package/network/services/dropbear/files/dropbear.init

   1 #!/bin/sh /etc/rc.common
   2 # Copyright (C) 2006-2010 OpenWrt.org
   3 # Copyright (C) 2006 Carlos Sobrinho
   4
   5 START=19
   6 STOP=50
   7
   8 USE_PROCD=1
   9 PROG=/usr/sbin/dropbear
  10 NAME=dropbear
  11 PIDCOUNT=0
  12
  13 extra_command "killclients" "Kill ${NAME} processes except servers and yourself"
  14
  15 # most of time real_stat() will be failing
  16 # due to missing "stat" binary (by default)
  17 real_stat() { env stat -L "$@" 2>/dev/null ; }
  18 dumb_stat() { ls -Ldln "$1" | tr -s '\t ' ' ' ; }
  19 stat_perm()  { real_stat -c '%A' "$1" || dumb_stat "$1" | cut -d ' ' -f 1 ; }
  20 stat_owner() { real_stat -c '%u' "$1" || dumb_stat "$1" | cut -d ' ' -f 3 ; }
  21
  22 _dropbearkey()
  23 {
  24         /usr/bin/dropbearkey "$@" </dev/null >/dev/null 2>&1
  25 }
  26
  27 # $1 - file name (host key or config)
  28 file_verify()
  29 {
  30         [ -f "$1" ] || return 1
  31         # checking file ownership
  32         [ "$(stat_owner "$1")" = "0" ] || {
  33                 chown 0 "$1"
  34                 [ "$(stat_owner "$1")" = "0" ] || return 2
  35         }
  36         # checking file permissions
  37         [ "$(stat_perm "$1")" = "-rw-------" ] || {
  38                 chmod 0600 "$1"
  39                 [ "$(stat_perm "$1")" = "-rw-------" ] || return 3
  40         }
  41         # file is host key or not?
  42         # if $2 is empty string - file is "host key"
  43         # if $2 is non-empty string - file is "config"
  44         [ -z "$2" ] || return 0
  45         # checking file contents (finally)
  46         [ -s "$1" ] || return 4
  47         _dropbearkey -y -f "$1" || return 5
  48         return 0
  49 }
  50
  51 # $1 - file_verify() return code
  52 file_errmsg()
  53 {
  54         case "$1" in
  55         0) ;;
  56         1) echo "file does not exist" ;;
  57         2) echo "file has wrong owner (must be owned by root)" ;;
  58         3) echo "file has wrong permissions (must not have group/other write bit)" ;;
  59         4) echo "file has zero length" ;;
  60         5) echo "file is not valid host key or not supported" ;;
  61         *) echo "unknown error" ;;
  62         esac
  63 }
  64
  65 # $1 - config option
  66 # $2 - host key file name
  67 hk_config()
  68 {
  69         local x m
  70         file_verify "$2" ; x=$?
  71         if [ "$x" = 0 ] ; then
  72                 procd_append_param command -r "$2"
  73                 return
  74         fi
  75         m=$(file_errmsg "$x")
  76         logger -s -t "${NAME}" -p daemon.warn \
  77           "Option '$1', skipping '$2': $m"
  78 }
  79
  80 # $1 - host key file name
  81 hk_config__keyfile() { hk_config keyfile "$1" ; }
  82
  83 ktype_all='ed25519 ecdsa rsa'
  84
  85 hk_generate_as_needed()
  86 {
  87         local hk_cfg_dir kgen ktype kfile hk_tmp_dir
  88         hk_cfg_dir='/etc/dropbear'
  89
  90         [ -d "${hk_cfg_dir}" ] || mkdir -p "${hk_cfg_dir}"
  91
  92         kgen=
  93         for ktype in ${ktype_all} ; do
  94                 kfile="${hk_cfg_dir}/dropbear_${ktype}_host_key"
  95
  96                 if file_verify "${kfile}" ; then continue ; fi
  97
  98                 kgen="${kgen}${kgen:+ }${ktype}"
  99         done
 100
 101         # all keys are sane?
 102         [ -n "${kgen}" ] || return 0
 103
 104         hk_tmp_dir=$(mktemp -d)
 105         # system in bad state?
