From 8282322353bd4e39e4e708c1ce5d9e6ed7497f6a Mon Sep 17 00:00:00 2001 From: TarCV Date: Sun, 9 Jul 2023 02:09:15 +0300 Subject: [PATCH 1/4] mullvad.openvpn-mullvad: 2.5.3 -> 2.6.0 Update OpenVPN to the version required by current Mullvad (cherry picked from commit 853bdc8aa55dbb3f1d8fda86e06117d069e847d8) --- .../networking/mullvad/openvpn.nix | 73 +++++++++++-------- 1 file changed, 43 insertions(+), 30 deletions(-) diff --git a/pkgs/applications/networking/mullvad/openvpn.nix b/pkgs/applications/networking/mullvad/openvpn.nix index b191c31d39ac..95562ad46cad 100644 --- a/pkgs/applications/networking/mullvad/openvpn.nix +++ b/pkgs/applications/networking/mullvad/openvpn.nix @@ -3,8 +3,7 @@ , fetchpatch , fetchurl , iproute2 -, autoconf -, automake +, autoreconfHook }: openvpn.overrideAttrs (oldAttrs: @@ -16,68 +15,82 @@ openvpn.overrideAttrs (oldAttrs: in rec { pname = "openvpn-mullvad"; - version = "2.5.3"; + version = "2.6.0"; src = fetchurl { url = "https://swupdate.openvpn.net/community/releases/openvpn-${version}.tar.gz"; - sha256 = "sha256-dfAETfRJQwVVynuZWit3qyTylG/cNmgwG47cI5hqX34="; + sha256 = "sha256-6+yTMmPJhQ72984SXi8iIUvmCxy7jM/xiJJkP+CDro8="; }; buildInputs = oldAttrs.buildInputs or [ ] ++ [ + autoreconfHook iproute2 ]; configureFlags = oldAttrs.configureFlags or [ ] ++ [ + # Flags are based on https://github.com/mullvad/mullvadvpn-app-binaries/blob/main/Makefile#L17 + "--enable-static" + "--disable-shared" + "--disable-debug" + "--disable-plugin-down-root" + "--disable-management" + "--disable-port-share" + "--disable-systemd" + "--disable-dependency-tracking" + "--disable-pkcs11" + "--disable-plugin-auth-pam" + "--enable-plugins" + "--disable-lzo" + "--disable-lz4" + "--enable-comp-stub" + + # TODO: Use '--enable-dco --disable-iproute2' on Linux, see https://github.com/mullvad/mullvadvpn-app-binaries/blob/main/Makefile#L35 "--enable-iproute2" "IPROUTE=${iproute2}/sbin/ip" ]; - nativeBuildInputs = oldAttrs.nativeBuildInputs or [ ] ++ [ - autoconf - automake - ]; - patches = oldAttrs.patches or [ ] ++ [ # look at compare to find the relevant commits - # https://github.com/OpenVPN/openvpn/compare/release/2.5...mullvad:mullvad-patches + # https://github.com/OpenVPN/openvpn/compare/release/2.6...mullvad:mullvad-patches # used openvpn version is the latest tag ending with -mullvad # https://github.com/mullvad/openvpn/tags (fetchMullvadPatch { # "Reduce PUSH_REQUEST_INTERVAL to one second" - commit = "41e44158fc71bb6cc8cc6edb6ada3307765a12e8"; - sha256 = "sha256-UoH0V6gTPdEuybFkWxdaB4zomt7rZeEUyXs9hVPbLb4="; - }) - (fetchMullvadPatch { - # "Allow auth plugins to set a failure reason" - commit = "f51781c601e8c72ae107deaf25bf66f7c193e9cd"; - sha256 = "sha256-+kwG0YElL16T0e+avHlI8gNQdAxneRS6fylv7QXvC1s="; + commit = "4084b49de84e64c56584a378e85faf37973b6d6d"; + sha256 = "sha256-MmYeFSw6c/QJh0LqLgkx+UxrbtTVv6zEFcnYEqznR1c="; }) (fetchMullvadPatch { # "Send an event to any plugins when authentication