20 Commits
v0.39 ... api

Author SHA1 Message Date
yo
2507f10b59 Add freebsd-update conf, add doFileExist, getCurrentRcKeyValue and addRcKeyValue, fix zfsGetDatasetByMountpoint and executeCommand output 2024-09-22 15:10:58 +02:00
yo
900e1939f3 Add init subcommand 2024-09-22 15:10:53 +02:00
yo
43a958cdec Update viper and cobra versions 2024-09-22 15:06:57 +02:00
yo
5b9862d641 Remove cmd/freebsd-update.conf.go, freebsd-update conf goes in utils.go 2024-09-22 15:06:34 +02:00
yo
7ca633d946 BUGFIX stopJail: Destroy interfaces once, whatever the current configuration 2024-09-05 10:05:21 +02:00
yo
199b3b1f7f Add start api command 2024-09-05 09:34:10 +02:00
yo
372e92fc41 Add start api command 2024-09-05 09:34:05 +02:00
yo
2afccc5a0e go version bump to 1.21, add gin-gonic dependency 2024-09-05 09:33:24 +02:00
yo
3d77209b53 Replace Printf with log.Debugf 2024-09-05 09:32:40 +02:00
yo
5ce62bc7de Add PrintJSON() for API use 2024-09-05 09:32:13 +02:00
yo
0e0ab8c653 Update Running, JID and InternalName values by ref so API will get fresh values 2024-09-05 09:28:05 +02:00
yo
3b548e4c85 ListJailProps() : Replace unused args with format + v0.42a WIP 2024-09-05 09:18:18 +02:00
yo
9d7db268cc ListJailsProps() : Replace unused args with format 2024-09-05 09:16:32 +02:00
yo
4cc1c476aa Show bridge name in errors + version bump to 0.41 2024-08-20 11:29:56 +02:00
yo
ce79783540 README update 2024-04-20 20:37:50 +02:00
yo
18d35b9224 v0.40: basejail now created from NN.N-RELEASE 2024-04-20 20:35:17 +02:00
yo
f41c93368d Update TODO 2024-04-20 20:33:59 +02:00
yo
452b0e4b4e BUGFIX starting jail with dhcp 2024-04-20 20:32:51 +02:00
yo
dbe9622a01 BUGFIX: enable accept_rtadv and rtsold_enable 2024-02-11 11:14:28 +01:00
yo
6ead474a78 BUGFIX on mac handling when none + BUGFIX on mac generation (+1 for jailside) 2024-02-11 10:17:31 +01:00
12 changed files with 676 additions and 312 deletions

View File

@ -22,13 +22,9 @@ gocage create jail1 -r 13.2-RELEASE
gocage set Config.Ip4_addr="vnet0|192.168.1.91/24" Config.Vnet=1 jail1
</code></pre>
Create basejail (jail based on a template, system will be nullfs read-only mounted from the template):
Create basejail (jail based on a release, system will be nullfs read-only mounted from the release directory):
<pre><code>
# First create basetpl from 13.2-RELEASE, set it as a template
gocage create -r 13.2-RELEASE basetpl
gocage set Config.Jailtype="template" basetpl
# Then create basejail1 based on basetpl
gocage create -b basetpl basejail1
gocage create -b -r 14.0-RELEASE basejail1
</code></pre>

11
TODO.md
View File

@ -1,8 +1,19 @@
Replicating jails between two servers (use zrepl)
Manage remote jails :
- Make gocage a service
- All commands should become API endpoint
- How to handle authentication ?
DEBUG:
- cmd/list.go:275:
// FIXME ??? Shouldn't be ioc-$Name ?
j.InternalName = rj.Name
- WriteConfigToDisk don't write neither "release" in cmd stop neither "last_started" in cmd start
26/08/2023 : Last_started is updated
BUGS:
- unable to set values containing equal sign :
# gocage set Config.Exec_poststart="jail -m allow.mount.linprocfs=1 name=ioc-poudriere-noo" poudriere-noo
Error parsing args: Config.Exec_poststart=jail -m allow.mount.linprocfs=1 name=ioc-poudriere-noo
- Fix fstab when migrating jail

96
cmd/api.go Normal file
View File

@ -0,0 +1,96 @@
package cmd
import (
//"io"
"fmt"
"strings"
"net/http"
"github.com/gin-gonic/gin"
"github.com/gin-contrib/cors"
)
func printJails(jails []string, fields []string) ([]byte, error) {
var res []byte
res = append(res, []byte("[")...)
// Build a filtered jail list
var filteredJails []Jail
if (len(jails) >= 1 && len(jails[0]) > 0) {
for _, j := range gJails {
if isStringInArray(jails, j.Name) {
filteredJails = append(filteredJails, j)
}
}
} else {
filteredJails = gJails
}
for i, j := range filteredJails {
out, err := j.PrintJSON(fields)
if err != nil {
return res, err
}
res = append(res, out...)
if i < len(filteredJails) - 1 {
res = append(res, []byte(",")...)
}
}
res = append(res, []byte("]")...)
return res, nil
}
func startApi(address string, port int) {
// Initialize gJails.
// FIXME: How to update this at running time without doubling the same jails?
// core will do this for us in add and delete functions
ListJails([]string{""}, false)
r := gin.Default()
// Cross Origin Request Support
config := cors.DefaultConfig()
// DANGER !
config.AllowOrigins = []string{"*"}
r.Use(cors.New(config))
r.GET("/jail/list", func(c *gin.Context) {
jailstr := c.Query("jail")
fields := c.Query("fields")
if len(fields) == 0 {
// TODO : Put this default value in (user?) configuration
fields = "Name,Running,Config.Release,Config.Ip4_addr"
}
jsout, err := printJails(strings.Split(jailstr, ","), strings.Split(fields, ","))
if err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"status": 1, "error": err.Error()})
} else {
c.Data(http.StatusOK, "application/json", jsout)
}
})
r.POST("/jail/start/:jail", func(c *gin.Context) {
jailstr := c.Params.ByName("jail")
// TODO : Capture or redirect output so we can know if jail was started or not
StartJail(strings.Split(jailstr, ","))
c.JSON(http.StatusOK, gin.H{"status": 0, "error": ""})
})
r.POST("/jail/stop/:jail", func(c *gin.Context) {
jailstr := c.Params.ByName("jail")
// TODO : Capture or redirect output so we can know if jail was started or not
StopJail(strings.Split(jailstr, ","))
c.JSON(http.StatusOK, gin.H{"status": 0, "error": ""})
})
r.GET("/jail/properties", func(c *gin.Context) {
props, err := ListJailsProps("json")
if err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"status": 1, "error": err.Error()})
} else {
c.Data(http.StatusOK, "application/json", []byte(props))
}
})
r.Run(fmt.Sprintf("%s:%d", address, port))
}

