cafkafk/nixpkgs
cafkafk/nixpkgs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

nixos/tor: improve type-checking and hardening

Browse source 
Fixes #77395.
Fixes #82790.
This commit is contained in:
Julien Moutinho 2020-09-11 07:46:59 +02:00 committed by Jörg Thalheim
parent 35c4d1d079
commit 8866576300
No known key found for this signature in database
GPG key ID: 003F2096411B5F92
4 changed files with 851 additions and 566 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
nixos/modules/services/networking/privoxy.nix
View file

@ -16,7 +16,7 @@ let
${concatMapStrings (f: "actionsfile ${f}\n") cfg.actionsFiles}
${concatMapStrings (f: "filterfile ${f}\n") cfg.filterFiles}
'' + optionalString cfg.enableTor ''
forward-socks4a / ${config.services.tor.client.socksListenAddressFaster} .
forward-socks5t / 127.0.0.1:9063 .
toggle 1
enable-remote-toggle 0
enable-edit-actions 0
@ -123,6 +123,11 @@ in
serviceConfig.ProtectSystem = "full";
};
services.tor.settings.SOCKSPort = mkIf cfg.enableTor [
# Route HTTP traffic over a faster port (without IsolateDestAddr).
{ addr = "127.0.0.1"; port = 9063; IsolateDestAddr = false; }
];
};
meta.maintainers = with lib.maintainers; [ rnhmjoj ];

1392
nixos/modules/services/security/tor.nix
View file

File diff suppressed because it is too large Load diff

2
nixos/tests/tor.nix
View file

@ -17,7 +17,7 @@ rec {
environment.systemPackages = with pkgs; [ netcat ];
services.tor.enable = true;
services.tor.client.enable = true;
services.tor.controlPort = 9051;
services.tor.settings.ControlPort = 9051;
};
testScript = ''

16
pkgs/tools/security/tor/default.nix
View file

@ -1,5 +1,6 @@
{ stdenv, fetchurl, pkgconfig, libevent, openssl, zlib, torsocks
, libseccomp, systemd, libcap, lzma, zstd, scrypt, nixosTests
, writeShellScript
# for update.nix
, writeScript
@ -12,7 +13,21 @@
, gnused
, nix
}:
let
tor-client-auth-gen = writeShellScript "tor-client-auth-gen" ''
PATH="${stdenv.lib.makeBinPath [coreutils gnugrep openssl]}"
pem="$(openssl genpkey -algorithm x25519)"
printf private_key=descriptor:x25519:
echo "$pem" | grep -v " PRIVATE KEY" |
base64 -d | tail --bytes=32 | base32 | tr -d =
printf public_key=descriptor:x25519:
echo "$pem" | openssl pkey -in /dev/stdin -pubout |
grep -v " PUBLIC KEY" |
base64 -d | tail --bytes=32 | base32 | tr -d =
'';
in
stdenv.mkDerivation rec {
pname = "tor";
version = "0.4.4.6";
@ -52,6 +67,7 @@ stdenv.mkDerivation rec {
mkdir -p $geoip/share/tor
mv $out/share/tor/geoip{,6} $geoip/share/tor
rm -rf $out/share/tor
ln -s ${tor-client-auth-gen} $out/bin/tor-client-auth-gen
'';
passthru = {