services: tor: Add support for pluggable transports.

Pluggable transports are programs that disguise Tor traffic, which
can be useful in case Tor is censored.  Pluggable transports
cannot be configured by #:config-file file exclusively because Tor
process is run via 'least-authority-wrapper' and cannot have access
to transport plugin, which is a separate executable (Bug#70302,
Bug#70332).

* doc/guix.texi (Networking Services): Document 'tor-transport-plugin'
data type and 'transport-plugins' option for 'tor-configuration.
* gnu/services/networking.scm: Export
'tor-configuration-transport-plugins', 'tor-transport-plugin',
'tor-transport-plugin?', 'tor-plugin-role',
'tor-plugin-protocol', and 'tor-plugin-program'.
(<tor-configuration>): Add 'transport-plugins' field.
(<tor-transport-plugin>): New variable.
(tor-configuration->torrc): Add content to 'torrc' computed-file.
(tor-shepherd-service): Add file-system-mapping(s).

Change-Id: I1b0319358778c7aee650bc843e021a6803a1cf3a
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

1 files changed, 56 insertions, 13 deletions

diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index a1f5f37564..9e794bcf70 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -161,10 +161,16 @@
             tor-configuration-hidden-services
             tor-configuration-socks-socket-type
             tor-configuration-control-socket-path
+            tor-configuration-transport-plugins
             tor-onion-service-configuration
             tor-onion-service-configuration?
             tor-onion-service-configuration-name
             tor-onion-service-configuration-mapping
+	    tor-transport-plugin
+	    tor-transport-plugin?
+	    tor-plugin-role
+	    tor-plugin-protocol
+	    tor-plugin-program
             tor-hidden-service  ; deprecated
             tor-service-type
 
@@ -975,7 +981,9 @@ applications in communication.  It is used by Jami, for example.")))
   (socks-socket-type tor-configuration-socks-socket-type ; 'tcp or 'unix
                      (default 'tcp))
   (control-socket?  tor-configuration-control-socket-path
-                    (default #f)))
+                    (default #f))
+  (transport-plugins tor-configuration-transport-plugins
+                    (default '())))
 
 (define %tor-accounts
   ;; User account and groups for Tor.
@@ -1005,10 +1013,24 @@ Onion Service.")
 @end lisp
 maps ports 22 and 80 of the Onion Service to the local ports 22 and 8080."))
 
+(define-record-type* <tor-transport-plugin>
+  tor-transport-plugin make-tor-transport-plugin
+  tor-transport-plugin?
+  (role           tor-plugin-role
+		  (default 'client)
+		  (sanitize (lambda (value)
+			      (if (memq value '(client server))
+				  value
+				  (configuration-field-error #f 'role value)))))
+  (protocol       tor-plugin-protocol
+		  (default "obfs4"))
+  (program        tor-plugin-program))
+
 (define (tor-configuration->torrc config)
   "Return a 'torrc' file for CONFIG."
   (match-record config <tor-configuration>
-    (tor config-file hidden-services socks-socket-type control-socket?)
+    (tor config-file hidden-services socks-socket-type control-socket?
+         transport-plugins)
     (computed-file
      "torrc"
      (with-imported-modules '((guix build utils))
@@ -1047,6 +1069,20 @@ HiddenServicePort ~a ~a~%"
                                     (cons name mapping)))
                                  hidden-services))
 
+               (for-each (match-lambda
+                           ((role-string protocol program)
+                            (format port "\
+~aTransportPlugin ~a exec ~a~%"
+                                    role-string protocol program)))
+                         '#$(map (match-lambda
+                                   (($ <tor-transport-plugin> role protocol program)
+                                    (list (if (eq? role 'client)
+                                              "Client"
+                                              "Server")
+                                          protocol
+                                          program)))
+                                 transport-plugins))
+
                (display "\
 ### End of automatically generated lines.\n\n" port)
 
@@ -1059,20 +1095,27 @@ HiddenServicePort ~a ~a~%"
 (define (tor-shepherd-service config)
   "Return a <shepherd-service> running Tor."
   (let* ((torrc (tor-configuration->torrc config))
+         (transport-plugins (tor-configuration-transport-plugins config))
          (tor   (least-authority-wrapper
                  (file-append (tor-configuration-tor config) "/bin/tor")
                  #:name "tor"
-                 #:mappings (list (file-system-mapping
-                                   (source "/var/lib/tor")
-                                   (target source)
-                                   (writable? #t))
-                                  (file-system-mapping
-                                   (source "/var/run/tor")
-                                   (target source)
-                                   (writable? #t))
-                                  (file-system-mapping
-                                   (source torrc)
-                                   (target source)))
+                 #:mappings (append
+                             (list (file-system-mapping
+                                    (source "/var/lib/tor")
+                                    (target source)
+                                    (writable? #t))
+                                   (file-system-mapping
+                                    (source "/var/run/tor")
+                                    (target source)
+                                    (writable? #t))
+                                   (file-system-mapping
+                                    (source torrc)
+                                    (target source)))
+                             (map (lambda (plugin)
+				    (file-system-mapping
+				     (source (tor-plugin-program plugin))
+				     (target source)))
+				  transport-plugins))
                  #:namespaces (delq 'net %namespaces))))
     (list (shepherd-service
            (provision '(tor))