d "${bastille_releasesdir}/${RELEASE}" ]; then
--- a/usr/local/share/bastille/cp.sh
+++ b/usr/local/share/bastille/cp.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -54,6 +54,8 @@ if [ $# -ne 2 ]; then
    usage
 fi

+bastille_root_check
+
 case "${OPTION}" in
    -q|--quiet)
        OPTION="-a"
--- a/usr/local/share/bastille/create.sh
+++ b/usr/local/share/bastille/create.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -69,34 +69,66 @@ validate_name() {
 }

 validate_ip() {
-    IPX_ADDR="ip4.addr"
-    IP6_MODE="disable"
-    ip6=$(echo "${IP}" | grep -E '^(([a-fA-F0-9:]+$)|([a-fA-F0-9:]+\/[0-9]{1,3}$))')
+    ipx_addr="ip4.addr"
+    ip="$1"
+    ip6=$(echo "${ip}" | grep -E '^(([a-fA-F0-9:]+$)|([a-fA-F0-9:]+\/[0-9]{1,3}$)|SLAAC)')
    if [ -n "${ip6}" ]; then
        info "Valid: (${ip6})."
-        IPX_ADDR="ip6.addr"
+        ipx_addr="ip6.addr"
        IP6_MODE="new"
    else
-        local IFS
-        if echo "${IP}" | grep -Eq '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$'; then
-            TEST_IP=$(echo "${IP}" | cut -d / -f1)
-            IFS=.
-            set ${TEST_IP}
-            for quad in 1 2 3 4; do
-                if eval [ \$$quad -gt 255 ]; then
-                    echo "Invalid: (${TEST_IP})"
-                    exit 1
-                fi
-            done
-            if ifconfig | grep -qw "${TEST_IP}"; then
-                warn "Warning: IP address already in use (${TEST_IP})."
-            else
-                info "Valid: (${IP})."
-            fi
+        if [ "${ip}" = "DHCP" ]; then
+            info "Valid: (${ip})."
        else
-            error_exit "Invalid: (${IP})."
+            local IFS
+            if echo "${ip}" | grep -Eq '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))?$'; then
+		CHARACTER="/"
+		TEST_SLASH=$(echo "${ip}"
+		    if echo $TEST_SLASH | grep -q "$CHARACTER"
+                    else
+	                exit 1
+		TEST_MASK=$(echo "${ip}" | cut -d / -f2)
+		    if TEST_MASK=""
+			echo "missing netmask"
+			exit 1
+                TEST_IP=$(echo "${ip}" | cut -d / -f1)
+                IFS=.
+                set ${TEST_IP}
+                for quad in 1 2 3 4; do
+                    if eval [ \$$quad -gt 255 ]; then
+                        echo "Invalid: (${TEST_IP})"
+                        exit 1
+                    fi
+                done
+                if ifconfig | grep -qwF "${TEST_IP}"; then
+                    warn "Warning: IP address already in use (${TEST_IP})."
+                else
+                    info "Valid: (${ip})."
+                fi
+            else
+                error_exit "Invalid: (${ip})."
+            fi
        fi
    fi
+    if echo "${ip}" | grep -qvE '(SLAAC|DHCP|0[.]0[.]0[.]0)'; then
+        if [ "${ipx_addr}" = "ip4.addr" ]; then
+                IP4_ADDR="${ip}"
+                IP4_DEFINITION="${ipx_addr} = ${ip};"
+        else
+                IP6_ADDR="${ip}"
+                IP6_DEFINITION="${ipx_addr} = ${ip};"
+        fi
+    fi
+}
+validate_ips() {
+    IP6_MODE="disable"
+    IP4_DEFINITION=""
+    IP6_DEFINITION=""
+    IP4_ADDR=""
+    IP6_ADDR=""
+    for ip in ${IP}; do
+        validate_ip "${ip}"
+    done
 }

 validate_netif() {
@@ -157,7 +189,8 @@ ${NAME} {
  securelevel = 2;

  interface = ${bastille_jail_conf_interface};
-  ${IPX_ADDR} = ${IP};
+  ${IP4_DEFINITION}
+  ${IP6_DEFINITION}
  ip6 = ${IP6_MODE};
 }
 EOF
@@ -180,7 +213,7 @@ ${NAME} {
  allow.mount.devfs;

  interface = ${bastille_jail_conf_interface};
-  ${IPX_ADDR} = ${IP};
+  ${ipx_addr} = ${IP};
  ip6 = ${IP6_MODE};
 }
 EOF
@@ -479,25 +512,44 @@ create_jail() {

            _gateway=''
            _gateway6=''
-            _ifconfig=SYNCDHCP
-            if [ "${IP}" != "0.0.0.0" ]; then # not using DHCP, so set static address.
-                if [ -n "${ip6}" ]; then
-                    _ifconfig="inet6 ${IP}"
-                else
-                    _ifconfig="inet ${IP}"
-                fi
+            _ifconfig_inet=''
+            _ifconfig_inet6=''
+            if echo "${IP}" | grep -qE '(0[.]0[.]0[.]0|DHCP)'; then
+                # Enable DHCP if requested
+                _ifconfig_inet=SYNCDHCP
+            else
+                # Else apply the default gateway
                if [ -n "${bastille_network_gateway}" ]; then
                    _gateway="${bastille_network_gateway}"
-                elif [ -n "${bastille_network_gateway6}" ]; then
-                    _gateway6="${bastille_network_gateway6}"
                else
-                    if [ -z ${ip6} ]; then
-                        _gateway="$(netstat -4rn | awk '/default/ {print $2}')"
+                    _gateway="$(netstat -rn | awk '/default/ {print $2}')"
+                fi
+            fi
+            # Add IPv4 address (this is empty if DHCP is used)
+            if [ -n "${IP4_ADDR}" ]; then
+                    _ifconfig_inet="${_ifconfig_inet} inet ${IP4_ADDR}"
+            fi
+            # Enable IPv6 if used
+            if [ "${IP6_MODE}" != "disable" ]; then
+                _ifconfig_inet6='inet6 -ifdisabled'
+                if echo "${IP}" | grep -qE 'SLAAC'; then
+                    # Enable SLAAC if requested
+                    _ifconfig_inet6="${_ifconfig_inet6} accept_rtadv"
+                else
+                    # Else apply the default gateway
+                    if [ -n "${bastille_network_gateway6}" ]; then
+                        _gateway6="${bastille_network_gateway6}"
                    else
-                        _gateway="$(netstat -6rn | awk '/default/ {print $2}')"
+                        _gateway6="$(netstat -6rn | awk '/default/ {print $2}')"
                    fi
                fi
            fi
+            # Add IPv6 address (this is empty if SLAAC is used)
+            if [ -n "${IP6_ADDR}" ]; then
+                    _ifconfig_inet6="${_ifconfig_inet6} ${IP6_ADDR}"
+            fi
+            # Join together IPv4 and IPv6 parts of ifconfig
+            _ifconfig="${_ifconfig_inet} ${_ifconfig_inet6}"
            bastille template "${NAME}" ${bastille_template_vnet} --arg BASE_TEMPLATE="${bastille_template_base}" --arg HOST_RESOLV_CONF="${bastille_resolv_conf}" --arg EPAIR="${uniq_epair}" --arg GATEWAY="${_gateway}" --arg GATEWAY6="${_gateway6}" --arg IFCONFIG="${_ifconfig}"
        fi
    elif [ -n "${THICK_JAIL}" ]; then
@@ -545,6 +597,8 @@ help|-h|--help)
    ;;
 esac

+bastille_root_check
+
 if echo "$3" | grep '@'; then
    BASTILLE_JAIL_IP=$(echo "$3" | awk -F@ '{print $2}')
    BASTILLE_JAIL_INTERFACES=$( echo "$3" | awk -F@ '{print $1}')
@@ -638,9 +692,9 @@ if [ -n "${LINUX_JAIL}" ]; then
        ## check for FreeBSD releases name
        NAME_VERIFY=ubuntu_focal
        ;;
-    debian_stretch|stretch|debian-stretch)
+    jammy|ubuntu_jammy|ubuntu-jammy)
        ## check for FreeBSD releases name
-        NAME_VERIFY=stretch
+        NAME_VERIFY=ubuntu_jammy
        ;;
    debian_buster|buster|debian-buster)
        ## check for FreeBSD releases name
@@ -650,6 +704,10 @@ if [ -n "${LINUX_JAIL}" ]; then
        ## check for FreeBSD releases name
        NAME_VERIFY=bullseye
        ;;
+    debian_bookworm|bookworm|debian-bookworm)
+        ## check for FreeBSD releases name
+        NAME_VERIFY=bookworm
+        ;;
    *)
        error_notify "Unknown Linux."
        usage
@@ -710,8 +768,9 @@ if [ -z "${EMPTY_JAIL}" ]; then
        NAME_VERIFY=Ubuntu_2004
        validate_release
        ;;
-    debian_stretch|stretch|debian-stretch)
-        NAME_VERIFY=Debian9
+    ubuntu_jammy|jammy|ubuntu-jammy)
+        UBUNTU="1"
+        NAME_VERIFY=Ubuntu_2204
        validate_release
        ;;
    debian_buster|buster|debian-buster)
@@ -722,6 +781,10 @@ if [ -z "${EMPTY_JAIL}" ]; then
        NAME_VERIFY=Debian11
        validate_release
        ;;
+    debian_bookworm|bookworm|debian-bookworm)
+        NAME_VERIFY=Debian12
+        validate_release
+        ;;
    *)
        error_notify "Unknown Release."
        usage
@@ -740,7 +803,7 @@ if [ -z "${EMPTY_JAIL}" ]; then

    ## check if ip address is valid
    if [ -n "${IP}" ]; then
-        validate_ip
+        validate_ips
    else
        usage
    fi
--- a/usr/local/share/bastille/destroy.sh
+++ b/usr/local/share/bastille/destroy.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -210,6 +210,8 @@ if [ $# -gt 1 ] || [ $# -lt 1 ]; then
    usage
 fi