fails" - commit = "c2f810f966f2ffd68564d940b5b8946ea6007d5a"; - sha256 = "sha256-PsKIxYwpLD66YaIpntXJM8OGcObyWBSAJsQ60ojvj30="; + commit = "f24de7922d70c6e1ae06acf18bce1f62d9fa6b07"; + sha256 = "sha256-RvlQbR6/s4NorYeA6FL7tE6geg6MIoZJtHeYxkVbdwA="; }) (fetchMullvadPatch { # "Shutdown when STDIN is closed" - commit = "879d6a3c0288b5443bbe1b94261655c329fc2e0e"; - sha256 = "sha256-pRFY4r+b91/xAKXx6u5GLzouQySXuO5gH0kMGm77a3c="; - }) - (fetchMullvadPatch { - # "Update TAP hardware ID" - commit = "7f71b37a3b25bec0b33a0e29780c222aef869e9d"; - sha256 = "sha256-RF/GvD/ZvhLdt34wDdUT/yxa+IVWx0eY6WRdNWXxXeQ="; + commit = "81ae84271c044359b67991b15ebfb0cf9a32b3ad"; + sha256 = "sha256-ilKMyU97ha2m0p1FD64aNQncnKo4Tyi/nATuD5yPmVw="; }) (fetchMullvadPatch { # "Undo dependency on Python docutils" - commit = "abd3c6214529d9f4143cc92dd874d8743abea17c"; - sha256 = "sha256-SC2RlpWHUDMAEKap1t60dC4hmalk3vok6xY+/xhC2U0="; + commit = "a5064b4b6c598b68d8cabc3f4006e5addef1ec1e"; + sha256 = "sha256-+B6jxL0M+W5LzeukXkir26hn1OaYnycVNBwMYFq6gsE="; }) (fetchMullvadPatch { # "Prevent signal when stdin is closed from being cleared (#10)" - commit = "b45b090c81e7b4f2dc938642af7a1e12f699f5c5"; - sha256 = "sha256-KPTFmbuJhMI+AvaRuu30CPPLQAXiE/VApxlUCqbZFls="; + commit = "abe529e6d7f71228a036007c6c02624ec98ad6c1"; + sha256 = "sha256-qJQeEtZO/+8kenXTKv4Bx6NltUYe8AwzXQtJcyhrjfc="; + }) + (fetchMullvadPatch { + # "Disable libcap-ng" + commit = "598014de7c063fa4e8ba1fffa01434229faafd04"; + sha256 = "sha256-+cFX5gmMuG6XFkTs6IV7utiKRF9E47F5Pgo93c+zBXo="; + }) + (fetchMullvadPatch { + # "Remove libnsl dep" + commit = "845727e01ab3ec9bd58fcedb31b3cf2ebe2d5226"; + sha256 = "sha256-Via62wKVfMWHTmO7xIXXO7b5k0KYHs1D0JVg3qnXkeM="; }) ]; + postPatch = oldAttrs.postPatch or [ ] ++ [ "rm ./configure" ]; meta = oldAttrs.meta or { } // { description = "OpenVPN with Mullvad-specific patches applied"; From e8e49ab1a3bb3654c21b81ba2dc7dd6a1704d030 Mon Sep 17 00:00:00 2001 From: TarCV Date: Tue, 11 Jul 2023 08:14:34 +0300 Subject: [PATCH 2/4] mullvad.openvpn-mullvad: Fix postPatch (cherry picked from commit 9e960a6c18dcd4dc5789e47a01cb98b565dc12e3) --- pkgs/applications/networking/mullvad/openvpn.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/networking/mullvad/openvpn.nix b/pkgs/applications/networking/mullvad/openvpn.nix index 95562ad46cad..c4ed6e3f6c97 100644 --- a/pkgs/applications/networking/mullvad/openvpn.nix +++ b/pkgs/applications/networking/mullvad/openvpn.nix @@ -90,7 +90,9 @@ openvpn.overrideAttrs (oldAttrs: sha256 = "sha256-Via62wKVfMWHTmO7xIXXO7b5k0KYHs1D0JVg3qnXkeM="; }) ]; - postPatch = oldAttrs.postPatch or [ ] ++ [ "rm ./configure" ]; + postPatch = oldAttrs.postPatch or "" + '' + rm ./configure + ''; meta = oldAttrs.meta or { } // { description = "OpenVPN with Mullvad-specific patches applied"; From 760e13660085b46063f8a40cfd5b761cd44500da Mon Sep 17 00:00:00 2001 From: TarCV Date: Tue, 11 Jul 2023 08:17:18 +0300 Subject: [PATCH 