 106         [ -n "${hk_tmp_dir}" ] || return 1
 107
 108         chmod 0700 "${hk_tmp_dir}"
 109
 110         for ktype in ${kgen} ; do
 111                 kfile="${hk_tmp_dir}/dropbear_${ktype}_host_key"
 112
 113                 if ! _dropbearkey -t ${ktype} -f "${kfile}" ; then
 114                         # unsupported key type
 115                         rm -f "${kfile}"
 116                         continue
 117                 fi
 118
 119                 chmod 0600 "${kfile}"
 120         done
 121
 122         kgen=
 123         for ktype in ${ktype_all} ; do
 124                 kfile="${hk_tmp_dir}/dropbear_${ktype}_host_key"
 125
 126                 [ -s "${kfile}" ] || continue
 127
 128                 kgen="${kgen}${kgen:+ }${ktype}"
 129         done
 130
 131         if [ -n "${kgen}" ] ; then
 132                 for ktype in ${kgen} ; do
 133                         kfile="${hk_tmp_dir}/dropbear_${ktype}_host_key"
 134                         [ -s "${kfile}" ] || continue
 135                         mv -f "${kfile}" "${hk_cfg_dir}/"
 136                 done
 137         fi
 138
 139         rm -rf "${hk_tmp_dir}"
 140
 141         # cleanup empty files
 142         for ktype in ${ktype_all} ; do
 143                 kfile="${hk_cfg_dir}/dropbear_${ktype}_host_key"
 144
 145                 [ -s "${kfile}" ] || rm -f "${kfile}"
 146         done
 147 }
 148
 149 append_ports()
 150 {
 151         local ipaddrs="$1"
 152         local port="$2"
 153
 154         [ -z "$ipaddrs" ] && {
 155                 procd_append_param command -p "$port"
 156                 return
 157         }
 158
 159         for addr in $ipaddrs; do
 160                 procd_append_param command -p "$addr:$port"
 161         done
 162 }
 163
 164 validate_section_dropbear()
 165 {
 166         uci_load_validate dropbear dropbear "$1" "$2" \
 167                 'PasswordAuth:bool:1' \
 168                 'enable:bool:1' \
 169                 'Interface:string' \
 170                 'GatewayPorts:bool:0' \
 171                 'ForceCommand:string' \
 172                 'RootPasswordAuth:bool:1' \
 173                 'RootLogin:bool:1' \
 174                 'rsakeyfile:file' \
 175                 'keyfile:list(file)' \
 176                 'BannerFile:file' \
 177                 'Port:port:22' \
 178                 'SSHKeepAlive:uinteger:300' \
 179                 'IdleTimeout:uinteger:0' \
 180                 'MaxAuthTries:uinteger:3' \
 181                 'RecvWindowSize:uinteger:0' \
 182                 'mdns:bool:1'
 183 }
 184
 185 dropbear_instance()
 186 {
 187         local ipaddrs
 188
 189         [ "$2" = 0 ] || {
 190                 echo "validation failed"
 191                 return 1
 192         }
 193
 194         [ -n "${Interface}" ] && {
 195                 [ -n "${BOOT}" ] && return 0
 196
 197                 network_get_ipaddrs_all ipaddrs "${Interface}" || {
 198                         echo "interface ${Interface} has no physdev or physdev has no suitable ip"
 199                         return 1
 200                 }
 201         }
 202
 203         [ "${enable}" = "0" ] && return 1
 204         PIDCOUNT="$(( ${PIDCOUNT} + 1))"
 205         local pid_file="/var/run/${NAME}.${PIDCOUNT}.pid"
 206
 207         # Increase default receive window size to increase
 208         # throughput on high latency links
 209         if [ "${RecvWindowSize}" -eq "0" ]; then
 210                 RecvWindowSize="262144"
 211         fi
 212
 213         procd_open_instance
 214         procd_set_param command "$PROG" -F -P "$pid_file"
 215         [ "${PasswordAuth}" -eq 0 ] && procd_append_param command -s
 216         [ "${GatewayPorts}" -eq 1 ] && procd_append_param command -a
 217         [ -n "${ForceCommand}" ] && procd_append_param command -c "${ForceCommand}"
 218         [ "${RootPasswordAuth}" -eq 0 ] && procd_append_param command -g
 219         [ "${RootLogin}" -eq 0 ] && procd_append_param command -w
 220         config_list_foreach "$1" 'keyfile' hk_config__keyfile
 221         if [ -n "${rsakeyfile}" ]; then
 222                 logger -s -t "${NAME}" -p daemon.crit \
 223                   "Option 'rsakeyfile' is considered to be DEPRECATED and will be REMOVED in future releases, use 'keyfile' list instead"
