From c260e9e399351d266121fbf818387b1c5f53ccc5 Mon Sep 17 00:00:00 2001 From: WilliButz Date: Wed, 22 May 2019 20:46:10 +0200 Subject: [PATCH 1/5] avahi: set AVAHI_SERVICE_DIR to well-known location Avahi now uses `/etc/avahi/services` instead of its store path to look for files with service definitions. --- pkgs/development/libraries/avahi/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/libraries/avahi/default.nix b/pkgs/development/libraries/avahi/default.nix index f276d0bf12e..b7f682990af 100644 --- a/pkgs/development/libraries/avahi/default.nix +++ b/pkgs/development/libraries/avahi/default.nix @@ -44,6 +44,8 @@ stdenv.mkDerivation rec { # autoipd won't build on darwin ++ stdenv.lib.optional stdenv.isDarwin "--disable-autoipd"; + NIX_CFLAGS_COMPILE = "-DAVAHI_SERVICE_DIR=\"/etc/avahi/services\""; + preBuild = stdenv.lib.optionalString stdenv.isDarwin '' sed -i '20 i\ #define __APPLE_USE_RFC_2292' \ From 49302dc5937e869672ceff5973454be7559ee58e Mon Sep 17 00:00:00 2001 From: WilliButz Date: Wed, 22 May 2019 20:59:34 +0200 Subject: [PATCH 2/5] nixos/avahi: refactor module, add option `extraServiceFiles` Types are now specified for all options. The fixed uid and gid for the avahi user have been removed and the user avahi is now in the group avahi. The the generic opening of the firewall for UDP port 5353 is now optional, but still defaults to true. The option `extraServiceFiles` was added to specify avahi service definitions, which are then placed in `/etc/avahi/services`. --- .../services/networking/avahi-daemon.nix | 416 ++++++++++-------- 1 file changed, 222 insertions(+), 194 deletions(-) diff --git a/nixos/modules/services/networking/avahi-daemon.nix b/nixos/modules/services/networking/avahi-daemon.nix index 4c91a0c415b..ddcfe3d77e2 100644 --- a/nixos/modules/services/networking/avahi-daemon.nix +++ b/nixos/modules/services/networking/avahi-daemon.nix @@ -1,10 +1,8 @@ -# Avahi daemon. { config, lib, pkgs, ... }: with lib; let - cfg = config.services.avahi; yesNo = yes : if yes then "yes" else "no"; @@ -39,215 +37,245 @@ let enable-reflector=${yesNo reflector} ${extraConfig} ''; - in - { - - ###### interface - - options = { - - services.avahi = { - - enable = mkOption { - default = false; - description = '' - Whether to run the Avahi daemon, which allows Avahi clients - to use Avahi's service discovery facilities and also allows - the local machine to advertise its presence and services - (through the mDNS responder implemented by `avahi-daemon'). - ''; - }; - - hostName = mkOption { - type = types.str; - description = '' - Host name advertised on the LAN. If not set, avahi will use the value - of config.networking.hostName. - ''; - }; - - domainName = mkOption { - type = types.str; - default = "local"; - description = '' - Domain name for all advertisements. - ''; - }; - - browseDomains = mkOption { - default = [ ]; - example = [ "0pointer.de" "zeroconf.org" ]; - description = '' - List of non-local DNS domains to be browsed. - ''; - }; - - ipv4 = mkOption { - default = true; - description = ''Whether to use IPv4''; - }; - - ipv6 = mkOption { - default = false; - description = ''Whether to use IPv6''; - }; - - interfaces = mkOption { - type = types.nullOr (types.listOf types.str); - default = null; - description = '' - List of network interfaces that should be used by the avahi-daemon. - Other interfaces will be ignored. If null all local interfaces - except loopback and point-to-point will be used. - ''; - }; - - allowPointToPoint = mkOption { - default = false; - description= '' - Whether to use POINTTOPOINT interfaces. Might make mDNS unreliable due to usually large - latencies with such links and opens a potential security hole by allowing mDNS access from Internet - connections. Use with care and YMMV! - ''; - }; - - wideArea = mkOption { - default = true; - description = ''Whether to enable wide-area service discovery.''; - }; - - reflector = mkOption { - default = false; - description = ''Reflect incoming mDNS requests to all allowed network interfaces.''; - }; - - publish = { - enable = mkOption { - default = false; - description = ''Whether to allow publishing in general.''; - }; - - userServices = mkOption { - default = false; - description = ''Whether to publish user services. Will set addresses=true.''; - }; - - addresses = mkOption { - default = false; - description = ''Whether to register mDNS address records for all local IP addresses.''; - }; - - hinfo = mkOption { - default = false; - description = '' - Whether to register an mDNS HINFO record which contains information about the - local operating system and CPU. - ''; - }; - - workstation = mkOption { - default = false; - description = ''Whether to register a service of type "_workstation._tcp" on the local LAN.''; - }; - - domain = mkOption { - default = false; - description = ''Whether to announce the locally used domain name for browsing by other hosts.''; - }; - - }; - - nssmdns = mkOption { - default = false; - description = '' - Whether to enable the mDNS NSS (Name Service Switch) plug-in. - Enabling it allows applications to resolve names in the `.local' - domain by transparently querying the Avahi daemon. - ''; - }; - - cacheEntriesMax = mkOption { - default = null; - type = types.nullOr types.int; - description = '' - Number of resource records to be cached per interface. Use 0 to - disable caching. Avahi daemon defaults to 4096 if not set. - ''; - }; - - extraConfig = mkOption { - default = ""; - type = types.lines; - description = '' - Extra config to append to avahi-daemon.conf. - ''; - }; - + options.services.avahi = { + enable = mkOption { + type = types.bool; + default = false; + description = '' + Whether to run the Avahi daemon, which allows Avahi clients + to use Avahi's service discovery facilities and also allows + the local machine to advertise its presence and services + (through the mDNS responder implemented by `avahi-daemon'). + ''; }; + hostName = mkOption { + type = types.str; + default = config.networking.hostName; + defaultText = literalExample "config.networking.hostName"; + description = '' + Host name advertised on the LAN. If not set, avahi will use the value + of . + ''; + }; + + domainName = mkOption { + type = types.str; + default = "local"; + description = '' + Domain name for all advertisements. + ''; + }; + + browseDomains = mkOption { + type = types.listOf types.str; + default = [ ]; + example = [ "0pointer.de" "zeroconf.org" ]; + description = '' + List of non-local DNS domains to be browsed. + ''; + }; + + ipv4 = mkOption { + type = types.bool; + default = true; + description = "Whether to use IPv4."; + }; + + ipv6 = mkOption { + type = types.bool; + default = false; + description = "Whether to use IPv6."; + }; + + interfaces = mkOption { + type = types.nullOr (types.listOf types.str); + default = null; + description = '' + List of network interfaces that should be used by the avahi-daemon. + Other interfaces will be ignored. If null, all local interfaces + except loopback and point-to-point will be used. + ''; + }; + + openFirewall = mkOption { + type = types.bool; + default = true; + description = '' + Whether to open the firewall for UDP port 5353. + ''; + }; + + allowPointToPoint = mkOption { + type = types.bool; + default = false; + description= '' + Whether to use POINTTOPOINT interfaces. Might make mDNS unreliable due to usually large + latencies with such links and opens a potential security hole by allowing mDNS access from Internet + connections. + ''; + }; + + wideArea = mkOption { + type = types.bool; + default = true; + description = "Whether to enable wide-area service discovery."; + }; + + reflector = mkOption { + type = types.bool; + default = false; + description = "Reflect incoming mDNS requests to all allowed network interfaces."; + }; + + extraServiceFiles = mkOption { + type = with types; attrsOf (either str path); + default = {}; + example = literalExample '' + { + ssh = "''${pkgs.avahi}/etc/avahi/services/ssh.service"; + smb = ''' + + + + %h + + _smb._tcp + 445 + + + '''; + } + ''; + description = '' + Specify custom service definitions which are placed in the avahi service directory. + See the avahi.service + 5 manpage for detailed information. + ''; + }; + + publish = { + enable = mkOption { + type = types.bool; + default = false; + description = "Whether to allow publishing in general."; + }; + + userServices = mkOption { + type = types.bool; + default = false; + description = "Whether to publish user services. Will set addresses=true."; + }; + + addresses = mkOption { + type = types.bool; + default = false; + description = "Whether to register mDNS address records for all local IP addresses."; + }; + + hinfo = mkOption { + type = types.bool; + default = false; + description = '' + Whether to register a mDNS HINFO record which contains information about the + local operating system and CPU. + ''; + }; + + workstation = mkOption { + type = types.bool; + default = false; + description = '' + Whether to register a service of type "_workstation._tcp" on the local LAN. + ''; + }; + + domain = mkOption { + type = types.bool; + default = false; + description = "Whether to announce the locally used domain name for browsing by other hosts."; + }; + }; + + nssmdns = mkOption { + type = types.bool; + default = false; + description = '' + Whether to enable the mDNS NSS (Name Service Switch) plug-in. + Enabling it allows applications to resolve names in the `.local' + domain by transparently querying the Avahi daemon. + ''; + }; + + cacheEntriesMax = mkOption { + type = types.nullOr types.int; + default = null; + description = '' + Number of resource records to be cached per interface. Use 0 to + disable caching. Avahi daemon defaults to 4096 if not set. + ''; + }; + + extraConfig = mkOption { + type = types.lines; + default = ""; + description = '' + Extra config to append to avahi-daemon.conf. + ''; + }; }; - - ###### implementation - config = mkIf cfg.enable { + users.users.avahi = { + description = "avahi-daemon privilege separation user"; + home = "/var/empty"; + group = "avahi"; + isSystemUser = true; + }; - services.avahi.hostName = mkDefault config.networking.hostName; - - users.users = singleton - { name = "avahi"; - uid = config.ids.uids.avahi; - description = "`avahi-daemon' privilege separation user"; - home = "/var/empty"; - }; - - users.groups = singleton - { name = "avahi"; - gid = config.ids.gids.avahi; - }; + users.groups.avahi = {}; system.nssModules = optional cfg.nssmdns pkgs.nssmdns; environment.systemPackages = [ pkgs.avahi ]; - systemd.sockets.avahi-daemon = - { description = "Avahi mDNS/DNS-SD Stack Activation Socket"; - listenStreams = [ "/run/avahi-daemon/socket" ]; - wantedBy = [ "sockets.target" ]; - }; - - systemd.services.avahi-daemon = - { description = "Avahi mDNS/DNS-SD Stack"; - wantedBy = [ "multi-user.target" ]; - requires = [ "avahi-daemon.socket" ]; - - serviceConfig."NotifyAccess" = "main"; - serviceConfig."BusName" = "org.freedesktop.Avahi"; - serviceConfig."Type" = "dbus"; - - path = [ pkgs.coreutils pkgs.avahi ]; - - preStart = "mkdir -p /run/avahi-daemon"; - - script = - '' - # Make NSS modules visible so that `avahi_nss_support ()' can - # return a sensible value. - export LD_LIBRARY_PATH="${config.system.nssModules.path}" - - exec ${pkgs.avahi}/sbin/avahi-daemon --syslog -f "${avahiDaemonConf}" - ''; + environment.etc = (mapAttrs' (n: v: nameValuePair + "avahi/services/${n}.service" + { ${if types.path.check