From 843215ac1c84eaab283f8ccc0b40c9cd37097c44 Mon Sep 17 00:00:00 2001 From: Pierre Bourdon Date: Sat, 9 Mar 2019 19:45:11 +0100 Subject: [PATCH 1/2] nixos/firewall: use types.port where appropriate --- nixos/modules/services/networking/firewall.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix index aba64e4f60f..73feba242a1 100644 --- a/nixos/modules/services/networking/firewall.nix +++ b/nixos/modules/services/networking/firewall.nix @@ -263,7 +263,7 @@ let commonOptions = { allowedTCPPorts = mkOption { - type = types.listOf types.int; + type = types.listOf types.port; default = [ ]; example = [ 22 80 ]; description = @@ -274,7 +274,7 @@ let }; allowedTCPPortRanges = mkOption { - type = types.listOf (types.attrsOf types.int); + type = types.listOf (types.attrsOf types.port); default = [ ]; example = [ { from = 8999; to = 9003; } ]; description = @@ -285,7 +285,7 @@ let }; allowedUDPPorts = mkOption { - type = types.listOf types.int; + type = types.listOf types.port; default = [ ]; example = [ 53 ]; description = @@ -295,7 +295,7 @@ let }; allowedUDPPortRanges = mkOption { - type = types.listOf (types.attrsOf types.int); + type = types.listOf (types.attrsOf types.port); default = [ ]; example = [ { from = 60000; to = 61000; } ]; description = From 18bc8203a10720a4db98670cbcbe75aa0579c145 Mon Sep 17 00:00:00 2001 From: Pierre Bourdon Date: Sat, 9 Mar 2019 19:59:01 +0100 Subject: [PATCH 2/2] nixos/firewall: canonicalize firewall ports lists Fixes #56086. --- nixos/modules/services/networking/firewall.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix index 73feba242a1..4ea891262e5 100644 --- a/nixos/modules/services/networking/firewall.nix +++ b/nixos/modules/services/networking/firewall.nix @@ -261,10 +261,14 @@ let fi ''; + canonicalizePortList = + ports: lib.unique (builtins.sort builtins.lessThan ports); + commonOptions = { allowedTCPPorts = mkOption { type = types.listOf types.port; default = [ ]; + apply = canonicalizePortList; example = [ 22 80 ]; description = '' @@ -287,6 +291,7 @@ let allowedUDPPorts = mkOption { type = types.listOf types.port; default = [ ]; + apply = canonicalizePortList; example = [ 53 ]; description = ''