]> Git — Sourcephile - sourcephile-nix.git/blob - nixos/modules/services/networking/upnpc.nix
nix: update inputs
[sourcephile-nix.git] / nixos / modules / services / networking / upnpc.nix
1 { pkgs, lib, config, ... }:
2 with lib;
3 let
4 inherit (config.users) users groups;
5 cfg = config.services.upnpc;
6 getInfo = ''
7 while IFS=: read -r k v; do
8 k=$(printf %s "$k" | sed -e 's/^\s*//' -e 's/\s*$//')
9 v=$(printf %s "$v" | sed -e 's/^\s*//' -e 's/\s*$//')
10 case $k in
11 (desc) desc=$v;;
12 ("Local LAN ip address") localIP=$v;;
13 esac
14 done <<EOF
15 $(upnpc -s)
16 EOF
17 '';
18 in
19 {
20 options.services.upnpc = {
21 enable = mkEnableOption "UPnP redirections";
22 redirections = mkOption {
23 description = "UPnP redirections to request.";
24 default = [ ];
25 type = types.listOf (types.submodule ({ config, ... }: {
26 options.externalPort = mkOption {
27 description = "External port to open on the redirecting device.";
28 type = types.port;
29 };
30 options.internalPort = mkOption {
31 description = "Internal port, target of the redirection.";
32 type = types.port;
33 default = config.externalPort;
34 };
35 options.protocol = mkOption {
36 description = "Protocol to redirect.";
37 type = with types; enum [ "TCP" "UDP" ];
38 default = "TCP";
39 };
40 options.description = mkOption {
41 description = "Description of the port mapping";
42 type = types.str;
43 default = "";
44 };
45 options.duration = mkOption {
46 description = "Duration of the redirection, in seconds. 0 means indefinitely.";
47 type = types.int;
48 default = 0;
49 };
50 options.maintainPeriod = mkOption {
51 description = "Period (in seconds) between runs to maintain the redirection.";
52 type = with types; nullOr int;
53 default = if config.duration > 0 then config.duration / 2 else null;
54 defaultText = "if duration > 0 then duration / 2 else null";
55 };
56 options.override = mkOption {
57 description = "Try to override the redirection in case of conflict in mapping entry.";
58 type = types.bool;
59 default = true;
60 };
61 options.service = mkOption {
62 description = "Configuration specific to the systemd service handling this UPnP redirecting.";
63 type = types.attrs;
64 default = { };
65 };
66 }));
67 };
68 };
69 config = mkIf cfg.enable {
70 systemd.services = listToAttrs (map
71 (r:
72 nameValuePair "upnpc-${toString r.internalPort}" (mkMerge [
73 {
74 description = "UPnP ${toString r.internalPort}";
75 after = [ "network-pre.target" ];
76 #wantedBy = [ "multi-user.target" ];
77 path = [ pkgs.miniupnpc ];
78 serviceConfig = {
79 Type = if r.maintainPeriod == null then "oneshot" else "simple";
80 RemainAfterExit = r.maintainPeriod == null;
81 ExecStart = pkgs.writeShellScript "upnpc-start-${toString r.internalPort}" ''
82 set -eu
83 redirect () {
84 result=
85 while IFS= read -r line; do
86 echo >&2 -E "$line"
87 case $line in
88 (*" is redirected to internal $localIP:${toString r.internalPort}"*) result=ok ;;
89 (*ConflictInMappingEntry*) result=conflict ;;
90 esac
91 done <<EOF
92 $(upnpc -u "$desc" ${optionalString (r.description != "") "-e \"${r.description}\""} \
93 -a "$localIP" ${toString r.internalPort} ${toString r.externalPort} ${r.protocol} ${toString r.duration} 2>&1)
94 EOF
95 }
96 while true; do
97 ${getInfo}
98 redirect
99 ${optionalString r.override ''
100 test "$result" != conflict || {
101 upnpc -u "$desc" -d ${toString r.externalPort} ${r.protocol}
102 redirect
103 }
104 ''}
105 case $result in
106 (ok) ${if r.maintainPeriod == null then "break" else "sleep " + toString r.maintainPeriod} ;;
107 (*) exit 1 ;;
108 esac
109 done
110 '';
111 ExecStop = "${pkgs.miniupnpc}/bin/upnpc -d ${toString r.externalPort} ${r.protocol}";
112 Restart = "on-failure";
113 RestartSec = mkDefault r.maintainPeriod;
114 DynamicUser = true;
115 User = users."upnpc".name;
116 };
117 }
118 r.service
119 ])
120 )
121 cfg.redirections);
122
123 # This enables to match on the uid in the firewall.
124 users.users."upnpc" = {
125 isSystemUser = true;
126 group = groups."upnpc".name;
127 };
128 users.groups."upnpc" = { };
129 networking.nftables.ruleset =
130 lib.optionalString (cfg.redirections != [ ]) ''
131 table inet filter {
132 # A set containing the udp port(s) to which SSDP replies are allowed.
133 set upnpc-ssdp {
134 type inet_service
135 timeout 5s
136 }
137 chain input-net {
138 # Create a rule for accepting any SSDP packets going to a remembered port.
139 udp dport @upnpc-ssdp counter accept comment "SSDP answer"
140 }
141 chain output-net {
142 skuid ${users.upnpc.name} \
143 tcp dport ssdp \
144 counter accept \
145 comment "SSDP automatic opening"
146 skuid ${users.upnpc.name} \
147 ip daddr 239.255.255.250 udp dport ssdp \
148 set add udp sport @upnpc-ssdp \
149 comment "SSDP automatic opening"
150 skuid ${users.upnpc.name} \
151 ip daddr 239.255.255.250 udp dport ssdp \
152 counter accept \
153 comment "SSDP"
154 }
155 }
156 '' + lib.optionalString config.networking.enableIPv6 ''
157 table inet filter {
158 chain output-net {
159 skuid ${users.upnpc.name} \
160 ip6 daddr { FF02::C, FF05::C, FF08::C, FF0E::C } \
161 udp dport ssdp \
162 set add udp sport @upnpc-ssdp \
163 comment "SSDP automatic opening"
164 skuid ${users.upnpc.name} \
165 ip6 daddr { FF02::C, FF05::C, FF08::C, FF0E::C } \
166 udp dport ssdp \
167 counter accept comment "SSDP"
168 }
169 }
170 '';
171 };
172 meta.maintainers = with maintainers; [ julm ];
173 }