Merge pull request #4108 from wkennington/master.firewall

Firewall: Don't allow traffic during nixos-switch / reload

nixos/modules/services/networking/firewall.nix

@@ -264,7 +264,7 @@ in
                      message = "This kernel does not support disabling conntrack helpers"; }
                  ];
 
-    systemd.services.firewall =
+    systemd.services.firewall = rec
       { description = "Firewall";
 
         wantedBy = [ "network.target" ];
@@ -277,8 +277,12 @@ in
         # better have all necessary modules already loaded.
         unitConfig.ConditionCapability = "CAP_NET_ADMIN";
 
-        serviceConfig.Type = "oneshot";
+        reloadIfChanged = true;
-        serviceConfig.RemainAfterExit = true;
+
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
 
         script =
           ''
@@ -417,11 +421,17 @@ in
             ip46tables -A INPUT -j nixos-fw
           '';
 
+        reload = ''
+          ${helpers}
+          ip46tables -A INPUT -j DROP
+          ${script}
+          ip46tables -D INPUT -j DROP || true # extraCommands might delete the above rule and cause this to fail
+        '';
+
         postStop =
           ''
             ${helpers}
             ip46tables -D INPUT -j nixos-fw || true
-            #ip46tables -P INPUT ACCEPT
           '';
       };
 

nixos/modules/system/boot/systemd-unit-options.nix

@@ -230,6 +230,15 @@ in rec {
       '';
     };
 
+    reload = mkOption {
+      type = types.lines;
+      default = "";
+      description = ''
+        Shell commands executed when the service's main process
+        is reloaded.
+      '';
+    };
+
     preStop = mkOption {
       type = types.lines;
       default = "";

nixos/modules/system/boot/systemd.nix

@@ -245,6 +245,12 @@ let
               ${config.postStart}
             '';
           })
+        (mkIf (config.reload != "")
+          { serviceConfig.ExecReload = makeJobScript "${name}-reload" ''
+              #! ${pkgs.stdenv.shell} -e
+              ${config.reload}
+            '';
+          })
         (mkIf (config.preStop != "")
           { serviceConfig.ExecStop = makeJobScript "${name}-pre-stop" ''
               #! ${pkgs.stdenv.shell} -e