+39
-173
@@ -1,185 +1,51 @@
|
||||
#!/bin/sh
|
||||
# sish-client: environment-driven connector for a sish edge.
|
||||
# Claims hostnames on the edge via SSH reverse forwards and relays them to local
|
||||
# targets. Reconnects forever with exponential backoff. See README.md.
|
||||
# Opens SSH reverse tunnels to a sish edge and reconnects forever. See README.md.
|
||||
set -eu
|
||||
set -f # routes may contain wildcards (*.example.com); never glob-expand them
|
||||
set -f # no globbing: routes may contain wildcards (*.example.com)
|
||||
|
||||
ESC=$(printf '\033')
|
||||
die() { echo "sish-client: $*" >&2; exit 64; }
|
||||
|
||||
log() { printf '%s sish-client: %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$*"; }
|
||||
die() { log "error: $*"; exit 64; }
|
||||
is_true() {
|
||||
case "$(printf '%s' "$1" | tr 'A-Z' 'a-z')" in
|
||||
1 | true | yes | on) return 0 ;;
|
||||
*) return 1 ;;
|
||||
esac
|
||||
}
|
||||
is_uint() { case "$1" in '' | *[!0-9]*) return 1 ;; *) return 0 ;; esac; }
|
||||
: "${SISH_HOST:?is required}" "${SISH_HOST_KEY:?is required}" "${SISH_ROUTES:?is required}"
|
||||
SNI_PROXY=${SISH_SNI_PROXY:-true}
|
||||
PROXY_PROTOCOL=${SISH_PROXY_PROTOCOL:-2}
|
||||
KEY=${SISH_KEY_FILE:-/secrets/id_ed25519}
|
||||
|
||||
# --- configuration -----------------------------------------------------------
|
||||
case $SNI_PROXY in true | false) ;; *) die "SISH_SNI_PROXY must be true or false" ;; esac
|
||||
case $PROXY_PROTOCOL in 1 | 2 | off) ;; *) die "SISH_PROXY_PROTOCOL must be 1, 2 or off" ;; esac
|
||||
[ -r "$KEY" ] || die "cannot read private key $KEY"
|
||||
|
||||
SISH_HOST=${SISH_HOST:-}
|
||||
SISH_PORT=${SISH_PORT:-2222}
|
||||
SISH_USER=${SISH_USER:-connector}
|
||||
SISH_KEY=${SISH_KEY:-}
|
||||
SISH_KEY_FILE=${SISH_KEY_FILE:-/secrets/id_ed25519}
|
||||
SISH_HOST_KEY=${SISH_HOST_KEY:-}
|
||||
SISH_KNOWN_HOSTS_FILE=${SISH_KNOWN_HOSTS_FILE:-}
|
||||
SISH_STRICT_HOST_KEY=${SISH_STRICT_HOST_KEY:-true}
|
||||
# Pin the edge host key: the only entry ssh will trust. A newline would allow
|
||||
# extra known_hosts lines (e.g. a wildcard entry), so the key must be one line.
|
||||
case $SISH_HOST_KEY in *'
|
||||
'*) die "SISH_HOST_KEY must be a single line" ;; esac
|
||||
KNOWN_HOSTS=$(mktemp) # private 0600 file with a random name, safe in a shared /tmp
|
||||
printf 'sish-edge %s\n' "$SISH_HOST_KEY" > "$KNOWN_HOSTS"
|
||||
|
||||
ROUTES=${ROUTES:-}
|
||||
ROUTES_FILE=${ROUTES_FILE:-}
|
||||
TARGET=${TARGET:-}
|
||||
DEFAULT_BIND_PORT=${DEFAULT_BIND_PORT:-443}
|
||||
|
||||
SNI_PROXY=${SNI_PROXY:-true}
|
||||
PROXY_PROTOCOL=${PROXY_PROTOCOL:-2}
|
||||
|
||||
KEEPALIVE_INTERVAL=${KEEPALIVE_INTERVAL:-15}
|
||||
CONNECT_TIMEOUT=${CONNECT_TIMEOUT:-10}
|
||||
BACKOFF_MIN=${BACKOFF_MIN:-2}
|
||||
BACKOFF_MAX=${BACKOFF_MAX:-60}
|
||||
SSH_EXTRA_OPTS=${SSH_EXTRA_OPTS:-}
|
||||
STATE_DIR=${STATE_DIR:-/tmp/sish-client}
|
||||
|
||||
[ -n "$SISH_HOST" ] || die "SISH_HOST is required"
|
||||
for v in SISH_PORT DEFAULT_BIND_PORT KEEPALIVE_INTERVAL CONNECT_TIMEOUT BACKOFF_MIN BACKOFF_MAX; do
|
||||
eval "val=\$$v"
|
||||
is_uint "$val" || die "$v must be a non-negative integer (got '$val')"