View File

@ -16,6 +16,11 @@ func CreateJail(args []string) {
var err error
var jtype []string
if gCreateArgs.BaseJail && gCreateArgs.Release == "" {
fmt.Println("Release should be set when creating basejail")
os.Exit(1)
}
if len(gCreateArgs.JailType) > 0 {
jtype = []string{gCreateArgs.JailType}
}
@ -50,21 +55,20 @@ func CreateJail(args []string) {
}
// Get base template if specified
if len(gCreateArgs.BaseTemplate) > 0 {
if gCreateArgs.BaseJail {
/**************************************************************************
* Create based jail from a template
*/
log.Debugf("Jail will be created from a base template\n")
bj, err := getJailFromArray(gCreateArgs.BaseTemplate, []string{"template"}, gJails)
if err != nil {
if strings.EqualFold(err.Error(), "Jail not found") {
fmt.Printf("Template not found\n")
return
} else {
fmt.Printf("ERROR: %s\n", err.Error())
return
}
log.Debugf("Jail will be created read-only from release %s\n", gCreateArgs.Release)
// First check if we got release on the same datastore
releasePath := fmt.Sprintf("%s/releases/%s/root", ds.Mountpoint, gCreateArgs.Release)
_, err := os.Stat(releasePath)
if os.IsNotExist(err) {
fmt.Printf("ERROR: Release locally not available. Run \"gocage fetch\"\n")
return
}
// Create jail datasets
dstDset := fmt.Sprintf("%s/jails/%s", ds.ZFSDataset, jname)
fmt.Printf(" > Initialize dataset %s\n", dstDset)
@ -87,7 +91,7 @@ func CreateJail(args []string) {
dstRootDir := fmt.Sprintf("%s/jails/%s/root", ds.Mountpoint, jname)
for _, d := range append(gBaseDirs, gEmptyDirs...) {
dstPath := dstRootDir
srcPath := bj.RootPath
srcPath := releasePath
for _, cd := range strings.Split(d, "/") {
srcPath = fmt.Sprintf("%s/%s", srcPath, cd)
dstPath = fmt.Sprintf("%s/%s", dstPath, cd)
@ -110,9 +114,9 @@ func CreateJail(args []string) {
// Copy these from basejail
fmt.Printf(" > Create base writable directories\n")
for _, d := range gCopyDirs {
err := cp.Copy(fmt.Sprintf("%s/%s", bj.RootPath, d), fmt.Sprintf("%s/%s", dstRootDir, d))
err := cp.Copy(fmt.Sprintf("%s/%s", releasePath, d), fmt.Sprintf("%s/%s", dstRootDir, d))
if err != nil {
fmt.Printf("ERROR copying %s to %s: %s\n", fmt.Sprintf("%s/%s", bj.RootPath, d),
fmt.Printf("ERROR copying %s to %s: %s\n", fmt.Sprintf("%s/%s", releasePath, d),
fmt.Sprintf("%s/%s", dstRootDir, d), err.Error())
return
}
@ -150,7 +154,7 @@ func CreateJail(args []string) {
// 2. Add a json item to config ("basejail_template" p.e.), but iocage would delete it once jail is started from iocage
// 3. Add a gocage specific config ("config.gocage.json" p.e.)
j.Config.Jailtype = "basejail"
j.Config.Origin = bj.Name
j.Config.Origin = gCreateArgs.Release
j.Config.Host_hostname = jname
j.Config.Host_hostuuid = jname
@ -166,7 +170,7 @@ func CreateJail(args []string) {
defer fstabHandle.Close()
for _, d := range gBaseDirs {
fmt.Fprintf(fstabHandle, "%s\t%s\tnullfs\tro\t0\t0\n", fmt.Sprintf("%s/%s", bj.RootPath, d), fmt.Sprintf("%s/%s", dstRootDir, d))
fmt.Fprintf(fstabHandle, "%s\t%s\tnullfs\tro\t0\t0\n", fmt.Sprintf("%s/%s", releasePath, d), fmt.Sprintf("%s/%s", dstRootDir, d))
}
fmt.Printf(" > Jail created!\n")

