1 #!/bin/sh /etc/rc.common
2 # Copyright (C) 2006-2010 OpenWrt.org
3 # Copyright (C) 2006 Carlos Sobrinho
9 PROG
=/usr
/sbin
/dropbear
13 extra_command
"killclients" "Kill ${NAME} processes except servers and yourself"
15 # most of time real_stat() will be failing
16 # due to missing "stat" binary (by default)
17 real_stat
() { env stat
-L "$@" 2>/dev
/null
; }
18 dumb_stat
() { ls -Ldln "$1" |
tr -s '\t ' ' ' ; }
19 stat_perm
() { real_stat
-c '%A' "$1" || dumb_stat
"$1" | cut
-d ' ' -f 1 ; }
20 stat_owner
() { real_stat
-c '%u' "$1" || dumb_stat
"$1" | cut
-d ' ' -f 3 ; }
24 /usr
/bin
/dropbearkey
"$@" </dev
/null
>/dev
/null
2>&1
27 # $1 - file name (host key or config)
30 [ -f "$1" ] ||
return 1
31 # checking file ownership
32 [ "$(stat_owner "$1")" = "0" ] ||
{
34 [ "$(stat_owner "$1")" = "0" ] ||
return 2
36 # checking file permissions
37 [ "$(stat_perm "$1")" = "-rw-------" ] ||
{
39 [ "$(stat_perm "$1")" = "-rw-------" ] ||
return 3
41 # file is host key or not?
42 # if $2 is empty string - file is "host key"
43 # if $2 is non-empty string - file is "config"
44 [ -z "$2" ] ||
return 0
45 # checking file contents (finally)
46 [ -s "$1" ] ||
return 4
47 _dropbearkey
-y -f "$1" ||
return 5
51 # $1 - file_verify() return code
56 1) echo "file does not exist" ;;
57 2) echo "file has wrong owner (must be owned by root)" ;;
58 3) echo "file has wrong permissions (must not have group/other write bit)" ;;
59 4) echo "file has zero length" ;;
60 5) echo "file is not valid host key or not supported" ;;
61 *) echo "unknown error" ;;
66 # $2 - host key file name
70 file_verify
"$2" ; x
=$?
71 if [ "$x" = 0 ] ; then
72 procd_append_param
command -r "$2"
76 logger
-s -t "${NAME}" -p daemon.warn \
77 "Option '$1', skipping '$2': $m"
80 # $1 - host key file name
81 hk_config__keyfile
() { hk_config keyfile
"$1" ; }
83 ktype_all
='ed25519 ecdsa rsa'
85 hk_generate_as_needed
()
87 local hk_cfg_dir kgen ktype kfile hk_tmp_dir
88 hk_cfg_dir
='/etc/dropbear'
90 [ -d "${hk_cfg_dir}" ] || mkdir
-p "${hk_cfg_dir}"
93 for ktype
in ${ktype_all} ; do
94 kfile
="${hk_cfg_dir}/dropbear_${ktype}_host_key"
96 if file_verify
"${kfile}" ; then continue ; fi
98 kgen
="${kgen}${kgen:+ }${ktype}"
102 [ -n "${kgen}" ] ||
return 0
104 hk_tmp_dir
=$
(mktemp
-d)
105 # system in bad state?
106 [ -n "${hk_tmp_dir}" ] ||
return 1
108 chmod 0700 "${hk_tmp_dir}"
110 for ktype
in ${kgen} ; do
111 kfile
="${hk_tmp_dir}/dropbear_${ktype}_host_key"
113 if ! _dropbearkey
-t ${ktype} -f "${kfile}" ; then
114 # unsupported key type
119 chmod 0600 "${kfile}"
123 for ktype
in ${ktype_all} ; do
124 kfile
="${hk_tmp_dir}/dropbear_${ktype}_host_key"
126 [ -s "${kfile}" ] ||
continue
128 kgen
="${kgen}${kgen:+ }${ktype}"
131 if [ -n "${kgen}" ] ; then
132 for ktype
in ${kgen} ; do
133 kfile
="${hk_tmp_dir}/dropbear_${ktype}_host_key"
134 [ -s "${kfile}" ] ||
continue
135 mv -f "${kfile}" "${hk_cfg_dir}/"
139 rm -rf "${hk_tmp_dir}"
141 # cleanup empty files
142 for ktype
in ${ktype_all} ; do
143 kfile
="${hk_cfg_dir}/dropbear_${ktype}_host_key"
145 [ -s "${kfile}" ] ||
rm -f "${kfile}"
149 # $1 - list with whitespace-separated elements
152 printf '%s' "$1" |
tr -s ' \r\n\t' ' ' |
sed -E 's/^ //;s/ $//'
155 warn_multiple_interfaces
()
157 logger
-t "${NAME}" -p daemon.warn \
158 "Option '$1' should specify SINGLE interface but instead it lists interfaces: $2"
159 logger
-t "${NAME}" -p daemon.warn \
160 "Consider creating per-interface instances instead!"
