nix/8.nix-darwin
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

networking: modify firewall settings only if explicitly set

Browse source
This commit is contained in:
Ryan Cao 2025-10-23 09:54:49 +01:00
parent c3211fcd0c
commit a4ecab1763
No known key found for this signature in database
GPG key ID: F605AB4AF937D5D0
3 changed files with 56 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

51
modules/networking/applicationFirewall.nix
View file

@ -13,6 +13,7 @@ in
{
meta.maintainers = [
(lib.maintainers.prince213 or "prince213")
(lib.maintainers.ryanccn or "ryanccn")
];
options.networking.applicationFirewall = {
@ -22,16 +23,34 @@ in
example = true;
description = "Whether to enable application firewall.";
};
blockAllIncoming = lib.mkEnableOption "blocking all incoming connections";
allowSigned = lib.mkEnableOption "built-in software to receive incoming connections" // {
default = true;
blockAllIncoming = lib.mkOption {
type = lib.types.nullOr lib.types.bool;
default = null;
example = true;
description = "Whether to block all incoming connections.";
};
allowSigned = lib.mkOption {
type = lib.types.nullOr lib.types.bool;
default = null;
example = true;
description = "Whether to allow built-in software to receive incoming connections.";
};
allowSignedApp = lib.mkOption {
type = lib.types.nullOr lib.types.bool;
default = null;
example = true;
description = "Whether to allow downloaded signed software to receive incoming connections.";
};
enableStealthMode = lib.mkOption {
type = lib.types.nullOr lib.types.bool;
default = null;
example = true;
description = "Whether to enable stealth mode.";
};
allowSignedApp =
lib.mkEnableOption "downloaded signed software to receive incoming connections"
// {
default = true;
};
enableStealthMode = lib.mkEnableOption "stealth mode";
};
config = {
@ -39,10 +58,16 @@ in
echo "configuring application firewall..." >&2
${lib.optionalString (cfg.enable != null) (socketfilterfw "setglobalstate" cfg.enable)}
${lib.optionalString (cfg.enable == true) (socketfilterfw "setblockall" cfg.blockAllIncoming)}
${socketfilterfw "setallowsigned" cfg.allowSigned}
${socketfilterfw "setallowsignedapp" cfg.allowSignedApp}
${socketfilterfw "setstealthmode" cfg.enableStealthMode}
${lib.optionalString (cfg.blockAllIncoming != null) (
socketfilterfw "setblockall" cfg.blockAllIncoming
)}
${lib.optionalString (cfg.allowSigned != null) (socketfilterfw "setallowsigned" cfg.allowSigned)}
${lib.optionalString (cfg.allowSignedApp != null) (
socketfilterfw "setallowsignedapp" cfg.allowSignedApp
)}
${lib.optionalString (cfg.enableStealthMode != null) (
socketfilterfw "setstealthmode" cfg.enableStealthMode
)}
'';
};
}

1
release.nix
View file

@ -85,6 +85,7 @@ in {
tests.homebrew = makeTest ./tests/homebrew.nix;
tests.launchd-daemons = makeTest ./tests/launchd-daemons.nix;
tests.launchd-setenv = makeTest ./tests/launchd-setenv.nix;
tests.networking-firewall = makeTest ./tests/networking-firewall.nix;
tests.networking-hostname = makeTest ./tests/networking-hostname.nix;
tests.networking-networkservices = makeTest ./tests/networking-networkservices.nix;
tests.nix-enable = makeTest ./tests/nix-enable.nix;

17
tests/networking-firewall.nix Normal file
View file

@ -0,0 +1,17 @@
{ config, ... }:
{
networking.applicationFirewall = {
enable = true;
blockAllIncoming = true;
allowSignedApp = false;
enableStealthMode = null;
};
test = ''
echo "checking socketfilterfw calls in /activate" >&2
grep "/usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on" ${config.out}/activate
grep "/usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on" ${config.out}/activate
grep "/usr/libexec/ApplicationFirewall/socketfilterfw --setallowsignedapp off" ${config.out}/activate
(! grep "/usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode" ${config.out}/activate)
'';
}