3/4] mullvad.openvpn-mullvad: Move hooks to nativeBuildInputs (cherry picked from commit a172885e8f0382fe37921701fd435f6b21d89f5b) --- pkgs/applications/networking/mullvad/openvpn.nix | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/mullvad/openvpn.nix b/pkgs/applications/networking/mullvad/openvpn.nix index c4ed6e3f6c97..3d290d49ec8c 100644 --- a/pkgs/applications/networking/mullvad/openvpn.nix +++ b/pkgs/applications/networking/mullvad/openvpn.nix @@ -22,9 +22,12 @@ openvpn.overrideAttrs (oldAttrs: sha256 = "sha256-6+yTMmPJhQ72984SXi8iIUvmCxy7jM/xiJJkP+CDro8="; }; - buildInputs = oldAttrs.buildInputs or [ ] ++ [ + nativeBuildInputs = oldAttrs.nativeBuildInputs or [ ] ++ [ autoreconfHook - iproute2 + ]; + + buildInputs = oldAttrs.buildInputs or [ ] ++ [ + iproute2 ]; configureFlags = oldAttrs.configureFlags or [ ] ++ [ From 0fb2855387c3dc623d2fd258fc5017c75116c468 Mon Sep 17 00:00:00 2001 From: TarCV Date: Tue, 11 Jul 2023 08:21:38 +0300 Subject: [PATCH 4/4] mullvad.openvpn-mullvad: Update configureFlags to match the flags from mullvadvpn-app-binaries on Linux too (cherry picked from commit 6957eb64cd01ac8524efc07beb2e11526b0403c1) --- .../networking/mullvad/openvpn.nix | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/pkgs/applications/networking/mullvad/openvpn.nix b/pkgs/applications/networking/mullvad/openvpn.nix index 3d290d49ec8c..ad3317280169 100644 --- a/pkgs/applications/networking/mullvad/openvpn.nix +++ b/pkgs/applications/networking/mullvad/openvpn.nix @@ -1,13 +1,17 @@ { lib +, stdenv , openvpn , fetchpatch , fetchurl , iproute2 +, libnl , autoreconfHook +, pkg-config }: openvpn.overrideAttrs (oldAttrs: let + inherit (lib) optional; fetchMullvadPatch = { commit, sha256 }: fetchpatch { url = "https://github.com/mullvad/openvpn/commit/${commit}.patch"; inherit sha256; @@ -24,13 +28,15 @@ openvpn.overrideAttrs (oldAttrs: nativeBuildInputs = oldAttrs.nativeBuildInputs or [ ] ++ [ autoreconfHook + pkg-config ]; - buildInputs = oldAttrs.buildInputs or [ ] ++ [ - iproute2 - ]; + buildInputs = oldAttrs.buildInputs or [ ] + ++ optional stdenv.isLinux [ libnl.dev ]; + + configureFlags = [ + # Assignement instead of appending to make sure to use exactly the flags required by mullvad - configureFlags = oldAttrs.configureFlags or [ ] ++ [ # Flags are based on https://github.com/mullvad/mullvadvpn-app-binaries/blob/main/Makefile#L17 "--enable-static" "--disable-shared" @@ -46,10 +52,11 @@ openvpn.overrideAttrs (oldAttrs: "--disable-lzo" "--disable-lz4" "--enable-comp-stub" - - # TODO: Use '--enable-dco --disable-iproute2' on Linux, see https://github.com/mullvad/mullvadvpn-app-binaries/blob/main/Makefile#L35 - "--enable-iproute2" - "IPROUTE=${iproute2}/sbin/ip" + ] + ++ optional stdenv.isLinux [ + # Flags are based on https://github.com/mullvad/mullvadvpn-app-binaries/blob/main/Makefile#L35 + "--enable-dco" # requires libnl + "--disable-iproute2" ]; patches = oldAttrs.patches or [ ] ++ [