From 90e491a37ae946fe4d418637ba21995aa05a40b6 Mon Sep 17 00:00:00 2001 From: Nuno Goncalves Date: Tue, 5 Oct 2010 21:51:46 +0000 Subject: [PATCH] [packages] sshtunnel: update to version 2 SVN-Revision: 23263 --- net/sshtunnel/Makefile | 7 +- net/sshtunnel/files/etc/config/sshtunnel | 32 +++++-- net/sshtunnel/files/etc/init.d/sshtunnel | 111 ++++++++++++++++------- net/sshtunnel/files/usr/bin/sshtunnel.sh | 13 +-- 4 files changed, 112 insertions(+), 51 deletions(-) diff --git a/net/sshtunnel/Makefile b/net/sshtunnel/Makefile index daf16b21b9..8a53fc3160 100644 --- a/net/sshtunnel/Makefile +++ b/net/sshtunnel/Makefile @@ -8,21 +8,22 @@ include $(TOPDIR)/rules.mk PKG_NAME:=sshtunnel -PKG_VERSION:=1 -PKG_RELEASE:=1 +PKG_VERSION:=2 +PKG_RELEASE:=2 include $(INCLUDE_DIR)/package.mk define Package/sshtunnel SECTION:=net CATEGORY:=Network + SUBMENU:=SSH TITLE:=Manages Local and Remote openssh ssh(1) tunnels MAINTAINER:=Nuno Goncalves DEPENDS:=+openssh-client endef define Package/sshtunnel/description -Creates openssh ssh(1) Local and Remote tunnels configured in UCI file. Can be user to allow remote connections, possibly over NATed connections or without public IP/DNS +Creates openssh ssh(1) Local and Remote tunnels configured in UCI file. Can be used to allow remote connections, possibly over NATed connections or without public IP/DNS endef define Package/sshtunnel/conffiles diff --git a/net/sshtunnel/files/etc/config/sshtunnel b/net/sshtunnel/files/etc/config/sshtunnel index acfd9420fe..ce3af0f929 100644 --- a/net/sshtunnel/files/etc/config/sshtunnel +++ b/net/sshtunnel/files/etc/config/sshtunnel @@ -1,30 +1,44 @@ # -# only authentication supported is public key with indentity file specified +# password authentication is not possible, publick key authentication must be used. +# set "option IdentityFile" to he file from which the identity (private key) for RSA or DSA authentication is read. +# The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_rsa and ~/.ssh/id_dsa for protocol version 2. +# ssh will also try to load certificate information from the filename obtained by appending -cert.pub to identity filenames. # pkcs11 support soon # +config server disney + option user mourinho + option hostname server.disney.com +# option port 22 +# option retrydelay 1 +# option CheckHostIP yes +# option Compression no +# option CompressionLevel 6 +# option IdentityFile ~/.ssh/id_rsa +# option LogLevel INFO +# option ServerAliveCountMax 3 +# option ServerAliveInterval 0 +# option StrictHostKeyChecking ask +# option TCPKeepAlive yes +# option VerifyHostKeyDNS yes + + # tunnelR(emote) - when the connection will be initiated to the R(emote) endpoint at # remoteaddress:remoteport and then forward to localaddress:localport # config tunnelR http - option user mourinho - option hostname server.disney.com - option identity /root/.ssh/id_rsa + option server disney option remoteaddress * option remoteport 9009 option localaddress 192.168.1.13 option localport 80 - option options '-o ServerAliveCountMax=3 -o ServerAliveInterval=20 -o StrictHostKeyChecking=false' # tunnelL(ocal) - when the connection will be initiated to the L(ocal) endpoint at # localaddress:localport and then forward to remoteaddress:remoteport # config tunnelL test - option user mourinho - option hostname server.disney.com - option identity /root/.ssh/id_rsa + option server disney option localaddress * option localport 1022 option remoteaddress secretserver.disney.com option remoteport 22 - option options '-o ServerAliveCountMax=3 -o ServerAliveInterval=20 -o StrictHostKeyChecking=false' diff --git