dnsmasq: improve init script

[openwrt/openwrt.git] / package / network / services / dnsmasq / files / dnsmasq.init

diff --git a/package/network/services/dnsmasq/files/dnsmasq.init b/package/network/services/dnsmasq/files/dnsmasq.init
index d5f70a0ee51a01edd1c1298ac2825140ad747019..19135af1c2de227e31f543763173cffa222b70f2 100644 (file)
--- a/package/network/services/dnsmasq/files/dnsmasq.init
+++ b/package/network/services/dnsmasq/files/dnsmasq.init
@@ -19,6 +19,7 @@ BASEDHCPSTAMPFILE="/var/run/dnsmasq"
 DHCPBOGUSHOSTNAMEFILE="/usr/share/dnsmasq/dhcpbogushostname.conf"
 RFC6761FILE="/usr/share/dnsmasq/rfc6761.conf"
 DHCPSCRIPT="/usr/lib/dnsmasq/dhcp-script.sh"
+DHCPSCRIPT_DEPENDS="/usr/share/libubox/jshn.sh /usr/bin/jshn /bin/ubus"
 
 DNSMASQ_DHCP_VER=4
 
@@ -172,6 +173,10 @@ append_ipset() {
        xappend "--ipset=$1"
 }
 
+append_connmark_allowlist() {
+       xappend "--connmark-allowlist=$1"
+}
+
 append_interface() {
        network_get_device ifname "$1" || ifname="$1"
        xappend "--interface=$ifname"
@@ -186,7 +191,22 @@ append_notinterface() {
        xappend "--except-interface=$ifname"
 }
 
+ismounted() {
+       local filename="$1"
+       local dirname
+       for dirname in $EXTRA_MOUNT ; do
+               case "$filename" in
+                       "${dirname}/"* | "${dirname}" )
+                               return 1
+                               ;;
+               esac
+       done
+
+       return 0
+}
+
 append_addnhosts() {
+       ismounted "$1" || append EXTRA_MOUNT "$1"
        xappend "--addn-hosts=$1"
 }
 
@@ -221,7 +241,7 @@ dhcp_subscrid_add() {
        config_get subscriberid "$cfg" subscriberid
        [ -n "$subscriberid" ] || return 0
 
-       xappend "--dhcp-subscrid=$networkid,$subscriberid"
+       xappend "--dhcp-subscrid=set:$networkid,$subscriberid"
 
        config_get_bool force "$cfg" force 0
 
@@ -237,7 +257,7 @@ dhcp_remoteid_add() {
        config_get remoteid "$cfg" remoteid
        [ -n "$remoteid" ] || return 0
 
-       xappend "--dhcp-remoteid=$networkid,$remoteid"
+       xappend "--dhcp-remoteid=set:$networkid,$remoteid"
 
        config_get_bool force "$cfg" force 0
 
@@ -254,7 +274,7 @@ dhcp_circuitid_add() {
        config_get circuitid "$cfg" circuitid
        [ -n "$circuitid" ] || return 0
 
-       xappend "--dhcp-circuitid=$networkid,$circuitid"
+       xappend "--dhcp-circuitid=set:$networkid,$circuitid"
 
        config_get_bool force "$cfg" force 0
 
@@ -270,7 +290,7 @@ dhcp_userclass_add() {
        config_get userclass "$cfg" userclass
        [ -n "$userclass" ] || return 0
 
-       xappend "--dhcp-userclass=$networkid,$userclass"
+       xappend "--dhcp-userclass=set:$networkid,$userclass"
 
        config_get_bool force "$cfg" force 0
 
@@ -287,7 +307,7 @@ dhcp_vendorclass_add() {
        config_get vendorclass "$cfg" vendorclass
        [ -n "$vendorclass" ] || return 0
 
-       xappend "--dhcp-vendorclass=$networkid,$vendorclass"
+       xappend "--dhcp-vendorclass=set:$networkid,$vendorclass"
 
        config_get_bool force "$cfg" force 0
 
@@ -303,7 +323,7 @@ dhcp_match_add() {
        config_get match "$cfg" match
        [ -n "$match" ] || return 0
 
-       xappend "--dhcp-match=$networkid,$match"
+       xappend "--dhcp-match=set:$networkid,$match"
 
        config_get_bool force "$cfg" force 0
 
@@ -801,19 +821,22 @@ dnsmasq_start()
        config_get_bool disabled "$cfg" disabled 0
        [ "$disabled" -gt 0 ] && return 0
 