+bastille_root_check
+
 ## check what should we clean
 case "${TARGET}" in
 *-CURRENT|*-CURRENT-I386|*-CURRENT-i386|*-current)
@@ -247,14 +249,14 @@ current-build-latest|current-BUILD-LATEST|CURRENT-BUILD-LATEST)
    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(current-build-latest)$' | sed 's/CURRENT/current/;s/build/BUILD/g;s/latest/LATEST/g')
    destroy_rel
    ;;
-Ubuntu_1804|Ubuntu_2004|UBUNTU_1804|UBUNTU_2004)
+Ubuntu_1804|Ubuntu_2004|Ubuntu_2204|UBUNTU_1804|UBUNTU_2004|UBUNTU_2204)
    ## check for Linux releases
-    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(Ubuntu_1804)$|(Ubuntu_2004)$' | sed 's/UBUNTU/Ubuntu/g;s/ubuntu/Ubuntu/g')
+    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(Ubuntu_1804)$|(Ubuntu_2004)$|(Ubuntu_2204)$' | sed 's/UBUNTU/Ubuntu/g;s/ubuntu/Ubuntu/g')
    destroy_rel
    ;;
-Debian9|Debian10|Debian11|DEBIAN9|DEBIAN10|DEBIAN11)
+Debian10|Debian11|Debian12|DEBIAN10|DEBIAN11|DEBIAN12)
    ## check for Linux releases
-    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(Debian9)$|(Debian10)$|(Debian11)$' | sed 's/DEBIAN/Debian/g')
+    NAME_VERIFY=$(echo "${TARGET}" | grep -iwE '(Debian10)$|(Debian11)$|(Debian12)$' | sed 's/DEBIAN/Debian/g')
    destroy_rel
    ;;
 *)
--- a/usr/local/share/bastille/edit.sh
+++ b/usr/local/share/bastille/edit.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -48,6 +48,8 @@ elif [ $# -eq 1 ]; then
    TARGET_FILENAME="${1}"
 fi

+bastille_root_check
+
 if [ -z "${EDITOR}" ]; then
    EDITOR=vi
 fi
--- a/usr/local/share/bastille/export.sh
+++ b/usr/local/share/bastille/export.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -71,6 +71,8 @@ if [ $# -gt 5 ] || [ $# -lt 1 ]; then
    usage
 fi

+bastille_root_check
+
 zfs_enable_check() {
    # Temporarily disable ZFS so we can create a standard backup archive
    if [ "${bastille_zfs_enable}" = "YES" ]; then
--- a/usr/local/share/bastille/htop.sh
+++ b/usr/local/share/bastille/htop.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -ne 0 ]; then
    usage
 fi

+bastille_root_check
+
 for _jail in ${JAILS}; do
    bastille_jail_path=$(/usr/sbin/jls -j "${_jail}" path)
    if [ ! -x "${bastille_jail_path}/usr/local/bin/htop" ]; then
--- a/usr/local/share/bastille/import.sh
+++ b/usr/local/share/bastille/import.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -59,6 +59,8 @@ if [ $# -gt 3 ] || [ $# -lt 1 ]; then
    usage
 fi

+bastille_root_check
+
 TARGET="${1}"
 OPT_FORCE=
 USER_IMPORT=
--- a/usr/local/share/bastille/limits.sh
+++ b/usr/local/share/bastille/limits.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 # Ressource limits added by Sven R github.com/hackacad
 #
@@ -55,6 +55,8 @@ if [ $# -ne 2 ]; then
    usage
 fi

+bastille_root_check
+
 OPTION="${1}"
 VALUE="${2}"

--- a/usr/local/share/bastille/list.sh
+++ b/usr/local/share/bastille/list.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -35,106 +35,114 @@ usage() {
    error_exit "Usage: bastille list [-j|-a] [release [-p]|template|(jail|container)|log|limit|(import|export|backup)]"
 }

+if [ "${1}" = help -o "${1}" = "-h" -o "${1}" = "--help" ]; then
+    usage
+fi
+
+bastille_root_check
+
 if [ $# -eq 0 ]; then
   /usr/sbin/jls -N
 fi

-if [ "$1" == "-j" ]; then
+if [ "${1}" == "-j" ]; then
    /usr/sbin/jls -N --libxo json
    exit 0
 fi

