Snapper (for feedback)

.travis.yml

@@ -1,8 +1,8 @@
 # Travis-CI configuration file for Plinth
 
-language: python
-python:
-  - "3.4"
+dist: trusty
+sudo: required
+language: generic
 
 env:
   - DJANGO_VERSION=">=1.7.0,<1.8.0"
@@ -12,13 +12,14 @@ env:
 # Debian packages required
 before_install:
   - sudo apt-get update -qq
-  - sudo apt-get install augeas-tools gir1.2-packagekitglib-1.0
+  - sudo apt-get -y install augeas-tools gir1.2-packagekitglib-1.0 python3-dev python3-gi
 
 # Command to install dependencies
 install:
+  - virtualenv --python=python3 --system-site-packages _venv
+  - source _venv/bin/activate
   - pip install Django$DJANGO_VERSION
   - pip install coverage==3.7
-  - pip install "pgi>=0.0.10.1"
   - pip install -r requirements.txt
 
 # Command to run tests

INSTALL

@@ -17,6 +17,7 @@
     libjs-modernizr \
     make \
     network-manager \
+    packagekit \
     ppp \
     pppoe \
     python3 \

README.md

@@ -13,9 +13,9 @@ personal servers running free software for private, personal
 communications.  It is a networking appliance designed to allow
 interfacing with the rest of the Internet under conditions of
 protected privacy and data security.  It hosts applications such as
-blog, wiki, website, social network, email, web proxy and a Tor relay
-on a device that can replace your Wi-Fi router so that your data stays
-with you.
+blog, wiki, website, social network, email, web proxy and a Tor relay,
+on a device that can replace your Wi-Fi router, so that your data
+stays with you.
 
 Plinth is a web interface to administer the functions of the
 FreedomBox.  It is extensible and provides various applications of

actions/dynamicdns

@@ -65,7 +65,7 @@ doGetOpt()
     basicauth=0
     ignoreCertError=0
 
-    while getopts ":s:d:u:p:I:U:c:b:" opt; do
+    while getopts ":s:d:u:P:I:U:c:b:p" opt; do
         case ${opt} in
             s)
                 if [ "${OPTARG}" != "${EMPTYSTRING}" ];then
@@ -80,6 +80,9 @@ doGetOpt()
             u)
                 user=${OPTARG}
             ;;
+            P)
+                pass=${OPTARG}
+            ;;
             p)
                 if read -t 0; then
                     IFS= read -r pass
@@ -164,11 +167,11 @@ doWriteCFG()
             echo "NAT no" >> ${HELPERCFG}
             # if this file is added ez-ipupdate will take ip form this interface
             {
-                "interface=${default_interface}"
+                echo "interface=${default_interface}"
                 # if this line is added to config file, ez-ipupdate will be launched on startup via init.d
-                "daemon"
-                "execute=${0} success"
-            } > ${out_file}
+                echo "daemon"
+                echo "execute=${0} success"
+            } >> ${out_file}
         fi
     fi
 }
@@ -186,10 +189,10 @@ doReadCFG()
     ipurl=""
 
     if [ ! -z "${cfgfile}" ];then
-        host=$(grep host "${cfgfile}" 2> /dev/null |cut -d = -f 2)
-        server=$(grep server "${cfgfile}" 2> /dev/null |cut -d = -f 2 |grep -v ^\'\')
-        user=$(grep user "${cfgfile}" 2> /dev/null |cut -d = -f 2 |cut -d : -f 1 )
-        pass=$(grep user "${cfgfile}" 2> /dev/null |cut -d = -f 2 |cut -d : -f 2)
+        host=$(grep ^host= "${cfgfile}" 2> /dev/null | cut -d = -f 2-)
+        server=$(grep ^server= "${cfgfile}" 2> /dev/null | cut -d = -f 2- | grep -v ^\'\')
+        user=$(grep ^user= "${cfgfile}" 2> /dev/null | cut -d = -f 2- | cut -d : -f 1 )
+        pass=$(grep ^user= "${cfgfile}" 2> /dev/null | cut -d = -f 2- | cut -d : -f 2-)
     fi
 