-       # reset list of DOMAINS and DNS servers (for each dnsmasq instance)
+       # reset list of DOMAINS, DNS servers and EXTRA mounts (for each dnsmasq instance)
        DNS_SERVERS=""
        DOMAIN=""
+       EXTRA_MOUNT=""
        CONFIGFILE="${BASECONFIGFILE}.${cfg}"
        CONFIGFILE_TMP="${CONFIGFILE}.$$"
        HOSTFILE="${BASEHOSTFILE}.${cfg}"
        HOSTFILE_TMP="${HOSTFILE}.$$"
+       HOSTFILE_DIR="$(dirname "$HOSTFILE")"
        BASEDHCPSTAMPFILE_CFG="${BASEDHCPSTAMPFILE}.${cfg}"
 
        # before we can call xappend
+       umask u=rwx,g=rx,o=rx
        mkdir -p /var/run/dnsmasq/
        mkdir -p $(dirname $CONFIGFILE)
-       mkdir -p $(dirname $HOSTFILE)
+       mkdir -p "$HOSTFILE_DIR"
        mkdir -p /var/lib/misc
        chown dnsmasq:dnsmasq /var/run/dnsmasq
 
@@ -921,10 +944,26 @@ dnsmasq_start()
        config_list_foreach "$cfg" "rev_server" append_rev_server
        config_list_foreach "$cfg" "address" append_address
        config_list_foreach "$cfg" "ipset" append_ipset
+
+       local connmark_allowlist_enable
+       config_get connmark_allowlist_enable "$cfg" connmark_allowlist_enable 0
+       [ "$connmark_allowlist_enable" -gt 0 ] && {
+               append_parm "$cfg" "connmark_allowlist_enable" "--connmark-allowlist-enable"
+               config_list_foreach "$cfg" "connmark_allowlist" append_connmark_allowlist
+       }
+
        [ -n "$BOOT" ] || {
                config_list_foreach "$cfg" "interface" append_interface
                config_list_foreach "$cfg" "notinterface" append_notinterface
        }
+       config_get_bool ignore_hosts_dir "$cfg" ignore_hosts_dir 0
+       if [ "$ignore_hosts_dir" = "1" ]; then
+               xappend "--addn-hosts=$HOSTFILE"
+               append EXTRA_MOUNT "$HOSTFILE"
+       else
+               xappend "--addn-hosts=$(dirname $HOSTFILE)"
+               append EXTRA_MOUNT "$(dirname $HOSTFILE)"
+       fi
        config_list_foreach "$cfg" "addnhosts" append_addnhosts
        config_list_foreach "$cfg" "bogusnxdomain" append_bogusnxdomain
        append_parm "$cfg" "leasefile" "--dhcp-leasefile" "/tmp/dhcp.leases"
@@ -1020,12 +1059,6 @@ dnsmasq_start()
 
        xappend "--dhcp-broadcast=tag:needs-broadcast"
 
-       config_get_bool ignore_hosts_dir "$cfg" ignore_hosts_dir 0
-       if [ "$ignore_hosts_dir" = "1" ]; then
-               xappend "--addn-hosts=$HOSTFILE"
-       else
-               xappend "--addn-hosts=$(dirname $HOSTFILE)"
-       fi
 
        config_get dnsmasqconfdir "$cfg" confdir "/tmp/dnsmasq.d"
        xappend "--conf-dir=$dnsmasqconfdir"
@@ -1119,7 +1152,11 @@ dnsmasq_start()
        procd_set_param respawn
 
        procd_add_jail dnsmasq ubus log
-       procd_add_jail_mount $CONFIGFILE $TRUSTANCHORSFILE $HOSTFILE $RFC6761FILE $DHCPBOGUSHOSTNAMEFILE /etc/passwd /etc/group /etc/TZ /dev/null /dev/urandom $dnsmasqconffile $dnsmasqconfdir $resolvdir $user_dhcpscript /etc/hosts /etc/ethers /sbin/hotplug-call $EXTRA_MOUNT $DHCPSCRIPT /tmp/hosts/
+       procd_add_jail_mount $CONFIGFILE $DHCPBOGUSHOSTNAMEFILE $DHCPSCRIPT $DHCPSCRIPT_DEPENDS
+       procd_add_jail_mount $EXTRA_MOUNT $RFC6761FILE $TRUSTANCHORSFILE
+       procd_add_jail_mount $dnsmasqconffile $dnsmasqconfdir $resolvdir $user_dhcpscript
+       procd_add_jail_mount /etc/passwd /etc/group /etc/TZ /etc/hosts /etc/ethers
+       [ "$HOSTFILE_DIR" != "/tmp" ] && procd_add_jail_mount "$HOSTFILE_DIR"
        procd_add_jail_mount_rw /var/run/dnsmasq/ $leasefile
 
        procd_close_instance