commit 1a4db01c84b5c052e2fb6992c684369cc4bf3d04 · pyrox.dev/nixpkgs

+86 -55
nixos/modules/services/networking/libreswan.nix
···

       9
       9
        
         libexec = "${pkgs.libreswan}/libexec/ipsec";

     

       10
       10
        
         ipsec = "${pkgs.libreswan}/sbin/ipsec";

     

       11
       11
        
       

     

       12
       12
       -
         trim = chars: str: let

     

       13
       13
       -
             nonchars = filter (x : !(elem x.value chars))

     

       14
       14
       -
                         (imap0 (i: v: {ind = i; value = v;}) (stringToCharacters str));

     

       15
       15
       -
           in

     

       16
       16
       -
             if length nonchars == 0 then ""

     

       17
       17
       -
             else substring (head nonchars).ind (add 1 (sub (last nonchars).ind (head nonchars).ind)) str;

     

       12
       12
       +
         trim = chars: str:

     

       13
       13
       +
         let

     

       14
       14
       +
           nonchars = filter (x : !(elem x.value chars))

     

       15
       15
       +
                      (imap0 (i: v: {ind = i; value = v;}) (stringToCharacters str));

     

       16
       16
       +
         in

     

       17
       17
       +
           if length nonchars == 0 then ""

     

       18
       18
       +
           else substring (head nonchars).ind (add 1 (sub (last nonchars).ind (head nonchars).ind)) str;

     

       18
       19
        
         indent = str: concatStrings (concatMap (s: ["  " (trim [" " "\t"] s) "\n"]) (splitString "\n" str));

     

       19
       20
        
         configText = indent (toString cfg.configSetup);

     

       20
       21
        
         connectionText = concatStrings (mapAttrsToList (n: v:

     

       21
       22
        
           ''

     

       22
       23
        
             conn ${n}

     

       23
       24
        
             ${indent v}

     

       25
       25
       +
           '') cfg.connections);

     

       24
       26
        
       

     

       25
       25
       -
           '') cfg.connections);

     

       26
       26
       -
         configFile = pkgs.writeText "ipsec.conf"

     

       27
       27
       +
         configFile = pkgs.writeText "ipsec-nixos.conf"

     

       27
       28
        
           ''

     

       28
       29
        
             config setup

     

       29
       30
        
             ${configText}

     
···

       31
       32
        
             ${connectionText}

     

       32
       33
        
           '';

     

       33
       34
        
       

     

       35
       35
       +
         policyFiles = mapAttrs' (name: text:

     

       36
       36
       +
           { name = "ipsec.d/policies/${name}";

     

       37
       37
       +
             value.source = pkgs.writeText "ipsec-policy-${name}" text;

     

       38
       38
       +
           }) cfg.policies;

     

       39
       39
       +
       

     

       34
       40
        
       in

     

       35
       41
        
       

     

       36
       42
        
       {

     
···

       41
       47
        
       

     

       42
       48
        
           services.libreswan = {

     

       43
       49
        
       

     

       44
       44
       -
             enable = mkEnableOption "libreswan ipsec service";

     

       50
       50
       +
             enable = mkEnableOption "Libreswan IPsec service";

     

       45
       51
        
       

     

       46
       52
        
             configSetup = mkOption {

     

       47
       53
        
               type = types.lines;

     

       48
       54
        
               default = ''

     

       49
       55
        
                   protostack=netkey

     

       50
       50
       -
                   nat_traversal=yes

     

       51
       56
        
                   virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10

     

       52
       57
        
               '';

     

       53
       58
        
               example = ''

     

       54
       59
        
                   secretsfile=/root/ipsec.secrets

     

       55
       60
        
                   protostack=netkey

     

       56
       56
       -
                   nat_traversal=yes

     

       57
       61
        
                   virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10

     

       58
       62
        
               '';

     

       59
       59
       -
               description = "Options to go in the 'config setup' section of the libreswan ipsec configuration";

     

       63
       63
       +
               description = "Options to go in the 'config setup' section of the Libreswan IPsec configuration";

