movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 13:40:28 +03:00
Code Activity

Merge pull request #81405 from NinjaTrappeur/nin-networkd-policy-rules

Browse source 
nixos/networkd: add RoutingPolicyRules-related options
This commit is contained in:
Maximilian Bosch 2020-03-04 12:29:29 +01:00 • committed by GitHub
commit 7f9131f260
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 101 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

65
nixos/modules/system/boot/networkd.nix
View file

@ -67,7 +67,12 @@ let
(assertOnlyFields [
"PrivateKeyFile" "ListenPort" "FwMark"
])
(assertRange "FwMark" 1 4294967295)
# The following check won't work on nix <= 2.2
# see https://github.com/NixOS/nix/pull/2378
#
# Add this again when we'll have drop the
# nix < 2.2 support.
# (assertRange "FwMark" 1 4294967295)
];
# NOTE The PresharedKey directive is missing on purpose here, please
@ -181,7 +186,12 @@ let
(assertOnlyFields [
"InterfaceId" "Independent"
])
(assertRange "InterfaceId" 1 4294967295)
# The following check won't work on nix <= 2.2
# see https://github.com/NixOS/nix/pull/2378
#
# Add this again when we'll have drop the
# nix < 2.2 support.
# (assertRange "InterfaceId" 1 4294967295)
(assertValueOneOf "Independent" boolValues)
];
@ -235,6 +245,26 @@ let
(assertValueOneOf "AutoJoin" boolValues)
];
checkRoutingPolicyRule = checkUnitConfig "RoutingPolicyRule" [
(assertOnlyFields [
"TypeOfService" "From" "To" "FirewallMark" "Table" "Priority"
"IncomingInterface" "OutgoingInterface" "SourcePort" "DestinationPort"
"IPProtocol" "InvertRule" "Family"
])
(assertRange "TypeOfService" 0 255)
# The following check won't work on nix <= 2.2
# see https://github.com/NixOS/nix/pull/2378
#
# Add this again when we'll have drop the
# nix < 2.2 support.
# (assertRange "FirewallMark" 1 4294967295)
(assertInt "Priority")
(assertPort "SourcePort")
(assertPort "DestinationPort")
(assertValueOneOf "InvertRule" boolValues)
(assertValueOneOf "Family" ["ipv4" "ipv6" "both"])
];
checkRoute = checkUnitConfig "Route" [
(assertOnlyFields [
"Gateway" "GatewayOnLink" "Destination" "Source" "Metric"
@ -535,6 +565,22 @@ let
};
};
routingPolicyRulesOptions = {
options = {
routingPolicyRuleConfig = mkOption {
default = { };
example = { routingPolicyRuleConfig = { Table = 10; IncomingInterface = "eth1"; Family = "both"; } ;};
type = types.addCheck (types.attrsOf unitOption) checkRoutingPolicyRule;
description = ''
Each attribute in this set specifies an option in the
<literal>[RoutingPolicyRule]</literal> section of the unit. See
<citerefentry><refentrytitle>systemd.network</refentrytitle>
<manvolnum>5</manvolnum></citerefentry> for details.
'';
};
};
};
routeOptions = {
options = {
routeConfig = mkOption {
@ -772,6 +818,16 @@ let
'';
};
routingPolicyRules = mkOption {
default = [ ];
type = with types; listOf (submodule routingPolicyRulesOptions);
description = ''
A list of routing policy rules sections to be added to the unit. See
<citerefentry><refentrytitle>systemd.network</refentrytitle>
<manvolnum>5</manvolnum></citerefentry> for details.
'';
};
routes = mkOption {
default = [ ];
type = with types; listOf (submodule routeOptions);
@ -928,6 +984,11 @@ let
[Route]
${attrsToSection x.routeConfig}
'')}
${flip concatMapStrings def.routingPolicyRules (x: ''
[RoutingPolicyRule]
${attrsToSection x.routingPolicyRuleConfig}
'')}
${def.extraConfig}
'';

5
nixos/modules/system/boot/systemd-lib.nix
View file

@ -59,6 +59,11 @@ in rec {
optional (attr ? ${name} && ! isMacAddress attr.${name})
"Systemd ${group} field `${name}' must be a valid mac address.";
isPort = i: i >= 0 && i <= 65535;
assertPort = name: group: attr:
optional (attr ? ${name} && ! isPort attr.${name})
"Error on the systemd ${group} field `${name}': ${attr.name} is not a valid port number.";
assertValueOneOf = name: values: group: attr:
optional (attr ? ${name} && !elem attr.${name} values)