dropbear: add option to set max auth tries

[openwrt/openwrt.git] / package / network / services / dropbear / files / dropbear.init

diff --git a/package/network/services/dropbear/files/dropbear.init b/package/network/services/dropbear/files/dropbear.init
index 320a401e2e221efeccf7f9deb077a3e6c34e1d55..3d8cb2ca5e372121e3f1c29fa5aca3d49e6c5a10 100755 (executable)
--- a/package/network/services/dropbear/files/dropbear.init
+++ b/package/network/services/dropbear/files/dropbear.init
@@ -12,82 +12,82 @@ PIDCOUNT=0
 EXTRA_COMMANDS="killclients"
 EXTRA_HELP="   killclients Kill ${NAME} processes except servers and yourself"
 
-dropbear_instance()
+append_ports()
 {
-       append_ports()
-       {
-               local ifname="$1"
-               local port="$2"
-
-               grep -qs "^ *$ifname:" /proc/net/dev || {
-                       procd_append_param command -p "$port"
-                       return
-               }
+       local ipaddrs="$1"
+       local port="$2"
 
-               for addr in $(
-                       ifconfig "$ifname" | sed -ne '
-                               /addr: *fe[89ab][0-9a-f]:/d
-                               s/.* addr: *\([0-9a-f:\.]*\).*/\1/p
-                       '
-               ); do
-                       procd_append_param command -p "$addr:$port"
-               done
+       [ -z "$ipaddrs" ] && {
+               procd_append_param command -p "$port"
+               return
        }
 
+       for addr in $ipaddrs; do
+               procd_append_param command -p "$addr:$port"
+       done
+}
+
+validate_section_dropbear()
+{
+       uci_validate_section dropbear dropbear "${1}" \
+               'PasswordAuth:bool:1' \
+               'enable:bool:1' \
+               'Interface:string' \
+               'GatewayPorts:bool:0' \
+               'RootPasswordAuth:bool:1' \
+               'RootLogin:bool:1' \
+               'rsakeyfile:file' \
+               'BannerFile:file' \
+               'Port:list(port):22' \
+               'SSHKeepAlive:uinteger:300' \
+               'IdleTimeout:uinteger:0' \
+               'MaxAuthTries:uinteger:3' \
+               'mdns:bool:1'
+}
 
-       local section="$1"
+dropbear_instance()
+{
+       local PasswordAuth enable Interface GatewayPorts \
+               RootPasswordAuth RootLogin rsakeyfile \
+               BannerFile Port SSHKeepAlive IdleTimeout \
+               MaxAuthTries mdns ipaddrs
+
+       validate_section_dropbear "${1}" || {
+               echo "validation failed"
+               return 1
+       }
 
-       # check if section is enabled (default)
-       local enabled
-       config_get_bool enabled "${section}" enable 1
-       [ "${enabled}" -eq 0 ] && return 1
+       [ -n "${Interface}" ] && {
+               network_get_ipaddrs_all ipaddrs "${Interface}" || {
+                       echo "interface ${Interface} has no physdev or physdev has no suitable ip"
+                       return 1
+               }
+       }
 
-       # increase pid file count to handle multiple instances correctly
+       [ "${enable}" = "0" ] && return 1
        PIDCOUNT="$(( ${PIDCOUNT} + 1))"
-
        local pid_file="/var/run/${NAME}.${PIDCOUNT}.pid"
 
