1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
|
{ buildGoModule
, fetchFromGitHub
, fetchpatch
, protobuf
, go-protobuf
, pkg-config
, libnetfilter_queue
, libnfnetlink
, lib
, coreutils
, iptables
, makeWrapper
, protoc-gen-go-grpc
, testers
, opensnitch
, nixosTests
}:
buildGoModule rec {
pname = "opensnitch";
version = "1.6.5.1";
src = fetchFromGitHub {
owner = "evilsocket";
repo = "opensnitch";
rev = "refs/tags/v${version}";
hash = "sha256-IVrAAHzLS7A7cYhRk+IUx8/5TGKeqC7M/7iXOpPe2ZA=";
};
postPatch = ''
# Allow configuring Version at build time
substituteInPlace daemon/core/version.go --replace "const " "var "
'';
modRoot = "daemon";
buildInputs = [
libnetfilter_queue
libnfnetlink
];
nativeBuildInputs = [
pkg-config
protobuf
go-protobuf
makeWrapper
protoc-gen-go-grpc
];
vendorHash = "sha256-PX41xeUJb/WKv3+z5kbRmJNP1vFu8x35NZvN2Dgp4CQ=";
preBuild = ''
# Fix inconsistent vendoring build error
# https://github.com/evilsocket/opensnitch/issues/770
cp ${./go.mod} go.mod
cp ${./go.sum} go.sum
make -C ../proto ../daemon/ui/protocol/ui.pb.go
'';
postBuild = ''
mv $GOPATH/bin/daemon $GOPATH/bin/opensnitchd
mkdir -p $out/etc/opensnitchd $out/lib/systemd/system
cp system-fw.json $out/etc/opensnitchd/
substitute default-config.json $out/etc/opensnitchd/default-config.json \
--replace "/var/log/opensnitchd.log" "/dev/stdout"
# Do not mkdir rules path
sed -i '8d' opensnitchd.service
# Fixup hardcoded paths
substitute opensnitchd.service $out/lib/systemd/system/opensnitchd.service \
--replace "/usr/local/bin/opensnitchd" "$out/bin/opensnitchd"
'';
ldflags = [
"-s"
"-w"
"-X github.com/evilsocket/opensnitch/daemon/core.Version=${version}"
];
postInstall = ''
wrapProgram $out/bin/opensnitchd \
--prefix PATH : ${lib.makeBinPath [ iptables ]}
'';
passthru.tests = {
inherit (nixosTests) opensnitch;
version = testers.testVersion {
package = opensnitch;
command = "opensnitchd -version";
};
};
meta = with lib; {
description = "An application firewall";
mainProgram = "opensnitchd";
homepage = "https://github.com/evilsocket/opensnitch/wiki";
license = licenses.gpl3Only;
maintainers = with maintainers; [ onny ];
platforms = platforms.linux;
};
}
|