 224                 sed -i.before-upgrade -E -e 's/option(\s+)rsakeyfile/list keyfile/' \
 225                   "/etc/config/${NAME}"
 226                 logger -s -t "${NAME}" -p daemon.crit \
 227                   "Auto-transition 'option rsakeyfile' => 'list keyfile' in /etc/config/${NAME} is done, please verify your configuration"
 228                 hk_config 'rsakeyfile' "${rsakeyfile}"
 229         fi
 230         [ -n "${BannerFile}" ] && procd_append_param command -b "${BannerFile}"
 231         append_ports "${ipaddrs}" "${Port}"
 232         [ "${IdleTimeout}" -ne 0 ] && procd_append_param command -I "${IdleTimeout}"
 233         [ "${SSHKeepAlive}" -ne 0 ] && procd_append_param command -K "${SSHKeepAlive}"
 234         [ "${MaxAuthTries}" -ne 0 ] && procd_append_param command -T "${MaxAuthTries}"
 235         [ "${RecvWindowSize}" -gt 0 -a "${RecvWindowSize}" -le 1048576 ] && \
 236                 procd_append_param command -W "${RecvWindowSize}"
 237         [ "${mdns}" -ne 0 ] && procd_add_mdns "ssh" "tcp" "$Port" "daemon=dropbear"
 238         procd_set_param respawn
 239         procd_close_instance
 240 }
 241
 242 load_interfaces()
 243 {
 244         config_get interface "$1" Interface
 245         config_get enable "$1" enable 1
 246
 247         [ "${enable}" = "1" ] && interfaces=" ${interface} ${interfaces}"
 248 }
 249
 250 boot()
 251 {
 252         BOOT=1
 253         start "$@"
 254 }
 255
 256 start_service()
 257 {
 258         hk_generate_as_needed
 259         file_verify /etc/dropbear/authorized_keys config
 260
 261         . /lib/functions.sh
 262         . /lib/functions/network.sh
 263
 264         config_load "${NAME}"
 265         config_foreach validate_section_dropbear dropbear dropbear_instance
 266 }
 267
 268 service_triggers()
 269 {
 270         local interfaces
 271
 272         procd_add_config_trigger "config.change" "dropbear" /etc/init.d/dropbear reload
 273
 274         config_load "${NAME}"
 275         config_foreach load_interfaces dropbear
 276
 277         [ -n "${interfaces}" ] && {
 278                 for n in $interfaces ; do
 279                         procd_add_interface_trigger "interface.*" $n /etc/init.d/dropbear reload
 280                 done
 281         }
 282
 283         procd_add_validation validate_section_dropbear
 284 }
 285
 286 shutdown() {
 287         # close all open connections
 288         killall dropbear
 289 }
 290
 291 killclients()
 292 {
 293         local ignore=''
 294         local server
 295         local pid
 296
 297         # if this script is run from inside a client session, then ignore that session
 298         pid="$$"
 299         while [ "${pid}" -ne 0 ]
 300          do
 301                 # get parent process id
 302                 pid=$(cut -d ' ' -f 4 "/proc/${pid}/stat")
 303                 [ "${pid}" -eq 0 ] && break
 304
 305                 # check if client connection
 306                 grep -F -q -e "${PROG}" "/proc/${pid}/cmdline" && {
 307                         append ignore "${pid}"
 308                         break
 309                 }
 310         done
 311
 312         # get all server pids that should be ignored
 313         for server in $(cat /var/run/${NAME}.*.pid)
 314          do
 315                 append ignore "${server}"
 316         done
 317
 318         # get all running pids and kill client connections
 319         local skip
 320         for pid in $(pidof "${NAME}")
 321          do
 322                 # check if correct program, otherwise process next pid
 323                 grep -F -q -e "${PROG}" "/proc/${pid}/cmdline" || {
 324                         continue
 325                 }
 326
 327                 # check if pid should be ignored (servers, ourself)
 328                 skip=0
 329                 for server in ${ignore}
 330                  do
 331                         if [ "${pid}" = "${server}" ]
 332                          then
 333                                 skip=1
 334                                 break
 335                         fi
 336                 done
 337                 [ "${skip}" -ne 0 ] && continue
 338
 339                 # kill process
 340                 echo "${initscript}: Killing ${pid}..."
 341                 kill -KILL ${pid}
 342         done
 343 }