JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nixos/sslh: add transparent proxying support (#41412)

Browse Source 
[x] Support transparent proxying. This means services behind sslh (Apache, sshd and so on) will see the external IP and ports as if the external world connected directly to them.
 [x] Run sslh daemon as unprivileged user instead of root (it is not only for security, transparent proxying requires it)
 [x] Removed pidFile support (it is not compatible with running sslh daemon as unprivileged user)
 [x] listenAddress default changed from "config.networking.hostName" (which resolves to meaningless "127.0.0.1" as with current /etc/hosts production) to "0.0.0.0" (all addresses)
This commit is contained in:
volth 2018-06-08 22:38:51 +00:00 committed by xeji
parent 3c0498518f
commit 2874e56c05
1 changed files with 95 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

114
nixos/modules/services/networking/sslh.nix
View File

@ -4,15 +4,14 @@ with lib;
let
cfg = config.services.sslh;
user = "sslh";
configFile = pkgs.writeText "sslh.conf" ''
verbose: ${boolToString cfg.verbose};
foreground: true;
inetd: false;
numeric: false;
transparent: false;
transparent: ${boolToString cfg.transparent};
timeout: "${toString cfg.timeout}";
user: "nobody";
pidfile: "${cfg.pidfile}";
listen:
(
@ -50,16 +49,16 @@ in
description = "Timeout in seconds.";
};
pidfile = mkOption {
type = types.path;
default = "/run/sslh.pid";
description = "PID file path for sslh daemon.";
transparent = mkOption {
type = types.bool;
default = false;
description = "Will the services behind sslh (Apache, sshd and so on) see the external IP and ports as if the external world connected directly to them";
};
listenAddress = mkOption {
type = types.str;
default = config.networking.hostName;
description = "Listening hostname.";
default = "0.0.0.0";
description = "Listening address or hostname.";
};
port = mkOption {
@ -76,14 +75,91 @@ in
};
};
config = mkIf cfg.enable {
systemd.services.sslh = {
description = "Applicative Protocol Multiplexer (e.g. share SSH and HTTPS on the same port)";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig.ExecStart = "${pkgs.sslh}/bin/sslh -F${configFile}";
serviceConfig.KillMode = "process";
serviceConfig.PIDFile = "${cfg.pidfile}";
};
};
config = mkMerge [
(mkIf cfg.enable {
users.users.${user} = {
description = "sslh daemon user";
isSystemUser = true;
};
systemd.services.sslh = {
description = "Applicative Protocol Multiplexer (e.g. share SSH and HTTPS on the same port)";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
User = user;
Group = "nogroup";
PermissionsStartOnly = true;
Restart = "always";
RestartSec = "1s";
ExecStart = "${pkgs.sslh}/bin/sslh -F${configFile}";
KillMode = "process";
AmbientCapabilities = "CAP_NET_BIND_SERVICE CAP_NET_ADMIN CAP_SETGID CAP_SETUID";
PrivateTmp = true;
PrivateDevices = true;
ProtectSystem = "full";
ProtectHome = true;
};
};
})
# code from https://github.com/yrutschle/sslh#transparent-proxy-support
# the only difference is using iptables mark 0x2 instead of 0x1 to avoid conflicts with nixos/nat module
(mkIf (cfg.enable && cfg.transparent) {
# Set route_localnet = 1 on all interfaces so that ssl can use "localhost" as destination
boot.kernel.sysctl."net.ipv4.conf.default.route_localnet" = 1;
boot.kernel.sysctl."net.ipv4.conf.all.route_localnet" = 1;
systemd.services.sslh = let
iptablesCommands = [
# DROP martian packets as they would have been if route_localnet was zero
# Note: packets not leaving the server aren't affected by this, thus sslh will still work
{ table = "raw"; command = "PREROUTING ! -i lo -d 127.0.0.0/8 -j DROP"; }
{ table = "mangle"; command = "POSTROUTING ! -o lo -s 127.0.0.0/8 -j DROP"; }
# Mark all connections made by ssl for special treatment (here sslh is run as user ${user})
{ table = "nat"; command = "OUTPUT -m owner --uid-owner ${user} -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CONNMARK --set-xmark 0x02/0x0f"; }
# Outgoing packets that should go to sslh instead have to be rerouted, so mark them accordingly (copying over the connection mark)
{ table = "mangle"; command = "OUTPUT ! -o lo -p tcp -m connmark --mark 0x02/0x0f -j CONNMARK --restore-mark --mask 0x0f"; }
];
ip6tablesCommands = [
{ table = "raw"; command = "PREROUTING ! -i lo -d ::1/128 -j DROP"; }
{ table = "mangle"; command = "POSTROUTING ! -o lo -s ::1/128 -j DROP"; }
{ table = "nat"; command = "OUTPUT -m owner --uid-owner ${user} -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CONNMARK --set-xmark 0x02/0x0f"; }
{ table = "mangle"; command = "OUTPUT ! -o lo -p tcp -m connmark --mark 0x02/0x0f -j CONNMARK --restore-mark --mask 0x0f"; }
];
in {
path = [ pkgs.iptables pkgs.iproute pkgs.procps ];
preStart = ''
# Cleanup old iptables entries which might be still there
${concatMapStringsSep "\n" ({table, command}: "while iptables -w -t ${table} -D ${command} 2>/dev/null; do echo; done") iptablesCommands}
${concatMapStringsSep "\n" ({table, command}: "iptables -w -t ${table} -A ${command}" ) iptablesCommands}
# Configure routing for those marked packets
ip rule add fwmark 0x2 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
'' + optionalString config.networking.enableIPv6 ''
${concatMapStringsSep "\n" ({table, command}: "while ip6tables -w -t ${table} -D ${command} 2>/dev/null; do echo; done") ip6tablesCommands}
${concatMapStringsSep "\n" ({table, command}: "ip6tables -w -t ${table} -A ${command}" ) ip6tablesCommands}
ip -6 rule add fwmark 0x2 lookup 100
ip -6 route add local ::/0 dev lo table 100
'';
postStop = ''
${concatMapStringsSep "\n" ({table, command}: "iptables -w -t ${table} -D ${command}") iptablesCommands}
ip rule del fwmark 0x2 lookup 100
ip route del local 0.0.0.0/0 dev lo table 100
'' + optionalString config.networking.enableIPv6 ''
${concatMapStringsSep "\n" ({table, command}: "ip6tables -w -t ${table} -D ${command}") ip6tablesCommands}
ip -6 rule del fwmark 0x2 lookup 100
ip -6 route del local ::/0 dev lo table 100
'';
};
})
];
}