-if [ $# -gt 0 ]; then
-    # Handle special-case commands first.
-    case "$1" in
-    help|-h|--help)
-        usage
-        ;;
-    all|-a|--all)
+TARGET=
+
+list_all(){
        if [ -d "${bastille_jailsdir}" ]; then
            DEFAULT_VALUE="-"
            SPACER=2
            MAX_LENGTH_JAIL_NAME=$(find ""${bastille_jailsdir}/*/jail.conf"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 grep -h -m 1 -e "^.* {$" | awk '{ print length($1) }' | sort -nr | head -n 1)
            MAX_LENGTH_JAIL_NAME=${MAX_LENGTH_JAIL_NAME:-3}
-            if [ ${MAX_LENGTH_JAIL_NAME} -lt 3 ]; then MAX_LENGTH_JAIL_NAME=3; fi
+            if [ "${MAX_LENGTH_JAIL_NAME}" -lt 3 ]; then MAX_LENGTH_JAIL_NAME=3; fi
            MAX_LENGTH_JAIL_IP=$(find ""${bastille_jailsdir}/*/jail.conf"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 sed -n "s/^[ ]*ip[4,6].addr[ ]*=[ ]*\(.*\);$/\1 /p" | sed 's/\// /g' | awk '{ print length($1) }' | sort -nr | head -n 1)
            MAX_LENGTH_JAIL_IP=${MAX_LENGTH_JAIL_IP:-10}
            MAX_LENGTH_JAIL_VNET_IP=$(find ""${bastille_jailsdir}/*/jail.conf"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 grep -l "vnet;" | grep -h "ifconfig_vnet0=" $(sed -n "s/\(.*\)jail.conf$/\1root\/etc\/rc.conf/p") | sed -n "s/^ifconfig_vnet0=\"\(.*\)\"$/\1/p"| sed "s/\// /g" | awk '{ if ($1 ~ /^[inet|inet6]/) print length($2); else print 15 }' | sort -nr | head -n 1)
            MAX_LENGTH_JAIL_VNET_IP=${MAX_LENGTH_JAIL_VNET_IP:-10}
-            if [ ${MAX_LENGTH_JAIL_VNET_IP} -gt ${MAX_LENGTH_JAIL_IP} ]; then MAX_LENGTH_JAIL_IP=${MAX_LENGTH_JAIL_VNET_IP}; fi
-            if [ ${MAX_LENGTH_JAIL_IP} -lt 10 ]; then MAX_LENGTH_JAIL_IP=10; fi
+            if [ "${MAX_LENGTH_JAIL_VNET_IP}" -gt "${MAX_LENGTH_JAIL_IP}" ]; then MAX_LENGTH_JAIL_IP=${MAX_LENGTH_JAIL_VNET_IP}; fi
+            if [ "${MAX_LENGTH_JAIL_IP}" -lt 10 ]; then MAX_LENGTH_JAIL_IP=10; fi
            MAX_LENGTH_JAIL_HOSTNAME=$(find ""${bastille_jailsdir}/*/jail.conf"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 grep -h -m 1 -e "^[ ]*host.hostname[ ]*=[ ]*\(.*\);" | awk '{ print length(substr($3, 1, length($3)-1)) }' | sort -nr | head -n 1)
            MAX_LENGTH_JAIL_HOSTNAME=${MAX_LENGTH_JAIL_HOSTNAME:-8}
-            if [ ${MAX_LENGTH_JAIL_HOSTNAME} -lt 8 ]; then MAX_LENGTH_JAIL_HOSTNAME=8; fi
+            if [ "${MAX_LENGTH_JAIL_HOSTNAME}" -lt 8 ]; then MAX_LENGTH_JAIL_HOSTNAME=8; fi
            MAX_LENGTH_JAIL_PORTS=$(find ""${bastille_jailsdir}/*/rdr.conf"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 -n1 awk '{ lines++; chars += length($0)} END { chars += lines - 1; print chars }' | sort -nr | head -n 1)
            MAX_LENGTH_JAIL_PORTS=${MAX_LENGTH_JAIL_PORTS:-15}
-            if [ ${MAX_LENGTH_JAIL_PORTS} -lt 15 ]; then MAX_LENGTH_JAIL_PORTS=15; fi
-            if [ ${MAX_LENGTH_JAIL_PORTS} -gt 30 ]; then MAX_LENGTH_JAIL_PORTS=30; fi
+            if [ "${MAX_LENGTH_JAIL_PORTS}" -lt 15 ]; then MAX_LENGTH_JAIL_PORTS=15; fi
+            if [ "${MAX_LENGTH_JAIL_PORTS}" -gt 30 ]; then MAX_LENGTH_JAIL_PORTS=30; fi
            MAX_LENGTH_JAIL_RELEASE=$(find ""${bastille_jailsdir}/*/fstab"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 grep -h "/releases/.*/root/.bastille.*nullfs" | grep -hE "^USERLAND_VERSION=" $(sed -n "s/^\(.*\) \/.*$/\1\/bin\/freebsd-version/p" | awk '!_[$0]++') | sed "s/[\"\'\^]//g;s/ .*$//g" | sed -n "s/^USERLAND_VERSION=\(.*\)$/\1/p" | awk '{ print length($0) }' | sort -nr | head -n 1)
            MAX_LENGTH_JAIL_RELEASE=${MAX_LENGTH_JAIL_RELEASE:-7}
            MAX_LENGTH_THICK_JAIL_RELEASE=$(find ""${bastille_jailsdir}/*/root/bin/freebsd-version"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 grep -hE "^USERLAND_VERSION=" | sed "s/[\"\'\^]//g;s/ .*$//g" | sed -n "s/^USERLAND_VERSION=\(.*\)$/\1/p" | awk '{ print length($0) }' | sort -nr | head -n 1)
            MAX_LENGTH_THICK_JAIL_RELEASE=${MAX_LENGTH_THICK_JAIL_RELEASE:-7}
            MAX_LENGTH_LINUX_JAIL_RELEASE=$(find ""${bastille_jailsdir}/*/fstab"" -maxdepth 1 -type f -print0 2> /dev/null | xargs -r0 -P0 grep -h "/jails/.*/root/proc.*linprocfs" | grep -hE "^NAME=|^VERSION_ID=|^VERSION_CODENAME=" $(sed -n "s/^linprocfs *\(.*\)\/.*$/\1\/etc\/os-release/p") 2> /dev/null | sed "s/\"//g" | sed "s/ GNU\/Linux//g" | sed "N;N;s/\n/;/g" | sed -n "s/^NAME=\(.*\);VERSION_ID=\(.*\);VERSION_CODENAME=\(.*\)$/\1 \2 (\3)/p" | awk '{ print length($0) }' | sort -nr | head -n 1) 
            MAX_LENGTH_LINUX_JAIL_RELEASE=${MAX_LENGTH_LINUX_JAIL_RELEASE:-7}
-            if [ ${MAX_LENGTH_THICK_JAIL_RELEASE} -gt ${MAX_LENGTH_JAIL_RELEASE} ]; then MAX_LENGTH_JAIL_RELEASE=${MAX_LENGTH_THICK_JAIL_RELEASE}; fi
-            if [ ${MAX_LENGTH_LINUX_JAIL_RELEASE} -gt ${MAX_LENGTH_JAIL_RELEASE} ]; then MAX_LENGTH_JAIL_RELEASE=${MAX_LENGTH_LINUX_JAIL_RELEASE}; fi
-            if [ ${MAX_LENGTH_JAIL_RELEASE} -lt 7 ]; then MAX_LENGTH_JAIL_RELEASE=7; fi
+            if [ "${MAX_LENGTH_THICK_JAIL_RELEASE}" -gt "${MAX_LENGTH_JAIL_RELEASE}" ]; then MAX_LENGTH_JAIL_RELEASE=${MAX_LENGTH_THICK_JAIL_RELEASE}; fi
+            if [ "${MAX_LENGTH_LINUX_JAIL_RELEASE}" -gt "${MAX_LENGTH_JAIL_RELEASE}" ]; then MAX_LENGTH_JAIL_RELEASE=${MAX_LENGTH_LINUX_JAIL_RELEASE}; fi
+            if [ "${MAX_LENGTH_JAIL_RELEASE}" -lt 7 ]; then MAX_LENGTH_JAIL_RELEASE=7; fi
            printf " JID%*sState%*sIP Address%*sPublished Ports%*sHostname%*sRelease%*sPath\n" "$((${MAX_LENGTH_JAIL_NAME} + ${SPACER} - 3))" "" "$((${SPACER}))" "" "$((${MAX_LENGTH_JAIL_IP} + ${SPACER} - 10))" "" "$((${MAX_LENGTH_JAIL_PORTS} + ${SPACER} - 15))" "" "$((${MAX_LENGTH_JAIL_HOSTNAME} + ${SPACER} - 8))" "" "$((${MAX_LENGTH_JAIL_RELEASE} + ${SPACER} - 7))" ""
-            JAIL_LIST=$(ls "${bastille_jailsdir}" | sed "s/\n//g")
+            if [ -n "${TARGET}" ]; then
+                # Query all info for a specific jail.
+                JAIL_LIST="${TARGET}"
+            else
+                # Query all info for all jails(default).
+                JAIL_LIST=$(ls "${bastille_jailsdir}" | sed "s/\n//g")
+            fi
            for _JAIL in ${JAIL_LIST}; do
                if [ -f "${bastille_jailsdir}/${_JAIL}/jail.conf" ]; then
-                        JAIL_NAME=$(grep -h -m 1 -e "^.* {$" "${bastille_jailsdir}/${_JAIL}/jail.conf" 2> /dev/null | awk '{ print $1 }')
-                        IS_FREEBSD_JAIL=0
-                        if [ -f "${bastille_jailsdir}/${JAIL_NAME}/root/bin/freebsd-version" -o -f "${bastille_jailsdir}/${JAIL_NAME}/root/.bastille/bin/freebsd-version" -o "$(grep -c "/releases/.*/root/.bastille.*nullfs" "${bastille_jailsdir}/${JAIL_NAME}/fstab" 2> /dev/null)" -gt 0 ]; then IS_FREEBSD_JAIL=1; fi
-                        IS_FREEBSD_JAIL=${IS_FREEBSD_JAIL:-0}
-                        IS_LINUX_JAIL=0
-                        if [ "$(grep -c "^linprocfs" "${bastille_jailsdir}/${JAIL_NAME}/fstab" 2> /dev/null)" -gt 0 ]; then IS_LINUX_JAIL=1; fi
-                        IS_LINUX_JAIL=${IS_LINUX_JAIL:-0}
-                        if [ "$(/usr/sbin/jls name | awk "/^${JAIL_NAME}$/")" ]; then
-                                JAIL_STATE="Up"
-                                if [ "$(awk '$1 == "vnet;" { print $1 }' "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)" ]; then
-                                        JAIL_IP=$(jexec -l ${JAIL_NAME} ifconfig -n vnet0 inet 2> /dev/null | sed -n "/.inet /{s///;s/ .*//;p;}")
-                                        if [ ! ${JAIL_IP} ]; then JAIL_IP=$(jexec -l ${JAIL_NAME} ifconfig -n vnet0 inet6 2> /dev/null | awk '/inet6 / && (!/fe80::/ || !/%vnet0/)' | sed -n "/.inet6 /{s///;s/ .*//;p;}"); fi
-                                else
-                                        JAIL_IP=$(/usr/sbin/jls -j ${JAIL_NAME} ip4.addr 2> /dev/null)
-                                        if [ ${JAIL_IP} = "-" ]; then JAIL_IP=$(/usr/sbin/jls -j ${JAIL_NAME} ip6.addr 2> /dev/null); fi
-                                fi
-                                JAIL_HOSTNAME=$(/usr/sbin/jls -j ${JAIL_NAME} host.hostname 2> /dev/null)
-                                JAIL_PORTS=$(pfctl -a "rdr/${JAIL_NAME}" -Psn 2> /dev/null | awk '{ printf "%s/%s:%s"",",$7,$14,$18 }' | sed "s/,$//")
-                                JAIL_PATH=$(/usr/sbin/jls -j ${JAIL_NAME} path 2> /dev/null)
-                                if [ ${IS_FREEBSD_JAIL} -eq 1 ]; then
-                                        JAIL_RELEASE=$(jexec -l ${JAIL_NAME} freebsd-version -u 2> /dev/null)
-                                fi
-                                if [ ${IS_LINUX_JAIL} -eq 1 ]; then
-                                                JAIL_RELEASE=$(grep -hE "^NAME=.*$|^VERSION_ID=.*$|^VERSION_CODENAME=.*$" "${JAIL_PATH}/etc/os-release" 2> /dev/null | sed "s/\"//g" | sed "s/ GNU\/Linux//g" | awk -F'=' '{ a[$1] = $2; o++ } o%3 == 0 { print a["VERSION_CODENAME"] " (" a["NAME"] " " a["VERSION_ID"] ")" }')
-                                fi
+                    JAIL_NAME=$(grep -h -m 1 -e "^.* {$" "${bastille_jailsdir}/${_JAIL}/jail.conf" 2> /dev/null | awk '{ print $1 }')
+                    IS_FREEBSD_JAIL=0
+                    if [ -f "${bastille_jailsdir}/${JAIL_NAME}/root/bin/freebsd-version" -o -f "${bastille_jailsdir}/${JAIL_NAME}/root/.bastille/bin/freebsd-version" -o "$(grep -c "/releases/.*/root/.bastille.*nullfs" "${bastille_jailsdir}/${JAIL_NAME}/fstab" 2> /dev/null)" -gt 0 ]; then IS_FREEBSD_JAIL=1; fi
+                    IS_FREEBSD_JAIL=${IS_FREEBSD_JAIL:-0}
+                    IS_LINUX_JAIL=0
+                    if [ "$(grep -c "^linprocfs" "${bastille_jailsdir}/${JAIL_NAME}/fstab" 2> /dev/null)" -gt 0 ]; then IS_LINUX_JAIL=1; fi
+                    IS_LINUX_JAIL=${IS_LINUX_JAIL:-0}
+                    if [ "$(/usr/sbin/jls name | awk "/^${JAIL_NAME}$/")" ]; then
+                        JAIL_STATE="Up"
+                        if [ "$(awk '$1 == "vnet;" { print $1 }' "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)" ]; then
+                            JAIL_IP=$(jexec -l ${JAIL_NAME} ifconfig -n vnet0 inet 2> /dev/null | sed -n "/.inet /{s///;s/ .*//;p;}")
+                            if [ ! "${JAIL_IP}" ]; then JAIL_IP=$(jexec -l ${JAIL_NAME} ifconfig -n vnet0 inet6 2> /dev/null | awk '/inet6 / && (!/fe80::/ || !/%vnet0/)' | sed -n "/.inet6 /{s///;s/ .*//;p;}"); fi
                        else
-                                JAIL_STATE=$(if [ "$(sed -n "/^${JAIL_NAME} {$/,/^}$/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null | awk '$0 ~ /^'${JAIL_NAME}' \{|\}/ { printf "%s",$0 }')" == "${JAIL_NAME} {}" ]; then echo "Down"; else echo "n/a"; fi)
-                                if [ "$(awk '$1 == "vnet;" { print $1 }' "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)" ]; then
-                                        JAIL_IP=$(sed -n 's/^ifconfig_vnet0="\(.*\)"$/\1/p' "${bastille_jailsdir}/${JAIL_NAME}/root/etc/rc.conf" 2> /dev/null | sed "s/\// /g" | awk '{ if ($1 ~ /^[inet|inet6]/) print $2; else print $1 }')
-                                else
-                                        JAIL_IP=$(sed -n "s/^[ ]*ip[4,6].addr[ ]*=[ ]*\(.*\);$/\1/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null | sed "s/\// /g" | awk '{ print $1 }')
+                            JAIL_IP=$(/usr/sbin/jls -j ${JAIL_NAME} ip4.addr 2> /dev/null)
+                            if [ "${JAIL_IP}" = "-" ]; then JAIL_IP=$(/usr/sbin/jls -j ${JAIL_NAME} ip6.addr 2> /dev/null); fi
+                        fi
+                        JAIL_HOSTNAME=$(/usr/sbin/jls -j ${JAIL_NAME} host.hostname 2> /dev/null)
+                        JAIL_PORTS=$(pfctl -a "rdr/${JAIL_NAME}" -Psn 2> /dev/null | awk '{ printf "%s/%s:%s"",",$7,$14,$18 }' | sed "s/,$//")
+                        JAIL_PATH=$(/usr/sbin/jls -j ${JAIL_NAME} path 2> /dev/null)
+                        if [ "${IS_FREEBSD_JAIL}" -eq 1 ]; then
+                            JAIL_RELEASE=$(jexec -l ${JAIL_NAME} freebsd-version -u 2> /dev/null)
+                        fi
+                        if [ "${IS_LINUX_JAIL}" -eq 1 ]; then
+                            JAIL_RELEASE=$(grep -hE "^NAME=.*$|^VERSION_ID=.*$|^VERSION_CODENAME=.*$" "${JAIL_PATH}/etc/os-release" 2> /dev/null | sed "s/\"//g" | sed "s/ GNU\/Linux//g" | awk -F'=' '{ a[$1] = $2; o++ } o%3 == 0 { print a["VERSION_CODENAME"] " (" a["NAME"] " " a["VERSION_ID"] ")" }')
+                        fi
+                    else
+                        JAIL_STATE=$(if [ "$(sed -n "/^${JAIL_NAME} {$/,/^}$/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null | awk '$0 ~ /^'${JAIL_NAME}' \{|\}/ { printf "%s",$0 }')" == "${JAIL_NAME} {}" ]; then echo "Down"; else echo "n/a"; fi)
+                        if [ "$(awk '$1 == "vnet;" { print $1 }' "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)" ]; then
+                            JAIL_IP=$(sed -n 's/^ifconfig_vnet0="\(.*\)"$/\1/p' "${bastille_jailsdir}/${JAIL_NAME}/root/etc/rc.conf" 2> /dev/null | sed "s/\// /g" | awk '{ if ($1 ~ /^[inet|inet6]/) print $2; else print $1 }')
+                        else
+                            JAIL_IP=$(sed -n "s/^[ ]*ip[4,6].addr[ ]*=[ ]*\(.*\);$/\1/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null | sed "s/\// /g" | awk '{ print $1 }')
+                        fi
+                        JAIL_HOSTNAME=$(sed -n "s/^[ ]*host.hostname[ ]*=[ ]*\(.*\);$/\1/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)
+                        if [ -f "${bastille_jailsdir}/${JAIL_NAME}/rdr.conf" ]; then JAIL_PORTS=$(awk '$1 ~ /^[tcp|udp]/ { printf "%s/%s:%s,",$1,$2,$3 }' "${bastille_jailsdir}/${JAIL_NAME}/rdr.conf" 2> /dev/null | sed "s/,$//"); else JAIL_PORTS=""; fi
+                            JAIL_PATH=$(sed -n "s/^[ ]*path[ ]*=[ ]*\(.*\);$/\1/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)
+                            if [ "${JAIL_PATH}" ]; then
+                                if [ "${IS_FREEBSD_JAIL}" -eq 1 ]; then
+                                    if [ -f "${JAIL_PATH}/bin/freebsd-version" ]; then
+                                        JAIL_RELEASE=$(grep -hE "^USERLAND_VERSION=" "${JAIL_PATH}/bin/freebsd-version" 2> /dev/null | sed "s/[\"\'\^]//g;s/ .*$//g" | sed -n "s/^USERLAND_VERSION=\(.*\)$/\1/p")
+                                    else
+                                        JAIL_RELEASE=$(grep -h "/releases/.*/root/.bastille.*nullfs" "${bastille_jailsdir}/${JAIL_NAME}/fstab" 2> /dev/null | grep -hE "^USERLAND_VERSION=" $(sed -n "s/^\(.*\) \/.*$/\1\/bin\/freebsd-version/p" | awk '!_[$0]++') | sed "s/[\"\'\^]//g;s/ .*$//g" | sed -n "s/^USERLAND_VERSION=\(.*\)$/\1/p")
+                                    fi
                                fi
-                                JAIL_HOSTNAME=$(sed -n "s/^[ ]*host.hostname[ ]*=[ ]*\(.*\);$/\1/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)
-                                if [ -f "${bastille_jailsdir}/${JAIL_NAME}/rdr.conf" ]; then JAIL_PORTS=$(awk '$1 ~ /^[tcp|udp]/ { printf "%s/%s:%s,",$1,$2,$3 }' "${bastille_jailsdir}/${JAIL_NAME}/rdr.conf" 2> /dev/null | sed "s/,$//"); else JAIL_PORTS=""; fi
-                                JAIL_PATH=$(sed -n "s/^[ ]*path[ ]*=[ ]*\(.*\);$/\1/p" "${bastille_jailsdir}/${JAIL_NAME}/jail.conf" 2> /dev/null)
-                                if [ ${JAIL_PATH} ]; then
-                                        if [ ${IS_FREEBSD_JAIL} -eq 1 ]; then
-                                                if [ -f "${JAIL_PATH}/bin/freebsd-version" ]; then
-                                                        JAIL_RELEASE=$(grep -hE "^USERLAND_VERSION=" "${JAIL_PATH}/bin/freebsd-version" 2> /dev/null | sed "s/[\"\'\^]//g;s/ .*$//g" | sed -n "s/^USERLAND_VERSION=\(.*\)$/\1/p")
-                                                else
-                                                        JAIL_RELEASE=$(grep -h "/releases/.*/root/.bastille.*nullfs" "${bastille_jailsdir}/${JAIL_NAME}/fstab" 2> /dev/null | grep -hE "^USERLAND_VERSION=" $(sed -n "s/^\(.*\) \/.*$/\1\/bin\/freebsd-version/p" | awk '!_[$0]++') | sed "s/[\"\'\^]//g;s/ .*$//g" | sed -n "s/^USERLAND_VERSION=\(.*\)$/\1/p")
-                                                fi
-                                        fi
-                                        if [ ${IS_LINUX_JAIL} -eq 1 ]; then
-                                                JAIL_RELEASE=$(grep -hE "^NAME=.*$|^VERSION_ID=.*$|^VERSION_CODENAME=.*$" "${JAIL_PATH}/etc/os-release" 2> /dev/null | sed "s/\"//g" | sed "s/ GNU\/Linux//g" | awk -F'=' '{ a[$1] = $2; o++ } o%3 == 0 { print a["VERSION_CODENAME"] " (" a["NAME"] " " a["VERSION_ID"] ")" }')
-                                        fi
-                                else
-                                        JAIL_RELEASE=""
+                                if [ "${IS_LINUX_JAIL}" -eq 1 ]; then
+                                    JAIL_RELEASE=$(grep -hE "^NAME=.*$|^VERSION_ID=.*$|^VERSION_CODENAME=.*$" "${JAIL_PATH}/etc/os-release" 2> /dev/null | sed "s/\"//g" | sed "s/ GNU\/Linux//g" | awk -F'=' '{ a[$1] = $2; o++ } o%3 == 0 { print a["VERSION_CODENAME"] " (" a["NAME"] " " a["VERSION_ID"] ")" }')
                                fi
+                            else
+                               JAIL_RELEASE=""
+                            fi
                        fi

