Initial impl of vnet jails

6 files changed, 32 insertions, 42 deletions

diff --git a/templates/etc_devd_lan0_jail_restore.conf.j2 b/templates/etc_devd_lan0_jail_restore.conf.j2
deleted file mode 100644
index c59b428..0000000
--- a/templates/etc_devd_lan0_jail_restore.conf.j2
+++ /dev/null
@@ -1,6 +0,0 @@
-notify 10 {
-    match "system"          "IFNET";
-    match "subsystem"       "lan0";
-    match "type"            "LINK_UP";
-    action "/usr/local/bin/restore_jail_aliases.sh";
-};
diff --git a/templates/etc_jail.conf.j2 b/templates/etc_jail.conf.j2
index bcfcef0..86da8de 100644
--- a/templates/etc_jail.conf.j2
+++ b/templates/etc_jail.conf.j2
@@ -1,7 +1,19 @@
-# STARTUP/LOGGING
-exec.start = "/bin/sh /etc/rc";
-exec.stop = "/bin/sh /etc/rc.shutdown";
-exec.consolelog = "/var/log/jail_console_${name}.log";
+# STARTUP/LOGGING/VNET
+$epair            = "epair${num}"; # epairXa is host end, epairXb is jail end
+vnet;
+vnet.interface    = "${epair}b";
+persist;
+exec.prestart    += "ifconfig $epair create || echo 'Failed to create $epair'";
+exec.prestart    += "ifconfig ${epair}a up";
+exec.prestart    += "ifconfig bridge0 addm ${epair}a";
+exec.clean;
+exec.start        = "/bin/sh /etc/rc";
+exec.poststart    = "jexec ${name} ifconfig ${epair}b 192.168.2.${num}/16";
+exec.poststart   += "jexec ${name} route add default 192.168.0.1 || echo 'Failed to add default route'";
+exec.stop         = "/bin/sh /etc/rc.shutdown";
+exec.poststop    += "ifconfig ${epair}b -vnet $name"; # workaround to bug 238326: move ${epair}b from the jail to the host when stopping jail services
+exec.poststop    += "ifconfig ${epair}b destroy";     # and then destroy the pair by destroying one end of it
+exec.consolelog   = "/var/log/jail_console_${name}.log";
 
 # PERMISSIONS
 allow.raw_sockets;
@@ -15,8 +27,7 @@ path = "/usr/local/jails/containers/${name}";
 # JAILS
 {% for jail in jails %}
 {{ jail.name }} {
-  ip4.addr = {{ jail.ip }};
-  interface = lan0;
+  $num           = "{{ jail.num }}";
 }
 
 {% endfor %}
diff --git a/templates/etc_pf.conf.j2 b/templates/etc_pf.conf.j2
index 0b5a756..0bb7fef 100644
--- a/templates/etc_pf.conf.j2
+++ b/templates/etc_pf.conf.j2
@@ -1,10 +1,20 @@
 lan_if = "lan0"
 wan_if = "wan0"
+jail_ingress_ip = "{{ jail_ingress_ip }}"
 
 # Default policy
 set skip on lo
 set block-policy return
 scrub in
+
+# Redirect HTTP to ingress jail
+# TODO: fix these redirects, they seem to not work
+rdr on $wan_if proto tcp from any to ($wan_if) port 80 -> $jail_ingress_ip port 80
+rdr on $wan_if proto tcp from any to ($wan_if) port 443 -> $jail_ingress_ip port 443
+rdr on $lan_if proto tcp from any to ($lan_if) port 80 -> $jail_ingress_ip port 80
+rdr on $lan_if proto tcp from any to ($lan_if) port 443 -> $jail_ingress_ip port 443
+
+# Default block all
 block in all
 
 # Allow all outbound traffic
diff --git a/templates/etc_rc.conf.j2 b/templates/etc_rc.conf.j2
index 641125b..195e599 100644
--- a/templates/etc_rc.conf.j2
+++ b/templates/etc_rc.conf.j2
@@ -14,6 +14,8 @@ ifconfig_lan0="inet {{ lan_ipv4_cidr }}"
 ifconfig_lan0_ipv6="inet6 accept_rtadv"
 ifconfig_wan0="DHCP"
 ifconfig_wan0_ipv6="inet6 accept_rtadv"
+cloned_interfaces="bridge0"
+ifconfig_bridge0="addm lan0 up"
 zpool_gpt_labels_enable="YES"
 smartd_enable="YES"
 pf_enable="YES"
diff --git a/templates/usr_local_bin_restore_jail_aliases.sh.j2 b/templates/usr_local_bin_restore_jail_aliases.sh.j2
deleted file mode 100644
index 25d317f..0000000
--- a/templates/usr_local_bin_restore_jail_aliases.sh.j2
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/bin/sh
-
-# The point of this script is to restore jail aliases
-# if the lan0 interface flaps
-
-if_lan="lan0"
-ipv4_out="$(ifconfig lan0 | grep "inet " | grep -v "0xffffffff")"
-ipv4_lan="$(echo "${ipv4_out}" | awk '{ print $2 }')"
-ipv4_mask="$(echo "${ipv4_out}" | awk '{ print $4 }')"
-
-if ! [ "$ipv4_mask" = "0xffff0000" ]; then
-    >&2 echo "Unexpected netmask on lan0: ${ipv4_mask}"
-    exit 1
-fi
-
-jls ip4.addr | while read ip; do
-    case "$ip" in
-        "192.168"*) ;;
-        *) continue ;;
-    esac
-    if ifconfig "$if_lan" | grep -q "$ip"; then
-        continue
-    fi
-
-    echo "Re-adding $ip to $if_lan"
-    ifconfig "$if_lan" inet "$ip/32" alias
-done
diff --git a/templates/usr_local_etc_nginx_nginx.conf.j2 b/templates/usr_local_etc_nginx_nginx.conf.j2
index fcdaf02..55c55df 100644
--- a/templates/usr_local_etc_nginx_nginx.conf.j2
+++ b/templates/usr_local_etc_nginx_nginx.conf.j2
@@ -22,7 +22,7 @@ http {
 
     {% for site in static_sites -%}
     {% if site.tls -%}
-    server {
+    {#server {
         listen 443 ssl;
         server_name {{ site.host }};
 
@@ -41,7 +41,7 @@ http {
         include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
         ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
     }
-
+    #}
     {% endif -%}
 
     server {
@@ -61,7 +61,7 @@ http {
         server_name {{ jail.name }}.jan.systems {{ jail.name }}.local.jan.systems;
 
         location / {
-            proxy_pass http://{{ jail.ip }};
+            proxy_pass http://192.168.2.{{ jail.num }};
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;