public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

TOR service: refactored options to avoid mess

Browse Source 
svn path=/nixos/trunk/; revision=23850
This commit is contained in:
Evgeny Egorochkin 2010-09-18 11:30:14 +00:00
parent 259c007f70
commit b2b227c99f
1 changed files with 174 additions and 172 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

94
modules/services/security/tor.nix
View File

@ -27,14 +27,17 @@ in
services.tor = { services.tor = {
enable = mkOption { config = mkOption {
default = false; default = "";
description = '' description = ''
Whether to enable the Tor anonymous routing daemon. Extra configuration. Contents will be added verbatim to the
configuration file.
''; '';
}; };
enableClient = mkOption { client = {
enable = mkOption {
default = true; default = true;
description = '' description = ''
Whether to enable Tor daemon to route application connections. Whether to enable Tor daemon to route application connections.
@ -61,15 +64,9 @@ in
''; '';
}; };
config = mkOption { privoxy = {
default = "";
description = ''
Extra configuration. Contents will be added verbatim to the
configuration file.
'';
};
enablePrivoxy = mkOption { enable = mkOption {
default = true; default = true;
description = '' description = ''
Whether to enable a special instance of privoxy dedicated to Tor. Whether to enable a special instance of privoxy dedicated to Tor.
@ -78,12 +75,12 @@ in
Most people using Tor want to anonymize their web traffic, so by Most people using Tor want to anonymize their web traffic, so by
default we enable an special instance of privoxy specifically for default we enable an special instance of privoxy specifically for
Tor. Tor.
However, if you are only going to use Tor only as a relay then you However, if you are only going to use Tor only for other kinds of
can disable this option. traffic then you can disable this option.
''; '';
}; };
privoxyListenAddress = mkOption { listenAddress = mkOption {
default = "127.0.0.1:8118"; default = "127.0.0.1:8118";
description = '' description = ''
Address that Tor's instance of privoxy is listening to. Address that Tor's instance of privoxy is listening to.
@ -94,7 +91,7 @@ in
''; '';
}; };
privoxyConfig = mkOption { config = mkOption {
default = ""; default = "";
description = '' description = ''
Extra configuration for Tor's instance of privoxy. Contents will be Extra configuration for Tor's instance of privoxy. Contents will be
@ -106,16 +103,22 @@ in
''; '';
}; };
enableRelay = mkOption { };
};
relay = {
enable = mkOption {
default = false; default = false;
description = '' description = ''
Whether to enable relaying traffic for others. Whether to enable relaying TOR traffic for others.
See https://www.torproject.org/docs/tor-doc-relay for details. See https://www.torproject.org/docs/tor-doc-relay for details.
''; '';
}; };
isBridgeRelay = mkOption { isBridge = mkOption {
default = false; default = false;
description = '' description = ''
Bridge relays (or "bridges" ) are Tor relays that aren't listed in the Bridge relays (or "bridges" ) are Tor relays that aren't listed in the
@ -131,7 +134,7 @@ in
''; '';
}; };
isExitRelay = mkOption { isExit = mkOption {
default = false; default = false;
description = '' description = ''
An exit relay allows Tor users to access regular Internet services. An exit relay allows Tor users to access regular Internet services.
@ -150,7 +153,7 @@ in
''; '';
}; };
relayBandwidthRate = mkOption { bandwidthRate = mkOption {
default = 0; default = 0;
example = 100; example = 100;
description = '' description = ''
@ -159,7 +162,7 @@ in
''; '';
}; };
relayBandwidthBurst = mkOption { bandwidthBurst = mkOption {
default = 0; default = 0;
example = 200; example = 200;
description = '' description = ''
@ -169,20 +172,20 @@ in
''; '';
}; };
relayPort = mkOption { port = mkOption {
default = 9001; default = 9001;
description = '' description = ''
What port to advertise for Tor connections. What port to advertise for Tor connections.
''; '';
}; };
relayListenAddress = mkOption { listenAddress = mkOption {
default = ""; default = "";
example = "0.0.0.0:9090"; example = "0.0.0.0:9090";
description = '' description = ''
