colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos: rewrite torsocks module

Browse Source 
Rather than trying to override the 'torsocks' executable in $PATH, the
new module instead properly configures `/etc/tor/torsocks.conf` and puts
the normal `torsocks` executable in $PATH so it can work out of the box.

As a bonus, I think this module actually works now, because the torsocks
configuration has changed a lot from when this was written, it seems...

Signed-off-by: Austin Seipp <aseipp@pobox.com>
This commit is contained in:
Austin Seipp 2014-12-05 23:19:17 -06:00
parent c206c728a8
commit e5e8efc1f4
1 changed files with 65 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

115
nixos/modules/services/security/torsocks.nix
View File

@ -1,85 +1,100 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.tor.torsocks;
optionalNullStr = b: v: optionalString (b != null) v;
cfg = config.services.tor;
configFile = ''
TorAddress ${toString (head (splitString ":" cfg.server))}
TorPort ${toString (tail (splitString ":" cfg.server))}
makeConfig = server: ''
server = ${toString(head (splitString ":" server))}
server_port = ${toString(tail (splitString ":" server))}
OnionAddrRange ${cfg.onionAddrRange}
local = 127.0.0.0/255.128.0.0
local = 127.128.0.0/255.192.0.0
local = 169.254.0.0/255.255.0.0
local = 172.16.0.0/255.240.0.0
local = 192.168.0.0/255.255.0.0
${optionalNullStr cfg.socks5Username
"SOCKS5Username ${cfg.socks5Username}"}
${optionalNullStr cfg.socks5Password
"SOCKS5Password ${cfg.socks5Password}"}
${cfg.torsocks.config}
'';
makeTorsocks = name: server: pkgs.writeTextFile {
name = name;
text = ''
#!${pkgs.stdenv.shell}
TORSOCKS_CONF_FILE=${pkgs.writeText "torsocks.conf" (makeConfig server)} LD_PRELOAD="${pkgs.torsocks}/lib/torsocks/libtorsocks.so $LD_PRELOAD" "$@"
'';
executable = true;
destination = "/bin/${name}";
};
torsocks = makeTorsocks "torsocks" cfg.torsocks.server;
torsocksFaster = makeTorsocks "torsocks-faster" cfg.torsocks.serverFaster;
AllowInbound ${if cfg.allowInbound then "1" else "0"}
'';
in
{
###### interface
options = {
services.tor.torsocks = {
enable = mkOption {
default = cfg.client.enable;
type = types.bool;
default = false;
description = ''
Whether to build torsocks scipt to relay application traffic via TOR.
Whether to build <literal>/etc/tor/torsocks.conf</literal>
containing the specified global torsocks configuration.
'';
};
server = mkOption {
default = cfg.client.socksListenAddress;
example = "192.168.0.20:9050";
type = types.str;
default = "127.0.0.1:9050";
example = "192.168.0.20:1234";
description = ''
IP address of TOR client to use.
IP/Port of the Tor SOCKS server. Currently, hostnames are
NOT supported by torsocks.
'';
};
serverFaster = mkOption {
default = cfg.client.socksListenAddressFaster;
example = "192.168.0.20:9063";
onionAddrRange = mkOption {
type = types.str;
default = "127.42.42.0/24";
description = ''
IP address of TOR client to use for applications like web browsers which
need less circuit isolation to achive satisfactory performance.
Tor hidden sites do not have real IP addresses. This
specifies what range of IP addresses will be handed to the
application as "cookies" for .onion names. Of course, you
should pick a block of addresses which you aren't going to
ever need to actually connect to. This is similar to the
MapAddress feature of the main tor daemon.
'';
};
config = mkOption {
default = "";
socks5Username = mkOption {
type = types.nullOr types.str;
default = null;
example = "bob";
description = ''
Extra configuration. Contents will be added verbatim to torsocks
configuration file.
SOCKS5 username. The <literal>TORSOCKS_USERNAME</literal>
environment variable overrides this option if it is set.
'';
};
socks5Password = mkOption {
type = types.nullOr types.str;
default = null;
example = "sekret";
description = ''
SOCKS5 password. The <literal>TORSOCKS_PASSWORD</literal>
environment variable overrides this option if it is set.
'';
};
allowInbound = mkOption {
type = types.bool;
default = false;
description = ''
Set Torsocks to accept inbound connections. If set to
<literal>true</literal>, listen() and accept() will be
allowed to be used with non localhost address.
'';
};
};
};
###### implementation
config = mkIf cfg.torsocks.enable {
environment.systemPackages = [ torsocks torsocksFaster ]; # expose it to the users
config = mkIf cfg.enable {
environment.systemPackages = [ pkgs.torsocks ];
environment.etc =
[ { source = pkgs.writeText "torsocks.conf" configFile;
target = "tor/torsocks.conf";
}
];
};
}