snlavaise/pmaports-rtwo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

main/postmarketos-base-ui: don't use dnsmasq for filtering

Browse Source 
This reverts 4b516916dc

Signed-off-by: Clayton Craft <craftyguy@postmarketos.org>
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/9005>
This commit is contained in:
Clayton Craft
2026-08-05 11:01:57 -07:00
committed by The Friendly Meow (merge) Bot
parent 990c2dd235
commit a8cd964e9f
4 changed files with 3 additions and 159 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.ci/shellcheck.sh
-1
View File
@@ -15,7 +15,6 @@ fi
# Shell: shellcheck
sh_files="
./main/mdss-fb-init-hack/mdss-fb-init-hack.sh
./main/postmarketos-base-ui/rootfs-usr-lib-NetworkManager-dispatcher.d-50-dns-filter.sh
./main/postmarketos-duranium/rootfs-usr-bin-duranium-set-channel
./main/postmarketos-duranium/rootfs-usr-libexec-duranium-first-boot
./main/postmarketos-duranium/rootfs-usr-libexec-duranium-usb-gadget-setup
main/postmarketos-base-ui/APKBUILD
+3 -11
View File
@@ -96,7 +96,6 @@ _source644="
usr/lib/NetworkManager/conf.d/50-hostname-mode.conf
usr/lib/NetworkManager/conf.d/50-iwd.conf
usr/lib/NetworkManager/conf.d/50-random-mac.conf
usr/lib/NetworkManager/conf.d/50-use-dnsmasq.conf
usr/lib/systemd/system/ModemManager.service.d/quick-suspend-resume.conf
usr/lib/systemd/system/iio-sensor-proxy.service.d/shutdown.conf
usr/lib/tmpfiles.d/alsa-utils.conf
@@ -107,7 +106,6 @@ _source644="
usr/share/mkinitfs/files/10-wireless-regdb.files
"
_source755="
usr/lib/NetworkManager/dispatcher.d/50-dns-filter.sh
usr/share/tinydm/env-wayland.d/50-sdl-wayland.sh
etc/profile.d/qt-mobile-controls.sh
etc/profile.d/qt-wayland.sh
@@ -222,20 +220,16 @@ obexd() {
}
networkmanager() {
# dnsmasq: required for connection sharing/hotspot
depends="
busctl
dnsmasq-dnssec-dbus>=2.90-r1
gojq
dnsmasq
networkmanager
networkmanager-cli
networkmanager-tui
networkmanager-wifi
networkmanager-wwan
networkmanager-dnsmasq"
networkmanager-wwan"
amove usr/lib/NetworkManager/conf.d/50-hostname-mode.conf
amove usr/lib/NetworkManager/conf.d/50-random-mac.conf
amove usr/lib/NetworkManager/conf.d/50-use-dnsmasq.conf
amove usr/lib/NetworkManager/dispatcher.d/50-dns-filter.sh
}
qt_tweaks() {
@@ -362,7 +356,6 @@ cac604e25c46e695dd30bd5a10cfd2d69595fcc3bc290096ac94b76b10834d591ea6576afb79c46b
3c9ae7415f4891bee8595166ed6a42cb577a837f741c6b5409d193558626348b41516888a01d0c4895282c5f4e9a1ff838c19712888750b2ef68429bb4b42ee3 rootfs-usr-lib-NetworkManager-conf.d-50-hostname-mode.conf
439615745d5be0d1ab6801cfbf960a31b12da30bf5df64ba2914ff32dae9e650595d7f96e66f5dff6308f092de1f746277ea7f4e701888a22571f7c119b7bf0d rootfs-usr-lib-NetworkManager-conf.d-50-iwd.conf
d4b4c4fed2dee7266f6a87ae266691377593014943e2953e4cd87a59f3110f25bfb5f3f866cc843519f628695e4df7602bfdcd3d79f2c2cd6e8256535c33b038 rootfs-usr-lib-NetworkManager-conf.d-50-random-mac.conf
900554534191fa0797064d35350934cdd8af59f30f0ae7d8ec63c2e11c44a16c643d3024b6543940488cd590fec1d392548bcaacc3be88cddff90f69b17ece07 rootfs-usr-lib-NetworkManager-conf.d-50-use-dnsmasq.conf
cc86775a7820eb683e67df7d23ebae9d72699a643ff1452c71daf38ac6c39a84fd1686e67351ab0a2c582f9fc0374410383e3a32bd378cf11a8fb6033fde35ac rootfs-usr-lib-systemd-system-ModemManager.service.d-quick-suspend-resume.conf