View File

@ -1,85 +0,0 @@
package cmd
const (
fbsdUpdateConfig = `
# $FreeBSD$
# Trusted keyprint. Changing this is a Bad Idea unless you've received
# a PGP-signed email from <security-officer@FreeBSD.org> telling you to
# change it and explaining why.
KeyPrint 800651ef4b4c71c27e60786d7b487188970f4b4169cc055784e21eb71d410cc5
# Server or server pool from which to fetch updates. You can change
# this to point at a specific server if you want, but in most cases
# using a "nearby" server won't provide a measurable improvement in
# performance.
ServerName update.FreeBSD.org
# Components of the base system which should be kept updated.
Components world
# Example for updating the userland and the kernel source code only:
# Components src/base src/sys world
# Paths which start with anything matching an entry in an IgnorePaths
# statement will be ignored.
IgnorePaths
# Paths which start with anything matching an entry in an IDSIgnorePaths
# statement will be ignored by "freebsd-update IDS".
IDSIgnorePaths /usr/share/man/cat
IDSIgnorePaths /usr/share/man/whatis
IDSIgnorePaths /var/db/locate.database
IDSIgnorePaths /var/log
# Paths which start with anything matching an entry in an UpdateIfUnmodified
# statement will only be updated if the contents of the file have not been
# modified by the user (unless changes are merged; see below).
UpdateIfUnmodified /etc/ /var/ /root/ /.cshrc /.profile
# When upgrading to a new FreeBSD release, files which match MergeChanges
# will have any local changes merged into the version from the new release.
MergeChanges /etc/
### Default configuration options:
# Directory in which to store downloaded updates and temporary
# files used by FreeBSD Update.
WorkDir /iocage/freebsd-update
# Destination to send output of "freebsd-update cron" if an error
# occurs or updates have been downloaded.
# MailTo root
# Is FreeBSD Update allowed to create new files?
# AllowAdd yes
# Is FreeBSD Update allowed to delete files?
# AllowDelete yes
# If the user has modified file ownership, permissions, or flags, should
# FreeBSD Update retain this modified metadata when installing a new version
# of that file?
# KeepModifiedMetadata yes
# When upgrading between releases, should the list of Components be
# read strictly (StrictComponents yes) or merely as a list of components
# which *might* be installed of which FreeBSD Update should figure out
# which actually are installed and upgrade those (StrictComponents no)?
StrictComponents yes
# When installing a new kernel perform a backup of the old one first
# so it is possible to boot the old kernel in case of problems.
BackupKernel no
# If BackupKernel is enabled, the backup kernel is saved to this
# directory.
# BackupKernelDir /boot/kernel.old
# When backing up a kernel also back up debug symbol files?
BackupKernelSymbolFiles no
# Create a new boot environment when installing patches
CreateBootEnv no
`
)

View File

@ -15,23 +15,37 @@ import (
* List all properties a jail have, with their internal name
* Only print properties name. To get name & values, use GetJailProperties()
*******************************************************************************/
func ListJailsProps(args []string) {
func ListJailsProps(format string) (string, error) {
var conf Jail
var result []string
var props []string
var out string
// Mandatory constructor to init default values
jailconf, err := NewJailConfig()
if err != nil {
fmt.Printf("Error allocating JailConfig: %s\n", err.Error())
return
return out, err
}
conf.Config = jailconf
result = getStructFieldNames(conf, result, "")
props = getStructFieldNames(conf, props, "")
for _, f := range result {
fmt.Printf("%s\n", f)
if format == "json" {
out = "{\"properties\":["
for i, p := range props {
out += fmt.Sprintf("\"%s\"", p)
if i < len(props) - 1 {
out += ","
}
}
out += "]}"
} else {
for _, p := range props {
out += fmt.Sprintf("%s\n", p)
}
}
return out, nil
}
/********************************************************************************

View File

@ -14,7 +14,7 @@ import (
)
const (
gVersion = "0.39"
gVersion = "0.42b"
// TODO : Get from $jail_zpool/defaults.json
MIN_DYN_DEVFS_RULESET = 1000
@ -22,12 +22,15 @@ const (
type createArgs struct {
Release string
BaseTemplate string
BaseJail bool
Datastore string
JailType string
}
var (
gApiAddress string
gApiPort int
gJailHost JailHost
gJails []Jail
gDatastores []Datastore
@ -56,6 +59,9 @@ var (
gTimeZone string
gSnapshotName string
gZPool string
gBridge string
gInterface string
gMigrateDestDatastore string
gYesToAll bool
@ -97,19 +103,13 @@ It support iocage jails and can coexist with iocage.`,
},
}
/* TODO
Initialize datastore(s) /iocage, /iocage/jails
Put defaults.json, update it with hostid,interfaces, and maybe other necessary fields
Initialize bridge
initCmd = &cobra.Command{
Use: "init",
Short: "Initialize GoCage",
//Long: `Let this show you how much fail I had to get this *cough* perfect`,
Run: func(cmd *cobra.Command, args []string) {
fv, _ := getFreeBSDVersion()
fmt.Printf("GoCage v.%s on FreeBSD %d.%d-%s\n", gVersion, fv.major, fv.minor, fv.flavor)
InitGoCage(args)
},
}*/
}
listCmd = &cobra.Command{
Use: "list",
@ -127,7 +127,12 @@ ex: gocage list srv-db srv-web`,
Short: "Print jails properties",
Long: "Display jails properties. You can use properties to filter, get or set them.",
Run: func(cmd *cobra.Command, args []string) {
ListJailsProps(args)
out, err := ListJailsProps("text")
if err != nil {
fmt.Printf("Error listing properties : %v\n", err)
} else {
fmt.Printf("%s\n", out)
}
},
}
@ -357,6 +362,14 @@ You can specify multiple datastores.`,
},
}
apiCmd = &cobra.Command{
Use: "startapi",
Short: "Run docage as a daemon, exposing API",
Run: func(cmd *cobra.Command, args []string) {
startApi(gApiAddress, gApiPort)
},
}
testCmd = &cobra.Command{
Use: "test",
Short: "temporary command to test some code snippet",
@ -379,6 +392,10 @@ func init() {
rootCmd.PersistentFlags().BoolVar(&gDebug, "debug", false, "Debug mode")
// Command dependant switches
initCmd.Flags().StringVarP(&gZPool, "pool", "p", "", "ZFS pool to create datastore on")
initCmd.Flags().StringVarP(&gBridge, "bridge", "b", "", "bridge to create for jails networking")
initCmd.Flags().StringVarP(&gInterface, "interface", "i", "", "interface to add as bridge member. This should be your main interface")
initCmd.MarkFlagsRequiredTogether("bridge", "interface")
// We reuse these flags in "gocage snapshot list myjail" and 'gocage datastore list" commands
listCmd.Flags().StringVarP(&gDisplayJColumns, "outcol", "o", "JID,Name,Config.Release,Config.Ip4_addr,Running", "Show these columns in output")
@ -420,10 +437,14 @@ func init() {
upgradeCmd.MarkFlagRequired("release")
createCmd.Flags().StringVarP(&gCreateArgs.Release, "release", "r", "", "Release for the jail (e.g.: \"13.1-RELEASE\"")
createCmd.Flags().StringVarP(&gCreateArgs.BaseTemplate, "basetpl", "b", "", "Base template. This will create a jail based on basetpl, so every up(date|grade) made to basetpl will immediately propagate to new jail\n")
createCmd.Flags().BoolVarP(&gCreateArgs.BaseJail, "basejail", "b", false, "Basejail. This will create a jail mounted read only from a release, so every up(date|grade) made to this release will immediately propagate to new jail.\n")
createCmd.Flags().StringVarP(&gCreateArgs.Datastore, "datastore", "d", "", "Datastore to create the jail on. Defaults to first declared in config.")
apiCmd.Flags().StringVarP(&gApiAddress, "listen-addr", "l", "127.0.0.1", "API listening address")
apiCmd.Flags().IntVarP(&gApiPort, "listen-port", "p", 1234, "API listening port")
// Now declare commands
rootCmd.AddCommand(initCmd)
rootCmd.AddCommand(versionCmd)
rootCmd.AddCommand(listCmd)
listCmd.AddCommand(listPropsCmd)
@ -441,7 +462,7 @@ func init() {
rootCmd.AddCommand(updateCmd)
rootCmd.AddCommand(upgradeCmd)
rootCmd.AddCommand(createCmd)
rootCmd.AddCommand(apiCmd)
rootCmd.AddCommand(testCmd)
snapshotCmd.AddCommand(snapshotListCmd)
@ -472,17 +493,6 @@ func initConfig() {
os.Exit(1)
}
// Load default configs from datastores
err := ListDatastores(viper.GetStringSlice("datastore"), false)
if err != nil {
fmt.Printf("ERROR: error checking datastores: %v\n", err)
os.Exit(1)
}
// fmt.Println("Using config file:", viper.ConfigFileUsed())
// fmt.Printf("datastore in config : %s\n", viper.GetStringSlice("datastore"))
// fmt.Printf("datastore.0 in config : %s\n", viper.GetStringSlice("datastore.0"))
// Command line flags have priority on config file
if rootCmd.Flags().Lookup("sudo") != nil && false == rootCmd.Flags().Lookup("sudo").Changed {
gUseSudo = viper.GetBool("sudo")
@ -516,11 +526,25 @@ func initConfig() {
os.Exit(1)
}
if gDebug {
log.SetLevel(log.DebugLevel)
log.Debugf("Debug mode enabled\n")
}
// no need to check prerequesites if we are initializing gocage
for _, rc := range rootCmd.Commands() {
//fmt.Printf("DEBUG: rootCmd subcommand: %v. Was it called? %s\n", rc.Use, rootCmd.Commands()[i].CalledAs())
if len(rc.CalledAs()) > 0 && strings.EqualFold("init", rc.CalledAs()) {
return
}
}
// Load default configs from datastores
err := ListDatastores(viper.GetStringSlice("datastore"), false)
if err != nil {
fmt.Printf("ERROR: error checking datastores: %v\n", err)
os.Exit(1)
}
}

