[PATCH] wg-quick: use bind mount for DNS when no openresolv

[Jason A. Donenfeld]

Posting this to the mailing list for review. Based on the thread
entitled, "Fixing wg-quick's DNS= directive with a hatchet". Comments
are very welcome.

---
 src/tools/wg-quick.bash | 28 +++++++++++++++++++++++++---
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/src/tools/wg-quick.bash b/src/tools/wg-quick.bash
index def78af..2fc19f1 100755
--- a/src/tools/wg-quick.bash
+++ b/src/tools/wg-quick.bash
@@ -131,11 +131,33 @@ set_mtu() {
 }
 
 set_dns() {
-       [[ ${#DNS[@]} -eq 0 ]] || printf 'nameserver %s\n' "${DNS[@]}" | cmd 
resolvconf -a "tun.$INTERFACE" -m 0 -x
+       [[ ${#DNS[@]} -gt 0 ]] || return 0
+
+       if [[ $(resolvconf --version 2>/dev/null) == openresolv\ * ]]; then
+               printf 'nameserver %s\n' "${DNS[@]}" | cmd resolvconf -a 
"$INTERFACE" -m 0 -x
+       else
+               local our_resolv="/etc/resolv.conf.wg-quick.$INTERFACE"
+               [[ -e /etc/resolv.conf ]] || touch /etc/resolv.conf
+               { echo "# This file was generated by wg-quick(8) for use with"
+                 echo "# the WireGuard interface $INTERFACE. It cannot be"
+                 echo "# removed or altered directly. You may remove this file"
+                 echo "# by running \`wg-quick down $INTERFACE\`, or if that"
+                 echo "# poses problems, run \`unmount /etc/resolv.conf\`."
+                 printf 'nameserver %s\n' "${DNS[@]}"
+               } > "$our_resolv"
+               cmd mount -Br "$our_resolv" /etc/resolv.conf || { unlink 
"$our_resolv"; false; }
+               unlink "$our_resolv"
+       fi
 }
 
 unset_dns() {
-       [[ ${#DNS[@]} -eq 0 ]] || cmd resolvconf -d "tun.$INTERFACE"
+       [[ ${#DNS[@]} -gt 0 ]] || return 0
+
+       if [[ $(resolvconf --version 2>/dev/null) == openresolv\ * ]]; then
+               cmd resolvconf -d "$INTERFACE"
+       else
+               cmd umount /etc/resolv.conf
+       fi
 }
 
 add_route() {
@@ -254,8 +276,8 @@ cmd_down() {
        [[ " $(wg show interfaces) " == *" $INTERFACE "* ]] || die 
"\`$INTERFACE' is not a WireGuard interface"
        execute_hooks "${PRE_DOWN[@]}"
        [[ $SAVE_CONFIG -eq 0 ]] || save_config
-       unset_dns
        del_if
+       unset_dns
        execute_hooks "${POST_DOWN[@]}"
 }
 
-- 
2.14.2

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard