[packages] sshtunnel: update to version 2
authorNuno Goncalves <nunojpg@gmail.com>
Tue, 5 Oct 2010 21:51:46 +0000 (21:51 +0000)
committerNuno Goncalves <nunojpg@gmail.com>
Tue, 5 Oct 2010 21:51:46 +0000 (21:51 +0000)
SVN-Revision: 23263

net/sshtunnel/Makefile
net/sshtunnel/files/etc/config/sshtunnel
net/sshtunnel/files/etc/init.d/sshtunnel
net/sshtunnel/files/usr/bin/sshtunnel.sh

index daf16b2..8a53fc3 100644 (file)
@@ -8,21 +8,22 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sshtunnel
-PKG_VERSION:=1
-PKG_RELEASE:=1
+PKG_VERSION:=2
+PKG_RELEASE:=2
 
 include $(INCLUDE_DIR)/package.mk
 
 define Package/sshtunnel
   SECTION:=net
   CATEGORY:=Network
+  SUBMENU:=SSH
   TITLE:=Manages Local and Remote openssh ssh(1) tunnels
   MAINTAINER:=Nuno Goncalves <nunojpg@gmail.com>
   DEPENDS:=+openssh-client
 endef
 
 define Package/sshtunnel/description
-Creates openssh ssh(1) Local and Remote tunnels configured in UCI file. Can be user to allow remote connections, possibly over NATed connections or without public IP/DNS
+Creates openssh ssh(1) Local and Remote tunnels configured in UCI file. Can be used to allow remote connections, possibly over NATed connections or without public IP/DNS
 endef
 
 define Package/sshtunnel/conffiles
index acfd942..ce3af0f 100644 (file)
@@ -1,30 +1,44 @@
 #
-# only authentication supported is public key with indentity file specified
+# password authentication is not possible, publick key authentication must be used.
+# set "option IdentityFile" to he file from which the identity (private key) for RSA or DSA authentication is read.  
+# The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_rsa and ~/.ssh/id_dsa for protocol version 2.
+# ssh will also try to load certificate information from the filename obtained by appending -cert.pub to identity filenames.
 # pkcs11 support soon
 #
 
+config server disney
+       option user                     mourinho
+       option hostname                 server.disney.com
+#      option port                     22
+#      option retrydelay               1       
+#      option CheckHostIP              yes
+#      option Compression              no
+#      option CompressionLevel         6
+#      option IdentityFile             ~/.ssh/id_rsa
+#      option LogLevel                 INFO
+#      option ServerAliveCountMax      3
+#      option ServerAliveInterval      0
+#      option StrictHostKeyChecking    ask
+#      option TCPKeepAlive             yes
+#      option VerifyHostKeyDNS         yes
+
+
 # tunnelR(emote) - when the connection will be initiated to the R(emote) endpoint at
 # remoteaddress:remoteport and then forward to localaddress:localport
 #
 config tunnelR http
-       option user             mourinho
-       option hostname         server.disney.com
-       option identity         /root/.ssh/id_rsa
+       option server           disney
        option remoteaddress    *
        option remoteport       9009
        option localaddress     192.168.1.13
        option localport        80
-       option options          '-o ServerAliveCountMax=3 -o ServerAliveInterval=20 -o StrictHostKeyChecking=false'
 
 # tunnelL(ocal) - when the connection will be initiated to the L(ocal) endpoint at
 # localaddress:localport and then forward to remoteaddress:remoteport 
 #
 config tunnelL test
-       option user             mourinho
-       option hostname         server.disney.com
-       option identity         /root/.ssh/id_rsa
+       option server           disney
        option localaddress     *
        option localport        1022
        option remoteaddress    secretserver.disney.com
        option remoteport       22
-       option options          '-o ServerAliveCountMax=3 -o ServerAliveInterval=20 -o StrictHostKeyChecking=false'
index 569d96f..53f6538 100755 (executable)
@@ -5,40 +5,82 @@ STOP=01
 
 PIDFILE="/tmp/run/sshtunnel"
 