View File

@ -340,7 +340,7 @@ func configureDhcpOrAcceptRtadv(jail *Jail, ipproto int, enable bool) error {
if ipproto == IPv6 {
key = fmt.Sprintf("%s_ipv6", key)
value = "inet6 auto_linklocal accept_rtadv autoconf"
value = "\"inet6 auto_linklocal accept_rtadv autoconf\""
}
if enable == true {
@ -363,7 +363,7 @@ func checkRtsold(jail *Jail) error {
if strings.Contains(jail.Config.Ip6_addr, "accept_rtadv") == false {
return fmt.Errorf("Must set at least one ip6_addr to accept_rtadv!\n")
}
err := enableRcKeyValue(jail.ConfigPath, "rtsold_enable", "yes")
err := enableRcKeyValue(fmt.Sprintf("%s/etc/rc.conf", jail.RootPath), "rtsold_enable", "yes")
if err != nil {
return fmt.Errorf("ERROR setting rtsold_enable=YES with sysrc for jail %s: %s\n", jail.Name, err)
}
@ -810,7 +810,9 @@ func generateMAC(jail *Jail, nic string) ([]byte, []byte, error) {
}
hsmac := append(prefix, suffix...)
jsmac := append(hsmac[:5], hsmac[5]+1)
jsmac := make([]byte, 6)
copy(jsmac, hsmac)
jsmac[5] = jsmac[5] + 1
// Save MACs to config
pname := fmt.Sprintf("Config.%s_mac", strings.Title(nic))
@ -853,6 +855,12 @@ func setupVnetInterfaceHostSide(jail *Jail) ([]string, error) {
return []string{}, err
}
} else {
if strings.EqualFold(val.String(), "none") {
hsmac, _, err = generateMAC(jail, nic)
if err != nil {
return []string{}, err
}
}
hsmac, err = hex.DecodeString(strings.Split(val.String(), " ")[0])
if err != nil {
return []string{}, fmt.Errorf("Error converting %s to hex\n", strings.Split(val.String(), " ")[0])
@ -862,7 +870,7 @@ func setupVnetInterfaceHostSide(jail *Jail) ([]string, error) {
// Get bridge MTU
mtu, err := gJailHost.GetBridgeMTU(bridge)
if err != nil {
return []string{}, fmt.Errorf("Error getting bridge mtu: %v\n", err)
return []string{}, fmt.Errorf("Error getting bridge \"%s\" mtu: %v\n", bridge, err)
}
// Create epair interface
@ -912,7 +920,9 @@ func setupVnetInterfaceJailSide(jail *Jail, hostepairs []string) error {
for _, i := range strings.Split(jail.Config.Ip4_addr, ",") {
v := strings.Split(i, "|")
ip4s[v[0]] = v[1]
if len(v) > 1 {
ip4s[v[0]] = v[1]
}
}
for _, i := range strings.Split(jail.Config.Ip6_addr, ",") {
v := strings.Split(i, "|")
@ -966,7 +976,7 @@ func setupVnetInterfaceJailSide(jail *Jail, hostepairs []string) error {
// Get bridge MTU
mtu, err := gJailHost.GetBridgeMTU(bridge)
if err != nil {
return fmt.Errorf("Error getting bridge %s mtu: %v\n", bridge, err)
return fmt.Errorf("Error getting bridge \"%s\" mtu: %v\n", bridge, err)
}
cmd = fmt.Sprintf("/usr/sbin/jexec %d ifconfig %s mtu %d", jail.JID, jsepair, mtu)
@ -1411,6 +1421,25 @@ func StartJail(args []string) {
}
}
// Get a reference to current jail, to update its properties in RAM so API will get fresh data
for i, j := range gJails {
if strings.EqualFold(j.Name, cj.Name) && strings.EqualFold(j.Datastore, cj.Datastore) {
if err = setStructFieldValue(&gJails[i], "Running", "true"); err != nil {
fmt.Printf("ERROR: setting Running property to true: %s\n", err.Error())
}
if err = setStructFieldValue(&gJails[i], "JID", fmt.Sprintf("%d", cj.JID)); err != nil {
fmt.Printf("ERROR: setting JID property to %d: %s\n", cj.JID, err.Error())
}
if err = setStructFieldValue(&gJails[i], "InternalName", cj.InternalName); err != nil {
fmt.Printf("ERROR: Setting InternalName property: %s\n", err.Error())
}
// FIXME: this value of devfs_ruleset should not go in Config, it should reside in Jail root properties as it is volatile (only valid while jail is running)
/*if err = setStructFieldValue(&gJails[i], "Devfs_ruleset", "0"); err != nil {
fmt.Printf("ERROR: setting Devfs_ruleset property to 0: %s\n", err.Error())
}*/
}
}
hostInt, err := gJailHost.GetInterfaces()
if err != nil {
fmt.Printf("Error listing jail host interfaces: %v\n", err)
@ -1438,7 +1467,7 @@ func StartJail(args []string) {
fmt.Printf(" > Setup VNet network: OK\n")
// Set default route, unless main network is dhcp
if ! cj.isFirstNetDhcp() {
if ! cj.isFirstNetDhcp() && !strings.EqualFold(cj.Config.Ip4_addr, "none") {
fmt.Printf(" > Setup default ipv4 gateway:\n")
cmd := fmt.Sprintf("/usr/sbin/setfib %s /usr/sbin/jexec %d route add default %s", cj.Config.Exec_fib, cj.JID, cj.Config.Defaultrouter)
out, err := executeCommand(cmd)