        procd_open_instance
        procd_set_param command "$PROG" -F -P "$pid_file"
-
-       # prepare parameters (initialise with pid file)
-       local val
-
-       # A) password authentication
-       config_get_bool val "${section}" PasswordAuth 1
-       [ "${val}" -eq 0 ] && procd_append_param command -s
-
-       # B) listen interface and port
-       local port
-       local interface
-       config_get interface "${section}" Interface
-       [ -n "$interface" ] && network_get_device interface "$interface"
-       config_get port "${section}" Port 22
-       append_ports "$interface" "$port"
-       # C) banner file
-       config_get val "${section}" BannerFile
-       [ -f "${val}" ] && procd_append_param command -b "${val}"
-       # D) gatewayports
-       config_get_bool val "${section}" GatewayPorts 0
-       [ "${val}" -eq 1 ] && procd_append_param command -a
-       # E) root password authentication
-       config_get_bool val "${section}" RootPasswordAuth 1
-       [ "${val}" -eq 0 ] && procd_append_param command -g
-       # F) root login
-       config_get_bool val "${section}" RootLogin 1
-       [ "${val}" -eq 0 ] && procd_append_param command -w
-       # G) host keys
-       config_get val "${section}" rsakeyfile
-       [ -f "${val}" ] && procd_append_param command -r "${val}"
-       config_get val "${section}" dsskeyfile
-       [ -f "${val}" ] && procd_append_param command -d "${val}"
-
+       [ "${PasswordAuth}" -eq 0 ] && procd_append_param command -s
+       [ "${GatewayPorts}" -eq 1 ] && procd_append_param command -a
+       [ "${RootPasswordAuth}" -eq 0 ] && procd_append_param command -g
+       [ "${RootLogin}" -eq 0 ] && procd_append_param command -w
+       [ -n "${rsakeyfile}" ] && procd_append_param command -r "${rsakeyfile}"
+       [ -n "${BannerFile}" ] && procd_append_param command -b "${BannerFile}"
+       append_ports "${ipaddrs}" "${Port}"
+       [ "${IdleTimeout}" -ne 0 ] && procd_append_param command -I "${IdleTimeout}"
+       [ "${SSHKeepAlive}" -ne 0 ] && procd_append_param command -K "${SSHKeepAlive}"
+       [ "${MaxAuthTries}" -ne 0 ] && procd_append_param command -T "${MaxAuthTries}"
+       [ "${mdns}" -ne 0 ] && procd_add_mdns "ssh" "tcp" "$Port" "daemon=dropbear"
+       procd_set_param respawn
        procd_close_instance
 }
 
 keygen()
 {
-       for keytype in rsa dss; do
+       for keytype in rsa; do
                # check for keys
                key=dropbear/dropbear_${keytype}_host_key
                [ -f /tmp/$key -o -s /etc/$key ] || {
@@ -108,10 +108,17 @@ keygen()
        chmod 0700 /etc/dropbear
 }
 
+load_interfaces()
+{
+       config_get interface "$1" Interface
+       config_get enable "$1" enable 1
+
+       [ "${enable}" = "1" ] && interfaces=" ${interface} ${interfaces}"
+}
+
 start_service()
 {
-       [ -s /etc/dropbear/dropbear_rsa_host_key -a \
-         -s /etc/dropbear/dropbear_dss_host_key ] || keygen
+       [ -s /etc/dropbear/dropbear_rsa_host_key ] || keygen
 
        . /lib/functions.sh
        . /lib/functions/network.sh
@@ -122,7 +129,20 @@ start_service()
 
 service_triggers()
 {
-       procd_add_reload_trigger "dropbear"
+       local interfaces
+
+       procd_add_config_trigger "config.change" "dropbear" /etc/init.d/dropbear reload
+
+       config_load "${NAME}"
+       config_foreach load_interfaces dropbear
+
+       [ -n "${interfaces}" ] && {
+               for n in $interfaces ; do
+                       procd_add_interface_trigger "interface.*" $n /etc/init.d/dropbear reload
+               done
+       }
+
+       procd_add_validation validate_section_dropbear
 }
 
 killclients()
@@ -165,7 +185,7 @@ killclients()
                skip=0
                for server in ${ignore}
                 do
-                       if [ "${pid}" == "${server}" ]
+                       if [ "${pid}" = "${server}" ]
                         then
                                skip=1
                                break