···

       
44
       
44
       
 
       
      path = [ pkgs.iptables pkgs.tcpcrypt pkgs.procps ];

     

       
45
       
45
       
 
       


     

       
46
       
46
       
 
       
      preStart = ''

     

       
47
       
47
       
+
       
        mkdir -p /var/run/tcpcryptd

     

       
48
       
48
       
+
       
        chown tcpcryptd /var/run/tcpcryptd

     

       
47
       
49
       
 
       
        sysctl -n net.ipv4.tcp_ecn >/run/pre-tcpcrypt-ecn-state

     

       
48
       
50
       
 
       
        sysctl -w net.ipv4.tcp_ecn=0

     

       
49
       
51
       
 
       


     

···

       
1
       
1
       
-
       
From 4ef50d76a2da61be60fea448690e24f35bc37299 Mon Sep 17 00:00:00 2001

     

       
2
       
2
       
-
       
From: Peter Simons <simons@cryp.to>

     

       
3
       
3
       
-
       
Date: Wed, 11 Sep 2013 17:19:29 +0200

     

       
4
       
4
       
-
       
Subject: [PATCH] Run tcpcryptd under uid 93 instead of 666.

     

       
5
       
5
       
-
       


     

       
6
       
6
       
-
       
---

     

       
7
       
7
       
-
       
 user/src/linux.c | 2 +-

     

       
8
       
8
       
-
       
 1 file changed, 1 insertion(+), 1 deletion(-)

     

       
9
       
9
       
-
       


     

       
10
       
10
       
-
       
diff --git a/user/src/linux.c b/user/src/linux.c

     

       
11
       
11
       
-
       
index b51e6b2..8199193 100644

     

       
12
       
12
       
-
       
--- a/user/src/linux.c

     

       
13
       
13
       
-
       
+++ b/user/src/linux.c

     

       
14
       
14
       
-
       
@@ -198,7 +198,7 @@ void linux_drop_privs(void)

     

       
15
       
15
       
-
       
 

     

       
16
       
16
       
-
       
 	cap_free(caps);

     

       
17
       
17
       
-
       
 

     

       
18
       
18
       
-
       
-	if (setuid(666) == -1)

     

       
19
       
19
       
-
       
+	if (setuid(93) == -1)

     

       
20
       
20
       
-
       
 		err(1, "setuid()");

     

       
21
       
21
       
-
       
 

     

       
22
       
22
       
-
       
 	caps = cap_init();

     

       
23
       
23
       
-
       
-- 

     

       
24
       
24
       
-
       
1.8.3.4

     

       
25
       
25
       
-
       


     

···

       
1
       
1
       
-
       
{ fetchurl, stdenv, autoconf, automake, libtool

     

       
1
       
1
       
+
       
{ fetchurl, stdenv, autoconf, automake, libtool, autoreconfHook

     

       
2
       
2
       
 
       
, openssl, libcap, libnfnetlink, libnetfilter_queue

     

       
3
       
3
       
 
       
}:

     

       
4
       
4
       
 
       


     

       
5
       
5
       
-
       
let

     

       
6
       
6
       
-
       
  rev = "0e07772316061ad67b8770e7d98d5dd099c9c7c7";

     

       
7
       
7
       
-
       
in

     

       
8
       
5
       
 
       
stdenv.mkDerivation rec {

     

       
9
       
9
       
-
       
  name = "tcpcrypt-2011.07.22";

     

       
6
       
6
       
+
       
  name = "tcpcrypt-0.3-rc1";

     

       
10
       
7
       
 
       


     

       
11
       
8
       
 
       
  src = fetchurl {

     

       
12
       
12
       
-
       
    url = "https://github.com/sorbo/tcpcrypt/archive/${rev}.tar.gz";

     

       
13
       
13
       
-
       
    sha256 = "1f1f1iawlvipnccwh31fxnb8yam1fgh36m0qcbc29qk1ggwrfnkk";

     

       
9
       
9
       
+
       
    url = "https://github.com/scslab/tcpcrypt/archive/v0.3-rc1.tar.gz";

     

       
10
       
10
       
+
       
    sha256 = "1k79xfip95kyy91b6rnmsgl66g52zrnm92ln4jms133nm2k9s4sa";

     

       
14
       
11
       
 
       
    name = "${name}.tar.gz";

     

       
15
       
12
       
 
       
  };

     

       
16
       
13
       
 
       


     

       
17
       
14
       
 
       
  dontStrip = true;

     

       
18
       
15
       
 
       


     

       
19
       
19
       
-
       
  buildInputs = [ autoconf automake libtool openssl libcap libnfnetlink libnetfilter_queue ];

     

       
16
       
16
       
+
       
  buildInputs = [ autoreconfHook autoconf automake libtool openssl libcap libnfnetlink libnetfilter_queue ];

     

       
20
       
17
       
 
       


     

       
21
       
21
       
-
       
  patches = [ ./0001-Run-tcpcryptd-under-uid-93-instead-of-666.patch ];

     

       
22
       
22
       
-
       


     

       
23
       
23
       
-
       
  preConfigure = "cd user; autoreconf -i";

     

       
18
       
18
       
+
       
  postUnpack = ''

     

       
19
       
19
       
+
       
    mkdir $sourceRoot/m4

     

       
20
       
20
       
+
       
  '';

     

       
24
       
21
       
 
       


     

       
25
       
22
       
 
       
  meta = {

     

       
26
       
23
       
 
       
    homepage = "http://tcpcrypt.org/";