View File

@ -7,8 +7,8 @@ import (
"sync"
"errors"
"regexp"
"slices"
"os/exec"
//"reflect"
"strconv"
"strings"
@ -83,15 +83,43 @@ func umountAndUnjailZFS(jail *Jail) error {
}
func destroyVNetInterfaces(jail *Jail) error {
// Wherever ipv6/ipv4 is enabled, if interface exist we destroy it
var vnetnames []string
for _, i := range strings.Split(jail.Config.Ip4_addr, ",") {
iname := fmt.Sprintf("%s.%d", strings.Split(i, "|")[0], jail.JID)
fmt.Printf("%s: ", iname)
_, err := executeCommand(fmt.Sprintf("ifconfig %s destroy", iname))
//_, err := executeScript(fmt.Sprintf("ifconfig %s destroy >/dev/null 2>&1", iname))
if len(strings.Split(i, "|")) == 2 {
iname := fmt.Sprintf("%s.%d", strings.Split(i, "|")[0], jail.JID)
if !slices.Contains(vnetnames, iname) {
vnetnames = append(vnetnames, iname)
}
}
}
for _, i := range strings.Split(jail.Config.Ip6_addr, ",") {
if len(strings.Split(i, "|")) == 2 {
iname := fmt.Sprintf("%s.%d", strings.Split(i, "|")[0], jail.JID)
if !slices.Contains(vnetnames, iname) {
vnetnames = append(vnetnames, iname)
}
}
}
for _, iname := range vnetnames {
fmt.Printf(" >%s: ", iname)
_, err := executeCommand(fmt.Sprintf("ifconfig %s", iname))
if err != nil {
return err
if strings.Contains(err.Error(), "does not exist") {
fmt.Printf("OK\n")
} else {
fmt.Printf("ERR: %v\n", err)
return err
}
} else {
fmt.Printf("OK\n")
_, err := executeCommand(fmt.Sprintf("ifconfig %s destroy", iname))
if err != nil {
fmt.Printf("ERR: %v\n", err)
return err
} else {
fmt.Printf("OK\n")
}
}
}

View File

@ -1,7 +1,10 @@
package cmd
import (
"fmt"
"sort"
"time"
"strings"
)
const (
@ -561,3 +564,90 @@ type DatastoreSort struct {
AvailableDec datastoreLessFunc
}
type Field struct {
Name string
MaxLen int
Value string
}
func (j *Jail) PrintJSON(fields []string) ([]byte, error) {
return j.PrintJSONWithUpper("", fields)
}
func (j *Jail) PrintJSONWithUpper(upper string, fields []string) ([]byte, error) {
var res []byte
if len(fields) < 1 {
return res, nil
}
if len(upper) > 0 {
res = append(res, []byte(fmt.Sprintf("\"%s\": {", upper))...)
} else {
res = append(res, []byte("{")...)
}
// Reorder fields so we got fields of a sub-structure adjacents
sort.Strings(fields)
var ffname string
offset := 0
for i, _ := range fields {
if i + offset >= len(fields) {
break
}
// Is this struct in struct?
if strings.Contains(fields[i+offset], ".") {
// Count items in this struct
var subfields []string
var newUpper string
for _, sf := range fields[i+offset:] {
if strings.Split(sf, ".")[0] == strings.Split(fields[i+offset], ".")[0] {
newUpper = strings.Split(sf, ".")[0]
sub := strings.Join(strings.Split(string(sf), ".")[1:], ".")
subfields = append(subfields, sub)
}
}
out, err := j.PrintJSONWithUpper(newUpper, subfields)
if err != nil {
return []byte{}, err
}
res = append(res, out...)
offset += len(subfields)-1
if i + offset < len(fields) - 1 {
res = append(res, []byte(",")...)
}
continue
}
if len(upper) > 0 {
ffname = fmt.Sprintf("%s.%s", upper, fields[i+offset])
} else {
ffname = fields[i+offset]
}
val, _, err := getStructFieldValue(j, ffname)
if err != nil {
return []byte{}, fmt.Errorf("Error accessing field \"%s\" : %v\n", fields[i+offset], err)
}
res = append(res, []byte(fmt.Sprintf("\"%s\": ", fields[i+offset]))...)
switch val.Interface().(type) {
case string:
res = append(res, []byte(fmt.Sprintf("\"%s\"", val.Interface().(string)))...)
case int:
res = append(res, []byte(fmt.Sprintf("%d", val.Interface().(int)))...)
case bool:
res = append(res, []byte(fmt.Sprintf("%t", val.Interface().(bool)))...)
default:
fmt.Printf("ERREUR dans Jail.PrintJSONWithUpper() : Type inconnu : %T\n", val.Interface())
}
if i + offset < len(fields) - 1 {
res = append(res, []byte(",")...)
}
}
res = append(res, []byte("}")...)
return res, nil
}

