tor module: add support for transparent proxy and dns #28939
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@offlinehacker, thanks for your PR! By analyzing the history of the files in this pull request, we identified @thoughtpolice, @Phreedom and @tnias to be potential reviewers. |
offlinehacker
force-pushed
the
nixos/tor/trans_proxy
branch
2 times, most recently
from
1463fa3
to
a8b59f9
Compare
|
A quote from SLNOS discussion:
… * `AutomapHostsSuffixes` must either be made configurable or be
removed. The patch fixes the value to the default value. Makes no
sense.
I also don't want to have `.exit` in there for security reasons.
* Same for `ClientRejectInternalAddresses` and
`ClientDNSRejectInternalAddresses`.
* `ClientRejectInternalAddresses` if made configurable should be moved
under `optionalString cfg.client.transparentProxy.enable` block. It
configures the proxy not the DNS.
|
offlinehacker
force-pushed
the
nixos/tor/trans_proxy
branch
from
a8b59f9
to
c5bd657
Compare
|
So i removed |
|
So i removed `ClientRejectInternalAddresses` and `ClientDNSRejectInternalAddresses` as these are set by default and i added option for `AutomapHostsSuffixes`.
* Please set all new `enable` to `false` by default.
* Also set `automapHostsSuffixes` to `[".onion" ".exit"]` by default (it's
tor's default).
Some more personal nitpicks:
* My personal OCD requires all options of newly added `mkOption`s to be
consistently ordered (e.g. `type`, followed `default`, `example`,
`description`, any consistent order is fine).
* If I were you I would also generalize other places that use isolation
(both `SOCKSPort`s) with your new `isolationOptions` (just make it
into a function that takes its `default` as an argument). It can be
done later, though.
|
offlinehacker
force-pushed
the
nixos/tor/trans_proxy
branch
from
c5bd657
to
00ab309
Compare
|
Ok, fixed, is this ok now? |
offlinehacker
force-pushed
the
nixos/tor/trans_proxy
branch
from
00ab309
to
4dae009
Compare
offlinehacker
force-pushed
the
nixos/tor/trans_proxy
branch
from
4dae009
to
78a86c9
Compare
|
LGTM. I haven't tested this, though.
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request adds support for tor transparent proxy
(nix.useSandbox on NixOS,
or option
build-use-sandboxinnix.confon non-NixOS)
nix-shell -p nox --run "nox-review wip"./result/bin/)