From f65d93f9f8dc60fa382919de9fe9869181920e30 Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Thu, 20 Jul 2023 13:26:33 +0200 Subject: [PATCH 1/4] dnscrypt-wrapper: disable fortify3 hardening flag This was enabled by default in db3e94c3 and breaks the key generation, specifically `dnscrypt-wrapper --gen-crypt-keypair` fails with: Generate crypt key pair... ok. Secret key stored in 2.dnscrypt-cert.server.key *** buffer overflow detected ***: terminated FAQ: 1. Is the buffer overflow real? Probably. 2. Is it maintained? Is upstream going to fix it? Not really. 3. Are you willing to investigate and patch it yourself? Nope. --- pkgs/tools/networking/dnscrypt-wrapper/default.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/tools/networking/dnscrypt-wrapper/default.nix b/pkgs/tools/networking/dnscrypt-wrapper/default.nix index ddec798a846..1e414b0521c 100644 --- a/pkgs/tools/networking/dnscrypt-wrapper/default.nix +++ b/pkgs/tools/networking/dnscrypt-wrapper/default.nix @@ -13,6 +13,9 @@ stdenv.mkDerivation rec { enableParallelBuilding = true; + # causes `dnscrypt-wrapper --gen-provider-keypair` to crash + hardeningDisable = [ "fortify3" ]; + nativeBuildInputs = [ pkg-config autoreconfHook ]; buildInputs = [ libsodium libevent ]; From c7c288fbd5ba0adbe15b6cd03b0ecd170597d619 Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Fri, 21 Jul 2023 12:02:00 +0200 Subject: [PATCH 2/4] nixos/dnscrypt-wrapper: avoid using polkit --- .../services/networking/dnscrypt-wrapper.nix | 21 +++++-------------- 1 file changed, 5 insertions(+), 16 deletions(-) diff --git a/nixos/modules/services/networking/dnscrypt-wrapper.nix b/nixos/modules/services/networking/dnscrypt-wrapper.nix index 082e0195093..741f054cd88 100644 --- a/nixos/modules/services/networking/dnscrypt-wrapper.nix +++ b/nixos/modules/services/networking/dnscrypt-wrapper.nix @@ -71,9 +71,9 @@ let if ! keyValid; then echo "certificate soon to become invalid; backing up old cert" mkdir -p oldkeys - mv -v ${cfg.providerName}.key oldkeys/${cfg.providerName}-$(date +%F-%T).key - mv -v ${cfg.providerName}.crt oldkeys/${cfg.providerName}-$(date +%F-%T).crt - systemctl restart dnscrypt-wrapper + mv -v "${cfg.providerName}.key" "oldkeys/${cfg.providerName}-$(date +%F-%T).key" + mv -v "${cfg.providerName}.crt" "oldkeys/${cfg.providerName}-$(date +%F-%T).crt" + kill "$(pidof -s dnscrypt-wrapper)" fi ''; @@ -222,17 +222,6 @@ in { }; users.groups.dnscrypt-wrapper = { }; - security.polkit.extraConfig = '' - // Allow dnscrypt-wrapper user to restart dnscrypt-wrapper.service - polkit.addRule(function(action, subject) { - if (action.id == "org.freedesktop.systemd1.manage-units" && - action.lookup("unit") == "dnscrypt-wrapper.service" && - subject.user == "dnscrypt-wrapper") { - return polkit.Result.YES; - } - }); - ''; - systemd.services.dnscrypt-wrapper = { description = "dnscrypt-wrapper daemon"; after = [ "network.target" ]; @@ -242,7 +231,7 @@ in { serviceConfig = { User = "dnscrypt-wrapper"; WorkingDirectory = dataDir; - Restart = "on-failure"; + Restart = "always"; ExecStart = "${pkgs.dnscrypt-wrapper}/bin/dnscrypt-wrapper ${toString daemonArgs}"; }; @@ -255,7 +244,7 @@ in { requires = [ "dnscrypt-wrapper.service" ]; description = "Rotates DNSCrypt wrapper keys if soon to expire"; - path = with pkgs; [ dnscrypt-wrapper dnscrypt-proxy1 gawk ]; + path = with pkgs; [ dnscrypt-wrapper dnscrypt-proxy1 gawk procps ]; script = rotateKeys; serviceConfig.User = "dnscrypt-wrapper"; }; From 0bd475c296ed8d6a27323249996745beb9755fc0 Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Fri, 21 Jul 2023 12:02:48 +0200 Subject: [PATCH 3/4] nixos/tests/dnscrypt-wrapper: fix flakyness --- nixos/tests/all-tests.nix | 2 +- nixos/tests/dnscrypt-wrapper/default.nix | 14 ++++++++------ 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 5f4aefad890..781d5c0fc5c 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -214,7 +214,7 @@ in { disable-installer-tools = handleTest ./disable-installer-tools.nix {}; discourse = handleTest ./discourse.nix {}; dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {}; - dnscrypt-wrapper = handleTestOn ["x86_64-linux"] ./dnscrypt-wrapper {}; + dnscrypt-wrapper = runTestOn ["x86_64-linux"] ./dnscrypt-wrapper; dnsdist = handleTest ./dnsdist.nix {}; doas = handleTest ./doas.nix {}; docker = handleTestOn ["aarch64-linux" "x86_64-linux"] ./docker.nix {}; diff --git a/nixos/tests/dnscrypt-wrapper/default.nix b/nixos/tests/dnscrypt-wrapper/default.nix index 1bdd064e113..1c05376e097 100644 --- a/nixos/tests/dnscrypt-wrapper/default.nix +++ b/nixos/tests/dnscrypt-wrapper/default.nix @@ -1,4 +1,6 @@ -import ../make-test-python.nix ({ pkgs, ... }: { +{ lib, pkgs, ... }: + +{ name = "dnscrypt-wrapper"; meta = with pkgs.lib.maintainers; { maintainers = [ rnhmjoj ]; @@ -50,23 +52,23 @@ import ../make-test-python.nix ({ pkgs, ... }: { server.wait_for_unit("dnscrypt-wrapper") server.wait_for_file("/var/lib/dnscrypt-wrapper/2.dnscrypt-cert.server.key") server.wait_for_file("/var/lib/dnscrypt-wrapper/2.dnscrypt-cert.server.crt") + almost_expiration = server.succeed("date --date '4days 23 hours 56min'").strip() with subtest("The client can connect to the server"): server.wait_for_unit("tinydns") client.wait_for_unit("dnscrypt-proxy2") - assert "1.2.3.4" in client.succeed( + assert "1.2.3.4" in client.wait_until_succeeds( "host it.works" ), "The IP address of 'it.works' does not match 1.2.3.4" with subtest("The server rotates the ephemeral keys"): # advance time by a little less than 5 days - server.succeed("date -s \"$(date --date '4 days 6 hours')\"") - client.succeed("date -s \"$(date --date '4 days 6 hours')\"") + server.succeed(f"date -s '{almost_expiration}'") + client.succeed(f"date -s '{almost_expiration}'") server.wait_for_file("/var/lib/dnscrypt-wrapper/oldkeys") with subtest("The client can still connect to the server"): server.wait_for_unit("dnscrypt-wrapper") client.succeed("host it.works") ''; -}) - +} From 4cd4b1b166d7ac2e8135f70e9456fa9babd356f1 Mon Sep 17 00:00:00 2001 From: rnhmjoj Date: Fri, 28 Jul 2023 15:55:15 +0200 Subject: [PATCH 4/4] dnscrypt-wrapper: link NixOS test --- pkgs/tools/networking/dnscrypt-wrapper/default.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pkgs/tools/networking/dnscrypt-wrapper/default.nix b/pkgs/tools/networking/dnscrypt-wrapper/default.nix index 1e414b0521c..944fd1b5897 100644 --- a/pkgs/tools/networking/dnscrypt-wrapper/default.nix +++ b/pkgs/tools/networking/dnscrypt-wrapper/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libsodium, libevent }: +{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libsodium, libevent, nixosTests }: stdenv.mkDerivation rec { pname = "dnscrypt-wrapper"; @@ -19,6 +19,10 @@ stdenv.mkDerivation rec { nativeBuildInputs = [ pkg-config autoreconfHook ]; buildInputs = [ libsodium libevent ]; + passthru.tests = { + inherit (nixosTests) dnscrypt-wrapper; + }; + meta = with lib; { description = "A tool for adding dnscrypt support to any name resolver"; homepage = "https://dnscrypt.info/";