a/net/sshtunnel/files/etc/init.d/sshtunnel b/net/sshtunnel/files/etc/init.d/sshtunnel index 569d96fca6..53f653883e 100755 --- a/net/sshtunnel/files/etc/init.d/sshtunnel +++ b/net/sshtunnel/files/etc/init.d/sshtunnel @@ -5,40 +5,82 @@ STOP=01 PIDFILE="/tmp/run/sshtunnel" +load_server() { + server="$1" + + config_get user $1 user + config_get hostname $1 hostname + config_get debuglevel $1 debuglevel "0" + config_get retrydelay $1 retrydelay "10" + config_get CheckHostIP $1 CheckHostIP + config_get Compression $1 Compression + config_get CompressionLevel $1 CompressionLevel + config_get IdentityFile $1 IdentityFile + config_get LogLevel $1 LogLevel + config_get ServerAliveCountMax $1 ServerAliveCountMax + config_get ServerAliveInterval $1 ServerAliveInterval + config_get StrictHostKeyChecking $1 StrictHostKeyChecking + config_get TCPKeepAlive $1 TCPKeepAlive + config_get VerifyHostKeyDNS $1 VerifyHostKeyDNS + + error="" + [ -n "$user" ] || error="user is not set" + [ -n "$hostname" ] || error="${error:+$error; }hostname is not set" + [ "$retrydelay" -ge 0 ] || error="${error:+$error; }retrydelay must be a positive integer" + #[ -f "$IdentityFile" ] || error="${error:+$error; }IdentityFile $IdentityFile not accessible" + #add validation for the rest of the parameters + [ -n "$error" ] && { logger -p user.err -t "sshtunnel" "tunnels to $server not started - $error"; return; } + + tunnels_cmd="" + count=0 + config_foreach load_tunnel tunnelR && config_foreach load_tunnel tunnelL + [ -n "$error" ] && { logger -p user.err -t "sshtunnel" "tunnels to $server not started - $error"; return; } + [ "$count" -eq 0 ] && { logger -p user.err -t "sshtunnel" "tunnels to $server not started - no tunnels defined"; return; } + + cmd="${CheckHostIP:+-o CheckHostIP=$CheckHostIP }" + cmd="$cmd${CheckHostIP:+-o CheckHostIP=$CheckHostIP }" + cmd="$cmd${Compression:+-o Compression=$Compression }" + cmd="$cmd${CompressionLevel:+-o CompressionLevel=$CompressionLevel }" + cmd="$cmd${IdentityFile:+-o IdentityFile=$IdentityFile }" + cmd="$cmd${LogLevel:+-o LogLevel=$LogLevel }" + cmd="$cmd${ServerAliveCountMax:+-o ServerAliveCountMax=$ServerAliveCountMax }" + cmd="$cmd${ServerAliveInterval:+-o ServerAliveInterval=$ServerAliveInterval }" + cmd="$cmd${StrictHostKeyChecking:+-o StrictHostKeyChecking=$StrictHostKeyChecking }" + cmd="$cmd${TCPKeepAlive:+-o TCPKeepAlive=$TCPKeepAlive }" + cmd="$cmd${VerifyHostKeyDNS:+-o VerifyHostKeyDNS=$VerifyHostKeyDNS }" + cmd="$cmd""-o ExitOnForwardFailure=yes -o BatchMode=yes -nN $tunnels_cmd $user@$hostname" + + /usr/bin/sshtunnel.sh "$cmd" "$retrydelay" "$server" & + echo $! >> "$PIDFILE".pids + logger -p user.info -t "sshtunnel" "started tunnels to $server (pid=$!;retrydelay=$retrydelay)" +} + load_tunnel() { - config_get user $1 user - config_get hostname $1 hostname - config_get identity $1 identity - config_get remoteport $1 remoteport - config_get localport $1 localport - config_get options $1 options '-o ServerAliveCountMax=3 -o ServerAliveInterval=20 -o StrictHostKeyChecking=false' - config_get retrydelay $1 retrydelay "10" + config_get section_server $1 server + [ "$server" = "$section_server" ] || return 0 # continue to read next section if this is not for the current server + let count++ # count nr of valid sections to make sure there are at least one + + config_get remoteport $1 remoteport + config_get localport $1 localport [ "$cfgtype" = "tunnelL" ] && { - config_get localaddress $1 localaddress "127.0.0.1" - config_get remoteaddress $1 remoteaddress "*" + config_get localaddress $1 localaddress "*" + config_get remoteaddress $1 remoteaddress } [ "$cfgtype" = "tunnelR" ] && { - config_get localaddress $1 localaddress "*" - config_get remoteaddress $1 remoteaddress "127.0.0.1" + config_get localaddress $1 localaddress + config_get remoteaddress $1 remoteaddress "*" } - local error - [ -f "$identity" ] || error="Identity file $identity not accessible" - [ -n "$user" ] || error="please set user option" - [ -n "$hostname" ] || error="please set hostname option" - [ "$remoteport" -gt 0 -a "$localport" -gt 0 -a "$retrydelay" -ge 0 ] || error="invalid configuration" - [ -n "$error" ] && { logger -p user.err -t "sshtunnel" "$cfgtype $1 not started - $error"; return; } + [ "$remoteport" -gt 0 ] || error="remoteport must be a positive integer" + [ "$localport" -gt 0 ] || error="${error:+$error; }localpost must be a positive integer" + [ -n "$error" ] && return 1 [ "$cfgtype" = "tunnelL" ] && { - args="-N -i $identity -o PasswordAuthentication=no -o ExitOnForwardFailure=yes $options -L $localaddress:$localport:$remoteaddress:$remoteport $user@$hostname" + tunnels_cmd="${tunnels_cmd:+$tunnels_cmd }-L $localaddress:$localport:$remoteaddress:$remoteport" } [ "$cfgtype" = "tunnelR" ] && { - args="-N -i $identity -o PasswordAuthentication=no -o ExitOnForwardFailure=yes $options -R $remoteaddress:$remoteport:$localaddress:$localport $user@$hostname" + tunnels_cmd="${tunnels_cmd:+$tunnels_cmd }-R $remoteaddress:$remoteport:$localaddress:$localport" } - - /usr/bin/sshtunnel.sh "$args" "$retrydelay" & - echo $! >> "$PIDFILE".pids - logger -p user.info -t "sshtunnel" "started new $cfgtype $1 (pid=$!;retrydelay=$retrydelay)" } stop() { @@ -51,10 +93,11 @@ stop() { start-stop-daemon -K -p "$PIDFILE"_"$pid".pid kill $pid logger -p daemon.info -t "sshtunnel[$pid]" "tunnel stopped" + rm "$PIDFILE"_"$pid".pid done < "$PIDFILE".pids - - rm "$PIDFILE".pids - + + rm "$PIDFILE".pids + logger -p user.info -t "sshtunnel" "all tunnels stopped" else logger -p user.info -t "sshtunnel" "no tunnels running" @@ -64,11 +107,13 @@ stop() { start() { [ -f "$PIDFILE".pids ] && stop - logger -p user.info -t "sshtunnel" "starting all tunnels" - - config_load sshtunnel - config_foreach load_tunnel tunnelR - config_foreach load_tunnel tunnelL - - logger -p user.info -t "sshtunnel" "all tunnels started" + config_load sshtunnel + if [ -n "$(uci show sshtunnel.@server[0])" ] # at least one server section exists + then + logger -p user.info -t "sshtunnel" "starting all tunnels" + config_foreach load_server server + logger -p user.info -t "sshtunnel" "all tunnels started" + else + logger -p user.info -t "sshtunnel" "no servers defined" + fi } diff --git a/net/sshtunnel/files/usr/bin/sshtunnel.sh b/net/sshtunnel/files/usr/bin/sshtunnel.sh index eccf07c3fb..77a8d6fc01 100755 --- a/net/sshtunnel/files/usr/bin/sshtunnel.sh +++ b/net/sshtunnel/files/usr/bin/sshtunnel.sh @@ -2,18 +2,19 @@ PIDFILE="/tmp/run/sshtunnel" -args=$1 -retrydelay=$2 +args="$1" +retrydelay="$2" +server="$3" while true do - logger -p daemon.info -t "sshtunnel[$$]" "connecting: ssh $args" + logger -p daemon.info -t "sshtunnel[$$][$server]" "connection started" start-stop-daemon -S -p "$PIDFILE"_"$$".pid -mx ssh -- $args &>/tmp/log/sshtunnel_$$ - logger -p daemon.err -t "sshtunnel[$$]" < /tmp/log/sshtunnel_$$ - rm /tmp/log/sshtunnel_$$ - logger -p daemon.info -t "sshtunnel[$$]" "ssh exited with code $?, retrying in $retrydelay seconds" + logger -p daemon.err -t "sshtunnel[$$][$server]" < /tmp/log/sshtunnel_$$ + rm /tmp/log/sshtunnel_$$ + logger -p daemon.info -t "sshtunnel[$$][$server]" "ssh exited with code $?, retrying in $retrydelay seconds" sleep "$retrydelay" & wait done -- 2.30.2