163 validate_section_dropbear
()
165 uci_load_validate dropbear dropbear
"$1" "$2" \
166 'PasswordAuth:bool:1' \
168 'DirectInterface:string' \
170 'GatewayPorts:bool:0' \
171 'ForceCommand:string' \
172 'RootPasswordAuth:bool:1' \
175 'keyfile:list(file)' \
178 'SSHKeepAlive:uinteger:300' \
179 'IdleTimeout:uinteger:0' \
180 'MaxAuthTries:uinteger:3' \
181 'RecvWindowSize:uinteger:262144' \
188 echo "validation failed"
192 [ "${enable}" = "1" ] ||
return 1
194 local iface ndev ipaddrs
196 # 'DirectInterface' should specify single interface
197 # but end users may misinterpret this setting
198 DirectInterface
=$
(normalize_list
"${DirectInterface}")
200 # 'Interface' should specify single interface
201 # but end users are often misinterpret this setting
202 Interface
=$
(normalize_list
"${Interface}")
204 if [ -n "${Interface}" ] ; then
205 if [ -n "${DirectInterface}" ] ; then
206 logger
-t "${NAME}" -p daemon.warn \
207 "Option 'DirectInterface' takes precedence over 'Interface'"
209 logger
-t "${NAME}" -p daemon.info \
210 "Option 'Interface' binds to address(es) but not to interface"
211 logger
-t "${NAME}" -p daemon.info \
212 "Consider using option 'DirectInterface' to bind directly to interface"
216 # handle 'DirectInterface'
217 iface
=$
(echo "${DirectInterface}" |
awk '{print $1}')
218 case "${DirectInterface}" in
220 warn_multiple_interfaces DirectInterface
"${DirectInterface}"
221 logger
-t "${NAME}" -p daemon.warn \
222 "Using network interface '${iface}' for direct binding"
225 while [ -n "${iface}" ] ; do
226 # if network is available (even during boot) - proceed
227 if network_is_up
"${iface}" ; then break ; fi
229 [ -z "${BOOT}" ] ||
return 0
231 logger
-t "${NAME}" -p daemon.crit \
232 "Network interface '${iface}' is not available!"
235 while [ -n "${iface}" ] ; do
236 # ${iface} is logical (higher level) interface name
237 # ${ndev} is 'real' interface name
238 # e.g.: if ${iface} is 'lan' (default LAN interface) then ${ndev} is 'br-lan'
239 network_get_device ndev
"${iface}"
240 [ -z "${ndev}" ] ||
break
242 logger
-t "${NAME}" -p daemon.crit \
243 "Missing network device for network interface '${iface}'!"
246 if [ -n "${iface}" ] ; then
247 logger
-t "${NAME}" -p daemon.info \
248 "Using network interface '${iface}' (network device '${ndev}') for direct binding"
251 while [ -z "${iface}" ] ; do
252 [ -n "${Interface}" ] ||
break
255 [ -z "${BOOT}" ] ||
return 0
257 case "${Interface}" in
259 warn_multiple_interfaces Interface
"${Interface}"
265 local DROPBEAR_MAX_PORTS
=10
268 for n
in ${Interface} ; do
269 [ -n "$n" ] ||
continue
272 network_get_ipaddrs_all if_ipaddrs
"$n"
273 [ -n "${if_ipaddrs}" ] ||
{
274 logger
-s -t "${NAME}" -p daemon.err \
275 "Network interface '$n' has no suitable IP address(es)!"
279 [ $c -le ${DROPBEAR_MAX_PORTS} ] ||
{
280 logger
-s -t "${NAME}" -p daemon.err \
281 "Network interface '$n' is NOT listened due to option limit exceed!"
285 for a
in ${if_ipaddrs} ; do
286 [ -n "$a" ] ||
continue
289 if [ $c -le ${DROPBEAR_MAX_PORTS} ] ; then
290 ipaddrs
="${ipaddrs} $a"
294 logger
-t "${NAME}" -p daemon.err \
295 "Endpoint '$a:${Port}' on network interface '$n' is NOT listened due to option limit exceed!"
