From owner-freebsd-questions@freebsd.org  Tue Mar 29 20:11:04 2016
Return-Path: <owner-freebsd-questions@freebsd.org>
Delivered-To: freebsd-questions@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 4B8E8AE2C9E
 for <freebsd-questions@mailman.ysv.freebsd.org>;
 Tue, 29 Mar 2016 20:11:04 +0000 (UTC)
 (envelope-from stdin@niklaas.eu)
Received: from box.niklaas.eu (unknown [IPv6:2a00:c98:2200:af07:6::1])
 by mx1.freebsd.org (Postfix) with ESMTP id 1C3A71482
 for <freebsd-questions@freebsd.org>; Tue, 29 Mar 2016 20:11:03 +0000 (UTC)
 (envelope-from stdin@niklaas.eu)
Received: by box.niklaas.eu (Postfix, from userid 1001)
 id 82F9961FA6; Tue, 29 Mar 2016 22:11:02 +0200 (CEST)
Date: Tue, 29 Mar 2016 22:11:02 +0200
From: Niklaas Baudet von Gersdorff <stdin@niklaas.eu>
To: freebsd-questions@freebsd.org
Subject: Variables substitution in jail.conf
Message-ID: <20160329201102.GA1256@box.niklaas.eu>
Mail-Followup-To: freebsd-questions@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.24 (2015-08-30)
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.21
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 29 Mar 2016 20:11:04 -0000

I am experimenting with jail.conf, trying to automate everything as much as
I can. I would like to execute pfctl commands automatically once a jail is
started or stopped; that is, adding the IP of the jail to a table that passes
connection and deleting it again once it's no longer needed. This is my
jail.conf:

    host.hostname = "$name.box-fra-01.klaas";
    path          = "/usr/local/jails/$name";
    ip4.addr      = "lo1|10.15.$network.$id";
    ip6.addr      = "vtnet0|2a00:XXX:XXXX:XXXX:X::$network:$id";
    mount         = "/usr/local/jails/templates/base-10.2-RELEASE /usr/local/jails/$name/     nullfs ro 0 0";
    mount        += "/usr/local/jails/thinjails/$name             /usr/local/jails/$name/jail nullfs rw 0 0";
    mount.devfs;

    exec.start    = "/bin/sh /etc/rc";
    exec.stop     = "/bin/sh /etc/rc.shutdown";

    exec.clean;

    www {
        $id            = 1;
        $network       = 1;
        exec.poststart = "pfctl -t www -T add ${ip4.addr} {$ip6.addr}";
        exec.poststop  = "pfctl -t www -T delete {$ip4.addr} {$ip6.addr}";
    }

However, I get an error that ip6 is not defined. I have already realised that
pfctl will give an error (because ip{4,6}.addr includes {lo1,vtnet0}) but what
I do not understand is why the parameter is not recognised.

I also tried setting things up with additional variables my_ip4 and my_ip6 but
that didn't work either. After reading jail.conf(5) I thought about putting
everything in hierarchical jails but I am not sure whether that will help to
make substitution work the way I want it to.

I am happy for any advise.