[ENHANCEMENT] Multiple interfaces for VNET jails

[eyegog]

Is your feature request related to a problem? Please describe.
I do have use cases where I would like to have jails with multiple interfaces attached to different bridges on different VLANs (mgmt, service, etc) for example:

mount.devfs;
exec.start="/bin/sh /etc/rc";
exec.stop="/bin/sh /etc/rc.shutdown";
devfs_ruleset="11";

myjail {
	path="/jails/myjail";
        host.hostname="$name.something.co.uk";
        enforce_statfs=2;
        vnet;
        vnet.interface+=myjail0_b;
        exec.prestart+="/usr/local/sbin/epair_create myjail0 bridge0";
        exec.poststop+="ifconfig myjail0_a destroy";
        vnet.interface+=myjail1_b;
        exec.prestart+="/usr/local/sbin/epair_create myjail1 bridge1";
        exec.poststop+="ifconfig myjail1_a destroy";

}

Inside jail:

$ ifconfig
lo0: flags=1008049<UP,LOOPBACK,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 16384
	options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
	inet 127.0.0.1 netmask 0xff000000
	inet6 ::1 prefixlen 128
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0xd
	groups: lo
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
pflog0: flags=0 metric 0 mtu 33152
	options=0
	groups: pflog
myjail0_b: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
	options=8<VLAN_MTU>
	ether 02:c9:eb:88:6b:0b
	inet 10.10.99.14 netmask 0xffffff00 broadcast 10.10.99.255
	groups: epair
	media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
	status: active
	nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
myjail1_b: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
	options=8<VLAN_MTU>
	ether 02:4c:71:81:a1:0b
	inet 10.10.4.7 netmask 0xffffff00 broadcast 10.10.4.255
	groups: epair
	media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
	status: active
	nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

As far as I am aware, Bastille doesn't support creating VNET jails with this kind of configuration.

Describe the solution you'd like
For Bastille to be able to create jails with multiple interfaces, perhaps with something like the following syntax:

bastille create -B azkaban 13.2-RELEASE 192.168.1.50/24 bridge0 172.16.17.5/24 bridge1 

Describe alternatives you've considered
As of the moment I've written other automation to create VNET jails with multiple interfaces but it would be nice to assimilate this functionality into a single tool.

Additional context
Admittedly I am a newbie to the Bastille source code - but I am willing to contribute towards the development of this functionality and mainly I want to know if the dev team would be interested in such a feature :)

[nreilly]

This would be a great enhancement. I'm currently achieving the outcome by modifying the jail.conf by hand and using a patched jib to make it work nicely with multiple bridges.

--- jib	2023-12-21 21:05:09.900919000 +0000
+++ /usr/local/bin/jib	2023-08-25 01:16:54.224528000 +0000
@@ -259,17 +259,10 @@
 	fi
 }
 
-jib_addm_usage="addm [-b BRIDGE_NAME] NAME [!]iface0 [[!]iface1 ...]"
+jib_addm_usage="addm NAME bridge0 bridge1 ...]"
 jib_addm_descr="Creates e0b_NAME [e1b_NAME ...]"
 jib_addm()
 {
-	local OPTIND=1 OPTARG flag bridge=bridge
-	while getopts b: flag; do
-		case "$flag" in
-		b) bridge="${OPTARG:-bridge}" ;;
-		*) action_usage addm # NOTREACHED
-		esac
-	done
 	shift $(( $OPTIND - 1 ))
 
 	local name="$1"

and then the relevant part of the jail.conf:

  vnet;
  vnet.interface = e0b_port, e1b_port, e2b_port, e3b_port, e4b_port, e5b_port, e6b_port, e7b_port, e8b_port;
  exec.prestart += "jib addm port a0 b0 c0 d0 a1 b1 c1 d1 a2";
  exec.poststop += "jib destroy port";

I also create the bridge interfaces via rc.conf, some bridged to local vlans.

