PageKite is a system for exposing FreedomBox services when you +
PageKite is a system for exposing {box_name} services when you don't have a direct connection to the Internet. You only need this -service if your FreedomBox services are unreachable from the rest of +service if your {box_name} services are unreachable from the rest of the Internet. This includes the following situations:
PageKite is not installed, please install it. PageKite comes -pre-installed with FreedomBox. On any Debian based system (such as -FreedomBox) you may install it using the command 'aptitude install -pagekite'
''') +pre-installed with {box_name}. On any Debian based system (such as +{box_name}) you may install it using the command 'aptitude install +pagekite'''').format(box_name=cfg.box_name) try: message = kwargs['message'].text diff --git a/modules/installed/services/xmpp.py b/modules/installed/services/xmpp.py index f3d48ad7a..858137af8 100644 --- a/modules/installed/services/xmpp.py +++ b/modules/installed/services/xmpp.py @@ -5,6 +5,7 @@ from plugin_mount import PagePlugin, FormPlugin import cfg from forms import Form import actions +import service from util import Message class xmpp(PagePlugin): @@ -15,6 +16,24 @@ class xmpp(PagePlugin): self.register_page("services.xmpp.register") cfg.html_root.services.menu.add_item("XMPP", "icon-comment", "/services/xmpp", 40) + self.client_service = service.Service( + 'xmpp-client', _('Chat Server - client connections'), enabled=True) + self.server_service = service.Service( + 'xmpp-server', _('Chat Server - server connections'), enabled=True) + self.bosh_service = service.Service( + 'xmpp-bosh', _('Chat Server - web interface'), enabled=True) + + # XXX: This is not correct. This essentially triggers firewall + # to enable XMPP ports. This happen on every start of + # Plinth. XMPP should be an option to be enabled on Plinth. If + # and when the user enables the following notifications must + # sent. If XMPP has be on by default in FreedomBox, then + # initial setup process that sets up XMPP also must open the + # firewall ports by default. + self.client_service.notify_enabled(self, enabled=True) + self.server_service.notify_enabled(self, enabled=True) + self.bosh_service.notify_enabled(self, enabled=True) + @cherrypy.expose @require() def index(self, **kwargs): diff --git a/modules/installed/system/firewall.py b/modules/installed/system/firewall.py new file mode 100644 index 000000000..f3faf78ea --- /dev/null +++ b/modules/installed/system/firewall.py @@ -0,0 +1,191 @@ +# +# This file is part of Plinth. +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, seeFirewall is a network security system that controls the incoming +and outgoing network traffic on your {box_name}. Keeping a firewall +enabled and properly configured reduces risk of security threat from +the Internet.
+ +The following the current status:
+''').format(box_name=cfg.box_name) + + if not self.get_installed_status(): + status = _(''' +Firewall is not installed. Please install it. Firewall comes +pre-installed with {box_name}. On any Debian based system (such as +{box_name}) you may install it using the command 'aptitude install +firewalld'
''').format(box_name=cfg.box_name) + + return self.fill_template(title=_("Firewall"), main=main + status) + + if not self.get_enabled_status(): + status = _(''' +Firewall daemon is not running. Please run it. Firewall comes +enabled by default on {box_name}. On any Debian based system (such as +{box_name}) you may run it using the command 'service firewalld start' +or in case of system with systemd 'systemctl start firewalld'
+''').format(box_name=cfg.box_name) + + return self.fill_template(title=_("Firewall"), main=main + status) + + enabled_services = self.get_enabled_services() + services_info = 'The operation of the firewall is automatic. When you enable a +service it is automatically permitted in the firewall and you disable +a service is automatically disabled in the firewall.
''' + + return self.fill_template(title=_("Firewall"), main=main + + services_info + footnote) + + def get_installed_status(self): + """Return whether firewall is installed""" + output = self._run(['get-installed']) + return output.split()[0] == 'installed' + + def get_enabled_status(self): + """Return whether firewall is installed""" + output = self._run(['get-status']) + return output.split()[0] == 'running' + + def get_enabled_services(self): + """Return the status of various services currently enabled""" + output = self._run(['get-enabled-services']) + return output.split() + + def add_service(self, port): + """Enable a service in firewall""" + self._run(['add-service', port]) + + def remove_service(self, port): + """Remove a service in firewall""" + self._run(['remove-service', port]) + + def on_service_enabled(self, sender, service_id, enabled, **kwargs): + """ + Enable/disable firewall ports when a service is + enabled/disabled. + """ + del sender # Unused + del kwargs # Unused + + enabled_services = self.get_enabled_services() + + cfg.log.info('Service enabled - %s, %s' % (service_id, enabled)) + for port in service_module.SERVICES[service_id].ports: + if enabled: + if port not in enabled_services: + self.add_service(port) + else: + if port in enabled_services: + enabled_services_on_port = [ + service_.is_enabled() + for service_ in service_module.SERVICES.values() + if port in service_.ports and + service_id != service_.service_id] + if not any(enabled_services_on_port): + self.remove_service(port) + + @staticmethod + def _run(arguments, superuser=True): + """Run an given command and raise exception if there was an error""" + command = 'firewall' + + cfg.log.info('Running command - %s, %s, %s' % (command, arguments, + superuser)) + + if superuser: + output, error = actions.superuser_run(command, arguments) + else: + output, error = actions.run(command, arguments) + + if error: + raise Exception('Error setting/getting firewalld confguration - %s' + % error) + + return output diff --git a/plinth.py b/plinth.py index d4f17f601..2d10aa089 100755 --- a/plinth.py +++ b/plinth.py @@ -12,6 +12,7 @@ from cherrypy.process.plugins import Daemonizer Daemonizer(cherrypy.engine).subscribe() import plugin_mount +import service import util as u from logger import Logger @@ -177,6 +178,9 @@ def setup(): cherrypy.engine.signal_handler.subscribe() def main(): + # Initialize basic services + service.init() + setup() cherrypy.engine.start() diff --git a/service.py b/service.py new file mode 100644 index 000000000..e310eceea --- /dev/null +++ b/service.py @@ -0,0 +1,73 @@ +# +# This file is part of Plinth. +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see