View File

@ -25,139 +25,220 @@ const (
// Maximum thread qty for start/stop
gMaxThreads = 4
gDefaultsJson = ` {
"CONFIG_VERSION": "27",
"allow_chflags": 0,
"allow_mlock": 0,
"allow_mount": 0,
"allow_mount_devfs": 0,
"allow_mount_fusefs": 0,
"allow_mount_nullfs": 0,
"allow_mount_procfs": 0,
"allow_mount_tmpfs": 0,
"allow_mount_zfs": 0,
"allow_quotas": 0,
"allow_raw_sockets": 0,
"allow_set_hostname": 1,
"allow_socket_af": 0,
"allow_sysvipc": 0,
"allow_tun": 0,
"allow_vmm": 0,
"assign_localhost": 0,
"available": "readonly",
"basejail": 0,
"boot": 0,
"bpf": 0,
"children_max": "0",
"comment": "none",
"compression": "lz4",
"compressratio": "readonly",
"coredumpsize": "off",
"count": "1",
"cpuset": "off",
"cputime": "off",
"datasize": "off",
"dedup": "off",
"defaultrouter": "auto",
"defaultrouter6": "auto",
"depends": "none",
"devfs_ruleset": "4",
"dhcp": 0,
"enforce_statfs": "2",
"exec_clean": 1,
"exec_created": "/usr/bin/true",
"exec_fib": "0",
"exec_jail_user": "root",
"exec_poststart": "/usr/bin/true",
"exec_poststop": "/usr/bin/true",
"exec_prestart": "/usr/bin/true",
"exec_prestop": "/usr/bin/true",
"exec_start": "/bin/sh /etc/rc",
"exec_stop": "/bin/sh /etc/rc.shutdown",
"exec_system_jail_user": "0",
"exec_system_user": "root",
"exec_timeout": "60",
"host_domainname": "none",
"host_time": 1,
"hostid": "36353536-3135-5a43-4a34-313130315a56",
"hostid_strict_check": 0,
"interfaces": "vnet0:bridge0",
"ip4": "new",
"ip4_addr": "none",
"ip4_saddrsel": 1,
"ip6": "new",
"ip6_addr": "none",
"ip6_saddrsel": 1,
"ip_hostname": 0,
"jail_zfs": 0,
"jail_zfs_mountpoint": "none",
"last_started": "none",
"localhost_ip": "none",
"login_flags": "-f root",
"mac_prefix": "2c44fd",
"maxproc": "off",
"memorylocked": "off",
"memoryuse": "off",
"min_dyn_devfs_ruleset": "1000",
"mount_devfs": 1,
"mount_fdescfs": 1,
"mount_linprocfs": 0,
"mount_procfs": 0,
"mountpoint": "readonly",
"msgqqueued": "off",
"msgqsize": "off",
"nat": 0,
"nat_backend": "ipfw",
"nat_forwards": "none",
"nat_interface": "none",
"nat_prefix": "172.16",
"nmsgq": "off",
"notes": "none",
"nsem": "off",
"nsemop": "off",
"nshm": "off",
"nthr": "off",
"openfiles": "off",
"origin": "readonly",
"owner": "root",
"pcpu": "off",
"plugin_name": "none",
"plugin_repository": "none",
"priority": "99",
"pseudoterminals": "off",
"quota": "none",
"readbps": "off",
"readiops": "off",
"reservation": "none",
"resolver": "/etc/resolv.conf",
"rlimits": "off",
"rtsold": 0,
"securelevel": "2",
"shmsize": "off",
"stacksize": "off",
"stop_timeout": "30",
"swapuse": "off",
"sync_state": "none",
"sync_target": "none",
"sync_tgt_zpool": "none",
"sysvmsg": "new",
"sysvsem": "new",
"sysvshm": "new",
"template": 0,
"type": "jail",
"used": "readonly",
"vmemoryuse": "off",
"vnet": 0,
"vnet0_mac": "none",
"vnet1_mac": "none",
"vnet2_mac": "none",
"vnet3_mac": "none",
"vnet_default_interface": "auto",
"vnet_interfaces": "none",
"wallclock": "off",
"writebps": "off",
"writeiops": "off"
}
fbsdUpdateConfig = `# $FreeBSD$
# Trusted keyprint. Changing this is a Bad Idea unless you've received
# a PGP-signed email from <security-officer@FreeBSD.org> telling you to
# change it and explaining why.
KeyPrint 800651ef4b4c71c27e60786d7b487188970f4b4169cc055784e21eb71d410cc5
# Server or server pool from which to fetch updates. You can change
# this to point at a specific server if you want, but in most cases
# using a "nearby" server won't provide a measurable improvement in
# performance.
ServerName update.FreeBSD.org
# Components of the base system which should be kept updated.
Components world
# Example for updating the userland and the kernel source code only:
# Components src/base src/sys world
# Paths which start with anything matching an entry in an IgnorePaths
# statement will be ignored.
IgnorePaths
# Paths which start with anything matching an entry in an IDSIgnorePaths
# statement will be ignored by "freebsd-update IDS".
IDSIgnorePaths /usr/share/man/cat
IDSIgnorePaths /usr/share/man/whatis
IDSIgnorePaths /var/db/locate.database
IDSIgnorePaths /var/log
# Paths which start with anything matching an entry in an UpdateIfUnmodified
# statement will only be updated if the contents of the file have not been
# modified by the user (unless changes are merged; see below).
UpdateIfUnmodified /etc/ /var/ /root/ /.cshrc /.profile
# When upgrading to a new FreeBSD release, files which match MergeChanges
# will have any local changes merged into the version from the new release.
MergeChanges /etc/
### Default configuration options:
# Directory in which to store downloaded updates and temporary
# files used by FreeBSD Update.
WorkDir /iocage/freebsd-update
# Destination to send output of "freebsd-update cron" if an error
# occurs or updates have been downloaded.
# MailTo root
# Is FreeBSD Update allowed to create new files?
# AllowAdd yes
# Is FreeBSD Update allowed to delete files?
# AllowDelete yes
# If the user has modified file ownership, permissions, or flags, should
# FreeBSD Update retain this modified metadata when installing a new version
# of that file?
# KeepModifiedMetadata yes
# When upgrading between releases, should the list of Components be
# read strictly (StrictComponents yes) or merely as a list of components
# which *might* be installed of which FreeBSD Update should figure out
# which actually are installed and upgrade those (StrictComponents no)?
StrictComponents yes
# When installing a new kernel perform a backup of the old one first
# so it is possible to boot the old kernel in case of problems.
BackupKernel no
# If BackupKernel is enabled, the backup kernel is saved to this
# directory.
# BackupKernelDir /boot/kernel.old
# When backing up a kernel also back up debug symbol files?
BackupKernelSymbolFiles no