     if [ ! -z ${HELPERCFG} ];then
@@ -293,7 +296,7 @@ doGetWANIP()
 doUpdate()
 {
     local dnsentry=$(nslookup "${host}"|tail -n2|grep A|sed s/[^0-9.]//g)
-    if [ "${dnsentry}" =  "${wanip}" ];then
+    if [ "${dnsentry}" = "${wanip}" ];then
         return
     fi
     if [ ! -z "${server}" ];then
@@ -335,8 +338,8 @@ case ${cmd} in
         doGetWANIP
         if [ "$(grep ^NAT ${HELPERCFG} | awk '{print $2}')" = "no" ];then
             #if we are not behind a NAT device and we use gnudip, start the daemon tool
-            local gnudipServer=$(grep server ${cfgfile} 2> /dev/null |cut -d = -f 2 |grep -v ^\'\')
-            if [ -f ${CFG} -a ! -z "${gnudipServer}" ];then
+            gnudipServer=$(grep ^server= ${cfgfile} 2> /dev/null | cut -d = -f 2- |grep -v ^\'\')
+            if [ ! -f ${CFG} -a ! -z "${gnudipServer}" ];then
                 mv ${CFG_disabled} ${CFG}
                 /etc/init.d/${TOOLNAME} start
             fi
@@ -371,10 +374,10 @@ case ${cmd} in
         fi
         # if we don't know our WAN IP do a blind update once a hour
         if [ "${wanip}" = ${NOIP} ];then
-            uptime=$(cut -d . -f 1 /proc/uptime)
+            currenttime=$(date +%s)
             LAST=0
             [ -f ${LASTUPDATE} ] && LAST=$(cat ${LASTUPDATE})
-            diff=$((uptime - LAST))
+            diff=$((currenttime - LAST))
             if [ ${diff} -gt ${UPDATEMINUTESUNKNOWN} ];then
                 doUpdate
             fi
@@ -389,7 +392,7 @@ case ${cmd} in
     success)
         date=$(date)
         echo "last update done (${date})" > ${STATUSFILE}
-        awk '{print $1}' /proc/uptime |cut -d . -f 1 > ${LASTUPDATE}
+        date +%s > ${LASTUPDATE}
         # if called from cronjob, the current IP is given as parameter
         if [ $# -eq 1 ];then
             echo "${1}" > ${IPFILE}
@@ -428,6 +431,7 @@ case ${cmd} in
         echo "-s <server>             Gnudip Server address"
         echo "-d <domain>             Domain to be updated"
         echo "-u <user>               Account username"
+        echo "-P <password>           Account password"
         echo "-p                      Read Account Password from stdin"
         echo "-I <IP check URL>       A URL which returns the IP of the client who is requesting"
         echo "-U <update URL>         The update URL (a HTTP GET on this URL will be done)"

