Skip to content

luci-app-nut: add/update SSL configuration for full support #8926

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
danielfdickinson wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

luci-app-nut: add/update SSL configuration for full support #8926

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions applications/luci-app-nut/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@
include $(TOPDIR)/rules.mk

LUCI_TITLE:=Network UPS Tools Configuration
LUCI_DEPENDS:=+luci-base +nut +nut-upsmon +nut-server +nut-upsc +nut-web-cgi +nut-upscmd +USE_GLIBC:ldd
LUCI_DEPENDS:=+luci-base +nut +nut-upsmon +nut-server +nut-upsc +nut-web-cgi +nut-upscmd

PKG_LICENSE:=Apache-2.0
PKG_MAINTAINER:=Daniel F. Dickinson <dfdpublic@wildtechgarden.ca> \
Paul Donald <newtwen+github@gmail.com>

EXTRA_DEPENDS:=nut (>= 2.8.4-3)
EXTRA_DEPENDS:=nut (>= 2.8.5-5)

include ../../luci.mk

Expand Down
26 changes: 1 addition & 25 deletions applications/luci-app-nut/htdocs/luci-static/resources/view/nut/nut_monitor.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,7 @@
'use strict';
'require form';
'require fs';
'require view';

const upsmon_tool = '/usr/sbin/upsmon';

function ESIFlags(o) {
o.value('EXEC', _('Execute notify command'));
o.value('SYSLOG', _('Write to syslog'));
Expand Down Expand Up @@ -50,19 +47,8 @@ function MonitorUserOptions(s) {
}

return view.extend({
load: function() {
return Promise.all([
L.resolveDefault(fs.exec_direct('/usr/bin/ldd', [upsmon_tool]), []).catch(function(err) {
throw new Error(_('Unable to run ldd: %s').format(err.message));
}).then(function(stdout) {
return stdout.includes('libssl.so');
}),
])
},

render: function(loaded_promises) {
render: function() {
let m, s, o;
const have_ssl_support = loaded_promises[0];

m = new form.Map('nut_monitor', _('NUT Monitor'),
_('Network UPS Tools Monitoring Configuration'));
Expand Down Expand Up @@ -95,16 +81,6 @@ return view.extend({
o.optional = true;
o.placeholder = 15;

if (have_ssl_support) {
o = s.option(form.Value, 'certpath', _('CA Certificate path'), _('Path containing ca certificates to match against host certificate'));
o.optional = true;
o.placeholder = '/etc/ssl/certs'

o = s.option(form.Flag, 'certverify', _('Verify all connection with SSL'), _('Require SSL and make sure server CN matches hostname'));
o.optional = true;
o.default = false;
}

s = m.section(form.TypedSection, 'notifications', _('Notifications settings'));
s.optional = true;
s.addremove = true;
Expand Down
50 changes: 48 additions & 2 deletions applications/luci-app-nut/htdocs/luci-static/resources/view/nut/nut_monitor_admin.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,22 @@
'use strict';
'require form';
'require fs';
'require view';

const ups_ssl_backend_file = '/usr/share/nut/ssl_backend';

return view.extend({
load: function() {

return Promise.all([
fs.trimmed(ups_ssl_backend_file)
])
Comment thread
danielfdickinson marked this conversation as resolved.
},

render: function() {
render: function(loaded_promises) {
let m, s, o;

const ssl_support_type = loaded_promises[0];

m = new form.Map('nut_monitor', _('NUT Monitor'),
_('Network UPS Tools Monitoring Configuration'));

Expand All @@ -27,6 +34,45 @@ return view.extend({
o.optional = true;
o.placeholder = '/usr/sbin/nutshutdown'

if (ssl_support_type == 'openssl') {
o = s.option(form.FileUpload, 'certfile', _('Client certificate chain and private key'), _('PEM file containing client certificate chain and private key (OpenSSL)'));
o.rmempty = true;
o.optional = true;

// For OpenSSL, certpath is a PEM file, not a database directory as with NSS
o = s.option(form.FileUpload, 'certpath', _('CA certificate(s)'), _('PEM file containing the CA certificate(s) (OpenSSL)'));
o.rmempty = true;
o.optional = true;
}

if (ssl_support_type == 'nss') {
// For NSS, certpath is a database directory, not a PEM file as with OpenSSL.
// We do not fill this field by default as the default database has no certificates,
// and must be filled to be useful. Doing this through the UI is a future task.
o = s.option(form.Value, 'certpath', _('Path to NSS certificate and key databases'), _('An empty database was created in /etc/nut/cert_db at package install. To use it, SSH in, fill it using certutil, and put /etc/nut/cert_db in this field.'));
o.optional = true;
}

if (ssl_support_type == 'openssl' || ssl_support_type == 'nss') {
o = s.option(form.Value, 'certident', _('Certificate name and password'), _('"Certificate name" and "certificate password" need to be entered in double-quotes (") if the value has a space in it. An empty password must be entered as an empty pair of double-quotes ("")'));
o.placeholder = '"certificate name" "certificate password"';
o.password = true;

o = s.option(form.Flag, 'certverify', _('Verify all connections with SSL'), _('Require SSL and verify host certificate'));
o.optional = true;
o.default = false;
o.rmempty = false

