podman: wire the podman bridges into dnsmasq and fw4

Ship a uci-defaults script that excepts the podman bridges from dnsmasq so
aardvark-dns can own the gateway :53, adds an fw4 zone forwarding the podman
subnets to wan, and reloads both so it also applies on a running system.

Signed-off-by: Daniel Golle <redacted>

diff --git a/utils/podman/Makefile b/utils/podman/Makefile
index fdb23ef2e40aa0c7f11e37176bbcdef3c5e77188..78e60243c9c9304582427c14c6b259857cb3491f 100644 (file)
--- a/utils/podman/Makefile
+++ b/utils/podman/Makefile
@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=podman
 PKG_VERSION:=5.8.4
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/podman-container-tools/podman/archive/v$(PKG_VERSION)
@@ -108,6 +108,8 @@ define Package/podman/install
        $(INSTALL_DATA) $(PKG_BUILD_DIR)/vendor/go.podman.io/common/pkg/seccomp/seccomp.json $(1)/usr/share/containers/
        $(INSTALL_DIR) $(1)/etc/init.d
        $(INSTALL_BIN) ./files/podman.init $(1)/etc/init.d/podman
+       $(INSTALL_DIR) $(1)/etc/uci-defaults
+       $(INSTALL_BIN) ./files/podman.defaults $(1)/etc/uci-defaults/90-podman
        $(SED) 's/driver = \"\"/driver = \"overlay\"/g' $(1)/etc/containers/storage.conf
 endef
 

diff --git a/utils/podman/files/podman.defaults b/utils/podman/files/podman.defaults
new file mode 100755 (executable)
index 0000000..95058f3
--- /dev/null
+++ b/utils/podman/files/podman.defaults
@@ -0,0 +1,40 @@
+#!/bin/sh
+
+changed=0
+
+if uci -q get dhcp.@dnsmasq[0] >/dev/null; then
+       case " $(uci -q get dhcp.@dnsmasq[0].notinterface) " in
+       *" podman* "*) ;;
+       *)
+               uci add_list dhcp.@dnsmasq[0].notinterface='podman*'
+               uci commit dhcp
+               changed=1
+               ;;
+       esac
+fi
+
+if ! uci -q get firewall.podman >/dev/null; then
+       uci -q batch <<-UCI
+               set firewall.podman=zone
+               set firewall.podman.name='podman'
+               add_list firewall.podman.device='podman+'
+               set firewall.podman.input='REJECT'
+               set firewall.podman.output='ACCEPT'
+               set firewall.podman.forward='REJECT'
+               set firewall.podman_wan=forwarding
+               set firewall.podman_wan.src='podman'
+               set firewall.podman_wan.dest='wan'
+               set firewall.podman_dns=rule
+               set firewall.podman_dns.name='Allow-DNS-podman'
+               set firewall.podman_dns.src='podman'
+               set firewall.podman_dns.proto='tcp udp'
+               set firewall.podman_dns.dest_port='53'
+               set firewall.podman_dns.target='ACCEPT'
+               commit firewall
+       UCI
+       changed=1
+fi
+
+[ "$changed" = 1 ] && reload_config
+
+exit 0