From 6e1cd10adb8b0c6e94822d66e1e8bfc1274884cc Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 29 Jun 2025 18:10:04 +0200 Subject: [PATCH 1/4] nixos/networkmanager: clean up plugin handling There is no point in having a special option to enable strongswan, when we can just parse the intent from the plugin list instead. Also pick up relevant runtime dependency information from the plugin package instead of providing additional options or hardcoding them. --- .../services/networking/networkmanager.nix | 42 +++++++------------ .../ne/networkmanager-fortisslvpn/package.nix | 3 ++ .../ne/networkmanager_strongswan/package.nix | 4 ++ 3 files changed, 23 insertions(+), 26 deletions(-) diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix index 803cc741ce15..4200792bfa9b 100644 --- a/nixos/modules/services/networking/networkmanager.nix +++ b/nixos/modules/services/networking/networkmanager.nix @@ -127,15 +127,20 @@ let ''; }; + concatPluginAttrs = attr: lib.concatMap (plugin: plugin.${attr} or [ ]) cfg.plugins; + pluginRuntimeDeps = concatPluginAttrs "networkManagerRuntimeDeps"; + pluginDbusDeps = concatPluginAttrs "networkManagerDbusDeps"; + pluginTmpfilesRules = concatPluginAttrs "networkManagerTmpfilesRules"; + packages = [ cfg.package ] ++ cfg.plugins + ++ pluginRuntimeDeps ++ lib.optionals (!delegateWireless && !enableIwd) [ pkgs.wpa_supplicant ]; - in { @@ -390,19 +395,6 @@ in ''; }; - enableStrongSwan = mkOption { - type = types.bool; - default = false; - description = '' - Enable the StrongSwan plugin. - - If you enable this option the - `networkmanager_strongswan` plugin will be added to - the {option}`networking.networkmanager.plugins` option - so you don't need to do that yourself. - ''; - }; - ensureProfiles = { profiles = with lib.types; @@ -523,6 +515,11 @@ in [ "networking" "networkmanager" "fccUnlockScripts" ] [ "networking" "modemmanager" "fccUnlockScripts" ] ) + (mkRemovedOptionModule [ + "networking" + "networkmanager" + "enableStrongSwan" + ] "Pass `pkgs.networkmanager_strongswan` into `networking.networkmanager.plugins` instead.") ]; ###### implementation @@ -597,13 +594,10 @@ in systemd.tmpfiles.rules = [ "d /etc/NetworkManager/system-connections 0700 root root -" - "d /etc/ipsec.d 0700 root root -" - "d /var/lib/NetworkManager-fortisslvpn 0700 root root -" - "d /var/lib/misc 0755 root root -" # for dnsmasq.leases # ppp isn't able to mkdir that directory at runtime "d /run/pppd/lock 0700 root root -" - ]; + ] ++ pluginTmpfilesRules; systemd.services.NetworkManager = { wantedBy = [ "multi-user.target" ]; @@ -642,6 +636,7 @@ in wantedBy = [ "multi-user.target" ]; before = [ "network-online.target" ]; after = [ "NetworkManager.service" ]; + path = pluginRuntimeDeps; script = let path = id: "/run/NetworkManager/system-connections/${id}.nmconnection"; @@ -680,10 +675,6 @@ in ]; }) - (mkIf cfg.enableStrongSwan { - networkmanager.plugins = [ pkgs.networkmanager_strongswan ]; - }) - (mkIf enableIwd { wireless.iwd.enable = true; }) @@ -710,11 +701,10 @@ in security.polkit.enable = true; security.polkit.extraConfig = polkitConf; - services.dbus.packages = - packages - ++ optional cfg.enableStrongSwan pkgs.strongswanNM - ++ optional (cfg.dns == "dnsmasq") pkgs.dnsmasq; + services.dbus.packages = packages ++ pluginDbusDeps ++ optional (cfg.dns == "dnsmasq") pkgs.dnsmasq; services.udev.packages = packages; + + systemd.services.NetworkManager.path = pluginRuntimeDeps; }; } diff --git a/pkgs/by-name/ne/networkmanager-fortisslvpn/package.nix b/pkgs/by-name/ne/networkmanager-fortisslvpn/package.nix index ec651b3b0a56..aafa2861b401 100644 --- a/pkgs/by-name/ne/networkmanager-fortisslvpn/package.nix +++ b/pkgs/by-name/ne/networkmanager-fortisslvpn/package.nix @@ -82,6 +82,9 @@ stdenv.mkDerivation rec { versionPolicy = "odd-unstable"; }; networkManagerPlugin = "VPN/nm-fortisslvpn-service.name"; + networkManagerTmpfilesRules = [ + "d /var/lib/NetworkManager-fortisslvpn 0700 root root -" + ]; }; meta = with lib; { diff --git a/pkgs/by-name/ne/networkmanager_strongswan/package.nix b/pkgs/by-name/ne/networkmanager_strongswan/package.nix index 1f19a10087c1..5d0b6ae110e8 100644 --- a/pkgs/by-name/ne/networkmanager_strongswan/package.nix +++ b/pkgs/by-name/ne/networkmanager_strongswan/package.nix @@ -49,6 +49,10 @@ stdenv.mkDerivation rec { passthru = { networkManagerPlugin = "VPN/nm-strongswan-service.name"; + networkManagerDbusDeps = [ strongswanNM ]; + networkManagerTmpfilesRules = [ + "d /etc/ipsec.d 0700 root root -" + ]; }; meta = with lib; { From c6eb84310af667b270b4a07095ce955639fbfaf2 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 29 Jun 2025 17:41:44 +0200 Subject: [PATCH 2/4] networkmanager: drop hard dependency on openconnect Its closure size is huge, due to a dependency on webkitgtk, and now that we want to enable networkmanager on the ISOs by default closure size matters a lot. Instead we now pass openconnect to the PATH of the systemd unit and pick it up from there. --- .../ne/networkmanager-openconnect/package.nix | 1 + .../tools/networking/networkmanager/default.nix | 2 -- .../networking/networkmanager/fix-paths.patch | 17 ++++++++--------- 3 files changed, 9 insertions(+), 11 deletions(-) diff --git a/pkgs/by-name/ne/networkmanager-openconnect/package.nix b/pkgs/by-name/ne/networkmanager-openconnect/package.nix index 098be3d6fe68..090fe868482b 100644 --- a/pkgs/by-name/ne/networkmanager-openconnect/package.nix +++ b/pkgs/by-name/ne/networkmanager-openconnect/package.nix @@ -73,6 +73,7 @@ stdenv.mkDerivation rec { versionPolicy = "odd-unstable"; }; networkManagerPlugin = "VPN/nm-openconnect-service.name"; + networkManagerRuntimeDeps = [ openconnect ]; }; meta = with lib; { diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix index 9513c66be3ad..2feabeefa54a 100644 --- a/pkgs/tools/networking/networkmanager/default.nix +++ b/pkgs/tools/networking/networkmanager/default.nix @@ -40,7 +40,6 @@ docbook_xml_dtd_412, docbook_xml_dtd_42, docbook_xml_dtd_43, - openconnect, curl, meson, mesonEmulatorHook, @@ -130,7 +129,6 @@ stdenv.mkDerivation (finalAttrs: { (replaceVars ./fix-paths.patch { inherit iputils - openconnect ethtool gnused ; diff --git a/pkgs/tools/networking/networkmanager/fix-paths.patch b/pkgs/tools/networking/networkmanager/fix-paths.patch index 47887de9283f..3cacf8152c2f 100644 --- a/pkgs/tools/networking/networkmanager/fix-paths.patch +++ b/pkgs/tools/networking/networkmanager/fix-paths.patch @@ -11,10 +11,10 @@ index 148acade5c..6395fbfbe5 100644 LABEL="nm_drivers_end" diff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c -index f3441508ab..7cde8d7d39 100644 +index e310a9c680..ed8d838e43 100644 --- a/src/core/devices/nm-device.c +++ b/src/core/devices/nm-device.c -@@ -14839,14 +14839,14 @@ nm_device_start_ip_check(NMDevice *self) +@@ -15239,14 +15239,14 @@ nm_device_start_ip_check(NMDevice *self) gw = nm_l3_config_data_get_best_default_route(l3cd, AF_INET); if (gw) { nm_inet4_ntop(NMP_OBJECT_CAST_IP4_ROUTE(gw)->gateway, buf); @@ -32,7 +32,7 @@ index f3441508ab..7cde8d7d39 100644 } } diff --git a/src/libnmc-base/nm-vpn-helpers.c b/src/libnmc-base/nm-vpn-helpers.c -index cbe76f5f1c..8515f94994 100644 +index cbe76f5f1c..6ec684f9fe 100644 --- a/src/libnmc-base/nm-vpn-helpers.c +++ b/src/libnmc-base/nm-vpn-helpers.c @@ -284,15 +284,6 @@ nm_vpn_openconnect_authenticate_helper(NMSettingVpn *s_vpn, GPtrArray *secrets, @@ -51,7 +51,7 @@ index cbe76f5f1c..8515f94994 100644 const char *oc_argv[(12 + 2 * G_N_ELEMENTS(oc_property_args))]; const char *gw; int port; -@@ -311,15 +302,7 @@ nm_vpn_openconnect_authenticate_helper(NMSettingVpn *s_vpn, GPtrArray *secrets, +@@ -311,13 +302,8 @@ nm_vpn_openconnect_authenticate_helper(NMSettingVpn *s_vpn, GPtrArray *secrets, port = extract_url_port(gw); @@ -62,9 +62,8 @@ index cbe76f5f1c..8515f94994 100644 - NULL, - NULL, - error); -- if (!path) -- return FALSE; -+ path = "@openconnect@/bin/openconnect"; ++ path = g_find_program_in_path("openconnect"); ++ + if (!path) + return FALSE; - oc_argv[oc_argc++] = path; - oc_argv[oc_argc++] = "--authenticate"; From ccdca43d80049e228f41b2a4159b704129b1a1be Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 29 Jun 2025 21:20:42 +0200 Subject: [PATCH 3/4] nixos/networkmanager: drop default plugin list and toggle It is unclear where this list originated, but it doesn't make sense to ship it with all networkmanager installations. The most excessive plugin is openconnect, that ships a 250 MB closure including webkitgtk. Instead users now have to specify the plugins they want explicitly. I updated the option to give hints on how to find them as best as I can. --- .../manual/release-notes/rl-2511.section.md | 2 + .../services/networking/networkmanager.nix | 46 +++++++++---------- 2 files changed, 25 insertions(+), 23 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md index 1d3c230e682d..9588ee334a50 100644 --- a/nixos/doc/manual/release-notes/rl-2511.section.md +++ b/nixos/doc/manual/release-notes/rl-2511.section.md @@ -10,6 +10,8 @@ - The default PostgreSQL version for new NixOS installations (i.e. with `system.stateVersion >= 25.11`) is v17. +- The NetworkManager module does not ship with a default set of VPN plugins anymore. All required VPN plugins must now be explicitly configured in [`networking.networkmanager.plugins`](#opt-networking.networkmanager.plugins). + ## New Modules {#sec-release-25.11-new-modules} diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix index 4200792bfa9b..2dfe39127cc8 100644 --- a/nixos/modules/services/networking/networkmanager.nix +++ b/nixos/modules/services/networking/networkmanager.nix @@ -225,30 +225,37 @@ in type = let networkManagerPluginPackage = types.package // { - description = "NetworkManager plug-in"; + description = "NetworkManager plugin package"; check = p: lib.assertMsg (types.package.check p && p ? networkManagerPlugin && lib.isString p.networkManagerPlugin) '' - Package ‘${p.name}’, is not a NetworkManager plug-in. + Package ‘${p.name}’, is not a NetworkManager plugin. Those need to have a ‘networkManagerPlugin’ attribute. ''; }; in types.listOf networkManagerPluginPackage; default = [ ]; - description = '' - List of NetworkManager plug-ins to enable. - Some plug-ins are enabled by the NetworkManager module by default. + example = literalExpression '' + [ + networkmanager-fortisslvpn + networkmanager-iodine + networkmanager-l2tp + networkmanager-openconnect + networkmanager-openvpn + networkmanager-sstp + networkmanager-strongswan + networkmanager-vpnc + ] ''; - }; - - enableDefaultPlugins = mkOption { - type = types.bool; - default = true; description = '' - Enable a set of recommended plugins. + List of plugin packages to install. + + See for available plugin packages. + and for an overview over builtin and external plugins + and their support status. ''; }; @@ -520,6 +527,11 @@ in "networkmanager" "enableStrongSwan" ] "Pass `pkgs.networkmanager_strongswan` into `networking.networkmanager.plugins` instead.") + (mkRemovedOptionModule [ + "networking" + "networkmanager" + "enableDefaultPlugins" + ] "Configure the required plugins explicitly in `networking.networkmanager.plugins`.") ]; ###### implementation @@ -663,18 +675,6 @@ in useDHCP = false; }) - (mkIf cfg.enableDefaultPlugins { - networkmanager.plugins = with pkgs; [ - networkmanager-fortisslvpn - networkmanager-iodine - networkmanager-l2tp - networkmanager-openconnect - networkmanager-openvpn - networkmanager-vpnc - networkmanager-sstp - ]; - }) - (mkIf enableIwd { wireless.iwd.enable = true; }) From 312015eaafbc3af80571bd68c465a6929cf710de Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 29 Jun 2025 23:20:31 +0200 Subject: [PATCH 4/4] networkmanager-strongswan: rename from networkmanager_strongswan This is to follow the same structure as all other nm plugins. --- nixos/modules/services/networking/networkmanager.nix | 2 +- .../package.nix | 0 pkgs/top-level/aliases.nix | 1 + 3 files changed, 2 insertions(+), 1 deletion(-) rename pkgs/by-name/ne/{networkmanager_strongswan => networkmanager-strongswan}/package.nix (100%) diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix index 2dfe39127cc8..f851f2428723 100644 --- a/nixos/modules/services/networking/networkmanager.nix +++ b/nixos/modules/services/networking/networkmanager.nix @@ -526,7 +526,7 @@ in "networking" "networkmanager" "enableStrongSwan" - ] "Pass `pkgs.networkmanager_strongswan` into `networking.networkmanager.plugins` instead.") + ] "Pass `pkgs.networkmanager-strongswan` into `networking.networkmanager.plugins` instead.") (mkRemovedOptionModule [ "networking" "networkmanager" diff --git a/pkgs/by-name/ne/networkmanager_strongswan/package.nix b/pkgs/by-name/ne/networkmanager-strongswan/package.nix similarity index 100% rename from pkgs/by-name/ne/networkmanager_strongswan/package.nix rename to pkgs/by-name/ne/networkmanager-strongswan/package.nix diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index d10327ff4865..8a0631807799 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1384,6 +1384,7 @@ mapAliases { or for all fonts fonts.packages = [ ... ] ++ builtins.filter lib.attrsets.isDerivation (builtins.attrValues pkgs.nerd-fonts) ''; # Added 2024-11-09 + networkmanager_strongswan = networkmanager-strongswan; # added 2025-06-29 newlibCross = newlib; # Added 2024-09-06 newlib-nanoCross = newlib-nano; # Added 2024-09-06 nix-direnv-flakes = nix-direnv;