cjdns/cjdns.sbin.patch

diff -up ./contrib/systemd/cjdns-loadmodules.service.sbin ./contrib/systemd/cjdns-loadmodules.service
--- ./contrib/systemd/cjdns-loadmodules.service.sbin	2017-01-13 21:43:05.413731242 -0500
+++ ./contrib/systemd/cjdns-loadmodules.service	2017-01-13 21:43:05.413731242 -0500
@@ -0,0 +1,13 @@
+[Unit]
+Description=Load cjdns kernel modules
+# Load kernel modules needed by cjdns so that it doesn't need the privilege
+Before=cjdns.service
+# Do not try to load modules in containers like openvz
+ConditionVirtualization=!container
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/modprobe tun
+
+[Install]
+WantedBy=multi-user.target
diff -up ./contrib/systemd/cjdns-online.sh.sbin ./contrib/systemd/cjdns-online.sh
--- ./contrib/systemd/cjdns-online.sh.sbin	2017-01-13 21:43:05.414731254 -0500
+++ ./contrib/systemd/cjdns-online.sh	2017-01-13 21:43:05.414731254 -0500
@@ -0,0 +1,90 @@
+#!/bin/sh
+#   Check whether cjdns IPs are available
+#   Copyright (C) 2016  Stuart D. Gathman <stuart@gathman.org>
+#
+#   This program is free software: you can redistribute it and/or modify
+#   it under the terms of the GNU General Public License as published by
+#   the Free Software Foundation, either version 3 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+cjdns_ips() {
+  ip -6 -o addr | while read i dev fam ip rem; do
+    case "$ip" in
+    fc*:*/8) echo "${ip%/8}";;
+    esac
+  done
+}
+
+cjdns_dev() {
+  ip -6 -o addr | while read i dev fam ip rem; do
+    case "$ip" in
+    fc*:*/8) echo "${dev}";;
+    esac
+  done
+}
+
+die() {
+  echo "$1" >&2
+  exit 1
+}
+
+PROGRAM_NAME="/usr/bin/cjdns-online"
+
+ARGS=$(getopt -n $PROGRAM_NAME -o t:xiqsh \
+	--long timeout:,exit,interface,quiet,wait-for-startup,help -- "$@")
+
+# Die if they fat finger arguments, this program may be run as root
+[ $? = 0 ] || die "Error parsing arguments. Try $PROGRAM_NAME --help"
+
+help() {
+        cat <<EOH
+Usage: $PROGRAM_NAME [options]
+        -t, --timeout <timeout_value>	time to wait in seconds, default 30
+        -i, --interface 	output interface name instead of ip
+        -x, --exit		exit immediately if cjdns is not online
+        -q, --quiet		don't print anything
+        -s, --wait-for-startup	wait for full startup instead of just tun dev
+EOH
+        exit 2
+}
+
+let timeout="30"
+let nowait="0"
+let quiet="0"
+let startup="0"
+let interface="0"
+
+eval set -- "$ARGS"
+while true; do
+  case "$1" in
+    -t|--timeout)	   let timeout="$2" || help; shift 2; continue;;
+    -i|--interface)	   let interface="1"; shift;;
+    -x|--exit)		   let nowait="1"; shift;;
+    -q|--quiet)		   let quiet="1"; shift;;
+    -s|--wait-for-startup) let startup="1"; shift;;
+    --) shift; break;;
+    *)	help;;
+  esac
+done
+
+let started="$(date +%s)"
+while test -z "$(cjdns_ips)"; do
+  let elapsed="$(date +%s) - $started"
+  [ $elapsed -gt $timeout ] && exit 1
+  sleep 2
+done
+if [ "$quiet" -eq 0 ]; then
+  if [ "$interface" -eq 0 ]; then
+    cjdns_ips
+  else
+    cjdns_dev
+  fi
+fi
diff -up ./contrib/systemd/cjdns.service.sbin ./contrib/systemd/cjdns.service
--- ./contrib/systemd/cjdns.service.sbin	2016-10-11 17:39:44.000000000 -0400
+++ ./contrib/systemd/cjdns.service	2017-01-13 22:07:35.128118775 -0500
@@ -1,18 +1,21 @@
 [Unit]
 Description=cjdns: routing engine designed for security, scalability, speed and ease of use
 Wants=network.target
-After=network.target
+After=network.target cjdns-loadmodules.service
+Requires=cjdns-loadmodules.service
 
 [Service]
 ProtectHome=true
 ProtectSystem=true
 SyslogIdentifier=cjdroute
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_SYS_CHROOT CAP_AUDIT_CONTROL
 ExecStartPre=/bin/sh -ec "if ! test -s /etc/cjdroute.conf; \
                 then umask 077; \
-                /usr/bin/cjdroute --genconf > /etc/cjdroute.conf; \
+                /usr/sbin/cjdroute --genconf | cat > /etc/cjdroute.conf; \
                 echo 'WARNING: A new /etc/cjdroute.conf file has been generated.'; \
             fi"
-ExecStart=/bin/sh -c "exec cjdroute --nobg < /etc/cjdroute.conf"
+ExecStart=/bin/sh -c "exec /usr/sbin/cjdroute --nobg < /etc/cjdroute.conf"
+ExecStartPost=/bin/sh /usr/libexec/cjdns/cjdns-up
 Restart=always
 
 [Install]
diff -up ./contrib/systemd/cjdns-wait-online.service.sbin ./contrib/systemd/cjdns-wait-online.service
--- ./contrib/systemd/cjdns-wait-online.service.sbin	2017-01-13 21:43:05.414731254 -0500
+++ ./contrib/systemd/cjdns-wait-online.service	2017-01-13 21:43:05.414731254 -0500
@@ -0,0 +1,13 @@
+[Unit]
+Description=CJDNS Wait Online
+Requisite=cjdns.service
+After=cjdns.service
+Wants=network.target
+Before=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/cjdns-online -s -q --timeout=30
+
+[Install]
+WantedBy=multi-user.target
diff -up ./contrib/upstart/cjdns.conf.sbin ./contrib/upstart/cjdns.conf
--- ./contrib/upstart/cjdns.conf.sbin	2016-10-11 17:39:44.000000000 -0400
+++ ./contrib/upstart/cjdns.conf	2017-01-13 21:45:35.268491363 -0500
@@ -13,10 +13,16 @@ pre-start script
     if ! [ -s /etc/cjdroute.conf ]; then
         ( # start a subshell to avoid side effects of umask later on
             umask 077 # to create the file with 600 permissions without races
-            /usr/bin/cjdroute --genconf > /etc/cjdroute.conf
+	    # use cat because cjdroute can't write directly to /etc
+            /usr/sbin/cjdroute --genconf | cat > /etc/cjdroute.conf
         ) # exit subshell; umask no longer applies
         echo 'WARNING: A new cjdns cjdroute.conf file has been generated.'
     fi
+    # preload tun driver, since we prevent module_request
+    case $(wc -c /proc/modules) in
+    0*) ;;
+    *) /sbin/modprobe tun;;
+    esac
 
     # If you need a non-standard setup, as described in
     # https://github.com/cjdelisle/cjdns#non-standard-setups,
@@ -25,4 +31,10 @@ pre-start script
     # see http://upstart.ubuntu.com/cookbook/#setuid
 end script
 
-exec /usr/bin/cjdroute --nobg < /etc/cjdroute.conf
+script
+  exec /usr/sbin/cjdroute --nobg < /etc/cjdroute.conf
+end script
+
+post-start script
+  . /usr/libexec/cjdns/cjdns-up
+end script