     

       60
       64
        
             };

     

       61
       65
        
       

     

       62
       66
        
             connections = mkOption {

     

       63
       67
        
               type = types.attrsOf types.lines;

     

       64
       68
        
               default = {};

     

       65
       65
       -
               example = {

     

       66
       66
       -
                 myconnection = ''

     

       67
       67
       -
                   auto=add

     

       68
       68
       -
                   left=%defaultroute

     

       69
       69
       -
                   leftid=@user

     

       69
       69
       +
               example = literalExample ''

     

       70
       70
       +
                 { myconnection = '''

     

       71
       71
       +
                     auto=add

     

       72
       72
       +
                     left=%defaultroute

     

       73
       73
       +
                     leftid=@user

     

       74
       74
       +
       

     

       75
       75
       +
                     right=my.vpn.com

     

       76
       76
       +
       

     

       77
       77
       +
                     ikev2=no

     

       78
       78
       +
                     ikelifetime=8h

     

       79
       79
       +
                   ''';

     

       80
       80
       +
                 }

     

       81
       81
       +
               '';

     

       82
       82
       +
               description = "A set of connections to define for the Libreswan IPsec service";

     

       83
       83
       +
             };

     

       84
       84
       +
       

     

       85
       85
       +
             policies = mkOption {

     

       86
       86
       +
               type = types.attrsOf types.lines;

     

       87
       87
       +
               default = {};

     

       88
       88
       +
               example = literalExample ''

     

       89
       89
       +
                 { private-or-clear = '''

     

       90
       90
       +
                     # Attempt opportunistic IPsec for the entire Internet

     

       91
       91
       +
                     0.0.0.0/0

     

       92
       92
       +
                     ::/0

     

       93
       93
       +
                   ''';

     

       94
       94
       +
                 }

     

       95
       95
       +
               '';

     

       96
       96
       +
               description = ''

     

       97
       97
       +
                 A set of policies to apply to the IPsec connections.

     

       70
       98
        
       

     

       71
       71
       -
                   right=my.vpn.com

     

       99
       99
       +
                 <note><para>

     

       100
       100
       +
                   The policy name must match the one of connection it needs to apply to.

     

       101
       101
       +
                 </para></note>

     

       102
       102
       +
               '';

     

       103
       103
       +
             };

     

       72
       104
        
       

     

       73
       73
       -
                   ikev2=no

     

       74
       74
       -
                   ikelifetime=8h

     

       75
       75
       -
                 '';

     

       76
       76
       -
               };

     

       77
       77
       -
               description = "A set of connections to define for the libreswan ipsec service";

     

       105
       105
       +
             disableRedirects = mkOption {

     

       106
       106
       +
               type = types.bool;

     

       107
       107
       +
               default = true;

     

       108
       108
       +
               description = ''

     

       109
       109
       +
                 Whether to disable send and accept redirects for all nework interfaces.

     

       110
       110
       +
                 See the Libreswan <link xlink:href="https://libreswan.org/wiki/FAQ#Why_is_it_recommended_to_disable_send_redirects_in_.2Fproc.2Fsys.2Fnet_.3F">

     

       111
       111
       +
                 FAQ</link> page for why this is recommended.

     

       112
       112
       +
               '';

     

       78
       113
        
             };

     

       114
       114
       +
       

     

       79
       115
        
           };

     

       80
       116
        
       

     

       81
       117
        
         };

     
···

       85
       121
        
       

     

       86
       122
        
         config = mkIf cfg.enable {

     

       87
       123
        
       

     

       124
       124
       +
           # Install package, systemd units, etc.