ifconfig_genet0="up"
ifconfig_genet0_2="up"
ifconfig_genet0_4="up"
ifconfig_genet0_6="up"
ifconfig_genet0_8="up"
vlans_genet0="2 4 6 8"
cloned_interfaces="bridge0 bridge1 bridge2 bridge3 bridge4 bridge5 bridge6 bridge7 bridge8"
ifconfig_bridge0_name="a0"
ifconfig_bridge1_name="b0"
ifconfig_bridge2_name="c0"
ifconfig_bridge3_name="d0"
ifconfig_bridge4_name="a1"
ifconfig_bridge5_name="b1"
ifconfig_bridge6_name="c1"
ifconfig_bridge7_name="d1"
ifconfig_bridge8_name="a2"
ifconfig_a0="inet 10.15.0.1/24"
ifconfig_b0="inet 10.14.0.129/25"
ifconfig_c0="inet 10.14.0.1/25"
ifconfig_d0="inet 10.14.2.1/24"
autobridge_interfaces="a1 b1 c1 d1"
autobridge_a1="genet0.6"
autobridge_b1="genet0.2"
autobridge_c1="genet0.4"
autobridge_d1="genet0.8"

[Notsonoble]

I agree that this would be a good thing to make work. I'm considering moving from iocage to bastille based on the fact that iocage seems to be dead. However I need the ability to apply different vlans to different jails (or interfaces in the same jail) and public ip jails outside the subnet of the host.

[tschettervictor]

I'd rather see it being a subcommand called "network" or something similar.

This would be hard to implement especially for cloning jails and such. The names of the epairs are directly linked to the number of jails, so having even one jail with multiple interfaces would increase the number by 1, and throw errors when creating the next jail.

One option is to use the jail name as the interface name. Then the default can stay the default, but any additional ones will be named differently.

I'll work on this...
All it would take is simply creating a new netblock as below.

jailv {
  devfs_ruleset = 13;
  enforce_statfs = 2;
  exec.clean;
  exec.consolelog = /var/log/bastille/jailv_console.log;
  exec.start = '/bin/sh /etc/rc';
  exec.stop = '/bin/sh /etc/rc.shutdown';
  host.hostname = jailv;
  mount.devfs;
  mount.fstab = /usr/local/bastille/jails/jailv/fstab;
  path = /usr/local/bastille/jails/jailv/root;
  securelevel = 2;
  osrelease = 13.4-RELEASE;

  vnet;
  vnet.interface = e0b_bastille1,e0b_jailv2;
  exec.prestart += "jib addm bastille1 vtnet0";
  exec.prestart += "ifconfig e0a_bastille1 description \"vnet host interface for Bastille jail jailv\"";
  exec.prestart += "ifconfig e0a_bastille1 ether 50:65:f3:76:71:8a";
  exec.prestart += "ifconfig e0b_bastille1 ether 50:65:f3:76:71:8b";
  exec.poststop += "jib destroy bastille1";
  exec.prestart += "jib addm jailv2 vtnet0";
  exec.prestart += "ifconfig e0a_jailv2 description \"vnet host interface for Bastille jail jailv\"";
  exec.prestart += "ifconfig e0a_jailv2 ether 50:65:f3:76:72:8a";
  exec.prestart += "ifconfig e0b_jailv2 ether 50:65:f3:76:72:8b";
  exec.poststop += "jib destroy jailv2";
}

[tschettervictor]

I have a working prototype for this feature. Tested with VNET jails as well as bridged VNET jails.

As of right now I have not tested cloning or renaming jails.

If anyone is interested I can share the file here.

It's simply a sub command called network, or net.

[tschettervictor]

Cloning is now functional as well.

[tschettervictor]

Renaming cloning creating etc... all functioning.

PR incoming...

[tschettervictor]

#783
@nreilly
@Notsonoble
@eyegog

Please test.