mdebray/tvl-depot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(ops/modules/open_eid): add support for Web eID extension

Browse source 
Most likely due to bad UX in browsers for hardware-backed TLS client
cert auth, most websites have switched from client-side TLS to the "Web
eID" extension.

Once installed, the extension uses [Native Messaging] to talk to a
`web-eid-app` application, which handles the communication with the
smart card itself.

This can be tested on https://web-eid.eu/ .

The commit needs nixpkgs to be bumped past
https://github.com/NixOS/nixpkgs/pull/227354 .

[Native Messaging]: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Native_messaging

Change-Id: Iffe6d81ecf7cee25406fa39a983ff52cf669c373
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8490
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
This commit is contained in:
Florian Klink 2023-04-21 00:04:23 +02:00 committed by flokli
parent ea1383682d
commit b58f6f1d61
1 changed files with 37 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

57
ops/modules/open_eid.nix
View file

@ -1,25 +1,6 @@
# NixOS module to configure the Estonian e-ID software.
{ pkgs, ... }:
let
# Wrapper script to tell to Chrome/Chromium to use p11-kit-proxy to load
# security devices.
# Each user needs to run this themselves, it does not work on a system level
# due to a bug in Chromium:
#
# https://bugs.chromium.org/p/chromium/issues/detail?id=16387
#
# Firefox users can just set
# extraPolicies.SecurityDevices.p11-kit-proxy "${pkgs.p11-kit}/lib/p11-kit-proxy.so";
# when overriding the firefox derivation.
setup-browser-eid = pkgs.writeShellScriptBin "setup-browser-eid" ''
NSSDB="''${HOME}/.pki/nssdb"
mkdir -p ''${NSSDB}
${pkgs.nssTools}/bin/modutil -force -dbdir sql:$NSSDB -add p11-kit-proxy \
-libfile ${pkgs.p11-kit}/lib/p11-kit-proxy.so
'';
in
{
services.pcscd.enable = true;
@ -29,9 +10,45 @@ in
module: ${pkgs.opensc}/lib/opensc-pkcs11.so
'';
# Configure Firefox (in case users set `programs.firefox.enable = true;`)
programs.firefox = {
# Allow a possibly installed "Web eID" extension to do native messaging with
# the "web-eid-app" native component.
# Users not using `programs.firefox.enable` can override their firefox
# derivation, by setting `extraNativeMessagingHosts = [ pkgs.web-eid-app ]`.
nativeMessagingHosts.euwebid = true;
# Configure Firefox to load smartcards via p11kit-proxy.
# Users not using `programs.firefox.enable` can override their firefox
# derivation, by setting
# `extraPolicies.SecurityDevices.p11-kit-proxy "${pkgs.p11-kit}/lib/p11-kit-proxy.so"`.
policies.SecurityDevices.p11-kit-proxy = "${pkgs.p11-kit}/lib/p11-kit-proxy.so";
};
# Chromium users need a symlink to their (slightly different) .json file
# in the native messaging hosts' manifest file location.
environment.etc."chromium/native-messaging-hosts/eu.webeid.json".source = "${pkgs.web-eid-app}/share/web-eid/eu.webeid.json";
environment.etc."opt/chrome/native-messaging-hosts/eu.webeid.json".source = "${pkgs.web-eid-app}/share/web-eid/eu.webeid.json";
environment.systemPackages = with pkgs; [
libdigidocpp.bin # provides digidoc-tool(1)
qdigidoc
setup-browser-eid
# Wrapper script to tell to Chrome/Chromium to use p11-kit-proxy to load
# security devices, so they can be used for TLS client auth.
# Each user needs to run this themselves, it does not work on a system level
# due to a bug in Chromium:
#
# https://bugs.chromium.org/p/chromium/issues/detail?id=16387
#
# Firefox users can just set
# extraPolicies.SecurityDevices.p11-kit-proxy "${pkgs.p11-kit}/lib/p11-kit-proxy.so";
# when overriding the firefox derivation.
(pkgs.writeShellScriptBin "setup-browser-eid" ''
NSSDB="''${HOME}/.pki/nssdb"
mkdir -p ''${NSSDB}
${pkgs.nssTools}/bin/modutil -force -dbdir sql:$NSSDB -add p11-kit-proxy \
-libfile ${pkgs.p11-kit}/lib/p11-kit-proxy.so
'')
];
}