From a8cd964e9fb6d9596266187e0e590bf730ce7fca Mon Sep 17 00:00:00 2001 From: Clayton Craft Date: Sat, 11 Jul 2026 19:06:28 -0700 Subject: [PATCH] main/postmarketos-base-ui: don't use dnsmasq for filtering This reverts 4b516916dc2 Signed-off-by: Clayton Craft Part-of: --- .ci/shellcheck.sh | 1 - main/postmarketos-base-ui/APKBUILD | 14 +- ...-NetworkManager-conf.d-50-use-dnsmasq.conf | 2 - ...tworkManager-dispatcher.d-50-dns-filter.sh | 145 ------------------ 4 files changed, 3 insertions(+), 159 deletions(-) delete mode 100644 main/postmarketos-base-ui/rootfs-usr-lib-NetworkManager-conf.d-50-use-dnsmasq.conf delete mode 100644 main/postmarketos-base-ui/rootfs-usr-lib-NetworkManager-dispatcher.d-50-dns-filter.sh diff --git a/.ci/shellcheck.sh b/.ci/shellcheck.sh index fa01b365a..9e3f2c76d 100755 --- a/.ci/shellcheck.sh +++ b/.ci/shellcheck.sh @@ -15,7 +15,6 @@ fi # Shell: shellcheck sh_files=" ./main/mdss-fb-init-hack/mdss-fb-init-hack.sh - ./main/postmarketos-base-ui/rootfs-usr-lib-NetworkManager-dispatcher.d-50-dns-filter.sh ./main/postmarketos-duranium/rootfs-usr-bin-duranium-set-channel ./main/postmarketos-duranium/rootfs-usr-libexec-duranium-first-boot ./main/postmarketos-duranium/rootfs-usr-libexec-duranium-usb-gadget-setup diff --git a/main/postmarketos-base-ui/APKBUILD b/main/postmarketos-base-ui/APKBUILD index 62b5b11cf..87a5bdd34 100644 --- a/main/postmarketos-base-ui/APKBUILD +++ b/main/postmarketos-base-ui/APKBUILD @@ -96,7 +96,6 @@ _source644=" usr/lib/NetworkManager/conf.d/50-hostname-mode.conf usr/lib/NetworkManager/conf.d/50-iwd.conf usr/lib/NetworkManager/conf.d/50-random-mac.conf - usr/lib/NetworkManager/conf.d/50-use-dnsmasq.conf usr/lib/systemd/system/ModemManager.service.d/quick-suspend-resume.conf usr/lib/systemd/system/iio-sensor-proxy.service.d/shutdown.conf usr/lib/tmpfiles.d/alsa-utils.conf @@ -107,7 +106,6 @@ _source644=" usr/share/mkinitfs/files/10-wireless-regdb.files " _source755=" - usr/lib/NetworkManager/dispatcher.d/50-dns-filter.sh usr/share/tinydm/env-wayland.d/50-sdl-wayland.sh etc/profile.d/qt-mobile-controls.sh etc/profile.d/qt-wayland.sh @@ -222,20 +220,16 @@ obexd() { } networkmanager() { + # dnsmasq: required for connection sharing/hotspot depends=" - busctl - dnsmasq-dnssec-dbus>=2.90-r1 - gojq + dnsmasq networkmanager networkmanager-cli networkmanager-tui networkmanager-wifi - networkmanager-wwan - networkmanager-dnsmasq" + networkmanager-wwan" amove usr/lib/NetworkManager/conf.d/50-hostname-mode.conf amove usr/lib/NetworkManager/conf.d/50-random-mac.conf - amove usr/lib/NetworkManager/conf.d/50-use-dnsmasq.conf - amove usr/lib/NetworkManager/dispatcher.d/50-dns-filter.sh } qt_tweaks() { @@ -362,7 +356,6 @@ cac604e25c46e695dd30bd5a10cfd2d69595fcc3bc290096ac94b76b10834d591ea6576afb79c46b 3c9ae7415f4891bee8595166ed6a42cb577a837f741c6b5409d193558626348b41516888a01d0c4895282c5f4e9a1ff838c19712888750b2ef68429bb4b42ee3 rootfs-usr-lib-NetworkManager-conf.d-50-hostname-mode.conf 439615745d5be0d1ab6801cfbf960a31b12da30bf5df64ba2914ff32dae9e650595d7f96e66f5dff6308f092de1f746277ea7f4e701888a22571f7c119b7bf0d rootfs-usr-lib-NetworkManager-conf.d-50-iwd.conf d4b4c4fed2dee7266f6a87ae266691377593014943e2953e4cd87a59f3110f25bfb5f3f866cc843519f628695e4df7602bfdcd3d79f2c2cd6e8256535c33b038 rootfs-usr-lib-NetworkManager-conf.d-50-random-mac.conf -900554534191fa0797064d35350934cdd8af59f30f0ae7d8ec63c2e11c44a16c643d3024b6543940488cd590fec1d392548bcaacc3be88cddff90f69b17ece07 rootfs-usr-lib-NetworkManager-conf.d-50-use-dnsmasq.conf cc86775a7820eb683e67df7d23ebae9d72699a643ff1452c71daf38ac6c39a84fd1686e67351ab0a2c582f9fc0374410383e3a32bd378cf11a8fb6033fde35ac rootfs-usr-lib-systemd-system-ModemManager.service.d-quick-suspend-resume.conf 