087b9e967f6ffeaeb1fd6c5860bb07d0b8c2ce2c1b636d73e989cc9f3c8c6a60dc9552ec5ff13a2bce6804c3f5e8876d4b41a07770f06f6cee0fa37a54f996b4 rootfs-usr-lib-systemd-system-iio-sensor-proxy.service.d-shutdown.conf
1f0e33cc8d435d2d97863a8080eb5b6d476b6515b29707bd2f86fafa8af6c3bbdacc7cd0eeb9ed4735d31baa760846e734e33c0238165e9b1e8fee666323096d rootfs-usr-lib-tmpfiles.d-alsa-utils.conf
@@ -371,7 +364,6 @@ cc86775a7820eb683e67df7d23ebae9d72699a643ff1452c71daf38ac6c39a84fd1686e67351ab0a
54620e508a5070ec8819e3661e592acfcfd26c52170b0ecc4dbbc1c61998963ce20bf9d9b051a608b76d6fc17e61c65decc16602b7d58061b9149667a968d258 rootfs-usr-share-flatpak-remotes.d-flathub.flatpakrepo
92930f027626825b027f585a9be180f8a6ebae6dc44d2cf8f9d43cce00db8cbb43c33fc341fe382abacb832ea1b6414dc4c8129d265b0258d096599b2e206a93 rootfs-usr-share-wireplumber-wireplumber.conf.d-50-bluetooth.conf
66a7a72746e822676d0ec76160e39b65c711e574a6334f3aad38c563d3104b33d0619d50b92c9201546fd81bfd10cfe0e4a59278cbcbddf20a238f6ad71c050c rootfs-usr-share-mkinitfs-files-10-wireless-regdb.files
36e0037f6d26a99db7b47831263be610d594e2c1c4a8ee7f6fc8b41092f501d3064d80b80ddf6a82b616bd2da09aa4da896074ad9f7fd53aba7e397da4190d22 rootfs-usr-lib-NetworkManager-dispatcher.d-50-dns-filter.sh
ecaa57d033a119a53a6574c27636b7c89d659d75ea48a973a6a4ff6f90e5d07202529fd489bfc9dfc7430f5b60f40612f6d5c06f7fab47e681b0a3112a874058 rootfs-usr-share-tinydm-env-wayland.d-50-sdl-wayland.sh
bf8db527c49fa724e640a90269ba2648a2555f5867b2adbfbd88d1f685261f757339757c09ee08f590c76de4bd3d0c73a47dea9bd340644dd4707e76152cefd1 rootfs-etc-profile.d-qt-mobile-controls.sh
6e193eca3961a78d47b4656892eae34d019d9317a255a201f5ea61e3300caff04c526a27cd98d0edc072b36e3eaf3a1768f4cd27c5e2be8b19c167d535c820a6 rootfs-etc-profile.d-qt-wayland.sh
main/postmarketos-base-ui/rootfs-usr-lib-NetworkManager-conf.d-50-use-dnsmasq.conf
-2
View File
@@ -1,2 +0,0 @@
[main]
dns=dnsmasq
main/postmarketos-base-ui/rootfs-usr-lib-NetworkManager-dispatcher.d-50-dns-filter.sh
-145
View File
@@ -1,145 +0,0 @@
#!/bin/sh
# This dispatcher script exists to configure a dnsmasq instance managed by
# NetworkManager to restrict DNS responses based on the IP configuration
# supported by NetworkManager's "Primary Connection". The script requires that
# NetworkManager is configured to use/manage dnsmasq.
# For more information about *why* this is necessary, see:
# - https://gitlab.postmarketos.org/postmarketOS/pmaports/-/issues/1430
# - https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/3823
# Related:
# - https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1279
set -eu
log_tag="nm-dns-filter"
dbus="busctl --json=short"
# gojq is like... 10x faster than jq on a modest phone... (0.07s vs 0.89s)
jq=gojq
action="${2:-}"
# Get the gateway for the given connection and IP protocol version
# $1: D-Bus path to connection
# $2: IP version, e.g. '4' or '6'
get_gateway() {
_conn="$1"
_ver="$2"
_ipcfg="$($dbus get-property \
org.freedesktop.NetworkManager \
"$_conn" \
org.freedesktop.NetworkManager.Connection.Active \
"Ip${_ver}Config" | $jq -r '.data')"
if [ -z "$_ipcfg" ]; then
logger -i -t "$log_tag" "error: unable to determine IP config for primary connection!"