v then "source" else "text"} = v; } + ) cfg.extraServiceFiles); + + systemd.sockets.avahi-daemon = { + description = "Avahi mDNS/DNS-SD Stack Activation Socket"; + listenStreams = [ "/run/avahi-daemon/socket" ]; + wantedBy = [ "sockets.target" ]; + }; + + systemd.tmpfiles.rules = [ "d /run/avahi-daemon - avahi avahi -" ]; + + systemd.services.avahi-daemon = { + description = "Avahi mDNS/DNS-SD Stack"; + wantedBy = [ "multi-user.target" ]; + requires = [ "avahi-daemon.socket" ]; + + # Make NSS modules visible so that `avahi_nss_support ()' can + # return a sensible value. + environment.LD_LIBRARY_PATH = config.system.nssModules.path; + + path = [ pkgs.coreutils pkgs.avahi ]; + + serviceConfig = { + NotifyAccess = "main"; + BusName = "org.freedesktop.Avahi"; + Type = "dbus"; + ExecStart = "${pkgs.avahi}/sbin/avahi-daemon --syslog -f ${avahiDaemonConf}"; }; + }; services.dbus.enable = true; services.dbus.packages = [ pkgs.avahi ]; - # Enabling Avahi without exposing it in the firewall doesn't make - # sense. - networking.firewall.allowedUDPPorts = [ 5353 ]; - + networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ 5353 ]; }; - } From 1800e49a0bc5de13ede9afea3236128c60126528 Mon Sep 17 00:00:00 2001 From: WilliButz Date: Wed, 22 May 2019 22:01:55 +0200 Subject: [PATCH 3/5] nixos/ids: remove avahi uid/gid --- nixos/modules/misc/ids.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix index 5b7fa5d2b98..8e5bb69a406 100644 --- a/nixos/modules/misc/ids.nix +++ b/nixos/modules/misc/ids.nix @@ -44,7 +44,7 @@ vsftpd = 7; ftp = 8; bitlbee = 9; - avahi = 10; + #avahi = 10; # removed 2019-05-22 nagios = 11; atd = 12; postfix = 13; @@ -358,7 +358,7 @@ vsftpd = 7; ftp = 8; bitlbee = 9; - avahi = 10; + #avahi = 10; # removed 2019-05-22 #nagios = 11; # unused atd = 12; postfix = 13; From 229e7834eb259a8938462ff738e897226e820c32 Mon Sep 17 00:00:00 2001 From: WilliButz Date: Thu, 23 May 2019 00:33:44 +0200 Subject: [PATCH 4/5] nixos/doc: add section about avahi changes --- nixos/doc/manual/release-notes/rl-1909.xml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/nixos/doc/manual/release-notes/rl-1909.xml b/nixos/doc/manual/release-notes/rl-1909.xml index 665345d6f35..df57b980645 100644 --- a/nixos/doc/manual/release-notes/rl-1909.xml +++ b/nixos/doc/manual/release-notes/rl-1909.xml @@ -236,6 +236,18 @@ (/var/lib/systemd/timesync), if required. - + + + The package avahi is now built to look up service + definitions from /etc/avahi/services instead of its + output directory in the nix store. Accordingly the module + now supports custom service definitions via + , which are then placed + in the aforementioned directory. See + avahi.service5 + for more information on custom service definitions. + + + From dbf4be46424c30ff5f8428a336e568b35b1b8524 Mon Sep 17 00:00:00 2001 From: WilliButz Date: Tue, 4 Jun 2019 00:21:51 +0200 Subject: [PATCH 5/5] nixos/tests/avahi: add test for extra service definitions --- nixos/tests/avahi.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/nixos/tests/avahi.nix b/nixos/tests/avahi.nix index 56b21a40155..ae4f54d5266 100644 --- a/nixos/tests/avahi.nix +++ b/nixos/tests/avahi.nix @@ -15,6 +15,7 @@ import ./make-test.nix ({ pkgs, ... } : { publish.enable = true; publish.userServices = true; publish.workstation = true; + extraServiceFiles.ssh = "${pkgs.avahi}/etc/avahi/services/ssh.service"; }; }; in { @@ -56,5 +57,11 @@ import ./make-test.nix ({ pkgs, ... } : { $one->succeed("getent hosts two.local >&2"); $two->succeed("getent hosts one.local >&2"); $two->succeed("getent hosts two.local >&2"); + + # extra service definitions + $one->succeed("avahi-browse -r -t _ssh._tcp | tee out >&2"); + $one->succeed("test `wc -l < out` -gt 0"); + $two->succeed("avahi-browse -r -t _ssh._tcp | tee out >&2"); + $two->succeed("test `wc -l < out` -gt 0"); ''; })