actions/letsencrypt

@@ -0,0 +1,188 @@
+#!/usr/bin/python3
+#
+# This file is part of Plinth.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+"""
+Configuration helper for Let's Encrypt.
+"""
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+
+from plinth import action_utils
+
+TEST_MODE = False
+LIVE_DIRECTORY = '/etc/letsencrypt/live/'
+APACHE_PREFIX = '/etc/apache2/sites-available/'
+APACHE_CONFIGURATION = '''
+<IfModule mod_gnutls.c>
+<VirtualHost _default_:443>
+	ServerAdmin webmaster@localhost
+	ServerName {domain}
+	DocumentRoot /var/www/html
+	<Directory />
+		Options FollowSymLinks
+		AllowOverride None
+	</Directory>
+	<Directory /var/www/html>
+		Options Indexes FollowSymLinks MultiViews
+		AllowOverride None
+		Order allow,deny
+		allow from all
+	</Directory>
+	ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
+	<Directory "/usr/lib/cgi-bin">
+		AllowOverride None
+		Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
+		Order allow,deny
+		Allow from all
+	</Directory>
+	ErrorLog ${{APACHE_LOG_DIR}}/error.log
+	# Possible values include: debug, info, notice, warn, error, crit, alert, emerg.
+	LogLevel warn
+	CustomLog ${{APACHE_LOG_DIR}}/ssl_access.log combined
+	#   GnuTLS Switch: Enable/Disable SSL/TLS for this virtual host.
+	GnuTLSEnable On
+	#   Automatically obtained certficates from Let's Encrypt
+	GnuTLSCertificateFile	/etc/letsencrypt/live/{domain}/fullchain.pem
+	GnuTLSKeyFile /etc/letsencrypt/live/{domain}/privkey.pem
+	#   See http://www.outoforder.cc/projects/apache/mod_gnutls/docs/#GnuTLSPriorities
+	GnuTLSPriorities NORMAL
+</VirtualHost>
+</IfModule>
+'''
+
+
+def parse_arguments():
+    """Return parsed command line arguments as dictionary."""
+    parser = argparse.ArgumentParser()
+    subparsers = parser.add_subparsers(dest='subcommand', help='Sub command')
+
+    subparsers.add_parser(
+        'get-status', help='Return the status of configured domains.')
+    revoke_parser = subparsers.add_parser(
+        'revoke', help='Disable and domain and revoke its certificate.')
+    revoke_parser.add_argument(
+        '--domain', help='Domain name to revoke certificate for')
+    obtain_parser = subparsers.add_parser(
+        'obtain', help='Obtain certficate for a domain and setup website.')
+    obtain_parser.add_argument(
+        '--domain', help='Domain name to obtain certificate for')
+
+    return parser.parse_args()
+
+
+def get_certficate_expiry(domain):
+    """Return the expiry date of a certificate."""
+    certificate_file = os.path.join(LIVE_DIRECTORY, domain, 'cert.pem')
+    output = subprocess.check_output(['openssl', 'x509', '-enddate', '-noout',
+                                      '-in', certificate_file])
+    return output.decode().strip().split('=')[1]
+
+
+def subcommand_get_status(_):
+    """Return a JSON dictionary of currently configured domains."""
+    try:
+        domains = os.listdir(LIVE_DIRECTORY)
+    except OSError:
+        domains = []
+
+    domains = [domain for domain in domains
+               if os.path.isdir(os.path.join(LIVE_DIRECTORY, domain))]
+
+    domain_status = {}
+    for domain in domains:
+        domain_status[domain] = {
+            'certificate_available': True,
+            'expiry_date': get_certficate_expiry(domain),
+            'web_enabled':
+            action_utils.webserver_is_enabled(domain, kind='site')
+        }
+
+    print(json.dumps({'domains': domain_status}))
+
+
+def subcommand_revoke(arguments):
+    """Disable a domain and revoke the certificate."""
+    domain = arguments.domain
+
+    command = ['letsencrypt', 'revoke', '--domain', domain, '--cert-path',
+               os.path.join(LIVE_DIRECTORY, domain, 'cert.pem')]
+    if TEST_MODE:
+        command.append('--staging')
+
+    process = subprocess.Popen(command, stdout=subprocess.PIPE,
+                               stderr=subprocess.PIPE)
+    stdout, stderr = process.communicate()
+    if process.returncode:
+        print(stderr.decode(), file=sys.stderr)
+        sys.exit(1)
+
+    action_utils.webserver_disable(domain, kind='site')
+
+
+def subcommand_obtain(arguments):
+    """Obtain a certificate for a domain and setup website."""
+    domain = arguments.domain
+
+    command = [
+        'letsencrypt', 'certonly', '--text', '--agree-tos',
+        '--register-unsafely-without-email', '--domain', arguments.domain,
+        '--authenticator', 'webroot', '--webroot-path', '/var/www/html/',
+        '--renew-by-default']
+    if TEST_MODE:
+        command.append('--staging')
+
+    process = subprocess.Popen(command, stdout=subprocess.PIPE,
+                               stderr=subprocess.PIPE)
+    stdin, stderr = process.communicate()
+    if process.returncode:
+        print(stderr.decode(), file=sys.stderr)
+        sys.exit(1)
+
+    setup_webserver_config(domain)
+
+    action_utils.webserver_enable(domain, kind='site')
+
+
+def setup_webserver_config(domain):
+    """Create SSL web server configuration for a domain.
+
+    Do so only if there is no configuration existing.
+    """
+    file_name = os.path.join(APACHE_PREFIX, domain + '.conf')
+    if os.path.isfile(file_name):
+        return
+
+    with open(file_name, 'w') as file_handle:
+        file_handle.write(APACHE_CONFIGURATION.format(domain=domain))
+
+
+def main():
+    """Parse arguments and perform all duties."""
+    arguments = parse_arguments()
+
+    subcommand = arguments.subcommand.replace('-', '_')
+    subcommand_method = globals()['subcommand_' + subcommand]
+    subcommand_method(arguments)
+
+
+if __name__ == '__main__':
+    main()

actions/minetest

@@ -0,0 +1,59 @@
+#!/usr/bin/python3
+#
+# This file is part of Plinth.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+"""
+Configuration helper for Minetest server.
+"""
+
+import argparse
+
+from plinth import action_utils
+
+
+def parse_arguments():
+    """Return parsed command line arguments as dictionary."""
+    parser = argparse.ArgumentParser()
+    subparsers = parser.add_subparsers(dest='subcommand', help='Sub command')
+
+    subparsers.add_parser('enable', help='Enable Minetest server')
+    subparsers.add_parser('disable', help='Disable Minetest server')
+
+    return parser.parse_args()
+
+
+def subcommand_enable(_):
+    """Enable and start server."""
+    action_utils.service_enable('minetest-server')
+
+
+def subcommand_disable(_):
+    """Disable and stop server."""
+    action_utils.service_disable('minetest-server')
+
+
+def main():
+    """Parse arguments and perform all duties."""
+    arguments = parse_arguments()
+
+    subcommand = arguments.subcommand.replace('-', '_')
+    subcommand_method = globals()['subcommand_' + subcommand]
+    subcommand_method(arguments)
+
+
+if __name__ == '__main__':
+    main()