From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Jason@zx2c4.com Received: from krantz.zx2c4.com (localhost [127.0.0.1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 9377cff4 for ; Thu, 26 Oct 2017 13:39:50 +0000 (UTC) Received: from frisell.zx2c4.com (frisell.zx2c4.com [192.95.5.64]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id e47d92e2 for ; Thu, 26 Oct 2017 13:39:50 +0000 (UTC) From: "Jason A. Donenfeld" To: wireguard@lists.zx2c4.com, Daniel Kahn Gillmor Subject: [PATCH v2] wg-quick: use bind mount for DNS when no openresolv Date: Thu, 26 Oct 2017 15:41:25 +0200 Message-Id: <20171026134125.2946-1-Jason@zx2c4.com> In-Reply-To: <20171026013240.13503-1-Jason@zx2c4.com> References: <20171026013240.13503-1-Jason@zx2c4.com> List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Version 2 uses the mount namespace trick, so that we don't leave anything dangling under any circumstances, and chroot envrionments still have the ability to bind mount /etc/resolv.conf to their chroots. --- src/tools/wg-quick.bash | 40 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 37 insertions(+), 3 deletions(-) diff --git a/src/tools/wg-quick.bash b/src/tools/wg-quick.bash index def78af..b6903ec 100755 --- a/src/tools/wg-quick.bash +++ b/src/tools/wg-quick.bash @@ -83,6 +83,7 @@ add_if() { del_if() { local fwmark + [[ $HAVE_SET_DNS -eq 0 ]] || unset_dns fwmark="$(wg show "$INTERFACE" fwmark)" DEFAULT_TABLE=0 [[ $fwmark != off ]] && DEFAULT_TABLE=$(( fwmark )) @@ -130,12 +131,45 @@ set_mtu() { cmd ip link set mtu $(( mtu - 80 )) dev "$INTERFACE" } +HAVE_SET_DNS=0 set_dns() { - [[ ${#DNS[@]} -eq 0 ]] || printf 'nameserver %s\n' "${DNS[@]}" | cmd resolvconf -a "tun.$INTERFACE" -m 0 -x + [[ ${#DNS[@]} -gt 0 ]] || return 0 + + if [[ $(resolvconf --version 2>/dev/null) == openresolv\ * ]]; then + printf 'nameserver %s\n' "${DNS[@]}" | cmd resolvconf -a "$INTERFACE" -m 0 -x + else + echo "[#] mount \`${DNS[*]}' /etc/resolv.conf" >&2 + [[ -e /etc/resolv.conf ]] || touch /etc/resolv.conf + { cat <<-_EOF + # This file was generated by wg-quick(8) for use with + # the WireGuard interface $INTERFACE. It cannot be + # removed or altered directly. You may remove this file + # by running \`wg-quick down $INTERFACE', or if that + # poses problems, run \`umount /etc/resolv.conf'. + + _EOF + printf 'nameserver %s\n' "${DNS[@]}" + } | unshare -m --propagation shared bash -c "$(cat <<-_EOF + set -e + mount --make-private /tmp + mount -t tmpfs none /tmp + cat > /tmp/resolv.conf + mount -o remount,ro /tmp + mount -B /tmp/resolv.conf /etc/resolv.conf + _EOF + )" + fi + HAVE_SET_DNS=1 } unset_dns() { - [[ ${#DNS[@]} -eq 0 ]] || cmd resolvconf -d "tun.$INTERFACE" + [[ ${#DNS[@]} -gt 0 ]] || return 0 + + if [[ $(resolvconf --version 2>/dev/null) == openresolv\ * ]]; then + cmd resolvconf -d "$INTERFACE" + else + cmd umount /etc/resolv.conf + fi } add_route() { @@ -254,8 +288,8 @@ cmd_down() { [[ " $(wg show interfaces) " == *" $INTERFACE "* ]] || die "\`$INTERFACE' is not a WireGuard interface" execute_hooks "${PRE_DOWN[@]}" [[ $SAVE_CONFIG -eq 0 ]] || save_config - unset_dns del_if + unset_dns execute_hooks "${POST_DOWN[@]}" } -- 2.14.2