From 09ad5a699b7652f600ec97a4393b220e1d586b34 Mon Sep 17 00:00:00 2001 From: Dmitriy Kholkin Date: Sun, 16 Apr 2023 21:16:53 +0300 Subject: [PATCH 1/2] ivpn{,-service}: 3.10.0 -> 3.10.15, fix packaging. --- pkgs/tools/networking/ivpn/binary-paths.patch | 125 ++++++++++++++++++ pkgs/tools/networking/ivpn/default.nix | 61 ++++++++- 2 files changed, 181 insertions(+), 5 deletions(-) create mode 100644 pkgs/tools/networking/ivpn/binary-paths.patch diff --git a/pkgs/tools/networking/ivpn/binary-paths.patch b/pkgs/tools/networking/ivpn/binary-paths.patch new file mode 100644 index 00000000000..76c75de06b7 --- /dev/null +++ b/pkgs/tools/networking/ivpn/binary-paths.patch @@ -0,0 +1,125 @@ +diff --git a/daemon/netinfo/netinfo_linux.go b/daemon/netinfo/netinfo_linux.go +index 2c953a6d..084aeba0 100644 +--- a/daemon/netinfo/netinfo_linux.go ++++ b/daemon/netinfo/netinfo_linux.go +@@ -27,6 +27,8 @@ import ( + "net" + "regexp" + "strconv" ++ "os/exec" ++ "path/filepath" + + "github.com/ivpn/desktop-app/daemon/shell" + ) +@@ -66,7 +68,14 @@ func doDefaultGatewayIP() (defGatewayIP net.IP, err error) { + } + } + +- retErr := shell.ExecAndProcessOutput(log, outParse, "", "/sbin/ip", "route") ++ ipCommand := "" ++ if p, err := exec.LookPath("ip"); err == nil { ++ if p, err = filepath.Abs(p); err == nil { ++ ipCommand = p ++ } ++ } ++ ++ retErr := shell.ExecAndProcessOutput(log, outParse, "", ipCommand, "route") + + if retErr == nil { + if defGatewayIP == nil { +diff --git a/daemon/service/platform/platform.go b/daemon/service/platform/platform.go +index 941a99a7..df821c4d 100644 +--- a/daemon/service/platform/platform.go ++++ b/daemon/service/platform/platform.go +@@ -111,12 +111,6 @@ func Init() (warnings []string, errors []error, logInfo []string) { + } + + // checking file permissions +- if err := checkFileAccessRightsStaticConfig("openvpnCaKeyFile", openvpnCaKeyFile); err != nil { +- errors = append(errors, err) +- } +- if err := checkFileAccessRightsStaticConfig("openvpnTaKeyFile", openvpnTaKeyFile); err != nil { +- errors = append(errors, err) +- } + + if len(openvpnUpScript) > 0 { + if err := checkFileAccessRightsExecutable("openvpnUpScript", openvpnUpScript); err != nil { +@@ -149,9 +143,6 @@ func Init() (warnings []string, errors []error, logInfo []string) { + if err := checkFileAccessRightsExecutable("dnscryptproxyBinPath", dnscryptproxyBinPath); err != nil { + errors = append(errors, err) + } +- if err := checkFileAccessRightsStaticConfig("dnscryptproxyConfigTemplate", dnscryptproxyConfigTemplate); err != nil { +- errors = append(errors, err) +- } + + if len(routeCommand) > 0 { + routeBinary := strings.Split(routeCommand, " ")[0] +diff --git a/daemon/service/platform/platform_linux.go b/daemon/service/platform/platform_linux.go +index 0c2d9850..ec99a352 100644 +--- a/daemon/service/platform/platform_linux.go ++++ b/daemon/service/platform/platform_linux.go +@@ -87,8 +87,16 @@ func GetSnapEnvs() *SnapEnvInfo { + + // initialize all constant values (e.g. servicePortFile) which can be used in external projects (IVPN CLI) + func doInitConstants() { +- openVpnBinaryPath = "/usr/sbin/openvpn" +- routeCommand = "/sbin/ip route" ++ if p, err := exec.LookPath("openvpn"); err == nil { ++ if p, err = filepath.Abs(p); err == nil { ++ openVpnBinaryPath = p ++ } ++ } ++ if p, err := exec.LookPath("ip"); err == nil { ++ if p, err = filepath.Abs(p); err == nil { ++ routeCommand = p + " route" ++ } ++ } + + // check if we are running in snap environment + if envs := GetSnapEnvs(); envs != nil { +diff --git a/daemon/service/platform/platform_linux_release.go b/daemon/service/platform/platform_linux_release.go +index 8b60c46c..cd76f1c9 100644 +--- a/daemon/service/platform/platform_linux_release.go ++++ b/daemon/service/platform/platform_linux_release.go +@@ -27,6 +27,8 @@ package platform + + import ( + "path" ++ "os/exec" ++ "path/filepath" + ) + + func doOsInitForBuild() (warnings []string, errors []error, logInfo []string) { +@@ -50,12 +52,28 @@ func doOsInitForBuild() (warnings []string, errors []error, logInfo []string) { + openvpnDownScript = path.Join(installDir, "etc/client.down") + serversFileBundled = path.Join(installDir, "etc/servers.json") + +- obfsproxyStartScript = path.Join(installDir, "obfsproxy/obfs4proxy") ++ if p, err := exec.LookPath("obfs4proxy"); err == nil { ++ if p, err = filepath.Abs(p); err == nil { ++ obfsproxyStartScript = p ++ } ++ } + +- wgBinaryPath = path.Join(installDir, "wireguard-tools/wg-quick") +- wgToolBinaryPath = path.Join(installDir, "wireguard-tools/wg") ++ if p, err := exec.LookPath("wg-quick"); err == nil { ++ if p, err = filepath.Abs(p); err == nil { ++ wgBinaryPath = p ++ } ++ } ++ if p, err := exec.LookPath("wg"); err == nil { ++ if p, err = filepath.Abs(p); err == nil { ++ wgToolBinaryPath = p ++ } ++ } + +- dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy") ++ if p, err := exec.LookPath("dnscrypt-proxy"); err == nil { ++ if p, err = filepath.Abs(p); err == nil { ++ dnscryptproxyBinPath = p ++ } ++ } + dnscryptproxyConfigTemplate = path.Join(installDir, "etc/dnscrypt-proxy-template.toml") + dnscryptproxyConfig = path.Join(tmpDir, "dnscrypt-proxy.toml") + diff --git a/pkgs/tools/networking/ivpn/default.nix b/pkgs/tools/networking/ivpn/default.nix index 7a475478a16..8ea80457ca8 100644 --- a/pkgs/tools/networking/ivpn/default.nix +++ b/pkgs/tools/networking/ivpn/default.nix @@ -2,17 +2,26 @@ , fetchFromGitHub , lib , wirelesstools +, makeWrapper +, wireguard-tools +, openvpn +, obfs4 +, iproute2 +, dnscrypt-proxy2 +, iptables +, gawk +, util-linux }: builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec { inherit pname; - version = "3.10.0"; + version = "3.10.15"; src = fetchFromGitHub { owner = "ivpn"; repo = "desktop-app"; rev = "v${version}"; - hash = "sha256-oX1PWIBPDcvBTxstEiN2WosiVUNXJoloppkpcABSi7Y="; + hash = "sha256-3yVRVM98tVjot3gIkUb/CDwmwKdOOBjBjzGL6htDtpk="; }; ldflags = [ @@ -31,16 +40,58 @@ builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec { homepage = "https://www.ivpn.net/apps"; changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}"; license = licenses.gpl3Only; - maintainers = with maintainers; [ urandom ]; + maintainers = with maintainers; [ urandom ataraxiasjel ]; }; })) { ivpn = { modRoot = "cli"; - vendorHash = "sha256-5FvKR1Kz91Yi/uILVFyJRnwFZSmZ5qnotXqOI4fKLbY="; + vendorHash = "sha256-T49AE3SUmdP3Tu9Sp5C/QryKDto/NzEqRuUQ3+aJFL0="; }; ivpn-service = { modRoot = "daemon"; vendorHash = "sha256-9Rk6ruMpyWtQe+90kw4F8OLq7/JcDSrG6ufkfcrS4W8="; - buildInputs = [ wirelesstools ]; + nativeBuildInputs = [ makeWrapper ]; + buildInputs = [ + wirelesstools + wireguard-tools + openvpn + obfs4 + iproute2 + dnscrypt-proxy2 + ]; + + patches = [ ./binary-paths.patch ]; + postPatch = '' + substituteInPlace daemon/service/platform/platform_linux_release.go \ + --replace 'installDir := "/opt/ivpn"' "installDir := \"$out\"" + ''; + + postFixup = '' + install -Dm700 $src/daemon/References/Linux/etc/client.down "$out/etc/client.down" + install -Dm700 $src/daemon/References/Linux/etc/client.up "$out/etc/client.up" + install -Dm700 $src/daemon/References/Linux/etc/firewall.sh "$out/etc/firewall.sh" + install -Dm700 $src/daemon/References/Linux/etc/splittun.sh "$out/etc/splittun.sh" + install -Dm600 $src/daemon/References/common/etc/servers.json "$out/etc/servers.json" + install -Dm400 $src/daemon/References/common/etc/ca.crt "$out/etc/ca.crt" + install -Dm400 $src/daemon/References/common/etc/ta.key "$out/etc/ta.key" + install -Dm400 $src/daemon/References/common/etc/dnscrypt-proxy-template.toml "$out/etc/dnscrypt-proxy-template.toml" + + patchShebangs --build $out/etc/firewall.sh + patchShebangs --build $out/etc/splittun.sh + patchShebangs --build $out/etc/client.down + patchShebangs --build $out/etc/client.up + + wrapProgram "$out/bin/ivpn-service" \ + --suffix PATH : ${lib.makeBinPath [ + wireguard-tools + openvpn + obfs4 + iproute2 + dnscrypt-proxy2 + iptables + gawk + util-linux + ]} + ''; }; } -- 2.39.2 From 6b70e841c49fa85a771577b5751f9aa3fbb3ef0c Mon Sep 17 00:00:00 2001 From: Dmitriy Kholkin Date: Sun, 16 Apr 2023 21:17:04 +0300 Subject: [PATCH 2/2] nixos/ivpn: init --- .../manual/release-notes/rl-2305.section.md | 2 + nixos/modules/module-list.nix | 1 + nixos/modules/services/networking/ivpn.nix | 51 +++++++++++++++++++ 3 files changed, 54 insertions(+) create mode 100644 nixos/modules/services/networking/ivpn.nix diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md index 8fa38931396..7ec3b074ed1 100644 --- a/nixos/doc/manual/release-notes/rl-2305.section.md +++ b/nixos/doc/manual/release-notes/rl-2305.section.md @@ -111,6 +111,8 @@ In addition to numerous new and upgraded packages, this release has the followin - [hardware.ipu6](#opt-hardware.ipu6.enable) adds support for ipu6 based webcams on intel tiger lake and alder lake. +- [ivpn](https://www.ivpn.net/), a secure, private VPN with fast WireGuard connections. Available as [services.ivpn](#opt-services.ivpn.enable). + ## Backward Incompatibilities {#sec-release-23.05-incompatibilities} diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index e0e50295abb..29ed59b9963 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -883,6 +883,7 @@ ./services/networking/iscsi/initiator.nix ./services/networking/iscsi/root-initiator.nix ./services/networking/iscsi/target.nix + ./services/networking/ivpn.nix ./services/networking/iwd.nix ./services/networking/jibri/default.nix ./services/networking/jicofo.nix diff --git a/nixos/modules/services/networking/ivpn.nix b/nixos/modules/services/networking/ivpn.nix new file mode 100644 index 00000000000..6df630c1f19 --- /dev/null +++ b/nixos/modules/services/networking/ivpn.nix @@ -0,0 +1,51 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.services.ivpn; +in +with lib; +{ + options.services.ivpn = { + enable = mkOption { + type = types.bool; + default = false; + description = lib.mdDoc '' + This option enables iVPN daemon. + This sets {option}`networking.firewall.checkReversePath` to "loose", which might be undesirable for security. + ''; + }; + }; + + config = mkIf cfg.enable { + boot.kernelModules = [ "tun" ]; + + environment.systemPackages = with pkgs; [ ivpn ivpn-service ]; + + # iVPN writes to /etc/iproute2/rt_tables + networking.iproute2.enable = true; + networking.firewall.checkReversePath = "loose"; + + systemd.services.ivpn-service = { + description = "iVPN daemon"; + wantedBy = [ "multi-user.target" ]; + wants = [ "network.target" ]; + after = [ + "network-online.target" + "NetworkManager.service" + "systemd-resolved.service" + ]; + path = [ + # Needed for mount + "/run/wrappers" + ]; + startLimitBurst = 5; + startLimitIntervalSec = 20; + serviceConfig = { + ExecStart = "${pkgs.ivpn-service}/bin/ivpn-service --logging"; + Restart = "always"; + RestartSec = 1; + }; + }; + }; + + meta.maintainers = with maintainers; [ ataraxiasjel ]; +} -- 2.39.2