087b9e967f6ffeaeb1fd6c5860bb07d0b8c2ce2c1b636d73e989cc9f3c8c6a60dc9552ec5ff13a2bce6804c3f5e8876d4b41a07770f06f6cee0fa37a54f996b4 rootfs-usr-lib-systemd-system-iio-sensor-proxy.service.d-shutdown.conf 1f0e33cc8d435d2d97863a8080eb5b6d476b6515b29707bd2f86fafa8af6c3bbdacc7cd0eeb9ed4735d31baa760846e734e33c0238165e9b1e8fee666323096d rootfs-usr-lib-tmpfiles.d-alsa-utils.conf @@ -371,7 +364,6 @@ cc86775a7820eb683e67df7d23ebae9d72699a643ff1452c71daf38ac6c39a84fd1686e67351ab0a 54620e508a5070ec8819e3661e592acfcfd26c52170b0ecc4dbbc1c61998963ce20bf9d9b051a608b76d6fc17e61c65decc16602b7d58061b9149667a968d258 rootfs-usr-share-flatpak-remotes.d-flathub.flatpakrepo 92930f027626825b027f585a9be180f8a6ebae6dc44d2cf8f9d43cce00db8cbb43c33fc341fe382abacb832ea1b6414dc4c8129d265b0258d096599b2e206a93 rootfs-usr-share-wireplumber-wireplumber.conf.d-50-bluetooth.conf 66a7a72746e822676d0ec76160e39b65c711e574a6334f3aad38c563d3104b33d0619d50b92c9201546fd81bfd10cfe0e4a59278cbcbddf20a238f6ad71c050c rootfs-usr-share-mkinitfs-files-10-wireless-regdb.files -36e0037f6d26a99db7b47831263be610d594e2c1c4a8ee7f6fc8b41092f501d3064d80b80ddf6a82b616bd2da09aa4da896074ad9f7fd53aba7e397da4190d22 rootfs-usr-lib-NetworkManager-dispatcher.d-50-dns-filter.sh ecaa57d033a119a53a6574c27636b7c89d659d75ea48a973a6a4ff6f90e5d07202529fd489bfc9dfc7430f5b60f40612f6d5c06f7fab47e681b0a3112a874058 rootfs-usr-share-tinydm-env-wayland.d-50-sdl-wayland.sh bf8db527c49fa724e640a90269ba2648a2555f5867b2adbfbd88d1f685261f757339757c09ee08f590c76de4bd3d0c73a47dea9bd340644dd4707e76152cefd1 rootfs-etc-profile.d-qt-mobile-controls.sh 6e193eca3961a78d47b4656892eae34d019d9317a255a201f5ea61e3300caff04c526a27cd98d0edc072b36e3eaf3a1768f4cd27c5e2be8b19c167d535c820a6 rootfs-etc-profile.d-qt-wayland.sh diff --git a/main/postmarketos-base-ui/rootfs-usr-lib-NetworkManager-conf.d-50-use-dnsmasq.conf b/main/postmarketos-base-ui/rootfs-usr-lib-NetworkManager-conf.d-50-use-dnsmasq.conf deleted file mode 100644 index 53a8b1725..000000000 --- a/main/postmarketos-base-ui/rootfs-usr-lib-NetworkManager-conf.d-50-use-dnsmasq.conf +++ /dev/null @@ -1,2 +0,0 @@ -[main] -dns=dnsmasq diff --git a/main/postmarketos-base-ui/rootfs-usr-lib-NetworkManager-dispatcher.d-50-dns-filter.sh b/main/postmarketos-base-ui/rootfs-usr-lib-NetworkManager-dispatcher.d-50-dns-filter.sh deleted file mode 100644 index ed3a91fc2..000000000 --- a/main/postmarketos-base-ui/rootfs-usr-lib-NetworkManager-dispatcher.d-50-dns-filter.sh +++ /dev/null @@ -1,145 +0,0 @@ -#!/bin/sh -# This dispatcher script exists to configure a dnsmasq instance managed by -# NetworkManager to restrict DNS responses based on the IP configuration -# supported by NetworkManager's "Primary Connection". The script requires that -# NetworkManager is configured to use/manage dnsmasq. -# For more information about *why* this is necessary, see: -# - https://gitlab.postmarketos.org/postmarketOS/pmaports/-/issues/1430 -# - https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/3823 -# Related: -# - https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1279 - -set -eu - -log_tag="nm-dns-filter" -dbus="busctl --json=short" -# gojq is like... 10x faster than jq on a modest phone... (0.07s vs 0.89s) -jq=gojq - -action="${2:-}" - -# Get the gateway for the given connection and IP protocol version -# $1: D-Bus path to connection -# $2: IP version, e.g. '4' or '6' -get_gateway() { - _conn="$1" - _ver="$2" - - _ipcfg="$($dbus get-property \ - org.freedesktop.NetworkManager \ - "$_conn" \ - org.freedesktop.NetworkManager.Connection.Active \ - "Ip${_ver}Config" | $jq -r '.data')" - - if [ -z "$_ipcfg" ]; then - logger -i -t "$log_tag" "error: unable to determine IP config for primary connection!" - exit 