1 #!/bin/sh /etc/rc.common
2 # Copyright (C) 2006-2010 OpenWrt.org
3 # Copyright (C) 2006 Carlos Sobrinho
9 PROG
=/usr
/sbin
/dropbear
13 extra_command
"killclients" "Kill ${NAME} processes except servers and yourself"
15 # most of time real_stat() will be failing
16 # due to missing "stat" binary (by default)
17 real_stat
() { env stat
-L "$@" 2>/dev
/null
; }
18 dumb_stat
() { ls -Ldln "$1" |
tr -s '\t ' ' ' ; }
19 stat_perm
() { real_stat
-c '%A' "$1" || dumb_stat
"$1" | cut
-d ' ' -f 1 ; }
20 stat_owner
() { real_stat
-c '%u' "$1" || dumb_stat
"$1" | cut
-d ' ' -f 3 ; }
24 /usr
/bin
/dropbearkey
"$@" </dev
/null
>/dev
/null
2>&1
27 # $1 - file name (host key or config)
30 [ -f "$1" ] ||
return 1
31 # checking file ownership
32 [ "$(stat_owner "$1")" = "0" ] ||
{
34 [ "$(stat_owner "$1")" = "0" ] ||
return 2
36 # checking file permissions
37 [ "$(stat_perm "$1")" = "-rw-------" ] ||
{
39 [ "$(stat_perm "$1")" = "-rw-------" ] ||
return 3
41 # file is host key or not?
42 # if $2 is empty string - file is "host key"
43 # if $2 is non-empty string - file is "config"
44 [ -z "$2" ] ||
return 0
45 # checking file contents (finally)
46 [ -s "$1" ] ||
return 4
47 _dropbearkey
-y -f "$1" ||
return 5
51 # $1 - file_verify() return code
56 1) echo "file does not exist" ;;
57 2) echo "file has wrong owner (must be owned by root)" ;;
58 3) echo "file has wrong permissions (must not have group/other write bit)" ;;
59 4) echo "file has zero length" ;;
60 5) echo "file is not valid host key or not supported" ;;
61 *) echo "unknown error" ;;
66 # $2 - host key file name
70 file_verify
"$2" ; x
=$?
71 if [ "$x" = 0 ] ; then
72 procd_append_param
command -r "$2"
76 logger
-s -t "${NAME}" -p daemon.warn \
77 "Option '$1', skipping '$2': $m"
80 # $1 - host key file name
81 hk_config__keyfile
() { hk_config keyfile
"$1" ; }
83 ktype_all
='ed25519 ecdsa rsa'
85 hk_generate_as_needed
()
87 local hk_cfg_dir kgen ktype kfile hk_tmp_dir
88 hk_cfg_dir
='/etc/dropbear'
90 [ -d "${hk_cfg_dir}" ] || mkdir
-p "${hk_cfg_dir}"
93 for ktype
in ${ktype_all} ; do
94 kfile
="${hk_cfg_dir}/dropbear_${ktype}_host_key"
96 if file_verify
"${kfile}" ; then continue ; fi
98 kgen
="${kgen}${kgen:+ }${ktype}"
102 [ -n "${kgen}" ] ||
return 0
104 hk_tmp_dir
=$
(mktemp
-d)
105 # system in bad state?
106 [ -n "${hk_tmp_dir}" ] ||
return 1
108 chmod 0700 "${hk_tmp_dir}"
110 for ktype
in ${kgen} ; do
111 kfile
="${hk_tmp_dir}/dropbear_${ktype}_host_key"
113 if ! _dropbearkey
-t ${ktype} -f "${kfile}" ; then
114 # unsupported key type
119 chmod 0600 "${kfile}"
123 for ktype
in ${ktype_all} ; do
124 kfile
="${hk_tmp_dir}/dropbear_${ktype}_host_key"
126 [ -s "${kfile}" ] ||
continue
128 kgen
="${kgen}${kgen:+ }${ktype}"
131 if [ -n "${kgen}" ] ; then
132 for ktype
in ${kgen} ; do
133 kfile
="${hk_tmp_dir}/dropbear_${ktype}_host_key"
134 [ -s "${kfile}" ] ||
continue
135 mv -f "${kfile}" "${hk_cfg_dir}/"
139 rm -rf "${hk_tmp_dir}"
141 # cleanup empty files
142 for ktype
in ${ktype_all} ; do
143 kfile
="${hk_cfg_dir}/dropbear_${ktype}_host_key"
145 [ -s "${kfile}" ] ||
rm -f "${kfile}"
154 [ -z "$ipaddrs" ] && {
155 procd_append_param
command -p "$port"
159 for addr
in $ipaddrs; do
160 procd_append_param
command -p "$addr:$port"
164 validate_section_dropbear
()
166 uci_load_validate dropbear dropbear
"$1" "$2" \
167 'PasswordAuth:bool:1' \
170 'GatewayPorts:bool:0' \
171 'ForceCommand:string' \
172 'RootPasswordAuth:bool:1' \
175 'keyfile:list(file)' \
178 'SSHKeepAlive:uinteger:300' \
179 'IdleTimeout:uinteger:0' \
180 'MaxAuthTries:uinteger:3' \
181 'RecvWindowSize:uinteger:0' \
190 echo "validation failed"
194 [ -n "${Interface}" ] && {