+load_server() {
+       server="$1"
+
+       config_get user         $1 user
+       config_get hostname     $1 hostname
+       config_get debuglevel   $1 debuglevel   "0"
+       config_get retrydelay   $1 retrydelay   "10"
+       config_get CheckHostIP  $1 CheckHostIP
+       config_get Compression  $1 Compression
+       config_get CompressionLevel     $1 CompressionLevel
+       config_get IdentityFile         $1 IdentityFile
+       config_get LogLevel             $1 LogLevel
+       config_get ServerAliveCountMax  $1 ServerAliveCountMax
+       config_get ServerAliveInterval  $1 ServerAliveInterval
+       config_get StrictHostKeyChecking $1 StrictHostKeyChecking
+       config_get TCPKeepAlive         $1 TCPKeepAlive
+       config_get VerifyHostKeyDNS     $1 VerifyHostKeyDNS
+       
+       error=""
+        [ -n "$user" ]                 || error="user is not set"                                                                       
+        [ -n "$hostname" ]     || error="${error:+$error; }hostname is not set"                                                    
+        [ "$retrydelay" -ge 0 ]        || error="${error:+$error; }retrydelay must be a positive integer"
+       #[ -f "$IdentityFile" ]         || error="${error:+$error; }IdentityFile $IdentityFile not accessible"
+       #add validation for the rest of the parameters  
+       [ -n "$error" ] && { logger -p user.err -t "sshtunnel" "tunnels to $server not started - $error"; return; }
+        
+        tunnels_cmd=""
+       count=0
+        config_foreach load_tunnel tunnelR && config_foreach load_tunnel tunnelL
+       [ -n "$error" ] && { logger -p user.err -t "sshtunnel" "tunnels to $server not started - $error"; return; }
+       [ "$count" -eq 0 ] && { logger -p user.err -t "sshtunnel" "tunnels to $server not started - no tunnels defined"; return; }
+
+       cmd="${CheckHostIP:+-o CheckHostIP=$CheckHostIP }"
+       cmd="$cmd${CheckHostIP:+-o CheckHostIP=$CheckHostIP }"
+       cmd="$cmd${Compression:+-o Compression=$Compression }"
+       cmd="$cmd${CompressionLevel:+-o CompressionLevel=$CompressionLevel }"
+       cmd="$cmd${IdentityFile:+-o IdentityFile=$IdentityFile }"
+       cmd="$cmd${LogLevel:+-o LogLevel=$LogLevel }"
+       cmd="$cmd${ServerAliveCountMax:+-o ServerAliveCountMax=$ServerAliveCountMax }"
+       cmd="$cmd${ServerAliveInterval:+-o ServerAliveInterval=$ServerAliveInterval }"
+       cmd="$cmd${StrictHostKeyChecking:+-o StrictHostKeyChecking=$StrictHostKeyChecking }"
+       cmd="$cmd${TCPKeepAlive:+-o TCPKeepAlive=$TCPKeepAlive }"
+       cmd="$cmd${VerifyHostKeyDNS:+-o VerifyHostKeyDNS=$VerifyHostKeyDNS }"
+       cmd="$cmd""-o ExitOnForwardFailure=yes -o BatchMode=yes -nN $tunnels_cmd $user@$hostname"
+
+       /usr/bin/sshtunnel.sh "$cmd" "$retrydelay" "$server" &
+       echo $! >> "$PIDFILE".pids
+       logger -p user.info -t "sshtunnel" "started tunnels to $server (pid=$!;retrydelay=$retrydelay)" 
+}
+
 load_tunnel() {
-       config_get user $1 user
-       config_get hostname $1 hostname
-       config_get identity $1 identity
-       config_get remoteport $1 remoteport
-       config_get localport $1 localport
-       config_get options $1 options '-o ServerAliveCountMax=3 -o ServerAliveInterval=20 -o StrictHostKeyChecking=false'
-       config_get retrydelay $1 retrydelay "10"
+       config_get section_server $1 server
+       [ "$server" = "$section_server" ] || return 0 # continue to read next section if this is not for the current server
+       let count++ # count nr of valid sections to make sure there are at least one
+
+       config_get remoteport   $1 remoteport
+       config_get localport    $1 localport
        [ "$cfgtype" = "tunnelL" ] && {
-               config_get localaddress $1 localaddress "127.0.0.1"
-               config_get remoteaddress $1 remoteaddress "*"
+               config_get localaddress $1 localaddress "*"
+               config_get remoteaddress $1 remoteaddress
        }
        [ "$cfgtype" = "tunnelR" ] && {
-               config_get localaddress $1 localaddress "*"
-               config_get remoteaddress $1 remoteaddress "127.0.0.1"
+               config_get localaddress $1 localaddress
+               config_get remoteaddress $1 remoteaddress "*" 
        }
 
