nixpkgs/modules/tasks/network-interfaces.nix

350 lines
11 KiB
Nix

{ config, pkgs, ... }:
with pkgs.lib;
let
cfg = config.networking;
hasVirtuals = any (i: i.virtual) cfg.interfaces;
in
{
###### interface
options = {
networking.hostName = mkOption {
default = "nixos";
description = ''
The name of the machine. Leave it empty if you want to obtain
it from a DHCP server (if using DHCP).
'';
};
networking.enableIPv6 = mkOption {
default = true;
description = ''
Whether to enable support for IPv6.
'';
};
networking.defaultGateway = mkOption {
default = "";
example = "131.211.84.1";
description = ''
The default gateway. It can be left empty if it is auto-detected through DHCP.
'';
};
networking.nameservers = mkOption {
default = [];
example = ["130.161.158.4" "130.161.33.17"];
description = ''
The list of nameservers. It can be left empty if it is auto-detected through DHCP.
'';
};
networking.domain = mkOption {
default = "";
example = "home";
description = ''
The domain. It can be left empty if it is auto-detected through DHCP.
'';
};
networking.localCommands = mkOption {
default = "";
example = "text=anything; echo You can put $text here.";
description = ''
Shell commands to be executed at the end of the
<literal>network-interfaces</literal> Upstart job. Note that if
you are using DHCP to obtain the network configuration,
interfaces may not be fully configured yet.
'';
};
networking.interfaces = mkOption {
default = [];
example = [
{ name = "eth0";
ipAddress = "131.211.84.78";
subnetMask = "255.255.255.128";
}
];
description = ''
The configuration for each network interface. If
<option>networking.useDHCP</option> is true, then every
interface not listed here will be configured using DHCP.
'';
type = types.list types.optionSet;
options = {
name = mkOption {
example = "eth0";
type = types.string;
description = ''
Name of the interface.
'';
};
ipAddress = mkOption {
default = "";
example = "10.0.0.1";
type = types.string;
description = ''
IP address of the interface. Leave empty to configure the
interface using DHCP.
'';
};
subnetMask = mkOption {
default = "";
example = "255.255.255.0";
type = types.string;
description = ''
Subnet mask of the interface. Leave empty to use the
default subnet mask.
'';
};
macAddress = mkOption {
default = "";
example = "00:11:22:33:44:55";
type = types.string;
description = ''
MAC address of the interface. Leave empty to use the default.
'';
};
virtual = mkOption {
default = false;
type = types.bool;
description = ''
Whether this interface is virtual and should be created by tunctl.
This is mainly useful for creating bridges between a host a virtual
network such as VPN or a virtual machine.
Defaults to tap device, unless interface contains "tun" in its name.
'';
};
virtualOwner = mkOption {
default = "root";
type = types.uniq types.string;
description = ''
In case of a virtual device, the user who owns it.
'';
};
proxyARP = mkOption {
default = false;
type = types.bool;
description = ''
Turn on proxy_arp for this device (and proxy_ndp for ipv6).
This is mainly useful for creating pseudo-bridges between a real
interface and a virtual network such as VPN or a virtual machine for
interfaces that don't support real bridging (most wlan interfaces).
As ARP proxying acts slightly above the link-layer, below-ip traffic
isn't bridged, so things like DHCP won't work. The advantage above
using NAT lies in the fact that no IP addresses are shared, so all
hosts are reachable/routeable.
WARNING: turns on ip-routing, so if you have multiple interfaces, you
should think of the consequence and setup firewall rules to limit this.
'';
};
};
};
networking.ifaces = mkOption {
default = listToAttrs
(map (iface: { name = iface.name; value = iface; }) config.networking.interfaces);
internal = true;
description = ''
The network interfaces in <option>networking.interfaces</option>
as an attribute set keyed on the interface name.
'';
};
networking.bridges = mkOption {
default = { };
example =
{ br0.interfaces = [ "eth0" "eth1" ];
br1.interfaces = [ "eth2" "wlan0" ];
};
description =
''
This option allows you to define Ethernet bridge devices
that connect physical networks together. The value of this
option is an attribute set. Each attribute specifies a
bridge, with the attribute name specifying the name of the
bridge's network interface.
'';
type = types.attrsOf types.optionSet;
options = {
interfaces = mkOption {
example = [ "eth0" "eth1" ];
type = types.listOf types.string;
description =
"The physical network interfaces connected by the bridge.";
};
};
};
networking.useDHCP = mkOption {
default = true;
merge = mergeEnableOption;
description = ''
Whether to use DHCP to obtain an IP adress and other
configuration for all network interfaces that are not manually
configured.