195 [ -n "${BOOT}" ] && return 0
197 network_get_ipaddrs_all ipaddrs
"${Interface}" ||
{
198 echo "interface ${Interface} has no physdev or physdev has no suitable ip"
203 [ "${enable}" = "0" ] && return 1
204 PIDCOUNT
="$(( ${PIDCOUNT} + 1))"
205 local pid_file
="/var/run/${NAME}.${PIDCOUNT}.pid"
207 # Increase default receive window size to increase
208 # throughput on high latency links
209 if [ "${RecvWindowSize}" -eq "0" ]; then
210 RecvWindowSize
="262144"
214 procd_set_param
command "$PROG" -F -P "$pid_file"
215 [ "${PasswordAuth}" -eq 0 ] && procd_append_param
command -s
216 [ "${GatewayPorts}" -eq 1 ] && procd_append_param
command -a
217 [ -n "${ForceCommand}" ] && procd_append_param
command -c "${ForceCommand}"
218 [ "${RootPasswordAuth}" -eq 0 ] && procd_append_param
command -g
219 [ "${RootLogin}" -eq 0 ] && procd_append_param
command -w
220 config_list_foreach
"$1" 'keyfile' hk_config__keyfile
221 if [ -n "${rsakeyfile}" ]; then
222 logger
-s -t "${NAME}" -p daemon.crit \
223 "Option 'rsakeyfile' is considered to be DEPRECATED and will be REMOVED in future releases, use 'keyfile' list instead"
224 sed -i.before-upgrade
-E -e 's/option(\s+)rsakeyfile/list keyfile/' \
225 "/etc/config/${NAME}"
226 logger
-s -t "${NAME}" -p daemon.crit \
227 "Auto-transition 'option rsakeyfile' => 'list keyfile' in /etc/config/${NAME} is done, please verify your configuration"
228 hk_config
'rsakeyfile' "${rsakeyfile}"
230 [ -n "${BannerFile}" ] && procd_append_param
command -b "${BannerFile}"
231 append_ports
"${ipaddrs}" "${Port}"
232 [ "${IdleTimeout}" -ne 0 ] && procd_append_param
command -I "${IdleTimeout}"
233 [ "${SSHKeepAlive}" -ne 0 ] && procd_append_param
command -K "${SSHKeepAlive}"
234 [ "${MaxAuthTries}" -ne 0 ] && procd_append_param
command -T "${MaxAuthTries}"
235 [ "${RecvWindowSize}" -gt 0 -a "${RecvWindowSize}" -le 1048576 ] && \
236 procd_append_param
command -W "${RecvWindowSize}"
237 [ "${mdns}" -ne 0 ] && procd_add_mdns
"ssh" "tcp" "$Port" "daemon=dropbear"
238 procd_set_param respawn
244 config_get interface
"$1" Interface
245 config_get
enable "$1" enable 1
247 [ "${enable}" = "1" ] && interfaces=" ${interface} ${interfaces}"
258 hk_generate_as_needed
259 file_verify
/etc
/dropbear
/authorized_keys config
262 .
/lib
/functions
/network.sh
264 config_load
"${NAME}"
265 config_foreach validate_section_dropbear dropbear dropbear_instance
272 procd_add_config_trigger
"config.change" "dropbear" /etc
/init.d
/dropbear reload
274 config_load
"${NAME}"
275 config_foreach load_interfaces dropbear
277 [ -n "${interfaces}" ] && {
278 for n
in $interfaces ; do
279 procd_add_interface_trigger
"interface.*" $n /etc
/init.d
/dropbear reload
283 procd_add_validation validate_section_dropbear
287 # close all open connections
297 # if this script is run from inside a client session, then ignore that session
299 while [ "${pid}" -ne 0 ]
301 # get parent process id
302 pid
=$
(cut
-d ' ' -f 4 "/proc/${pid}/stat")
303 [ "${pid}" -eq 0 ] && break
305 # check if client connection
306 grep -F -q -e "${PROG}" "/proc/${pid}/cmdline" && {
307 append ignore
"${pid}"
312 # get all server pids that should be ignored
313 for server
in $
(cat /var
/run
/${NAME}.
*.pid
)
315 append ignore
"${server}"
318 # get all running pids and kill client connections
320 for pid
in $
(pidof
"${NAME}")
322 # check if correct program, otherwise process next pid
323 grep -F -q -e "${PROG}" "/proc/${pid}/cmdline" ||
{
327 # check if pid should be ignored (servers, ourself)
329 for server
in ${ignore}
331 if [ "${pid}" = "${server}" ]
337 [ "${skip}" -ne 0 ] && continue
340 echo "${initscript}: Killing ${pid}..."