-                        if [ ${#JAIL_PORTS} -gt ${MAX_LENGTH_JAIL_PORTS} ]; then JAIL_PORTS="$(echo ${JAIL_PORTS} | cut -c-$((${MAX_LENGTH_JAIL_PORTS} - 3)))..."; fi
+                        if [ "${#JAIL_PORTS}" -gt "${MAX_LENGTH_JAIL_PORTS}" ]; then JAIL_PORTS="$(echo ${JAIL_PORTS} | cut -c-$((${MAX_LENGTH_JAIL_PORTS} - 3)))..."; fi
                        JAIL_NAME=${JAIL_NAME:-${DEFAULT_VALUE}}
                        JAIL_STATE=${JAIL_STATE:-${DEFAULT_VALUE}}
                        JAIL_IP=${JAIL_IP:-${DEFAULT_VALUE}}
@@ -148,48 +156,85 @@ if [ $# -gt 0 ]; then
        else
            error_exit "unfortunately there are no jails here (${bastille_jailsdir})"
        fi
+}
+
+list_release(){
+    if [ -d "${bastille_releasesdir}" ]; then
+        REL_LIST=$(ls "${bastille_releasesdir}" | sed "s/\n//g")
+        for _REL in ${REL_LIST}; do
+            if [ -f "${bastille_releasesdir}/${_REL}/root/.profile" -o -d "${bastille_releasesdir}/${_REL}/debootstrap" ]; then
+                if [ "${2}" == "-p" -a -f "${bastille_releasesdir}/${_REL}/bin/freebsd-version" ]; then
+                    REL_PATCH_LEVEL=$(sed -n "s/^USERLAND_VERSION=\"\(.*\)\"$/\1/p" "${bastille_releasesdir}/${_REL}/bin/freebsd-version" 2> /dev/null)
+                    REL_PATCH_LEVEL=${REL_PATCH_LEVEL:-${_REL}}
+                    echo "${REL_PATCH_LEVEL}"
+                else
+                    echo "${_REL}"
+                fi
+            fi
+        done
+    fi
+}
+
+list_template(){
+    find "${bastille_templatesdir}" -type d -maxdepth 2
+}
+
+list_jail(){
+    if [ -d "${bastille_jailsdir}" ]; then
+        JAIL_LIST=$(ls "${bastille_jailsdir}" | sed "s/\n//g")
+        for _JAIL in ${JAIL_LIST}; do
+            if [ -f "${bastille_jailsdir}/${_JAIL}/jail.conf" ]; then
+                echo "${_JAIL}"
+            fi
+        done
+    fi
+}
+
+list_log(){
+	find "${bastille_logsdir}" -type f -maxdepth 1
+}
+
+list_limit(){
+    rctl -h jail:
+}
+
+list_import(){
+    ls "${bastille_backupsdir}" | grep -v ".sha256$"
+}
+
+if [ $# -gt 0 ]; then
+    # Handle special-case commands first.
+    case "${1}" in
+    all|-a|--all)
+        list_all
        ;;
    release|releases)
-        if [ -d "${bastille_releasesdir}" ]; then
-            REL_LIST=$(ls "${bastille_releasesdir}" | sed "s/\n//g")
-            for _REL in ${REL_LIST}; do
-                if [ -f "${bastille_releasesdir}/${_REL}/root/.profile" -o -d "${bastille_releasesdir}/${_REL}/debootstrap" ]; then
-                    if [ "$2" == "-p" -a -f "${bastille_releasesdir}/${_REL}/bin/freebsd-version" ]; then
-                        REL_PATCH_LEVEL=$(sed -n "s/^USERLAND_VERSION=\"\(.*\)\"$/\1/p" "${bastille_releasesdir}/${_REL}/bin/freebsd-version" 2> /dev/null)
-                        REL_PATCH_LEVEL=${REL_PATCH_LEVEL:-${_REL}}
-                        echo "${REL_PATCH_LEVEL}"
-                    else
-                        echo "${_REL}"
-                    fi
-                fi
-            done
-        fi
+        list_release
        ;;
    template|templates)
-        find "${bastille_templatesdir}" -type d -maxdepth 2
+        list_template
        ;;
    jail|jails|container|containers)
-        if [ -d "${bastille_jailsdir}" ]; then
-            JAIL_LIST=$(ls "${bastille_jailsdir}" | sed "s/\n//g")
-            for _JAIL in ${JAIL_LIST}; do
-                if [ -f "${bastille_jailsdir}/${_JAIL}/jail.conf" ]; then
-                    echo "${_JAIL}"
-                fi
-            done
-        fi
+        list_jail
        ;;
    log|logs)
-        find "${bastille_logsdir}" -type f -maxdepth 1
+        list_log
        ;;
    limit|limits)
-        rctl -h jail:
+        list_limit
        ;;
    import|imports|export|exports|backup|backups)
-        ls "${bastille_backupsdir}" | grep -v ".sha256$"
+        list_import
    exit 0
    ;;
    *)
-        usage
+        # Check if we want to query all info for a specific jail instead.
+        if [ -f "${bastille_jailsdir}/${1}/jail.conf" ]; then
+            TARGET="${1}"
+            list_all
+        else
+            usage
+        fi
        ;;
    esac
 fi
--- a/usr/local/share/bastille/mount.sh
+++ b/usr/local/share/bastille/mount.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -50,6 +50,8 @@ else
    _fstab="$@"
 fi

