···

       
70
       
 
       
      '';

     

       
71
       
 
       
    };

     

       
72
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
73
       
 
       
    networking.nftables.preCheckRuleset = mkOption {

     

       
74
       
 
       
      type = types.lines;

     

       
75
       
 
       
      default = "";

     
···

       
282
       
 
       
            cp $out ruleset.conf

     

       
283
       
 
       
            sed 's|include "${deletionsScriptVar}"||' -i ruleset.conf

     

       
284
       
 
       
            ${cfg.preCheckRuleset}

     

       
285
       
-
       
            export NIX_REDIRECTS=/etc/protocols=${pkgs.buildPackages.iana-etc}/etc/protocols:/etc/services=${pkgs.buildPackages.iana-etc}/etc/services

     

       
286
       
 
       
            LD_PRELOAD="${pkgs.buildPackages.libredirect}/lib/libredirect.so ${pkgs.buildPackages.lklWithFirewall.lib}/lib/liblkl-hijack.so" \

     

       
287
       
 
       
              ${pkgs.buildPackages.nftables}/bin/nft --check --file ruleset.conf

     

       
288
       
 
       
          '';

     

···

       
70
       
 
       
      '';

     

       
71
       
 
       
    };

     

       
72
       
 
       


     

       
73
       
+
       
    networking.nftables.checkRulesetRedirects = mkOption {

     

       
74
       
+
       
      type = types.addCheck (types.attrsOf types.path) (attrs: all types.path.check (attrNames attrs));

     

       
75
       
+
       
      default = {

     

       
76
       
+
       
        "/etc/hosts" = config.environment.etc.hosts.source;

     

       
77
       
+
       
        "/etc/protocols" = config.environment.etc.protocols.source;

     

       
78
       
+
       
        "/etc/services" = config.environment.etc.services.source;

     

       
79
       
+
       
      };

     

       
80
       
+
       
      defaultText = literalExpression ''

     

       
81
       
+
       
        {

     

       
82
       
+
       
          "/etc/hosts" = config.environment.etc.hosts.source;

     

       
83
       
+
       
          "/etc/protocols" = config.environment.etc.protocols.source;

     

       
84
       
+
       
          "/etc/services" = config.environment.etc.services.source;

     

       
85
       
+
       
        }

     

       
86
       
+
       
      '';

     

       
87
       
+
       
      description = mdDoc ''

     

       
88
       
+
       
        Set of paths that should be intercepted and rewritten while checking the ruleset

     

       
89
       
+
       
        using `pkgs.buildPackages.libredirect`.

     

       
90
       
+
       
      '';

     

       
91
       
+
       
    };

     

       
92
       
+
       


     

       
93
       
 
       
    networking.nftables.preCheckRuleset = mkOption {

     

       
94
       
 
       
      type = types.lines;

     

       
95
       
 
       
      default = "";

     
···

       
302
       
 
       
            cp $out ruleset.conf

     

       
303
       
 
       
            sed 's|include "${deletionsScriptVar}"||' -i ruleset.conf

     

       
304
       
 
       
            ${cfg.preCheckRuleset}

     

       
305
       
+
       
            export NIX_REDIRECTS=${escapeShellArg (concatStringsSep ":" (mapAttrsToList (n: v: "${n}=${v}") cfg.checkRulesetRedirects))}

     

       
306
       
 
       
            LD_PRELOAD="${pkgs.buildPackages.libredirect}/lib/libredirect.so ${pkgs.buildPackages.lklWithFirewall.lib}/lib/liblkl-hijack.so" \

     

       
307
       
 
       
              ${pkgs.buildPackages.nftables}/bin/nft --check --file ruleset.conf

     

       
308
       
 
       
          '';