dnsdist: Convert capabilities configuration

diff --git a/pdns/dnsdistdist/dnsdist-configuration.hh b/pdns/dnsdistdist/dnsdist-configuration.hh
index 01c3dd4b37aacb0522fb0a9490c5910abb0be46d..7f36034d765208d3ef2293bd7039ca7a34b817af 100644 (file)
--- a/pdns/dnsdistdist/dnsdist-configuration.hh
+++ b/pdns/dnsdistdist/dnsdist-configuration.hh
@@ -145,6 +145,7 @@ static_assert(s_defaultPayloadSizeSelfGenAnswers < s_udpIncomingBufferSize, "The
 
 struct Configuration
 {
+  std::set<std::string> d_capabilitiesToRetain;
   std::string d_consoleKey;
 #ifdef __linux__
   // On Linux this gives us 128k pending queries (default is 8192 queries),

diff --git a/pdns/dnsdistdist/dnsdist-lua.cc b/pdns/dnsdistdist/dnsdist-lua.cc
index cb7fcf9e5af3dac86ee2488d8235d30654113a84..667db8d9a8eec78843990fa449258fe5f1d35700 100644 (file)
--- a/pdns/dnsdistdist/dnsdist-lua.cc
+++ b/pdns/dnsdistdist/dnsdist-lua.cc
@@ -443,7 +443,9 @@ static void handleNewServerSourceParameter(boost::optional<newserver_t>& vars, D
         }
 #ifdef SO_BINDTODEVICE
         /* we need to retain CAP_NET_RAW to be able to set SO_BINDTODEVICE in the health checks */
-        g_capabilitiesToRetain.insert("CAP_NET_RAW");
+        dnsdist::configuration::updateImmutableConfiguration([](dnsdist::configuration::Configuration& config) {
+          config.d_capabilitiesToRetain.insert("CAP_NET_RAW");
+        });
 #endif
       }
       else {
@@ -3297,17 +3299,22 @@ static void setupLuaConfig(LuaContext& luaCtx, bool client, bool configCheck)
 #endif /* HAVE_LIBSSL && HAVE_OCSP_BASIC_SIGN && !DISABLE_OCSP_STAPLING */
 
   luaCtx.writeFunction("addCapabilitiesToRetain", [](LuaTypeOrArrayOf<std::string> caps) {
-    if (!checkConfigurationTime("addCapabilitiesToRetain")) {
-      return;
-    }
-    setLuaSideEffect();
-    if (caps.type() == typeid(std::string)) {
-      g_capabilitiesToRetain.insert(boost::get<std::string>(caps));
+    try {
+      dnsdist::configuration::updateImmutableConfiguration([&caps](dnsdist::configuration::Configuration& config) {
+        if (caps.type() == typeid(std::string)) {
+          config.d_capabilitiesToRetain.insert(boost::get<std::string>(caps));
+        }
+        else if (caps.type() == typeid(LuaArray<std::string>)) {
+          for (const auto& cap : boost::get<LuaArray<std::string>>(caps)) {
+            config.d_capabilitiesToRetain.insert(cap.second);
+          }
+        }
+      });
+      setLuaSideEffect();
     }
-    else if (caps.type() == typeid(LuaArray<std::string>)) {
-      for (const auto& cap : boost::get<LuaArray<std::string>>(caps)) {
-        g_capabilitiesToRetain.insert(cap.second);
-      }
+    catch (const std::exception& exp) {
+      g_outputBuffer = "addCapabilitiesToRetain cannot be used at runtime!\n";
+      errlog("addCapabilitiesToRetain cannot be used at runtime!");
     }
   });
 

diff --git a/pdns/dnsdistdist/dnsdist.cc b/pdns/dnsdistdist/dnsdist.cc
index df237bfe64fe5bdebdc8cfbe9adcfdb88add89ed..1ef3c00320538033f3e58ab916bfc7beb51273e8 100644 (file)
--- a/pdns/dnsdistdist/dnsdist.cc
+++ b/pdns/dnsdistdist/dnsdist.cc
@@ -137,8 +137,6 @@ Rings g_rings;
 
 GlobalStateHolder<servers_t> g_dstates;
 
-std::set<std::string> g_capabilitiesToRetain;
-
 // we are not willing to receive a bigger UDP response than that, no matter what
 static constexpr size_t s_maxUDPResponsePacketSize{4096U};
 static size_t const s_initialUDPPacketBufferSize = s_maxUDPResponsePacketSize + DNSCRYPT_MAX_RESPONSE_PADDING_AND_MAC_SIZE;
@@ -3102,7 +3100,7 @@ static void dropPrivileges()
   }
 
   bool retainedCapabilities = true;
-  if (!g_capabilitiesToRetain.empty() && (getegid() != newgid || geteuid() != newuid)) {
+  if (!dnsdist::configuration::getImmutableConfiguration().d_capabilitiesToRetain.empty() && (getegid() != newgid || geteuid() != newuid)) {
     retainedCapabilities = keepCapabilitiesAfterSwitchingIDs();
   }
 
@@ -3133,7 +3131,7 @@ static void dropPrivileges()
        or as an unprivileged user with ambient
        capabilities like CAP_NET_BIND_SERVICE.
     */
-    dropCapabilities(g_capabilitiesToRetain);
+    dropCapabilities(dnsdist::configuration::getImmutableConfiguration().d_capabilitiesToRetain);
   }
   catch (const std::exception& e) {
     warnlog("%s", e.what());

diff --git a/pdns/dnsdistdist/dnsdist.hh b/pdns/dnsdistdist/dnsdist.hh
index 398a5700014e616784c3af1a7d83de43bc14fffb..6fdd47394e09b1d5fec94b125cad799e179c6e19 100644 (file)
--- a/pdns/dnsdistdist/dnsdist.hh
+++ b/pdns/dnsdistdist/dnsdist.hh
@@ -1057,8 +1057,6 @@ extern std::vector<std::shared_ptr<DNSCryptContext>> g_dnsCryptLocals;
 bool handleDNSCryptQuery(PacketBuffer& packet, DNSCryptQuery& query, bool tcp, time_t now, PacketBuffer& response);
 bool checkDNSCryptQuery(const ClientState& clientState, PacketBuffer& query, std::unique_ptr<DNSCryptQuery>& dnsCryptQuery, time_t now, bool tcp);
 
-extern std::set<std::string> g_capabilitiesToRetain;
-
 enum class ProcessQueryResult : uint8_t
 {
   Drop,