+bastille_root_check
+
 ## assign needed variables
 _hostpath=$(echo "${_fstab}" | awk '{print $1}')
 _jailpath=$(echo "${_fstab}" | awk '{print $2}')
@@ -65,8 +67,10 @@ if [ -z "${_hostpath}" ] || [ -z "${_jailpath}" ] || [ -z "${_type}" ] || [ -z "
    exit 1
 fi

-## if host path doesn't exist or type is not "nullfs"
-if [ ! -d "${_hostpath}" ] || [ "${_type}" != "nullfs" ]; then
+## if host path doesn't exist, type is not "nullfs" or are using advanced mount type "tmpfs,linprocfs,linsysfs, fdescfs, procfs"	
+if [ "${_hostpath}" == "tmpfs" -a "$_type" == "tmpfs" ] || [ "${_hostpath}" == "linprocfs" -a "${_type}" == "linprocfs" ] || [ "${_hostpath}" == "linsysfs" -a "${_type}" == "linsysfs" ] || [ "${_hostpath}" == "proc" -a "${_type}" == "procfs" ] || [ "${_hostpath}" == "fdesc" -a "${_type}" == "fdescfs" ]  ;  then
+    warn "Detected advanced mount type ${_hostpath}"
+elif [ ! -d "${_hostpath}" ] || [ "${_type}" != "nullfs" ]; then
    error_notify "Detected invalid host path or incorrect mount type in FSTAB."
    warn "Format: /host/path jail/path nullfs ro 0 0"
    warn "Read: ${_fstab}"
--- a/usr/local/share/bastille/pkg.sh
+++ b/usr/local/share/bastille/pkg.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -45,17 +45,34 @@ if [ $# -lt 1 ]; then
    usage
 fi

+bastille_root_check
+
+errors=0
+
 for _jail in ${JAILS}; do
    info "[${_jail}]:"
    bastille_jail_path=$(/usr/sbin/jls -j "${_jail}" path)
    if [ -f "/usr/sbin/mport" ]; then
-        jexec -l -U root "${_jail}" /usr/sbin/mport "$@"
+        if ! jexec -l -U root "${_jail}" /usr/sbin/mport "$@"; then
+            errors=1
+        fi
    elif [ -f "${bastille_jail_path}/usr/bin/apt" ]; then
-        jexec -l "${_jail}" /usr/bin/apt "$@"
+        if ! jexec -l "${_jail}" /usr/bin/apt "$@"; then
+            errors=1
+        fi
    elif [ "${USE_HOST_PKG}" = 1 ]; then
-        /usr/sbin/pkg -j "${_jail}" "$@"
+        if ! /usr/sbin/pkg -j "${_jail}" "$@"; then
+            errors=1
+        fi
    else
-        jexec -l -U root "${_jail}" /usr/sbin/pkg "$@"
+        if ! jexec -l -U root "${_jail}" /usr/sbin/pkg "$@"; then
+            errors=1
+        fi
    fi
    echo
 done
+
+if [ $errors -ne 0 ]; then
+    error_exit "Failed to apply on some jails, please check logs"
+    exit 1
+fi
--- a/usr/local/share/bastille/rdr.sh
+++ b/usr/local/share/bastille/rdr.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -46,9 +46,12 @@ if [ $# -lt 2 ]; then
    usage
 fi

+bastille_root_check
+
 TARGET="${1}"
 JAIL_NAME=""
 JAIL_IP=""
+JAIL_IP6=""
 EXT_IF=""
 shift

@@ -71,6 +74,13 @@ check_jail_validity() {
            error_exit "Jail IP not found: ${TARGET}"
        fi
    fi
+    # Check if jail ip6 address (ip6.addr) is valid (non-VNET only)
+    if [ "$(bastille config $TARGET get vnet)" != 'enabled' ]; then
+        if [ "$(bastille config $TARGET get ip6)" != 'disable' ] && [ "$(bastille config $TARGET get ip6)" != 'not set' ]; then
+            JAIL_IP6=$(/usr/sbin/jls -j "${TARGET}" ip6.addr 2>/dev/null)
+        fi
+    fi
+

    # Check if rdr-anchor is defined in pf.conf
    if ! (pfctl -sn | grep rdr-anchor | grep 'rdr/\*' >/dev/null); then
@@ -78,9 +88,9 @@ check_jail_validity() {
    fi

    # Check if ext_if is defined in pf.conf
-    EXT_IF=$(grep '^[[:space:]]*ext_if[[:space:]]*=' /etc/pf.conf)
+    EXT_IF=$(grep "^[[:space:]]*${bastille_network_pf_ext_if}[[:space:]]*=" ${bastille_pf_conf})
    if [ -z "${EXT_IF}" ]; then
-        error_exit "ext_if not defined in pf.conf"
+        error_exit "bastille_network_pf_ext_if (${bastille_network_pf_ext_if}) not defined in pf.conf"
    fi
 }

@@ -104,8 +114,13 @@ fi
 # function: load rdr rule via pfctl
 load_rdr_rule() {
 ( pfctl -a "rdr/${JAIL_NAME}" -Psn;
-  printf '%s\nrdr pass on $ext_if inet proto %s to port %s -> %s port %s\n' "$EXT_IF" "$1" "$2" "$JAIL_IP" "$3" ) \
+  printf '%s\nrdr pass on $%s inet proto %s to port %s -> %s port %s\n' "$EXT_IF" "${bastille_network_pf_ext_if}" "$1" "$2" "$JAIL_IP" "$3" ) \
      | pfctl -a "rdr/${JAIL_NAME}" -f-
+if [ -n "$JAIL_IP6" ]; then
+  ( pfctl -a "rdr/${JAIL_NAME}" -Psn;
+  printf '%s\nrdr pass on $%s inet proto %s to port %s -> %s port %s\n' "$EXT_IF" "${bastille_network_pf_ext_if}" "$1" "$2" "$JAIL_IP6" "$3" ) \
+    | pfctl -a "rdr/${JAIL_NAME}" -f-
+fi
 }

 # function: load rdr rule with log via pfctl
@@ -114,8 +129,14 @@ proto=$1;host_port=$2;jail_port=$3;
 shift 3;
 log=$@
 ( pfctl -a "rdr/${JAIL_NAME}" -Psn;
-  printf '%s\nrdr pass %s on $ext_if inet proto %s to port %s -> %s port %s\n' "$EXT_IF" "$log" "$proto" "$host_port" "$JAIL_IP" "$jail_port" ) \
+  printf '%s\nrdr pass %s on $%s inet proto %s to port %s -> %s port %s\n' "$EXT_IF" "$log" "${bastille_network_pf_ext_if}" "$proto" "$host_port" "$JAIL_IP" "$jail_port" ) \
      | pfctl -a "rdr/${JAIL_NAME}" -f-
+if [ -n "$JAIL_IP6" ]; then
+  ( pfctl -a "rdr/${JAIL_NAME}" -Psn;
+  printf '%s\nrdr pass %s on $%s inet proto %s to port %s -> %s port %s\n' "$EXT_IF" "$log" "${bastille_network_pf_ext_if}" "$proto" "$host_port" "$JAIL_IP6" "$jail_port" ) \
+    | pfctl -a "rdr/${JAIL_NAME}" -f-
+fi
+
 }

 while [ $# -gt 0 ]; do
@@ -161,7 +182,7 @@ while [ $# -gt 0 ]; do
                        shift 3
                        if [ $# -gt 3 ]; then
                            for last in $@; do
-				true
+                                true
                            done
                            if [ $2 == "(" ] && [ $last == ")" ] ; then
                                check_jail_validity
--- a/usr/local/share/bastille/rename.sh
+++ b/usr/local/share/bastille/rename.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -56,6 +56,8 @@ if [ $# -ne 1 ]; then
    usage
 fi

