dnsmasq: source RFC6761 file first

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>

diff --git a/package/network/services/dnsmasq/Makefile b/package/network/services/dnsmasq/Makefile
index a2abf7ddbed28ff937ba0bab883ee832e8d492f7..93d782792d9b0e3ffb35ff402822f9447c665a9c 100644 (file)
--- a/package/network/services/dnsmasq/Makefile
+++ b/package/network/services/dnsmasq/Makefile
@@ -30,6 +30,7 @@ PKG_CONFIG_DEPENDS:= CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dhcp \
        CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dnssec \
        CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_auth \
        CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_ipset \
+       CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_nftset \
        CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_conntrack \
        CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_noid \
        CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_broken_rtc \
@@ -61,10 +62,11 @@ endef
 
 define Package/dnsmasq-full
 $(call Package/dnsmasq/Default)
-  TITLE += (with DNSSEC, DHCPv6, Auth DNS, IPset, Conntrack, NO_ID enabled by default)
+  TITLE += (with DNSSEC, DHCPv6, Auth DNS, IPset, Nftset, Conntrack, NO_ID enabled by default)
   DEPENDS+=+PACKAGE_dnsmasq_full_dnssec:libnettle \
        +PACKAGE_dnsmasq_full_ipset:kmod-ipt-ipset \
-       +PACKAGE_dnsmasq_full_conntrack:libnetfilter-conntrack
+       +PACKAGE_dnsmasq_full_conntrack:libnetfilter-conntrack \
+       +PACKAGE_dnsmasq_full_nftset:nftables-json
   VARIANT:=full
   PROVIDES:=dnsmasq
 endef
@@ -110,6 +112,9 @@ define Package/dnsmasq-full/config
        config PACKAGE_dnsmasq_full_ipset
                bool "Build with IPset support."
                default y
+       config PACKAGE_dnsmasq_full_nftset
+               bool "Build with Nftset support."
+               default y
        config PACKAGE_dnsmasq_full_conntrack
                bool "Build with Conntrack support."
                default y
@@ -144,6 +149,7 @@ ifeq ($(BUILD_VARIANT),full)
                $(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dnssec),-DHAVE_DNSSEC) \
                $(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_auth),,-DNO_AUTH) \
                $(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_ipset),,-DNO_IPSET) \
+               $(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_nftset),-DHAVE_NFTSET,) \
                $(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_conntrack),-DHAVE_CONNTRACK,) \
                $(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_noid),-DNO_ID,) \
                $(if $(CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_broken_rtc),-DHAVE_BROKEN_RTC) \

diff --git a/package/network/services/dnsmasq/files/dnsmasq.init b/package/network/services/dnsmasq/files/dnsmasq.init
index b49f2cb61d43f601946d052588c798f4a79afc3d..b65f7e7c3f7969673d0e2ff33ead304e515fa591 100755 (executable)
--- a/package/network/services/dnsmasq/files/dnsmasq.init
+++ b/package/network/services/dnsmasq/files/dnsmasq.init
@@ -33,6 +33,7 @@ dnsmasq_ignore_opt() {
                [ "${dnsmasq_features#* DNSSEC }" = "$dnsmasq_features" ] || dnsmasq_has_dnssec=1
                [ "${dnsmasq_features#* TFTP }" = "$dnsmasq_features" ] || dnsmasq_has_tftp=1
                [ "${dnsmasq_features#* ipset }" = "$dnsmasq_features" ] || dnsmasq_has_ipset=1
+               [ "${dnsmasq_features#* nftset }" = "$dnsmasq_features" ] || dnsmasq_has_nftset=1
        fi
 
        case "$opt" in
@@ -55,6 +56,8 @@ dnsmasq_ignore_opt() {
                        [ -z "$dnsmasq_has_tftp" ] ;;
                ipset)
                        [ -z "$dnsmasq_has_ipset" ] ;;
+               nftset)
+                       [ -z "$dnsmasq_has_nftset" ] ;;
                *)
                        return 1
        esac
@@ -173,6 +176,10 @@ append_ipset() {
        xappend "--ipset=$1"
 }
 
+append_nftset() {
+       xappend "--nftset=$1"
+}
+
 append_connmark_allowlist() {
        xappend "--connmark-allowlist=$1"
 }
@@ -808,6 +815,29 @@ dnsmasq_ipset_add() {
        xappend "--ipset=$domains/$ipsets"
 }
 
+dnsmasq_nftset_add() {
+       local cfg="$1"
+       local nftsets domains
+
+       add_nftset() {
+               nftsets="${nftsets:+$nftsets,}$1"
+       }
+
+       add_domain() {
+               # leading '/' is expected
+               domains="$domains/$1"
+       }
+
+       config_list_foreach "$cfg" "name" add_nftset
+       config_list_foreach "$cfg" "domain" add_domain
+
+       if [ -z "$nftsets" ] || [ -z "$domains" ]; then
+               return 0
+       fi
+
+       xappend "--nftset=$domains/$nftsets"
+}
+
 dnsmasq_start()
 {
        local cfg="$1"
@@ -849,6 +879,12 @@ dnsmasq_start()
                xappend "--conf-file=${dnsmasqconffile}"
        }
 
+       config_get_bool boguspriv "$cfg" boguspriv 1
+       [ "$boguspriv" -gt 0 ] && {
+               xappend "--bogus-priv"
+               [ -r "$RFC6761FILE" ] && xappend "--conf-file=$RFC6761FILE"
+       }
+
        $PROG --version | grep -osqE "^Compile time options:.* DHCPv6( |$)" && DHCPv6CAPABLE=1 || DHCPv6CAPABLE=0
 
 
@@ -940,6 +976,7 @@ dnsmasq_start()
        config_list_foreach "$cfg" "rev_server" append_rev_server
        config_list_foreach "$cfg" "address" append_address
        config_list_foreach "$cfg" "ipset" append_ipset
+       config_list_foreach "$cfg" "nftset" append_nftset
 
        local connmark_allowlist_enable
        config_get connmark_allowlist_enable "$cfg" connmark_allowlist_enable 0
@@ -1096,11 +1133,6 @@ dnsmasq_start()
        config_foreach filter_dnsmasq mxhost dhcp_mx_add "$cfg"
        echo >> $CONFIGFILE_TMP
 
-       config_get_bool boguspriv "$cfg" boguspriv 1
-       [ "$boguspriv" -gt 0 ] && {
-               xappend "--bogus-priv"
-               [ -r "$RFC6761FILE" ] && xappend "--conf-file=$RFC6761FILE"
-       }
 
        if [ "$DNSMASQ_DHCP_VER" -gt 4 ] ; then
                # Enable RA feature for when/if it is constructed,
@@ -1124,6 +1156,10 @@ dnsmasq_start()
        config_foreach filter_dnsmasq ipset dnsmasq_ipset_add "$cfg"
        echo >> $CONFIGFILE_TMP
 
+       echo >> $CONFIGFILE_TMP
+       config_foreach filter_dnsmasq nftset dnsmasq_nftset_add "$cfg"
+       echo >> $CONFIGFILE_TMP
+
        echo >> $CONFIGFILE_TMP
        mv -f $CONFIGFILE_TMP $CONFIGFILE
        mv -f $HOSTFILE_TMP $HOSTFILE