diff --git a/README.md b/README.md index 912e2b3..1938543 100644 --- a/README.md +++ b/README.md @@ -372,6 +372,18 @@ The last step is to remove the current running jail, change the version in `etc/ If there's anything wrong you can always go back to the previous version using the above steps. +## Advanced Features +Jaildk also offers some advanced features like automatically setting up and deleting ipfw rules or freezing and thawing a jail (to make it easily portable). +### Using the IPFW +To use the IPFW on your host you first have to enable ipfw in your hosts rc.conf `firewall_enable="YES"`. +You probably want to set the default firewalling-type there aswell, check out the [FreeBSD handbook](https://www.freebsd.org/doc/handbook/firewalls-ipfw.html) for further information. +Once enabled you also need to start ipfw by executing the rc script: `/etc/rc.d/ipfw start`. +Be aware that inter-jail communication is transfered via the loopback interface (normally lo0) for which there is a high priority allow any to any rule by default: `allow ip from any to any via lo` +In order to control the inter-jail communication you have to delete this rule first. + +If an ipfw.conf exists for a jail (e.g. /jail/etc/myjail/ipfw.conf) the rules inside that config file are added when starting, and deleted when stopping the jail. +E.g. allowing HTTP/HTTPS traffic for that jail (webserver): `allow tcp from any to $ip setup keep-state` +As demonstrated in the previous rule `$ip` is reserved and automatically replaced with the jails own ip (as reported by `jls`). ## Getting help @@ -389,6 +401,7 @@ This software is licensed under the BSD license. ## Authors T.v.Dein + F.Sass (Culsu) ## Project homepage diff --git a/jaildk b/jaildk index ac98e0e..f30cb85 100755 --- a/jaildk +++ b/jaildk @@ -715,7 +715,7 @@ jaildk_clone() { clone $j/data/$src/www $j/data/$new/www clone $j/data/$src/spool $j/data/$new/spool - ex cp -pRp $j/etc/$src/mount.conf $j/etc/$src/ports.conf $j/etc/$src/mtree.conf $j/etc/$new/ + ex cp -pRp $j/etc/$src/mount.conf $j/etc/$src/ports.conf $j/etc/$src/mtree.conf $j/etc/$src/ipfw.conf $j/etc/$new/ echo "Creating $j/etc/$src/jail.conf" cat $j/etc/$src/jail.conf | egrep -v "^(name|version)=" > $j/etc/$new/jail.conf @@ -782,9 +782,11 @@ jaildk_create() { jaildk_clone -s $src -d $jail -o $srcversion -n $newversion # some perl magic to extract the hostname (if any) from /etc/jail.conf - and write it into the jails rc.conf jailhostname=$(cat /etc/jail.conf | tr -d '\t\r\n ' | perl -ne '$_ =~ /.*'"$newjail"'(\{(?:\{.*\}|[^{])*\})|\w+/; print $1;' | grep -oE 'hostname=[^;]+' | cut -d= -f2) - [ -n "$jailhostname" ] && sed -iE 's/^hostname.*$/hostname="'"$jailhostname"'"/' $j/etc/$newjail/local-etc-$newversion/rc.conf - - + if [ -n "$jailhostname" ]; then + echo "new name: $jailhostname" + echo "in path $j/etc/$jail/local-etc-$newversion/rc.conf" + sed -iE 's/^hostname.*$/hostname="'"$jailhostname"'"/' $j/etc/$newjail/local-etc-$newversion/rc.conf + fi } remove() { @@ -903,6 +905,7 @@ jaildk_jail() { ;; *) service jail $mode $jail + jaildk_ipfw $jail $mode ;; esac fi @@ -1162,6 +1165,9 @@ home/$name/root-$version $name/root nullfs rw' > bold "creating template config $j/etc/.template/ports.conf" (echo bash; echo ca_root_nss) > $j/etc/.template/ports.conf + bold "creating template config $j/etc/.template/ipfw.conf" + touch $j/etc/.template/ipfw.conf + bold "creating template config $j/etc/.template/mtree.conf" # touch $j/etc/.template/mtree.conf echo '/set type=dir uid=0 gid=0 mode=01777 @@ -1460,6 +1466,42 @@ jaildk_thaw() { bold "Done. Thawed jail $jail $version from $image." } +jaildk_ipfw() { + jail=$1 + mode=$2 + if [ -f "$j/etc/$jail/ipfw.conf" ]; then + echo + bold "Managing IPFW Rules..." + case $mode in + start) + jaildk_ipfw_delete $jail "y" + jaildk_ipfw_add $jail + ;; + stop) + jaildk_ipfw_delete $jail + ;; + esac + bold "... done" + echo + fi +} + +jaildk_ipfw_add() { + jail=$1 + # Getting current jails IP.. + jailip=$(jls | grep -E "$jail\$" | awk '{print $2}') + # Adding rules + cat $j/etc/$jail/ipfw.conf | awk -v jailname="$jail" '{print "ipfw add "$0" // " jailname}' | sed -E "s/\\\$ip/$jailip/g" | while read rule; do $rule; done + +} + +jaildk_ipfw_delete() { + jail=$1 + noout=$2 + # Deleting rules + ipfw show | grep -E "// $jail\$" | while read rule; do [ -z "$2" ] && bold "Deleting rule $rule"; sh -c "ipfw delete $(echo $rule| awk '{print $1}')"; done + +} ########################## #