+bastille_root_check
+
 NEWNAME="${1}"

 update_jailconf() {
@@ -68,6 +70,9 @@ update_jailconf() {
            sed -i '' "s|path.*=.*;|path = ${bastille_jailsdir}/${NEWNAME}/root;|" "${JAIL_CONFIG}"
            sed -i '' "s|mount.fstab.*=.*;|mount.fstab = ${bastille_jailsdir}/${NEWNAME}/fstab;|" "${JAIL_CONFIG}"
            sed -i '' "s|${TARGET}.*{|${NEWNAME} {|" "${JAIL_CONFIG}"
+            # Rename vnet interface
+            sed -i '' "/vnet.interface/s|_${TARGET}\";|_${NEWNAME}\";|" "${JAIL_CONFIG}"
+            sed -i '' "/ifconfig/s|_${TARGET}|_${NEWNAME}|" "${JAIL_CONFIG}"
        fi
    fi
 }
--- a/usr/local/share/bastille/restart.sh
+++ b/usr/local/share/bastille/restart.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
--- a/usr/local/share/bastille/service.sh
+++ b/usr/local/share/bastille/service.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -45,6 +45,8 @@ if [ $# -lt 1 -o $# -gt 2 ]; then
    usage
 fi

+bastille_root_check
+
 for _jail in ${JAILS}; do
    info "[${_jail}]:"
    jexec -l "${_jail}" /usr/sbin/service "$@"
--- a/usr/local/share/bastille/setup.sh
+++ b/usr/local/share/bastille/setup.sh
@@ -0,0 +1,126 @@
+#!/bin/sh
+#
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+#
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/common.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    error_exit "Usage: bastille setup [pf|bastille0|zfs|vnet]"
+}
+
+# Check for too many args
+if [ $# -gt 1 ]; then
+    usage
+fi
+
+# Configure bastille0 network interface
+configure_bastille0() {
+    info "Configuring bastille0 loopback interface"
+    sysrc cloned_interfaces+=lo1
+    sysrc ifconfig_lo1_name="bastille0"
+
+    info "Bringing up new interface: bastille0"
+    service netif cloneup
+}
+
+configure_vnet() {
+    info "Configuring bridge interface"
+    sysrc cloned_interfaces+=bridge1
+    sysrc ifconfig_bridge1_name=bastille1
+
+    info "Bringing up new interface: bastille1"
+    service netif cloneup
+}
+
+# Configure pf firewall
+configure_pf() {
+if [ ! -f "${bastille_pf_conf}" ]; then
+    local ext_if
+    ext_if=$(netstat -rn | awk '/default/ {print $4}' | head -n1)
+    info "Determined default network interface: ($ext_if)"
+    info "${bastille_pf_conf} does not exist: creating..." 
+    
+    ## creating pf.conf
+    cat << EOF > ${bastille_pf_conf}
+## generated by bastille setup
+ext_if="$ext_if"
+
+set block-policy return
+scrub in on \$ext_if all fragment reassemble
+set skip on lo
+
+table <jails> persist
+nat on \$ext_if from <jails> to any -> (\$ext_if:0)
+rdr-anchor "rdr/*"
+
+block in all
+pass out quick keep state
+antispoof for \$ext_if inet
+pass in inet proto tcp from any to any port ssh flags S/SA keep state
+EOF
+    sysrc pf_enable=YES
+else
+    error_exit "${bastille_pf_conf} already exists. Exiting."
+fi
+}
+
+# Configure ZFS
+configure_zfs() {
+    if [ ! "$(kldstat -q -m zfs)" ]; then
+        info "ZFS module not loaded; skipping..."
+    else
+        bastille_zroot=$(zpool list | grep -v NAME | awk '{print $1}')
+        sysrc -f "${bastille_prefix}/bastille.conf" bastille_zfs_enable=YES
+        sysrc -f "${bastille_prefix}/bastille.conf" bastille_zfs_zpool="${bastille_zroot}"
+    fi
+}
+
+# Run all functions if no args (default)
+if [ $# -eq 0 ]; then
+    configure_bastille0
+    configure_pf
+    configure_zfs
+fi
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+pf|firewall)
+    configure_pf
+    ;;
+bastille0|network)
+    configure_bastille0
+    ;;
+zfs)
+    configure_zfs
+    ;;
+esac
--- a/usr/local/share/bastille/start.sh
+++ b/usr/local/share/bastille/start.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -gt 1 ] || [ $# -lt 1 ]; then
    usage
 fi

+bastille_root_check
+
 TARGET="${1}"
 shift

@@ -77,14 +79,14 @@ for _jail in ${JAILS}; do
        fi

        ## warn if matching configured (but not online) ip4.addr, ignore if there's no ip4.addr entry
-        ip=$(grep 'ip4.addr' "${bastille_jailsdir}/${_jail}/jail.conf" | awk '{print $3}' | sed 's/\;//g')
+        ip=$(bastille config "${_jail}" get ip4.addr)
        if [ -n "${ip}" ]; then
-            if ifconfig | grep -w "${ip}" >/dev/null; then
+            if ifconfig | grep -wF "${ip}" >/dev/null; then
                error_notify "Error: IP address (${ip}) already in use."
                continue
            fi
-            ## add ip4.addr to firewall table:jails
-            pfctl -q -t jails -T add "${ip}"
+            ## add ip4.addr to firewall table
+            pfctl -q -t "${bastille_network_pf_table}" -T add "${ip}"
        fi

        ## start the container
--- a/usr/local/share/bastille/stop.sh
+++ b/usr/local/share/bastille/stop.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -ne 0 ]; then
    usage
 fi

+bastille_root_check
+
 for _jail in ${JAILS}; do
    ## test if running
    if [ "$(/usr/sbin/jls name | awk "/^${_jail}$/")" ]; then
@@ -70,10 +72,10 @@ for _jail in ${JAILS}; do
        info "[${_jail}]:"
        jail -f "${bastille_jailsdir}/${_jail}/jail.conf" -r "${_jail}"

-        ## remove (captured above) ip4.addr from firewall table:jails
+        ## remove (captured above) ip4.addr from firewall table
        if [ -n "${bastille_network_loopback}" -a ! -z "${_ip}" ]; then
            if grep -qw "interface.*=.*${bastille_network_loopback}" "${bastille_jailsdir}/${_jail}/jail.conf"; then
-                pfctl -q -t jails -T delete "${_ip}"
+                pfctl -q -t "${bastille_network_pf_table}" -T delete "${_ip}"
            fi
        fi
    fi
--- a/usr/local/share/bastille/sysrc.sh
+++ b/usr/local/share/bastille/sysrc.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -45,6 +45,8 @@ if [ $# -lt 1 ]; then
    usage
 fi

+bastille_root_check
+
 for _jail in ${JAILS}; do
    info "[${_jail}]:"
    jexec -l "${_jail}" /usr/sbin/sysrc "$@"
--- a/usr/local/share/bastille/tags.sh
+++ b/usr/local/share/bastille/tags.sh
@@ -0,0 +1,104 @@
+#!/bin/sh
+#
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
+# All rights reserved.
+# Ressource limits added by Lars Engels github.com/bsdlme
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+# * Redistributions of source code must retain the above copyright notice, this
+#   list of conditions and the following disclaimer.
+#
+# * Redistributions in binary form must reproduce the above copyright notice,
+#   this list of conditions and the following disclaimer in the documentation
+#   and/or other materials provided with the distribution.
+#
+# * Neither the name of the copyright holder nor the names of its
+#   contributors may be used to endorse or promote products derived from
+#   this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+. /usr/local/share/bastille/common.sh
+. /usr/local/etc/bastille/bastille.conf
+
+usage() {
+    error_notify "Usage: bastille tags TARGET add tag1[,tag2,...]"
+    error_notify "       bastille tags TARGET delete tag1[,tag2,...]"
+    error_notify "       bastille tags TARGET list [tag]"
+    echo -e "Example: bastille tags JAILNAME add database,mysql"
+    echo -e "         bastille tags JAILNAME delete mysql"
+    echo -e "         bastille tags ALL list"
+    echo -e "         bastille tags ALL list mysql"
+    exit 1
+}
+
+# Handle special-case commands first.
+case "$1" in
+help|-h|--help)
+    usage
+    ;;
+esac
+
+if [ $# -lt 1 -o $# -gt 2 ]; then
+    usage
+fi
+
+bastille_root_check
+
+ACTION="${1}"
+TAGS="${2}"
+
+for _jail in ${JAILS}; do
+    bastille_jail_tags="${bastille_jailsdir}/${_jail}/tags"
+    case ${ACTION} in
+        add)
+        for _tag in $(echo ${TAGS} | tr , ' '); do
+            echo ${_tag} >> "${bastille_jail_tags}"
+            tmpfile="$(mktemp)"
+            sort "${bastille_jail_tags}" | uniq > "${tmpfile}"
+            mv "${tmpfile}" "${bastille_jail_tags}"
+        done
+        ;;
+        del*)
+        for _tag in $(echo ${TAGS} | tr , ' '); do
+            [ ! -f "${bastille_jail_tags}" ] && break # skip if no tags file
+            tmpfile="$(mktemp)"
+            grep -Ev "^${_tag}\$" "${bastille_jail_tags}" > "${tmpfile}"
+            mv "${tmpfile}" "${bastille_jail_tags}"
+            # delete tags file if empty
+            [ ! -s "${bastille_jail_tags}" ] && rm "${bastille_jail_tags}"
+        done
+        ;;
+        list)
+        if [ -n "${TAGS}" ]; then
+            [ -n "$(echo ${TAGS} | grep ,)" ] && usage # Only one tag per query
+            [ ! -f "${bastille_jail_tags}" ] && continue # skip if there is no tags file
+            grep -qE "^${TAGS}\$" "${bastille_jail_tags}"
+            if [ $? -eq 0 ]; then
+              echo "${_jail}"
+              continue
+            fi
+        else
+            if [ -f "${bastille_jail_tags}" ]; then
+                echo -n "${_jail}: "
+                xargs < "${bastille_jail_tags}"
+            fi
+        fi
+        ;;
+        *)
+        usage
+        ;;
+    esac
+done
+
--- a/usr/local/share/bastille/template.sh
+++ b/usr/local/share/bastille/template.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -116,6 +116,8 @@ if [ $# -lt 1 ]; then
    bastille_usage
 fi