     

       88
       125
        
           environment.systemPackages = [ pkgs.libreswan pkgs.iproute2 ];

     

       126
       126
       +
           systemd.packages = [ pkgs.libreswan ];

     

       127
       127
       +
           systemd.tmpfiles.packages = [ pkgs.libreswan ];

     

       128
       128
       +
       

     

       129
       129
       +
           # Install configuration files

     

       130
       130
       +
           environment.etc = {

     

       131
       131
       +
             "ipsec.secrets".source = "${pkgs.libreswan}/etc/ipsec.secrets";

     

       132
       132
       +
             "ipsec.conf".source = "${pkgs.libreswan}/etc/ipsec.conf";

     

       133
       133
       +
             "ipsec.d/01-nixos.conf".source = configFile;

     

       134
       134
       +
           } // policyFiles;

     

       135
       135
       +
       

     

       136
       136
       +
           # Create NSS database directory

     

       137
       137
       +
           systemd.tmpfiles.rules = [ "d /var/lib/ipsec/nss 755 root root -" ];

     

       89
       138
        
       

     

       90
       139
        
           systemd.services.ipsec = {

     

       91
       140
        
             description = "Internet Key Exchange (IKE) Protocol Daemon for IPsec";

     

       92
       92
       -
             path = [

     

       93
       93
       -
               "${pkgs.libreswan}"

     

       94
       94
       -
               "${pkgs.iproute2}"

     

       95
       95
       -
               "${pkgs.procps}"

     

       96
       96
       -
               "${pkgs.nssTools}"

     

       97
       97
       -
               "${pkgs.iptables}"

     

       98
       98
       -
               "${pkgs.nettools}"

     

       99
       99
       -
             ];

     

       100
       100
       -
       

     

       101
       101
       -
             wants = [ "network-online.target" ];

     

       102
       102
       -
             after = [ "network-online.target" ];

     

       103
       141
        
             wantedBy = [ "multi-user.target" ];

     

       104
       104
       -
       

     

       105
       105
       -
             serviceConfig = {

     

       106
       106
       -
               Type = "simple";

     

       107
       107
       -
               Restart = "always";

     

       108
       108
       -
               EnvironmentFile = "-${pkgs.libreswan}/etc/sysconfig/pluto";

     

       109
       109
       -
               ExecStartPre = [

     

       110
       110
       -
                 "${libexec}/addconn --config ${configFile} --checkconfig"

     

       111
       111
       -
                 "${libexec}/_stackmanager start"

     

       112
       112
       -
                 "${ipsec} --checknss"

     

       113
       113
       -
                 "${ipsec} --checknflog"

     

       114
       114
       -
               ];

     

       115
       115
       -
               ExecStart = "${libexec}/pluto --config ${configFile} --nofork \$PLUTO_OPTIONS";

     

       116
       116
       -
               ExecStop = "${libexec}/whack --shutdown";

     

       117
       117
       -
               ExecStopPost = [

     

       118
       118
       -
                 "${pkgs.iproute2}/bin/ip xfrm policy flush"

     

       119
       119
       -
                 "${pkgs.iproute2}/bin/ip xfrm state flush"

     

       120
       120
       -
                 "${ipsec} --stopnflog"

     

       121
       121
       -
               ];

     

       122
       122
       -
               ExecReload = "${libexec}/whack --listen";

     

       123
       123
       -
             };

     

       124
       124
       -
       

     

       142
       142
       +
             restartTriggers = [ configFile ] ++ mapAttrsToList (n: v: v.source) policyFiles;

     

       143
       143
       +
             path = with pkgs; [

     

       144
       144
       +
               libreswan

     

       145
       145
       +
               iproute2

     

       146
       146
       +
               procps

     

       147
       147
       +
               nssTools

     

       148
       148
       +
               iptables

     

       149
       149
       +
               nettools

     

       150
       150
       +
             ];

     

       151
       151
       +
             preStart = optionalString cfg.disableRedirects ''

     

       152
       152
       +
               # Disable send/receive redirects

     

       153
       153
       +
               echo 0 | tee /proc/sys/net/ipv4/conf/*/send_redirects

     

       154
       154
       +
               echo 0 | tee /proc/sys/net/ipv{4,6}/conf/*/accept_redirects

     

       155
       155
       +
             '';

     

       125
       156
        
           };

     

       126
       157
        
       

     

       127
       158
        
         };