o = s.option(form.Flag, 'forcessl', _('Require SSL to connect'), _('Require SSL even if not verifying host certificates'));
o.optional = true;
o.default = false;
o.rmempty = false;

o = s.option(form.DynamicList, 'certhost', _('Per-host override for certident, certverify, and forcessl'), _('hostname "certificate name" "certverify as 0 or 1" "forcessl as 0 or 1"'));
o.optional = true;
o.placeholder = 'hostname "certificate name" certverify forcessl';
}

return m.render();
}
});
15 changes: 2 additions & 13 deletions applications/luci-app-nut/htdocs/luci-static/resources/view/nut/nut_server.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@

const driver_path = '/usr/libexec/nut/';
const old_driver_path = '/lib/nut/';
const ups_daemon = '/usr/sbin/upsd';

function resolveDriverList(path) {
return Promise.resolve(L.resolveDefault(fs.list(path), []).then(function(entries) {
Expand All @@ -24,20 +23,15 @@ function resolveDriverList(path) {
return view.extend({
load: function() {
return Promise.all([
L.resolveDefault(fs.exec_direct('/usr/bin/ldd', [ups_daemon]), []).catch(function(err) {
throw new Error(_('Unable to run ldd: %s').format(err.message));
}).then(function(stdout) {
return stdout.includes('libssl.so');
}),
resolveDriverList(driver_path),
resolveDriverList(old_driver_path),
])
},

render: function(loaded_promises) {
let m, s, o;
const have_ssl_support = loaded_promises[0];
const driver_list = (loaded_promises[1].length > 0) ? loaded_promises[1] : loaded_promises[2];

const driver_list = (loaded_promises[0].length > 0) ? loaded_promises[0] : loaded_promises[1];

m = new form.Map('nut_server', _('NUT Server'),
_('Network UPS Tools Server Configuration'));
Expand Down Expand Up @@ -99,11 +93,6 @@ return view.extend({
o.datatype = 'uinteger'
o.placeholder = 24;

if (have_ssl_support) {
o = s.option(form.Value, 'certfile', _('Certificate file (SSL)'));
o.optional = true;
}

// Drivers global settings
s = m.section(form.NamedSection, 'driver_global', 'driver_global', _('Driver Global Settings'));
s.addremove = true;
Expand Down
46 changes: 44 additions & 2 deletions applications/luci-app-nut/htdocs/luci-static/resources/view/nut/nut_server_admin.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,22 @@
'use strict';
'require form';
'require fs';
'require view';

const ups_ssl_backend_file = '/usr/share/nut/ssl_backend';

return view.extend({
load: function() {

return Promise.all([
fs.trimmed(ups_ssl_backend_file)
])
},

render: function() {
render: function(loaded_promises) {
let m, s, o;

const ssl_support_type = loaded_promises[0];

m = new form.Map('nut_server', _('NUT Server'),
_('Network UPS Tools Server Configuration'));

Expand All @@ -25,6 +32,41 @@ return view.extend({
o.optional = true;
o.placeholder = '/var/run/nut'

if (ssl_support_type == 'openssl') {
o = s.option(form.FileUpload, 'certfile', _('Server certificate chain and private key'), _('PEM file containing server certificate chain and private key (OpenSSL)'));
o.rmempty = true;
o.optional = true;

// For OpenSSL, certpath is a PEM file, not a database directory as with NSS
o = s.option(form.FileUpload, 'certpath', _('CA certificate(s)'), _('PEM file containing the CA certificate(s) (OpenSSL)'));
Comment thread
danielfdickinson marked this conversation as resolved.
o.rmempty = true;
o.optional = true;
}

if (ssl_support_type == 'nss') {
// For NSS, certpath is a database directory, not a PEM file as with OpenSSL.
// We do not fill this field by default as the default database has no certificates,
// and must be filled to be useful. Doing this through the UI is a future task.
o = s.option(form.Value, 'certpath', _('Path to NSS certificate and key databases'), _('An empty database was created in /etc/nut/cert_db at package install. To use it, SSH in, fill it using certutil, and put /etc/nut/cert_db in this field.'));
o.optional = true;
}

if (ssl_support_type == 'openssl' || ssl_support_type == 'nss') {
o = s.option(form.Value, 'certident', _('Certificate name and password'), _('"Certificate name" and "certificate password" need to be entered in double-quotes (") if the value has a space in it. An empty password must be entered as an empty pair of double-quotes ("")'));
o.placeholder = '"certificate name" "certificate password"';
o.password = true;

o = s.option(form.ListValue, 'certrequest', _('Certificate request level'), _('Whether to request a client certificate and whether to validate a requested client certificate'));
o.value('0', _('NO (do not request or verify a client certificate)'));
o.value('1', _('REQUEST (any client certificate)'));
o.value('2', _('REQUIRE (and verify)'));

o = s.option(form.Flag, 'disable_weak_ssl', _('Disable weak SSL'), _('Require at least TLSv1.2 for SSL communications'));
o.rmempty = false;
o.optional = false;
o.default = true;
}

return m.render();
}
});
Loading
Loading