Set this if you need to listen on a port other than the one advertised Set this if you need to listen on a port other than the one advertised
in relayPort (e.g. to advertise 443 but bind to 9090). You'll need to do in relayPort (e.g. to advertise 443 but bind to 9090). You'll need to do
ipchains or other port forwarding yourself to make this work. ipchains or other port forwsarding yourself to make this work.
''; '';
}; };
@ -210,17 +213,16 @@ in
}; };
};
###### implementation ###### implementation
config = mkIf cfg.enable { config = mkIf (cfg.client.enable || cfg.relay.enable) {
environment.systemPackages = [ tor ]; # provides tor-resolve and torify environment.systemPackages = [ tor ]; # provides tor-resolve and torify
assertions = [ { assertions = [ {
assertion = cfg.enableRelay || cfg.enableClient; assertion = cfg.relay.enable -> !(cfg.relay.isBridge && cfg.relay.isExit);
message = "Need to either enable TOR client or relay functionality";
} {
assertion = cfg.enableRelay -> !(cfg.isBridgeRelay && cfg.isExitRelay);
message = "Can't be both an exit and a bridge relay at the same time"; message = "Can't be both an exit and a bridge relay at the same time";
} ]; } ];
@ -245,7 +247,7 @@ in
exec = "${tor}/bin/tor -f ${pkgs.writeText "torrc" cfg.config}"; exec = "${tor}/bin/tor -f ${pkgs.writeText "torrc" cfg.config}";
}; };
jobs.torPrivoxy = mkIf (cfg.enablePrivoxy && cfg.enableClient) jobs.torPrivoxy = mkIf (cfg.client.privoxy.enable && cfg.client.enable)
{ name = "tor-privoxy"; { name = "tor-privoxy";
startOn = "starting tor"; startOn = "starting tor";
@ -259,32 +261,32 @@ in
# Needed to run privoxy as an unprivileged user? # Needed to run privoxy as an unprivileged user?
${modprobe}/sbin/modprobe capability || true ${modprobe}/sbin/modprobe capability || true
''; '';
exec = "${privoxy}/sbin/privoxy --no-daemon --user ${torUser} ${pkgs.writeText "torPrivoxy.conf" cfg.privoxyConfig}"; exec = "${privoxy}/sbin/privoxy --no-daemon --user ${torUser} ${pkgs.writeText "torPrivoxy.conf" cfg.client.privoxy.config}";
}; };
services.tor.config = '' services.tor.config = ''
DataDirectory ${stateDir} DataDirectory ${stateDir}
User ${torUser} User ${torUser}
'' ''
+ optionalString cfg.enableClient '' + optionalString cfg.client.enable ''
SocksListenAddress ${cfg.socksListenAddress} SocksListenAddress ${cfg.client.socksListenAddress}
${opt "SocksPolicy" cfg.socksPolicy} ${opt "SocksPolicy" cfg.client.socksPolicy}
'' ''
+ optionalString cfg.enableRelay '' + optionalString cfg.relay.enable ''
ORPort ${toString cfg.relayPort} ORPort ${toString cfg.relay.port}
${opt "ORListenAddress" cfg.relayListenAddress } ${opt "ORListenAddress" cfg.relay.listenAddress }
${opt "Nickname" cfg.nickname} ${opt "Nickname" cfg.relay.nickname}
${optint "RelayBandwidthRate" cfg.relayBandwidthRate} ${optint "RelayBandwidthRate" cfg.relay.bandwidthRate}
${optint "RelayBandwidthBurst" cfg.relayBandwidthBurst} ${optint "RelayBandwidthBurst" cfg.relay.bandwidthBurst}
${if cfg.isExitRelay then opt "ExitPolicy" cfg.exitPolicy else "ExitPolicy reject *:*"} ${if cfg.relay.isExit then opt "ExitPolicy" cfg.relay.exitPolicy else "ExitPolicy reject *:*"}
${if cfg.isBridgeRelay then "BridgeRelay 1" else ""} ${if cfg.relay.isBridge then "BridgeRelay 1" else ""}
''; '';
services.tor.privoxyConfig = '' services.tor.client.privoxy.config = ''
# Generally, this file goes in /etc/privoxy/config # Generally, this file goes in /etc/privoxy/config
# #
# Tor listens as a SOCKS4a proxy here: # Tor listens as a SOCKS4a proxy here:
forward-socks4a / ${cfg.socksListenAddress} . forward-socks4a / ${cfg.client.socksListenAddress} .
confdir ${privoxy}/etc confdir ${privoxy}/etc
logdir ${privoxyDir} logdir ${privoxyDir}
# actionsfile standard # Internal purpose, recommended # actionsfile standard # Internal purpose, recommended
@ -300,7 +302,7 @@ in
debug 8192 # Errors - *we highly recommended enabling this* debug 8192 # Errors - *we highly recommended enabling this*
user-manual ${privoxy}/doc/privoxy/user-manual user-manual ${privoxy}/doc/privoxy/user-manual
listen-address ${cfg.privoxyListenAddress} listen-address ${cfg.client.privoxy.listenAddress}
toggle 1 toggle 1
enable-remote-toggle 0 enable-remote-toggle 0
enable-edit-actions 0 enable-edit-actions 0