+bastille_root_check
+
 ## global variables
 TEMPLATE="${1}"
 bastille_template=${bastille_templatesdir}/${TEMPLATE}
--- a/usr/local/share/bastille/top.sh
+++ b/usr/local/share/bastille/top.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -45,6 +45,8 @@ if [ $# -ne 0 ]; then
    usage
 fi

+bastille_root_check
+
 for _jail in ${JAILS}; do
    info "[${_jail}]:"
    jexec -l "${_jail}" /usr/bin/top
--- a/usr/local/share/bastille/umount.sh
+++ b/usr/local/share/bastille/umount.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -ne 1 ]; then
    usage
 fi

+bastille_root_check
+
 MOUNT_PATH=$1

 for _jail in ${JAILS}; do
--- a/usr/local/share/bastille/update.sh
+++ b/usr/local/share/bastille/update.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -gt 2 ] || [ $# -lt 1 ]; then
    usage
 fi

+bastille_root_check
+
 TARGET="${1}"
 OPTION="${2}"

--- a/usr/local/share/bastille/upgrade.sh
+++ b/usr/local/share/bastille/upgrade.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,8 @@ if [ $# -gt 3 ] || [ $# -lt 2 ]; then
    usage
 fi

+bastille_root_check
+
 TARGET="$1"
 NEWRELEASE="$2"
 OPTION="$3"
--- a/usr/local/share/bastille/verify.sh
+++ b/usr/local/share/bastille/verify.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -154,6 +154,8 @@ if [ $# -gt 1 ] || [ $# -lt 1 ]; then
    bastille_usage
 fi

+bastille_root_check
+
 case "$1" in
 *-RELEASE|*-release|*-RC1|*-rc1|*-RC2|*-rc2)
    RELEASE=$1
--- a/usr/local/share/bastille/zfs.sh
+++ b/usr/local/share/bastille/zfs.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2018-2022, Christer Edwards <christer.edwards@gmail.com>
+# Copyright (c) 2018-2023, Christer Edwards <christer.edwards@gmail.com>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -43,6 +43,14 @@ for _jail in ${JAILS}; do
 done
 }

+zfs_destroy_snapshot() {
+for _jail in ${JAILS}; do
+    info "[${_jail}]:"
+    zfs destroy -r "${bastille_zfs_zpool}/${bastille_zfs_prefix}/jails/${_jail}"@"${TAG}"
+    echo
+done
+}
+
 zfs_set_value() {
 for _jail in ${JAILS}; do
    info "[${_jail}]:"
@@ -74,6 +82,8 @@ help|-h|--help)
    ;;
 esac