-       local error
-       [ -f "$identity" ]      || error="Identity file $identity not accessible"
-        [ -n "$user" ]                 || error="please set user option"                                                                       
-        [ -n "$hostname" ]     || error="please set hostname option"                                                    
-        [ "$remoteport" -gt 0 -a "$localport" -gt 0 -a "$retrydelay" -ge 0 ]   || error="invalid configuration"
-       [ -n "$error" ] && { logger -p user.err -t "sshtunnel" "$cfgtype $1 not started - $error"; return; }
+        [ "$remoteport" -gt 0 ] || error="remoteport must be a positive integer"                                                                       
+        [ "$localport" -gt 0 ]         || error="${error:+$error; }localpost must be a positive integer"
+       [ -n "$error" ] && return 1
 
        [ "$cfgtype" = "tunnelL" ] && {
-               args="-N -i $identity -o PasswordAuthentication=no -o ExitOnForwardFailure=yes $options -L $localaddress:$localport:$remoteaddress:$remoteport $user@$hostname"
+               tunnels_cmd="${tunnels_cmd:+$tunnels_cmd }-L $localaddress:$localport:$remoteaddress:$remoteport"
        }
        [ "$cfgtype" = "tunnelR" ] && {
-               args="-N -i $identity -o PasswordAuthentication=no -o ExitOnForwardFailure=yes $options -R $remoteaddress:$remoteport:$localaddress:$localport $user@$hostname"
+               tunnels_cmd="${tunnels_cmd:+$tunnels_cmd }-R $remoteaddress:$remoteport:$localaddress:$localport"
        }
-       
-       /usr/bin/sshtunnel.sh "$args" "$retrydelay" &
-       echo $! >> "$PIDFILE".pids
-       logger -p user.info -t "sshtunnel" "started new $cfgtype $1 (pid=$!;retrydelay=$retrydelay)" 
 }
 
 stop() {
@@ -51,10 +93,11 @@ stop() {
                        start-stop-daemon -K -p "$PIDFILE"_"$pid".pid
                        kill $pid
                        logger -p daemon.info -t "sshtunnel[$pid]" "tunnel stopped"
+                       rm "$PIDFILE"_"$pid".pid
                done < "$PIDFILE".pids
-                
-                rm "$PIDFILE".pids
-                
+
+               rm "$PIDFILE".pids
+
                 logger -p user.info -t "sshtunnel" "all tunnels stopped"
         else
                 logger -p user.info -t "sshtunnel" "no tunnels running"
@@ -64,11 +107,13 @@ stop() {
 start() {
         [ -f "$PIDFILE".pids ] && stop
         
-        logger -p user.info -t "sshtunnel" "starting all tunnels"
-        
-        config_load sshtunnel
-        config_foreach load_tunnel tunnelR
-        config_foreach load_tunnel tunnelL
-       
-        logger -p user.info -t "sshtunnel" "all tunnels started"
+       config_load sshtunnel
+       if [ -n "$(uci show sshtunnel.@server[0])" ] # at least one server section exists
+       then        
+               logger -p user.info -t "sshtunnel" "starting all tunnels"
+               config_foreach load_server server       
+               logger -p user.info -t "sshtunnel" "all tunnels started"        
+       else
+               logger -p user.info -t "sshtunnel" "no servers defined"
+       fi
 }
index eccf07c..77a8d6f 100755 (executable)
@@ -2,18 +2,19 @@
 
 PIDFILE="/tmp/run/sshtunnel"
 
-args=$1
-retrydelay=$2
+args="$1"
+retrydelay="$2"
+server="$3"
 
 while true
 do
-       logger -p daemon.info -t "sshtunnel[$$]" "connecting: ssh $args"
+       logger -p daemon.info -t "sshtunnel[$$][$server]" "connection started"
        
        start-stop-daemon -S -p "$PIDFILE"_"$$".pid -mx ssh -- $args &>/tmp/log/sshtunnel_$$ 
-       logger -p daemon.err -t "sshtunnel[$$]" < /tmp/log/sshtunnel_$$
-       rm /tmp/log/sshtunnel_$$
        
-       logger -p daemon.info -t "sshtunnel[$$]" "ssh exited with code $?, retrying in $retrydelay seconds"
+       logger -p daemon.err -t "sshtunnel[$$][$server]" < /tmp/log/sshtunnel_$$
+       rm /tmp/log/sshtunnel_$$
+       logger -p daemon.info -t "sshtunnel[$$][$server]" "ssh exited with code $?, retrying in $retrydelay seconds"
        
        sleep "$retrydelay" & wait
 done