pkgs/applications/networking/mullvad/openvpn.nix

   1 { lib
   2 , stdenv
   3 , openvpn
   4 , fetchpatch
   5 , fetchurl
   6 , libnl
   7 , autoreconfHook
   8 , pkg-config
   9 }:
  10
  11 openvpn.overrideAttrs (oldAttrs:
  12   let
  13     inherit (lib) optional;
  14     fetchMullvadPatch = { commit, sha256 }: fetchpatch {
  15       url = "https://github.com/mullvad/openvpn/commit/${commit}.patch";
  16       inherit sha256;
  17     };
  18   in
  19   rec {
  20     pname = "openvpn-mullvad";
  21     version = "2.6.0";
  22
  23     src = fetchurl {
  24       url = "https://swupdate.openvpn.net/community/releases/openvpn-${version}.tar.gz";
  25       sha256 = "sha256-6+yTMmPJhQ72984SXi8iIUvmCxy7jM/xiJJkP+CDro8=";
  26     };
  27
  28     nativeBuildInputs = oldAttrs.nativeBuildInputs or [ ] ++ [
  29       autoreconfHook
  30       pkg-config
  31     ];
  32
  33     buildInputs = oldAttrs.buildInputs or [ ]
  34        ++ optional stdenv.hostPlatform.isLinux [ libnl.dev ];
  35
  36     configureFlags = [
  37       # Assignement instead of appending to make sure to use exactly the flags required by mullvad
  38
  39       # Flags are based on https://github.com/mullvad/mullvadvpn-app-binaries/blob/main/Makefile#L17
  40       "--enable-static"
  41       "--disable-shared"
  42       "--disable-debug"
  43       "--disable-plugin-down-root"
  44       "--disable-management"
  45       "--disable-port-share"
  46       "--disable-systemd"
  47       "--disable-dependency-tracking"
  48       "--disable-pkcs11"
  49       "--disable-plugin-auth-pam"
  50       "--enable-plugins"
  51       "--disable-lzo"
  52       "--disable-lz4"
  53       "--enable-comp-stub"
  54     ]
  55     ++ optional stdenv.hostPlatform.isLinux [
  56       # Flags are based on https://github.com/mullvad/mullvadvpn-app-binaries/blob/main/Makefile#L35
  57       "--enable-dco" # requires libnl
  58       "--disable-iproute2"
  59     ];
  60
  61     patches = oldAttrs.patches or [ ] ++ [
  62       # look at compare to find the relevant commits
  63       # https://github.com/OpenVPN/openvpn/compare/release/2.6...mullvad:mullvad-patches
  64       # used openvpn version is the latest tag ending with -mullvad
  65       # https://github.com/mullvad/openvpn/tags
  66       (fetchMullvadPatch {
  67         # "Reduce PUSH_REQUEST_INTERVAL to one second"
  68         commit = "4084b49de84e64c56584a378e85faf37973b6d6d";
  69         sha256 = "sha256-MmYeFSw6c/QJh0LqLgkx+UxrbtTVv6zEFcnYEqznR1c=";
  70       })
  71       (fetchMullvadPatch {
  72         # "Send an event to any plugins when authentication fails"
  73         commit = "f24de7922d70c6e1ae06acf18bce1f62d9fa6b07";
  74         sha256 = "sha256-RvlQbR6/s4NorYeA6FL7tE6geg6MIoZJtHeYxkVbdwA=";
  75       })
  76       (fetchMullvadPatch {
  77         # "Shutdown when STDIN is closed"
  78         commit = "81ae84271c044359b67991b15ebfb0cf9a32b3ad";
  79         sha256 = "sha256-ilKMyU97ha2m0p1FD64aNQncnKo4Tyi/nATuD5yPmVw=";
  80       })
  81       (fetchMullvadPatch {
  82         # "Undo dependency on Python docutils"
  83         commit = "a5064b4b6c598b68d8cabc3f4006e5addef1ec1e";
  84         sha256 = "sha256-+B6jxL0M+W5LzeukXkir26hn1OaYnycVNBwMYFq6gsE=";
  85       })
  86       (fetchMullvadPatch {
  87         # "Prevent signal when stdin is closed from being cleared (#10)"
  88         commit = "abe529e6d7f71228a036007c6c02624ec98ad6c1";
  89         sha256 = "sha256-qJQeEtZO/+8kenXTKv4Bx6NltUYe8AwzXQtJcyhrjfc=";
  90       })
  91       (fetchMullvadPatch {
  92         # "Disable libcap-ng"
  93         commit = "598014de7c063fa4e8ba1fffa01434229faafd04";
  94         sha256 = "sha256-+cFX5gmMuG6XFkTs6IV7utiKRF9E47F5Pgo93c+zBXo=";
  95       })
  96       (fetchMullvadPatch {
  97         # "Remove libnsl dep"
  98         commit = "845727e01ab3ec9bd58fcedb31b3cf2ebe2d5226";
  99         sha256 = "sha256-Via62wKVfMWHTmO7xIXXO7b5k0KYHs1D0JVg3qnXkeM=";
 100       })
 101     ];
 102     postPatch = oldAttrs.postPatch or "" + ''
 103       rm ./configure
 104     '';
 105
 106     meta = oldAttrs.meta or { } // {
 107       description = "OpenVPN with Mullvad-specific patches applied";
 108       homepage = "https://github.com/mullvad/openvpn";
 109       maintainers = with lib; [ maintainers.cole-h ];
 110     };
 111   })