# Create a new boot environment when installing patches
CreateBootEnv no
`
gDefaultsJson = `{
"CONFIG_VERSION": "27",
"allow_chflags": 0,
"allow_mlock": 0,
"allow_mount": 0,
"allow_mount_devfs": 0,
"allow_mount_fusefs": 0,
"allow_mount_nullfs": 0,
"allow_mount_procfs": 0,
"allow_mount_tmpfs": 0,
"allow_mount_zfs": 0,
"allow_quotas": 0,
"allow_raw_sockets": 0,
"allow_set_hostname": 1,
"allow_socket_af": 0,
"allow_sysvipc": 0,
"allow_tun": 0,
"allow_vmm": 0,
"assign_localhost": 0,
"available": "readonly",
"basejail": 0,
"boot": 0,
"bpf": 0,
"children_max": "0",
"comment": "none",
"compression": "lz4",
"compressratio": "readonly",
"coredumpsize": "off",
"count": "1",
"cpuset": "off",
"cputime": "off",
"datasize": "off",
"dedup": "off",
"defaultrouter": "auto",
"defaultrouter6": "auto",
"depends": "none",
"devfs_ruleset": "4",
"dhcp": 0,
"enforce_statfs": "2",
"exec_clean": 1,
"exec_created": "/usr/bin/true",
"exec_fib": "0",
"exec_jail_user": "root",
"exec_poststart": "/usr/bin/true",
"exec_poststop": "/usr/bin/true",
"exec_prestart": "/usr/bin/true",
"exec_prestop": "/usr/bin/true",
"exec_start": "/bin/sh /etc/rc",
"exec_stop": "/bin/sh /etc/rc.shutdown",
"exec_system_jail_user": "0",
"exec_system_user": "root",
"exec_timeout": "60",
"host_domainname": "none",
"host_time": 1,
"hostid": "TO-BE-REPLACED-WITH-HOSTID",
"hostid_strict_check": 0,
"interfaces": "vnet0:TO-BE-REPLACED-WITH-BRIDGE",
"ip4": "new",
"ip4_addr": "none",
"ip4_saddrsel": 1,
"ip6": "new",
"ip6_addr": "none",
"ip6_saddrsel": 1,
"ip_hostname": 0,
"jail_zfs": 0,
"jail_zfs_mountpoint": "none",
"last_started": "none",
"localhost_ip": "none",
"login_flags": "-f root",
"mac_prefix": "2c44fd",
"maxproc": "off",
"memorylocked": "off",
"memoryuse": "off",
"min_dyn_devfs_ruleset": "1000",
"mount_devfs": 1,
"mount_fdescfs": 1,
"mount_linprocfs": 0,
"mount_procfs": 0,
"mountpoint": "readonly",
"msgqqueued": "off",
"msgqsize": "off",
"nat": 0,
"nat_backend": "ipfw",
"nat_forwards": "none",
"nat_interface": "none",
"nat_prefix": "172.16",
"nmsgq": "off",
"notes": "none",
"nsem": "off",
"nsemop": "off",
"nshm": "off",
"nthr": "off",
"openfiles": "off",
"origin": "readonly",
"owner": "root",
"pcpu": "off",
"plugin_name": "none",
"plugin_repository": "none",
"priority": "99",
"pseudoterminals": "off",
"quota": "none",
"readbps": "off",
"readiops": "off",
"reservation": "none",
"resolver": "/etc/resolv.conf",
"rlimits": "off",
"rtsold": 0,
"securelevel": "2",
"shmsize": "off",
"stacksize": "off",
"stop_timeout": "30",
"swapuse": "off",
"sync_state": "none",
"sync_target": "none",
"sync_tgt_zpool": "none",
"sysvmsg": "new",
"sysvsem": "new",
"sysvshm": "new",
"template": 0,
"type": "jail",
"used": "readonly",
"vmemoryuse": "off",
"vnet": 0,
"vnet0_mac": "none",
"vnet1_mac": "none",
"vnet2_mac": "none",
"vnet3_mac": "none",
"vnet_default_interface": "auto",
"vnet_interfaces": "none",
"wallclock": "off",
"writebps": "off",
"writeiops": "off"
}
`
)
@ -362,7 +443,7 @@ func executeCommand(cmdline string) (string, error) {
out, err = exec.Command(cmd[0]).CombinedOutput()
}
return string(out), err
return strings.TrimSuffix(string(out), "\n"), err
}
/* From iocage:
@ -629,9 +710,7 @@ func executeCommandInJail(jail *Jail, cmdline string) (string, error) {
word = word + string(c)
}
if gDebug {
fmt.Printf("DEBUG: executeCommandInJail: prepare to execute \"%s\"\n", cmd)
}
log.Debugf("executeCommandInJail: will execute \"%s\"\n", strings.Join(cmd, " "))
out, err := exec.Command(cmd[0], cmd[1:]...).CombinedOutput()
@ -814,7 +893,9 @@ func zfsCreateDataset(dataset, mountpoint, compression string) error {
}
// Return dataset name for a given mountpoint
func zfsGetDatasetByMountpoint(mountpoint string) (string, error) {
cmd := fmt.Sprintf("zfs list -p -r -H -o name %s", mountpoint)
// We dont want no recursivity
//cmd := fmt.Sprintf("zfs list -p -r -H -o name %s", mountpoint)
cmd := fmt.Sprintf("zfs list -p -H -o name %s", mountpoint)
out, err := executeCommand(cmd)
if err != nil {
return "", errors.New(fmt.Sprintf("%v; command returned \"%s\"", err, out))
@ -868,6 +949,17 @@ func getPermissions(path string) (os.FileInfo, error) {
return os.Stat(path)
}
func doFileExist(filePath string) (bool, error) {
if _, err := os.Stat(filePath); err != nil {
if errors.Is(err, os.ErrNotExist) {
return false, nil
} else {
return false, err
}
}
return true, nil
}
/*****************************************************************************
*
* rc.conf management
@ -902,6 +994,43 @@ func disableRcKey(rcconfpath string, key string) error {
return nil
}
// returns no error if rc key does not exist
func getCurrentRcKeyValue(rcconfpath string, key string) (string, error) {
cmd := "/usr/sbin/sysrc -a"
kvs, err := executeCommand(cmd)
if err != nil {
return "", err
}
for _, kv := range strings.Split(string(kvs), "\n") {
fmt.Printf("%s\n", kv)
if strings.HasPrefix(kv, fmt.Sprintf("%s:", key)) {
return strings.TrimPrefix(strings.Join(strings.Split(kv, ":")[1:], ":"), " "), nil
}
}
return "", nil
}
// Add a value to current existing key value
func addRcKeyValue(rcconfpath string, key string, value string) error {
var nv string
cv, err := getCurrentRcKeyValue(rcconfpath, key)
if err != nil {
return err
}
if len(cv) > 0 {
log.Debugf("Current value of %s: %s\n", key, cv)
nv = fmt.Sprintf("\"%s %s\"", cv, value)
} else {
nv = fmt.Sprintf("\"%s\"", value)
}
cmd := fmt.Sprintf("/usr/sbin/sysrc -f %s %s=%s", rcconfpath, key, nv)
_, err = executeCommand(cmd)
if err != nil {
return err
}
return nil
}
/*****************************************************************************
* Parse an fstab file, returning an array of Mount
*****************************************************************************/