+bastille_root_check
+
 ## check ZFS enabled
 if [ ! "${bastille_zfs_enable}" = "YES" ]; then
    error_exit "ZFS not enabled."
@@ -101,6 +111,10 @@ snap|snapshot)
    TAG=$2
    zfs_snapshot
    ;;
+destroy_snap|destroy_snapshot)
+    TAG=$2
+    zfs_destroy_snapshot
+    ;;
 df|usage)
    zfs_disk_usage
    ;;
Author	SHA1	Message	Date
Barry McCormick	0065a6b9f0	slash check added	2023-10-17 12:35:25 -07:00
Barry McCormick	10949c0eeb	netmask checking for jail ip	2023-10-17 08:52:32 -07:00
Barry McCormick	3355c07dbf	rdr disable directive fix	2023-10-04 10:13:08 -07:00
Christer Edwards	61e7084b33	Merge pull request #596 from cedwards/2023_release 2023 release	2023-07-14 21:59:49 -06:00
Christer Edwards	3ea553086f	source bastille.conf for pf path support	2023-07-14 21:53:02 -06:00
Christer Edwards	2fd1f2c812	update versions and dates	2023-07-14 21:35:18 -06:00
Christer Edwards	e15a481e46	setup now references bastille_pf_conf variable	2023-07-14 21:07:36 -06:00
Christer Edwards	15f2ea8574	Merge branch 'master' of https://github.com/bastillebsd/bastille into 2023_release	2023-07-14 21:02:30 -06:00
Christer Edwards	4efcc5021c	update copyright dates	2023-07-14 21:02:14 -06:00
Christer Edwards	a2e1befa80	Merge pull request #587 from JRGTH/list_cmd_update list cmd enhancement	2023-07-14 16:37:01 -06:00
Christer Edwards	15c43ee214	Merge pull request #590 from tobiastom/feature/upgrade-documentation Added initial upgrading documentation.	2023-07-14 16:34:52 -06:00
Christer Edwards	a406654e18	Merge pull request #593 from gqgunhed/gqgunhed-linux-releases Updated supported Linux releases	2023-07-14 16:34:24 -06:00
Christer Edwards	7f41973f43	Merge pull request #595 from skenizen/fix-rdr-pf-path /etc/pf.conf path for rdr.sh set by a variable in bastille configuration	2023-07-14 16:32:43 -06:00
skenizen	373ccd45d9	changed the occurence of path /etc/pf.conf in the rdr.sh script for reading it as a variable from the bastille configuration.	2023-07-12 10:57:46 +02:00
gqgunhed	6e78be22f0	added focal+jammy to Apt::Cache-Start Ran into an error without the change when using the "universe" repos, so I included these.	2023-07-10 13:04:25 +02:00
gqgunhed	cf569eaeeb	Updated supported Linux releases Added - Ubuntu2204 - Debian12 Removed - Debian9	2023-07-10 12:19:30 +02:00
gqgunhed	8d16399e50	Added NAME_VERIFY=Ubuntu_2204 section	2023-07-10 12:13:22 +02:00
gqgunhed	bea80db898	Exchanged entry for Debian9 with Debian12	2023-07-10 12:08:47 +02:00
gqgunhed	a89f42242c	Added ubuntu-jammy and bookworm releases removed "stretch" release	2023-07-10 12:04:40 +02:00
gqgunhed	16fae72518	Added Ubuntu Jammy 22.04 LTS	2023-07-10 12:01:01 +02:00
gqgunhed	4891ce69e7	Update bootstrap.sh Changes to include more recent Linux/Debian releases	2023-07-10 11:57:29 +02:00
Christer Edwards	e64a6af214	Merge pull request #592 from BastilleBSD/rdr_fix fix rdr issue detecting IP6 when disabled or not set	2023-06-21 20:36:45 -06:00
Christer Edwards	72b8000347	fix rdr issue detecting IP6 when disabled or not set	2023-06-21 20:34:19 -06:00
Tobias Tom	a0140e18bb	Added initial upgrading documentation. Source: https://gist.github.com/cedwards/1e00c3d0aa6fbb14bc5b16fca8df0c35	2023-05-24 14:15:04 +01:00
Christer Edwards	bc9f4d7e90	Merge pull request #588 from yaazkal/all-target-fix [FIX] Support `ALL` in `pkg` command when using the -H or --host option.	2023-05-12 09:04:34 -06:00
Yaazkal	0b7ed7850a	[FIX] Support `ALL` in `pkg` command when using the -H or --host option.	2023-05-09 21:24:42 -05:00
JRGTH	e454f1c826	list cmd enhancement	2023-05-03 09:02:55 -04:00
Christer Edwards	cb840684ab	Merge pull request #586 from JRGTH/create_fixes Add missing spaces for consistency	2023-05-02 08:08:46 -06:00
JRGTH	2e583cf9ab	Add missing spaces for consistency Add missing spaces for jail.conf content consistency.	2023-05-02 09:55:35 -04:00
Christer Edwards	6ec7ae99f0	Merge pull request #585 from JRGTH/add_version Fix missing version	2023-05-01 11:35:22 -06:00
JRGTH	8f803d511e	Fix missing version	2023-05-01 13:30:54 -04:00
Christer Edwards	c760b817bd	Merge pull request #581 from shirkdog/master Updates for HardenedBSD Installer URL updates	2023-04-05 12:16:51 -06:00
M.Shirk	be50bd2359	Update to default conf	2023-04-05 14:08:37 -04:00
M.Shirk	228420049c	Updates to the hardenedbsd installer URLs for bootstrapping releases.	2023-04-05 14:06:00 -04:00
Christer Edwards	d7609c2bc1	Merge pull request #580 from android-ucet/patch-1 add ipv6 rdr support	2023-03-28 15:31:23 -06:00
android-ucet	bf6fbed2b5	add ipv6 rdr support	2023-03-28 15:03:53 +02:00
Christer Edwards	2e2032fee8	Merge pull request #579 from bsdlme/master Sort bastille usage ouput and update README.md for newer FreeBSD releases	2023-03-23 19:58:26 -06:00
Lars E	a9d8ae2cf1	Merge branch 'BastilleBSD:master' into master	2023-03-23 23:16:41 +01:00
Lars Engels	f936afeae6	Sort bastille usage ouput and update README.md for newer FreeBSD releases	2023-03-23 23:14:39 +01:00
Christer Edwards	5aa98a8dae	Merge pull request #578 from bsdlme/master Add "tags" subcommand to add /delete / list tags	2023-03-23 13:36:35 -06:00
Lars Engels	64c3b6045e	Allow running bastille and subcomands with help flags as regular user	2023-03-16 20:58:11 +01:00
Lars Engels	6776427e5a	Drop "search" in favor of "list"	2023-03-16 18:06:44 +01:00
Lars Engels	10d94668fc	Re-work "list" command / output and add "search" command.	2023-03-15 15:47:54 +01:00
Lars Engels	91d1768740	Add "tags" subcommand	2023-03-14 22:04:06 +01:00
Lars Engels	c94f653e0b	Refactor	2023-03-14 22:03:16 +01:00
Lars Engels	09a1d306dc	Add "bastille tags" subcommand to add tag strings to jails	2023-03-14 21:34:07 +01:00
Christer Edwards	7b63059d03	Merge pull request #573 from drbrain/patch-1 Fix link	2023-02-25 07:09:11 -07:00
Eric Hodel	34669ce2e6	Fix link	2023-02-25 00:37:46 -08:00
Christer Edwards	5c94c283fb	Merge pull request #564 from Efiartes/zfs_destroy_snapshot Added zfs_destroy_snapshot functionality	2023-02-15 07:48:42 -07:00
Christer Edwards	5c84731cd4	Merge pull request #572 from UrsusDominatus/rename_command_vnet_interfaces Rename command now affects name of created vnet interfaces	2023-02-15 07:47:44 -07:00
Roman Marchenko	c016bc0667	Blank line removal	2023-02-15 13:51:46 +01:00
Roman Marchenko	3f665e4738	Rename command now affects name of created vnet interfaces	2023-02-15 13:36:26 +01:00
Christer Edwards	9588d52686	Merge pull request #566 from nwisemanII/SSHIdentBootstrap Accept ssh git addresses in bootstrap	2023-01-16 11:46:16 -07:00
Nico Wiseman	5adc75abed	Clean up the git template name by removing .git from the end - this looks weird in the filesystem	2023-01-16 17:12:03 +00:00
Nico Wiseman	9a00ae5323	Added git endpoint for bastille bootstrap	2023-01-16 16:40:21 +00:00
kr0m	124902d6ba	Added zfs_destroy_snapshot functionality	2022-12-27 08:03:58 +01:00
Christer Edwards	0629233f25	Merge pull request #534 from cqexbesd/config_rebased Make parsing on jail.conf more robust	2022-12-13 20:58:30 -07:00
Christer Edwards	c00d8a4e05	Merge pull request #561 from Vertalo/ip-in-use Fix bug in ip-in-use test	2022-12-13 20:54:58 -07:00
Christer Edwards	bfce059225	Merge pull request #560 from chriswells0/pf-config Make pf table name and external interface configurable.	2022-12-13 20:54:33 -07:00
Christer Edwards	ec7a6d8f6d	Merge pull request #559 from chriswells0/pf-jails Use "bastille config" to get ipv4.addr.	2022-12-13 20:54:11 -07:00
Christer Edwards	0240d6532b	Merge pull request #546 from PythonLinks/master Updating the documentation for public clouds with IPV6 networking.	2022-12-13 20:53:38 -07:00
William Erik Baxter	ec18847f3e	Fix bug in ip-in-use test Need grep -wF instead of grep -w for IP test to avoid spurious match against broadcast address in ifconfig output.	2022-12-04 05:47:15 -06:00
Chris Wells	dd7f195c1e	Make pf table name and external interface configurable. Closes #508	2022-11-26 23:24:33 -05:00
Chris Wells	bdae170529	Use "bastille config" to get ipv4.addr. Fixes issue with jails not being added to pf table.	2022-11-23 22:41:45 -05:00
Christer Edwards	0ee17be875	Merge pull request #558 from BastilleBSD/linux_create_bugfix fixing regression in create.sh for Linux containers	2022-11-02 21:18:00 -06:00
Christer Edwards	778ef6e581	fixing regression in create.sh for Linux containers	2022-11-02 21:17:05 -06:00
Christer Edwards	a73b9972e3	Merge pull request #556 from BastilleBSD/start_stop_order fixes #389 regarding shutdown order	2022-11-01 17:24:44 -06:00
Christer Edwards	6a7ab04d9b	fixes #389 regarding shutdown order	2022-11-01 17:23:00 -06:00
Christer Edwards	937986f4b6	Merge pull request #554 from BastilleBSD/makefile_install_version Makefile install target updates version to match git rev of HEAD	2022-10-27 17:13:55 -06:00
Christer Edwards	a4102c7f61	Makefile install target updates version to match git rev of HEAD	2022-10-27 17:10:54 -06:00
Christer Edwards	3702066864	Merge pull request #536 from cqexbesd/minor Minor Changes	2022-10-27 11:32:27 -06:00
Christer Edwards	79897e9af7	Merge pull request #539 from patmaddox/gcp-docs Document Bastille VNET on GCP	2022-10-27 11:30:34 -06:00
Christer Edwards	55c7c4c6be	Merge pull request #550 from Stormle/master Fixed typo in README.md	2022-10-27 11:26:18 -06:00
Christer Edwards	e5c71c794a	Merge pull request #553 from frikilax/pkg_report_errors PKG::ADDED:: return error code and print error message when 'bastille pkg' fails	2022-10-27 11:25:54 -06:00
Christer Edwards	e04aee2617	Merge pull request #549 from JartX/advanced_mount_types Advanced Mount Types Support	2022-10-27 11:10:38 -06:00
Christer Edwards	0dcefae18c	Merge pull request #435 from CamilionEU/evilham-improve-ipv6-and-dualstack-creation [WIP] [feedback required] Improve dualstack and IPv6 support on jail creation	2022-10-17 20:35:32 -06:00
Théo Bertin	37e607c055	PKG::ADDED:: return error code and print error message when 'bastille pkg' fails This allows better integration of 'bastille pkg' in scripts, and permits to catch errors during 'bastille template' commands	2022-10-14 16:10:52 +00:00
Evilham	f6f179b6c3	Updates for latest commits	2022-10-13 10:49:26 +02:00
Evilham	fdfbb8287f	Improve dualstack and IPv6 support on jail creation This is still WIP / PoC and would require documentation changes, opening PR to gather feedback as this is a first-time contribution. Important changes: - instead of relying on 0.0.0.0 to signal DHCP, we now support passing "DHCP" in the IP parameter. - we also support "SLAAC" as a value for the IP parameter, which enables accepting route advertisement - fixed an oddity in the way the gateway was being handled for IPv6 (in certain cases it was being passed as the GATEWAY template parameter - allow passing multiple values to the IP parameter, this would work as a quoted parameter - that means that, e.g. bastille create -V test 13.0-RELEASE "SLAAC DHCP" wan is possible and creates a dual-stack jail - passing both DHCP, SLAAC and fixed IPs is also possible, but only one IP per protocol number is supported; last one wins	2022-10-13 10:49:26 +02:00
Stormle	44cc3c0b91	Fixed typo in README.md	2022-10-08 01:55:26 +03:00
PythonLinks	2f35d07e58	Update networking.rst Vultr supports FreeBSD and gives us both a single ipv4 and a range of ipv6 addresses. So the simple thing to do is to give each container its own public ipv6 address. No need to mess with vnet. At least that is the theory. Wish me luck in getting this working. Am I really the first person to be using this approach?	2022-10-04 15:58:52 +02:00
Sagformas	d451573889	Advanced Mount Types Support	2022-10-04 11:05:05 +02:00
PythonLinks	64fcda2533	Update networking.rst Polished up this Document.	2022-09-30 07:38:46 +02:00
PythonLinks	ca3303fd4d	Updating the Docs for Coulds with IPV6 networking. I hope I got this all correct. I did get the containers networked correctly on vultr, but I am not a networking guy so I hope I did not misstate anything. Any edits I am happy to fix. And now I have to run, I am late for the multi lingual meetup. But this stuff is way more fun.	2022-09-21 19:27:47 +02:00
Christer Edwards	f1d73a0c02	Merge pull request #543 from tofazzz/master Updated "export" sub-command docs (0.9.20220216)	2022-09-02 09:58:35 -06:00
tofaz	a0abac97ff	Update export.rst	2022-09-02 11:36:43 -04:00
tofaz	6f739229cb	Update export.rst Updated with syntax from 0.9.20220216 as if running just bastille export TARGET it errors with: "Error: Stream can not be written to a terminal. You must redirect standard output. Error: An export option is required, see 'bastille export, otherwise the user must redirect to standard output."	2022-09-02 11:35:45 -04:00
Pat Maddox	427128b9f0	Explain permissive NAT	2022-07-31 00:03:57 -07:00
Pat Maddox	cf6e555ce9	Update GCP docs for default gateway and resolver Bastille can handle it, no need to configure inside the jail.	2022-07-30 23:52:36 -07:00
Pat Maddox	c9d28ceed1	Document Bastille VNET on GCP	2022-07-30 20:59:50 -07:00
Andrew Stevenson	797f406a31	Convert tab to spaces Spaces seem to be the convention for these files, for better or worse, so make things consistent.	2022-07-24 22:16:38 +00:00
Andrew Stevenson	a352fd6507	Expand comment (this should have gone in a previous commit)	2022-07-24 22:16:04 +00:00
Andrew Stevenson	a4ac5e961f	Make parsing on jail.conf more robust jail.conf has a few tricky things about it's format (such as supporting variable expansion) so it is easiest to get jail to do the parsing for us. The changes to get required changes to set as well as we no longer are calling grep so that became a single awk script as well.	2022-07-24 10:27:54 +00:00
Christer Edwards	c50e99b3e7	Merge pull request #533 from cqexbesd/colour Enable colour only when writing to a tty	2022-07-23 21:23:16 -06:00
Andrew Stevenson	a0b7bc54e0	Enable colour only when writing to a tty The escape codes can confuse other scripts and things in pipes	2022-07-23 09:29:42 +00:00
Christer Edwards	639334052f	Merge pull request #532 from cedwards/update_doc_version update versions from 12.x to 13.x	2022-07-22 07:56:32 -06:00
Christer Edwards	40c99ef979	update versions from 12.x to 13.x	2022-07-22 07:55:22 -06:00
Christer Edwards	260149c2a9	Merge pull request #530 from JRGTH/clone_cmd_fixes Update the exec.* with uniq_epair when cloning jails	2022-07-18 10:31:59 -06:00
Christer Edwards	722adc44cb	Merge pull request #531 from cedwards/cmd_bugfix bugfix for cmd when using ALL target	2022-07-18 10:28:11 -06:00
Christer Edwards	e35c59330d	bugfix for cmd when using ALL target	2022-07-17 18:43:13 -06:00
JRGTH	74b6eb76e7	Update the exec.* with uniq_epair when cloning jails This update will fix the startup error after cloning a jail, this was because the exec.prestart/poststop not being properly updated.	2022-07-14 21:41:52 -04:00