301 PIDCOUNT
="$(( ${PIDCOUNT} + 1))"
302 local pid_file
="/var/run/${NAME}.${PIDCOUNT}.pid"
305 procd_set_param
command "$PROG" -F -P "$pid_file"
306 if [ -n "${iface}" ] ; then
307 # if ${iface} is non-empty then ${ndev} is non-empty too
308 procd_append_param
command -l "${ndev}" -p "${Port}"
310 if [ -z "${ipaddrs}" ] ; then
311 procd_append_param
command -p "${Port}"
314 for a
in ${ipaddrs} ; do
315 [ -n "$a" ] ||
continue
316 procd_append_param
command -p "$a:${Port}"
320 [ "${PasswordAuth}" -eq 0 ] && procd_append_param
command -s
321 [ "${GatewayPorts}" -eq 1 ] && procd_append_param
command -a
322 [ -n "${ForceCommand}" ] && procd_append_param
command -c "${ForceCommand}"
323 [ "${RootPasswordAuth}" -eq 0 ] && procd_append_param
command -g
324 [ "${RootLogin}" -eq 0 ] && procd_append_param
command -w
325 config_list_foreach
"$1" 'keyfile' hk_config__keyfile
326 if [ -n "${rsakeyfile}" ]; then
327 logger
-s -t "${NAME}" -p daemon.crit \
328 "Option 'rsakeyfile' is considered to be DEPRECATED and will be REMOVED in future releases, use 'keyfile' list instead"
329 sed -i.before-upgrade
-E -e 's/option(\s+)rsakeyfile/list keyfile/' \
330 "/etc/config/${NAME}"
331 logger
-s -t "${NAME}" -p daemon.crit \
332 "Auto-transition 'option rsakeyfile' => 'list keyfile' in /etc/config/${NAME} is done, please verify your configuration"
333 hk_config
'rsakeyfile' "${rsakeyfile}"
335 [ -n "${BannerFile}" ] && procd_append_param
command -b "${BannerFile}"
336 [ "${IdleTimeout}" -ne 0 ] && procd_append_param
command -I "${IdleTimeout}"
337 [ "${SSHKeepAlive}" -ne 0 ] && procd_append_param
command -K "${SSHKeepAlive}"
338 [ "${MaxAuthTries}" -ne 0 ] && procd_append_param
command -T "${MaxAuthTries}"
339 [ "${RecvWindowSize}" -gt 0 ] && {
340 # NB: OpenWrt increases receive window size to increase throughput on high latency links
341 # ref: validate_section_dropbear()
342 # default receive window size is 24576 (DEFAULT_RECV_WINDOW in default_options.h)
345 local MAX_RECV_WINDOW
=10485760
346 if [ "${RecvWindowSize}" -gt ${MAX_RECV_WINDOW} ] ; then
347 # separate logging is required because syslog misses dropbear's message
348 # Bad recv window '${RecvWindowSize}', using ${MAX_RECV_WINDOW}
349 # it's probably dropbear issue but we should handle this and notify user
350 logger
-s -t "${NAME}" -p daemon.warn \
351 "Option 'RecvWindowSize' is too high (${RecvWindowSize}), limiting to ${MAX_RECV_WINDOW}"
352 RecvWindowSize
=${MAX_RECV_WINDOW}
354 procd_append_param
command -W "${RecvWindowSize}"
356 [ "${mdns}" -ne 0 ] && procd_add_mdns
"ssh" "tcp" "$Port" "daemon=dropbear"
357 procd_set_param respawn
364 config_get
enable "$1" enable 1
365 [ "${enable}" = "1" ] ||
return 0
367 local direct_iface iface
368 config_get direct_iface
"$1" DirectInterface
369 direct_iface
=$
(normalize_list
"${direct_iface}")
370 # 'DirectInterface' takes precedence over 'Interface'
371 if [ -n "${direct_iface}" ] ; then
372 iface
=$
(echo "${direct_iface}" |
awk '{print $1}')
374 config_get iface
"$1" Interface
375 iface
=$
(normalize_list
"${iface}")
377 interfaces
="${interfaces} ${iface}"
388 hk_generate_as_needed
389 file_verify
/etc
/dropbear
/authorized_keys config
392 .
/lib
/functions
/network.sh
394 config_load
"${NAME}"
395 config_foreach validate_section_dropbear dropbear dropbear_instance
402 procd_add_config_trigger
"config.change" "${NAME}" /etc
/init.d
/dropbear reload
404 config_load
"${NAME}"
405 config_foreach load_interfaces
"${NAME}"
407 [ -n "${interfaces}" ] && {
409 for n
in $
(printf '%s\n' ${interfaces} |
sort -u) ; do
410 procd_add_interface_trigger
"interface.*" $n /etc
/init.d
/dropbear reload
414 procd_add_validation validate_section_dropbear
418 # close all open connections
428 # if this script is run from inside a client session, then ignore that session
430 while [ "${pid}" -ne 0 ]
432 # get parent process id
433 pid
=$
(cut
-d ' ' -f 4 "/proc/${pid}/stat")
434 [ "${pid}" -eq 0 ] && break
436 # check if client connection
437 grep -F -q -e "${PROG}" "/proc/${pid}/cmdline" && {
438 append ignore
"${pid}"
443 # get all server pids that should be ignored
444 for server
in $
(cat /var
/run
/${NAME}.
*.pid
)
446 append ignore
"${server}"
449 # get all running pids and kill client connections
451 for pid
in $
(pidof
"${NAME}")
453 # check if correct program, otherwise process next pid
454 grep -F -q -e "${PROG}" "/proc/${pid}/cmdline" ||
{
458 # check if pid should be ignored (servers, ourself)
460 for server
in ${ignore}
462 if [ "${pid}" = "${server}" ]
468 [ "${skip}" -ne 0 ] && continue
471 echo "${initscript}: Killing ${pid}..."