1 - fi - logger -i -t "$log_tag" "pri conn ip$_ver config path: $_ipcfg" - - _attempt=0 - # NetworkManager dispatches to the script as soon as the interface comes - # up, which for an IPv6 network may be before the device has received an - # Router Advertisement (RA). This means that there may be no IPv6 gateway - # defined right now, but if we wait a few seconds an RA might arrive and a - # gateway might become defined. NM does not dispatch to scripts when an RA - # arrives and triggers a change in IP address / gateway / routes, so the - # current invocation is our only chance. So we wait up to 5 seconds for the - # gateway to be defined before deciding that the network doesn't have IPv6 - # connectivity. NetworkManager-dispatcher man page says that the dispatcher - # will kill scripts that run for "too long", that's currently (in NM 1.42) - # set to 10 minutes, but let's keep our timeout much shorter. - while [ "$_attempt" -lt 5 ]; do - _gateway="$($dbus get-property \ - org.freedesktop.NetworkManager \ - "$_ipcfg" \ - "org.freedesktop.NetworkManager.IP${_ver}Config" \ - Gateway | $jq -r '.data')" - if [ -n "$_gateway" ]; then - break - fi - sleep 1 - _attempt="$(( _attempt + 1 ))" - done - - logger -i -t "$log_tag" "ip$_ver gateway: $_gateway" - - echo "$_gateway" -} - -# $1: filter record type, e.g. 'A' or 'AAAA' -# $2: bool value, e.g. 'true' or 'false' -set_filter() { - _type="$1" - _val="$2" - logger -i -t "$log_tag" "setting $_type filter to '$_val'" - $dbus call org.freedesktop.NetworkManager.dnsmasq \ - /uk/org/thekelleys/dnsmasq \ - org.freedesktop.NetworkManager.dnsmasq \ - "SetFilter$_type" b "$_val" -} - -# The up/down actions are probably(?) sufficient to act on. The goal is to only -# update filtering in dnsmasq when there's some possibility that the _primary -# connection_ has changed. -case "$action" in - "up" | "down" | "reapply") - ;; - *) - # unsupported action - exit 0 -esac - -primaryConn="$($dbus get-property \ - org.freedesktop.NetworkManager \ - /org/freedesktop/NetworkManager \ - org.freedesktop.NetworkManager \ - PrimaryConnection | $jq -r '.data')" - -if [ -z "$primaryConn" ]; then - logger -i -t "$log_tag" "unable to determine primary connection!" - exit 1 -fi - -# This looks at the primary connection's 'gateway' property for the IP6Config -# and IP4Config interfaces, and assumes that if the gateway is unset then the -# connection does not "support" the protocol. - -ip4gateway="$(get_gateway "$primaryConn" 4)" -ip6gateway="$(get_gateway "$primaryConn" 6)" - -# if no gateways, disable all filtering (default dnsmasq behavior) -if [ -z "$ip4gateway" ] && [ -z "$ip6gateway" ]; then - logger -i -t "$log_tag" "no gateways for primary connection" - logger -i -t "$log_tag" "disabling IPv4 filter" - set_filter A false - logger -i -t "$log_tag" "disabling IPv6 filter" - set_filter AAAA false -else # toggle filters individually depending on gateway status - if [ -z "$ip4gateway" ]; then - logger -i -t "$log_tag" "enabling IPv4 filter" - set_filter A true - else - logger -i -t "$log_tag" "disabling IPv4 filter" - set_filter A false - fi - - if [ -z "$ip6gateway" ]; then - logger -i -t "$log_tag" "enabling IPv6 filter" - set_filter AAAA true - else - logger -i -t "$log_tag" "disabling IPv6 filter" - set_filter AAAA false - fi -fi - -# dnsmasq will continue to use possibly unfiltered results from its cache, so -# clear the cache -# also see: https://www.mail-archive.com/dnsmasq-discuss@lists.thekelleys.org.uk/msg16695.html - -$dbus call \ - org.freedesktop.NetworkManager.dnsmasq \ - /uk/org/thekelleys/dnsmasq org.freedesktop.NetworkManager.dnsmasq \ - ClearCache - -logger -i -t "$log_tag" "dns filter config applied successfully"