exit 1
fi
logger -i -t "$log_tag" "pri conn ip$_ver config path: $_ipcfg"
_attempt=0
# NetworkManager dispatches to the script as soon as the interface comes
# up, which for an IPv6 network may be before the device has received an
# Router Advertisement (RA). This means that there may be no IPv6 gateway
# defined right now, but if we wait a few seconds an RA might arrive and a
# gateway might become defined. NM does not dispatch to scripts when an RA
# arrives and triggers a change in IP address / gateway / routes, so the
# current invocation is our only chance. So we wait up to 5 seconds for the
# gateway to be defined before deciding that the network doesn't have IPv6
# connectivity. NetworkManager-dispatcher man page says that the dispatcher
# will kill scripts that run for "too long", that's currently (in NM 1.42)
# set to 10 minutes, but let's keep our timeout much shorter.
while [ "$_attempt" -lt 5 ]; do
_gateway="$($dbus get-property \
org.freedesktop.NetworkManager \
"$_ipcfg" \
"org.freedesktop.NetworkManager.IP${_ver}Config" \
Gateway | $jq -r '.data')"
if [ -n "$_gateway" ]; then
break
fi
sleep 1
_attempt="$(( _attempt + 1 ))"
done
logger -i -t "$log_tag" "ip$_ver gateway: $_gateway"
echo "$_gateway"
}
# $1: filter record type, e.g. 'A' or 'AAAA'
# $2: bool value, e.g. 'true' or 'false'
set_filter() {
_type="$1"
_val="$2"
logger -i -t "$log_tag" "setting $_type filter to '$_val'"
$dbus call org.freedesktop.NetworkManager.dnsmasq \
/uk/org/thekelleys/dnsmasq \
org.freedesktop.NetworkManager.dnsmasq \
"SetFilter$_type" b "$_val"
}
# The up/down actions are probably(?) sufficient to act on. The goal is to only
# update filtering in dnsmasq when there's some possibility that the _primary
# connection_ has changed.
case "$action" in
"up" | "down" | "reapply")
;;
*)
# unsupported action
exit 0
esac
primaryConn="$($dbus get-property \
org.freedesktop.NetworkManager \
/org/freedesktop/NetworkManager \
org.freedesktop.NetworkManager \
PrimaryConnection | $jq -r '.data')"
if [ -z "$primaryConn" ]; then
logger -i -t "$log_tag" "unable to determine primary connection!"
exit 1
fi
# This looks at the primary connection's 'gateway' property for the IP6Config
# and IP4Config interfaces, and assumes that if the gateway is unset then the
# connection does not "support" the protocol.
ip4gateway="$(get_gateway "$primaryConn" 4)"
ip6gateway="$(get_gateway "$primaryConn" 6)"
# if no gateways, disable all filtering (default dnsmasq behavior)
if [ -z "$ip4gateway" ] && [ -z "$ip6gateway" ]; then
logger -i -t "$log_tag" "no gateways for primary connection"
logger -i -t "$log_tag" "disabling IPv4 filter"
set_filter A false
logger -i -t "$log_tag" "disabling IPv6 filter"
set_filter AAAA false
else # toggle filters individually depending on gateway status
if [ -z "$ip4gateway" ]; then
logger -i -t "$log_tag" "enabling IPv4 filter"
set_filter A true
else
logger -i -t "$log_tag" "disabling IPv4 filter"
set_filter A false
fi
if [ -z "$ip6gateway" ]; then
logger -i -t "$log_tag" "enabling IPv6 filter"
set_filter AAAA true
else
logger -i -t "$log_tag" "disabling IPv6 filter"
set_filter AAAA false
fi
fi
# dnsmasq will continue to use possibly unfiltered results from its cache, so
# clear the cache
# also see: https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/msg16695.html
$dbus call \
org.freedesktop.NetworkManager.dnsmasq \
/uk/org/thekelleys/dnsmasq org.freedesktop.NetworkManager.dnsmasq \
ClearCache
logger -i -t "$log_tag" "dns filter config applied successfully"