62
go.mod
View File

@ -1,32 +1,60 @@
module gocage
go 1.17
go 1.21
require (
github.com/c-robinson/iplib v1.0.3
github.com/c2h5oh/datasize v0.0.0-20220606134207-859f65c6625b
github.com/gin-contrib/cors v1.7.2
github.com/gin-gonic/gin v1.10.0
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
github.com/otiai10/copy v1.12.0
github.com/sirupsen/logrus v1.8.1
github.com/spf13/cobra v1.2.1
github.com/spf13/viper v1.9.0
golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420
github.com/spf13/cobra v1.8.1
github.com/spf13/viper v1.19.0
golang.org/x/net v0.25.0
)
require (
github.com/fsnotify/fsnotify v1.5.1 // indirect
github.com/bytedance/sonic v1.11.6 // indirect
github.com/bytedance/sonic/loader v0.1.1 // indirect
github.com/cloudwego/base64x v0.1.4 // indirect
github.com/cloudwego/iasm v0.2.0 // indirect
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/gabriel-vasile/mimetype v1.4.3 // indirect
github.com/gin-contrib/sse v0.1.0 // indirect
github.com/go-playground/locales v0.14.1 // indirect
github.com/go-playground/universal-translator v0.18.1 // indirect
github.com/go-playground/validator/v10 v10.20.0 // indirect
github.com/goccy/go-json v0.10.2 // indirect
github.com/hashicorp/hcl v1.0.0 // indirect
github.com/inconshreveable/mousetrap v1.0.0 // indirect
github.com/magiconair/properties v1.8.5 // indirect
github.com/mitchellh/mapstructure v1.4.2 // indirect
github.com/pelletier/go-toml v1.9.4 // indirect
github.com/spf13/afero v1.6.0 // indirect
github.com/spf13/cast v1.4.1 // indirect
github.com/spf13/jwalterweatherman v1.1.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/klauspost/cpuid/v2 v2.2.7 // indirect
github.com/leodido/go-urn v1.4.0 // indirect
github.com/magiconair/properties v1.8.7 // indirect
github.com/mattn/go-isatty v0.0.20 // indirect
github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/pelletier/go-toml/v2 v2.2.2 // indirect
github.com/sagikazarmark/locafero v0.4.0 // indirect
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
github.com/sourcegraph/conc v0.3.0 // indirect
github.com/spf13/afero v1.11.0 // indirect
github.com/spf13/cast v1.6.0 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/subosito/gotenv v1.2.0 // indirect
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8 // indirect
golang.org/x/text v0.3.6 // indirect
gopkg.in/ini.v1 v1.63.2 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
github.com/subosito/gotenv v1.6.0 // indirect
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
github.com/ugorji/go/codec v1.2.12 // indirect
go.uber.org/atomic v1.9.0 // indirect
go.uber.org/multierr v1.9.0 // indirect
golang.org/x/arch v0.8.0 // indirect
golang.org/x/crypto v0.23.0 // indirect
golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
golang.org/x/sys v0.20.0 // indirect
golang.org/x/text v0.15.0 // indirect
google.golang.org/protobuf v1.34.1 // indirect
gopkg.in/ini.v1 v1.67.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
)