creds: finish to migrate to systemd-creds.nix

[sourcephile-nix.git] / nixos / modules / services / networking / upnpc.nix

diff --git a/nixos/modules/services/networking/upnpc.nix b/nixos/modules/services/networking/upnpc.nix
index abe9e20e66d92ed92c0790a37b3868ecee9114a1..4ac8685531b0c6bc84396c7afa5b76a6fb55f595 100644 (file)
--- a/nixos/modules/services/networking/upnpc.nix
+++ b/nixos/modules/services/networking/upnpc.nix
@@ -1,7 +1,7 @@
 { pkgs, lib, config, ... }:
 with lib;
 let
-  inherit (config.users) users;
+  inherit (config.users) users groups;
   cfg = config.services.upnpc;
   getInfo = ''
     while IFS=: read -r k v; do
@@ -69,7 +69,7 @@ config = {
   systemd.services = listToAttrs (map (r:
     nameValuePair "upnpc-${toString r.internalPort}" (mkMerge [
       { description = "UPnP ${toString r.internalPort}";
-        after = [ "network-online.target" ];
+        after = [ "network-pre.target" ];
         #wantedBy = [ "multi-user.target" ];
         path = [ pkgs.miniupnpc ];
         serviceConfig = {
@@ -117,7 +117,53 @@ config = {
     ) cfg.redirections);
 
   # This enables to match on the uid in the firewall.
-  users.users."upnpc".isSystemUser = true;
+  users.users."upnpc" = {
+    isSystemUser = true;
+    group = groups."upnpc".name;
+  };
+  users.groups."upnpc" = {};
+  networking.nftables.ruleset =
+    lib.optionalString (cfg.redirections != []) ''
+    table inet filter {
+      # A set containing the udp port(s) to which SSDP replies are allowed.
+      set upnpc-ssdp {
+        type inet_service
+        timeout 5s
+      }
+      chain input-net {
+        # Create a rule for accepting any SSDP packets going to a remembered port.
+        udp dport @upnpc-ssdp counter accept comment "SSDP answer"
+      }
+      chain output-net {
+        skuid ${users.upnpc.name} \
+          tcp dport ssdp \
+          counter accept \
+          comment "SSDP automatic opening"
+        skuid ${users.upnpc.name} \
+          ip daddr 239.255.255.250 udp dport ssdp \
+          set add udp sport @upnpc-ssdp \
+          comment "SSDP automatic opening"
+        skuid ${users.upnpc.name} \
+          ip daddr 239.255.255.250 udp dport ssdp \
+          counter accept \
+          comment "SSDP"
+      }
+    }
+    '' + lib.optionalString config.networking.enableIPv6 ''
+    table inet filter {
+      chain output-net {
+        skuid ${users.upnpc.name} \
+          ip6 daddr { FF02::C, FF05::C, FF08::C, FF0E::C } \
+          udp dport ssdp \
+          set add udp sport @upnpc-ssdp \
+          comment "SSDP automatic opening"
+        skuid ${users.upnpc.name} \
+          ip6 daddr { FF02::C, FF05::C, FF08::C, FF0E::C } \
+          udp dport ssdp \
+          counter accept comment "SSDP"
+      }
+    }
+    '';
 };
 meta.maintainers = with maintainers; [ julm ];
 }