From c2f7d50aa90221bed4521ea1612f7d3d372dca40 Mon Sep 17 00:00:00 2001 From: Dmitriy Kholkin Date: Sun, 16 Apr 2023 21:16:53 +0300 Subject: [PATCH 1/2] ivpn{,-service}: 3.10.0 -> 3.10.15, fix packaging. --- pkgs/tools/networking/ivpn/default.nix | 53 ++++++++++++++++++-- pkgs/tools/networking/ivpn/permissions.patch | 27 ++++++++++ 2 files changed, 76 insertions(+), 4 deletions(-) create mode 100644 pkgs/tools/networking/ivpn/permissions.patch diff --git a/pkgs/tools/networking/ivpn/default.nix b/pkgs/tools/networking/ivpn/default.nix index 7a475478a16d2..e8e33f3bc73aa 100644 --- a/pkgs/tools/networking/ivpn/default.nix +++ b/pkgs/tools/networking/ivpn/default.nix @@ -2,17 +2,26 @@ , fetchFromGitHub , lib , wirelesstools +, makeWrapper +, wireguard-tools +, openvpn +, obfs4 +, iproute2 +, dnscrypt-proxy2 +, iptables +, gawk +, util-linux }: builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec { inherit pname; - version = "3.10.0"; + version = "3.10.15"; src = fetchFromGitHub { owner = "ivpn"; repo = "desktop-app"; rev = "v${version}"; - hash = "sha256-oX1PWIBPDcvBTxstEiN2WosiVUNXJoloppkpcABSi7Y="; + hash = "sha256-3yVRVM98tVjot3gIkUb/CDwmwKdOOBjBjzGL6htDtpk="; }; ldflags = [ @@ -31,16 +40,52 @@ builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec { homepage = "https://www.ivpn.net/apps"; changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}"; license = licenses.gpl3Only; - maintainers = with maintainers; [ urandom ]; + maintainers = with maintainers; [ urandom ataraxiasjel ]; }; })) { ivpn = { modRoot = "cli"; - vendorHash = "sha256-5FvKR1Kz91Yi/uILVFyJRnwFZSmZ5qnotXqOI4fKLbY="; + vendorHash = "sha256-T49AE3SUmdP3Tu9Sp5C/QryKDto/NzEqRuUQ3+aJFL0="; }; ivpn-service = { modRoot = "daemon"; vendorHash = "sha256-9Rk6ruMpyWtQe+90kw4F8OLq7/JcDSrG6ufkfcrS4W8="; + nativeBuildInputs = [ makeWrapper ]; buildInputs = [ wirelesstools ]; + + patches = [ ./permissions.patch ]; + postPatch = '' + substituteInPlace daemon/service/platform/platform_linux.go \ + --replace 'openVpnBinaryPath = "/usr/sbin/openvpn"' \ + 'openVpnBinaryPath = "${openvpn}/bin/openvpn"' \ + --replace 'routeCommand = "/sbin/ip route"' \ + 'routeCommand = "${iproute2}/bin/ip route"' + + substituteInPlace daemon/netinfo/netinfo_linux.go \ + --replace 'retErr := shell.ExecAndProcessOutput(log, outParse, "", "/sbin/ip", "route")' \ + 'retErr := shell.ExecAndProcessOutput(log, outParse, "", "${iproute2}/bin/ip", "route")' + + substituteInPlace daemon/service/platform/platform_linux_release.go \ + --replace 'installDir := "/opt/ivpn"' "installDir := \"$out\"" \ + --replace 'obfsproxyStartScript = path.Join(installDir, "obfsproxy/obfs4proxy")' \ + 'obfsproxyStartScript = "${obfs4}/bin/obfs4proxy"' \ + --replace 'wgBinaryPath = path.Join(installDir, "wireguard-tools/wg-quick")' \ + 'wgBinaryPath = "${wireguard-tools}/bin/wg-quick"' \ + --replace 'wgToolBinaryPath = path.Join(installDir, "wireguard-tools/wg")' \ + 'wgToolBinaryPath = "${wireguard-tools}/bin/wg"' \ + --replace 'dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")' \ + 'dnscryptproxyBinPath = "${dnscrypt-proxy2}/bin/dnscrypt-proxy"' + ''; + + postFixup = '' + mkdir -p $out/etc + cp -r $src/daemon/References/Linux/etc/* $out/etc/ + cp -r $src/daemon/References/common/etc/* $out/etc/ + + patchShebangs --build $out/etc/firewall.sh $out/etc/splittun.sh $out/etc/client.down $out/etc/client.up + + wrapProgram "$out/bin/ivpn-service" \ + --suffix PATH : ${lib.makeBinPath [ iptables gawk util-linux ]} + ''; }; } diff --git a/pkgs/tools/networking/ivpn/permissions.patch b/pkgs/tools/networking/ivpn/permissions.patch new file mode 100644 index 0000000000000..72fdc4a591e95 --- /dev/null +++ b/pkgs/tools/networking/ivpn/permissions.patch @@ -0,0 +1,27 @@ +diff --git a/daemon/service/platform/platform.go b/daemon/service/platform/platform.go +index 941a99a7..df821c4d 100644 +--- a/daemon/service/platform/platform.go ++++ b/daemon/service/platform/platform.go +@@ -111,12 +111,6 @@ func Init() (warnings []string, errors []error, logInfo []string) { + } + + // checking file permissions +- if err := checkFileAccessRightsStaticConfig("openvpnCaKeyFile", openvpnCaKeyFile); err != nil { +- errors = append(errors, err) +- } +- if err := checkFileAccessRightsStaticConfig("openvpnTaKeyFile", openvpnTaKeyFile); err != nil { +- errors = append(errors, err) +- } + + if len(openvpnUpScript) > 0 { + if err := checkFileAccessRightsExecutable("openvpnUpScript", openvpnUpScript); err != nil { +@@ -149,9 +143,6 @@ func Init() (warnings []string, errors []error, logInfo []string) { + if err := checkFileAccessRightsExecutable("dnscryptproxyBinPath", dnscryptproxyBinPath); err != nil { + errors = append(errors, err) + } +- if err := checkFileAccessRightsStaticConfig("dnscryptproxyConfigTemplate", dnscryptproxyConfigTemplate); err != nil { +- errors = append(errors, err) +- } + + if len(routeCommand) > 0 { + routeBinary := strings.Split(routeCommand, " ")[0] From 706060e47d0808244bd33a27287cc53e21318666 Mon Sep 17 00:00:00 2001 From: Dmitriy Kholkin Date: Sun, 16 Apr 2023 21:17:04 +0300 Subject: [PATCH 2/2] nixos/ivpn: init --- .../manual/release-notes/rl-2305.section.md | 2 + nixos/modules/module-list.nix | 1 + nixos/modules/services/networking/ivpn.nix | 51 +++++++++++++++++++ 3 files changed, 54 insertions(+) create mode 100644 nixos/modules/services/networking/ivpn.nix diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md index 8fa3893139607..7ec3b074ed1eb 100644 --- a/nixos/doc/manual/release-notes/rl-2305.section.md +++ b/nixos/doc/manual/release-notes/rl-2305.section.md @@ -111,6 +111,8 @@ In addition to numerous new and upgraded packages, this release has the followin - [hardware.ipu6](#opt-hardware.ipu6.enable) adds support for ipu6 based webcams on intel tiger lake and alder lake. +- [ivpn](https://www.ivpn.net/), a secure, private VPN with fast WireGuard connections. Available as [services.ivpn](#opt-services.ivpn.enable). + ## Backward Incompatibilities {#sec-release-23.05-incompatibilities} diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index e0e50295abb06..29ed59b9963f1 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -883,6 +883,7 @@ ./services/networking/iscsi/initiator.nix ./services/networking/iscsi/root-initiator.nix ./services/networking/iscsi/target.nix + ./services/networking/ivpn.nix ./services/networking/iwd.nix ./services/networking/jibri/default.nix ./services/networking/jicofo.nix diff --git a/nixos/modules/services/networking/ivpn.nix b/nixos/modules/services/networking/ivpn.nix new file mode 100644 index 0000000000000..6df630c1f1947 --- /dev/null +++ b/nixos/modules/services/networking/ivpn.nix @@ -0,0 +1,51 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.services.ivpn; +in +with lib; +{ + options.services.ivpn = { + enable = mkOption { + type = types.bool; + default = false; + description = lib.mdDoc '' + This option enables iVPN daemon. + This sets {option}`networking.firewall.checkReversePath` to "loose", which might be undesirable for security. + ''; + }; + }; + + config = mkIf cfg.enable { + boot.kernelModules = [ "tun" ]; + + environment.systemPackages = with pkgs; [ ivpn ivpn-service ]; + + # iVPN writes to /etc/iproute2/rt_tables + networking.iproute2.enable = true; + networking.firewall.checkReversePath = "loose"; + + systemd.services.ivpn-service = { + description = "iVPN daemon"; + wantedBy = [ "multi-user.target" ]; + wants = [ "network.target" ]; + after = [ + "network-online.target" + "NetworkManager.service" + "systemd-resolved.service" + ]; + path = [ + # Needed for mount + "/run/wrappers" + ]; + startLimitBurst = 5; + startLimitIntervalSec = 20; + serviceConfig = { + ExecStart = "${pkgs.ivpn-service}/bin/ivpn-service --logging"; + Restart = "always"; + RestartSec = 1; + }; + }; + }; + + meta.maintainers = with maintainers; [ ataraxiasjel ]; +}