nixos/modules/services/networking/upnpc.nix

   1 { pkgs, lib, config, ... }:
   2 with lib;
   3 let
   4   inherit (config.users) users groups;
   5   cfg = config.services.upnpc;
   6   getInfo = ''
   7     while IFS=: read -r k v; do
   8       k=$(printf %s "$k" | sed -e 's/^\s*//' -e 's/\s*$//')
   9       v=$(printf %s "$v" | sed -e 's/^\s*//' -e 's/\s*$//')
  10       case $k in
  11         (desc) desc=$v;;
  12         ("Local LAN ip address") localIP=$v;;
  13       esac
  14     done <<EOF
  15     $(upnpc -s)
  16     EOF
  17   '';
  18 in
  19 {
  20 options.services.upnpc = {
  21   redirections = mkOption {
  22     description = "UPnP redirections to request.";
  23     default = [];
  24     type = types.listOf (types.submodule ({config, ...}: {
  25       options.externalPort = mkOption {
  26         description = "External port to open on the redirecting device.";
  27         type = types.port;
  28       };
  29       options.internalPort = mkOption {
  30         description = "Internal port, target of the redirection.";
  31         type = types.port;
  32         default = config.externalPort;
  33       };
  34       options.protocol = mkOption {
  35         description = "Protocol to redirect.";
  36         type = with types; enum ["TCP" "UDP"];
  37         default = "TCP";
  38       };
  39       options.description = mkOption {
  40         description = "Description of the port mapping";
  41         type = types.str;
  42         default = "";
  43       };
  44       options.duration = mkOption {
  45         description = "Duration of the redirection, in seconds. 0 means indefinitely.";
  46         type = types.int;
  47         default = 0;
  48       };
  49       options.maintainPeriod = mkOption {
  50         description = "Period (in seconds) between runs to maintain the redirection.";
  51         type = with types; nullOr int;
  52         default = if config.duration > 0 then config.duration / 2 else null;
  53         defaultText = "if duration > 0 then duration / 2 else null";
  54       };
  55       options.override = mkOption {
  56         description = "Try to override the redirection in case of conflict in mapping entry.";
  57         type = types.bool;
  58         default = true;
  59       };
  60       options.service = mkOption {
  61         description = "Configuration specific to the systemd service handling this UPnP redirecting.";
  62         type = types.attrs;
  63         default = {};
  64       };
  65     }));
  66   };
  67 };
  68 config = {
  69   systemd.services = listToAttrs (map (r:
  70     nameValuePair "upnpc-${toString r.internalPort}" (mkMerge [
  71       { description = "UPnP ${toString r.internalPort}";
  72         after = [ "network-pre.target" ];
  73         #wantedBy = [ "multi-user.target" ];
  74         path = [ pkgs.miniupnpc ];
  75         serviceConfig = {
  76           Type = if r.maintainPeriod == null then "oneshot" else "simple";
  77           RemainAfterExit = r.maintainPeriod == null;
  78           ExecStart = pkgs.writeShellScript "upnpc-start-${toString r.internalPort}" ''
  79             set -eu
  80             redirect () {
  81               result=
  82               while IFS= read -r line; do
  83                 echo >&2 -E "$line"
  84                 case $line in
  85                   (*" is redirected to internal $localIP:${toString r.internalPort}"*) result=ok ;;
  86                   (*ConflictInMappingEntry*) result=conflict ;;
  87                 esac
  88               done <<EOF
  89             $(upnpc -u "$desc" ${optionalString (r.description != "") "-e \"${r.description}\""} \
  90               -a "$localIP" ${toString r.internalPort} ${toString r.externalPort} ${r.protocol} ${toString r.duration} 2>&1)
  91             EOF
  92             }
  93             while true; do
  94               ${getInfo}
  95               redirect
  96               ${optionalString r.override ''
  97                 test "$result" != conflict || {
  98                   upnpc -u "$desc" -d ${toString r.externalPort} ${r.protocol}
  99                   redirect
 100                 }
 101               ''}
 102               case $result in
 103                 (ok) ${if r.maintainPeriod == null then "break" else "sleep " + toString r.maintainPeriod} ;;
 104                 (*) exit 1 ;;
 105               esac
 106             done
 107           '';
 108           ExecStop = "${pkgs.miniupnpc}/bin/upnpc -d ${toString r.externalPort} ${r.protocol}";
 109           Restart = "on-failure";
 110           RestartSec = mkDefault r.maintainPeriod;
 111           DynamicUser = true;
 112           User = users."upnpc".name;
 113         };
 114       }
 115       r.service
 116     ])
 117     ) cfg.redirections);
 118
 119   # This enables to match on the uid in the firewall.
 120   users.users."upnpc" = {
 121     isSystemUser = true;
 122     group = groups."upnpc".name;
 123   };
 124   users.groups."upnpc" = {};
 125   networking.nftables.ruleset =
 126     lib.optionalString (cfg.redirections != []) ''
 127     table inet filter {
 128       # A set containing the udp port(s) to which SSDP replies are allowed.
 129       set upnpc-ssdp {
 130         type inet_service
 131         timeout 5s
 132       }
 133       chain input-net {
 134         # Create a rule for accepting any SSDP packets going to a remembered port.
 135         udp dport @upnpc-ssdp counter accept comment "SSDP answer"
 136       }
 137       chain output-net {
 138         skuid ${users.upnpc.name} \
 139           tcp dport ssdp \
 140           counter accept \
 141           comment "SSDP automatic opening"
 142         skuid ${users.upnpc.name} \
 143           ip daddr 239.255.255.250 udp dport ssdp \
 144           set add udp sport @upnpc-ssdp \
 145           comment "SSDP automatic opening"
 146         skuid ${users.upnpc.name} \
 147           ip daddr 239.255.255.250 udp dport ssdp \
 148           counter accept \
 149           comment "SSDP"
 150       }
 151     }
 152     '' + lib.optionalString config.networking.enableIPv6 ''
 153     table inet filter {
 154       chain output-net {
 155         skuid ${users.upnpc.name} \
 156           ip6 daddr { FF02::C, FF05::C, FF08::C, FF0E::C } \
 157           udp dport ssdp \
 158           set add udp sport @upnpc-ssdp \
 159           comment "SSDP automatic opening"
 160         skuid ${users.upnpc.name} \
 161           ip6 daddr { FF02::C, FF05::C, FF08::C, FF0E::C } \
 162           udp dport ssdp \
 163           counter accept comment "SSDP"
 164       }
 165     }
 166     '';
 167 };
 168 meta.maintainers = with maintainers; [ julm ];
 169 }