'';
};
};
###### implementation
config = {
boot.kernelModules = optional cfg.enableIPv6 "ipv6" ++ optional hasVirtuals "tun";
environment.systemPackages =
[ pkgs.host
pkgs.iproute
pkgs.iputils
pkgs.nettools
pkgs.wirelesstools
pkgs.rfkill
pkgs.openresolv
]
++ optional (cfg.bridges != {}) pkgs.bridge_utils
++ optional hasVirtuals pkgs.tunctl
++ optional cfg.enableIPv6 pkgs.ndisc6;
security.setuidPrograms = [ "ping" "ping6" ];
jobs."network-interfaces" =
{ description = "Static Network Interfaces";
after = [ "systemd-udev-settle.service" ];
before = [ "network.target" ];
wantedBy = [ "network.target" ];
path = [ pkgs.iproute ];
preStart =
''
set +e # continue in case of errors
# Create virtual network interfaces
${flip concatMapStrings cfg.interfaces (i:
optionalString i.virtual
''
echo "Creating virtual network interface ${i.name}..."
${pkgs.tunctl}/bin/tunctl -t "${i.name}" -u "${i.virtualOwner}"
'')
}
# Set MAC addresses of interfaces, if desired.
${flip concatMapStrings cfg.interfaces (i:
optionalString (i.macAddress != "")
''
echo "Setting MAC address of ${i.name} to ${i.macAddress}..."
ip link set "${i.name}" address "${i.macAddress}"
'')
}
for i in $(cd /sys/class/net && ls -d *); do
echo "Bringing up network device $i..."
ip link set "$i" up
done
# Create bridge devices.
${concatStrings (attrValues (flip mapAttrs cfg.bridges (n: v: ''
echo "Creating bridge ${n}..."
${pkgs.bridge_utils}/sbin/brctl addbr "${n}"
# Set bridge's hello time to 0 to avoid startup delays.
${pkgs.bridge_utils}/sbin/brctl setfd "${n}" 0
${flip concatMapStrings v.interfaces (i: ''
${pkgs.bridge_utils}/sbin/brctl addif "${n}" "${i}"
ip addr flush dev "${i}"
'')}
# !!! Should delete (brctl delif) any interfaces that
# no longer belong to the bridge.
'')))}
# Configure the manually specified interfaces.
${flip concatMapStrings cfg.interfaces (i:
optionalString (i.ipAddress != "")
''
echo "Configuring interface ${i.name}..."
ip addr add "${i.ipAddress}""${optionalString (i.subnetMask != "") ("/" + i.subnetMask)}" \
dev "${i.name}"
'' +
optionalString i.proxyARP
''
echo 1 > /proc/sys/net/ipv4/conf/${i.name}/proxy_arp
'' +
optionalString (i.proxyARP && cfg.enableIPv6)
''
echo 1 > /proc/sys/net/ipv6/conf/${i.name}/proxy_ndp
'')
}
# Set the static DNS configuration, if given.
cat | ${pkgs.openresolv}/sbin/resolvconf -a static <<EOF
${optionalString (cfg.nameservers != [] && cfg.domain != "") ''
domain ${cfg.domain}
''}
${flip concatMapStrings cfg.nameservers (ns: ''
nameserver ${ns}
'')}
EOF
# Set the default gateway.
${optionalString (cfg.defaultGateway != "") ''
ip route add default via "${cfg.defaultGateway}"
''}
# turn on forwarding if any interface has enabled proxy_arp
${optionalString (any (i: i.proxyARP) cfg.interfaces) ''
echo 1 > /proc/sys/net/ipv4/ip_forward
''}
# Run any user-specified commands.
${pkgs.stdenv.shell} ${pkgs.writeText "local-net-cmds" cfg.localCommands}
${optionalString (cfg.interfaces != [] || cfg.localCommands != "") ''
# Start the ip-up target (e.g. to start ntpd).
${config.system.build.systemd}/bin/systemctl start ip-up.target
''}
'';
};
# Set the host name in the activation script. Don't clear it if
# it's not configured in the NixOS configuration, since it may
# have been set by dhclient in the meantime.
system.activationScripts.hostname =
optionalString (config.networking.hostName != "") ''
hostname "${config.networking.hostName}"
'';
};
}