|
||||
# host:bind-port=target:port -> -R host:bind-port:target:port
|
||||
# Each route stays a single argument to -R, so it cannot inject ssh options.
|
||||
forwards=""
|
||||
for r in $(printf '%s' "$SISH_ROUTES" | tr , ' '); do
|
||||
case $r in *=*) ;; *) die "bad route '$r', expected host:port=target:port" ;; esac
|
||||
forwards="$forwards -R ${r%%=*}:${r#*=}"
|
||||
done
|
||||
case "$PROXY_PROTOCOL" in 1 | 2 | off | none | false | 0) ;; *) die "PROXY_PROTOCOL must be 1, 2 or off" ;; esac
|
||||
[ -n "$forwards" ] || die "SISH_ROUTES contains no routes"
|
||||
|
||||
umask 077
|
||||
mkdir -p "$STATE_DIR" || die "STATE_DIR $STATE_DIR is not writable (mount a tmpfs on /tmp with a read-only root fs)"
|
||||
READY_FILE=$STATE_DIR/ready
|
||||
FIFO=$STATE_DIR/ssh.out
|
||||
KEY=$STATE_DIR/id_key
|
||||
KNOWN_HOSTS=$STATE_DIR/known_hosts
|
||||
rm -f "$READY_FILE"
|
||||
# sish session options, sent as the remote command
|
||||
opts=""
|
||||
if [ "$SNI_PROXY" = true ]; then opts="sni-proxy=true"; fi
|
||||
if [ "$PROXY_PROTOCOL" != off ]; then opts="$opts proxy-protocol=$PROXY_PROTOCOL"; fi
|
||||
|
||||
# --- private key: always copied so ssh sees a private 0600 file we own -------
|
||||
|
||||
if [ -n "$SISH_KEY" ]; then
|
||||
printf '%s\n' "$SISH_KEY" > "$KEY"
|
||||
elif [ -r "$SISH_KEY_FILE" ]; then
|
||||
cat "$SISH_KEY_FILE" > "$KEY"
|
||||
else
|
||||
die "no private key: set SISH_KEY or mount a readable key at SISH_KEY_FILE ($SISH_KEY_FILE)"
|
||||
fi
|
||||
chmod 600 "$KEY"
|
||||
|
||||
# --- host key verification ---------------------------------------------------
|
||||
|
||||
HOST_KEY_OPTS=""
|
||||
if [ -n "$SISH_HOST_KEY" ]; then
|
||||
printf 'sish-edge %s\n' "$SISH_HOST_KEY" > "$KNOWN_HOSTS"
|
||||
HOST_KEY_OPTS="-o HostKeyAlias=sish-edge -o UserKnownHostsFile=$KNOWN_HOSTS -o StrictHostKeyChecking=yes"
|
||||
elif [ -n "$SISH_KNOWN_HOSTS_FILE" ]; then
|
||||
[ -r "$SISH_KNOWN_HOSTS_FILE" ] || die "SISH_KNOWN_HOSTS_FILE $SISH_KNOWN_HOSTS_FILE is not readable"
|
||||
HOST_KEY_OPTS="-o UserKnownHostsFile=$SISH_KNOWN_HOSTS_FILE -o StrictHostKeyChecking=yes"
|
||||
elif is_true "$SISH_STRICT_HOST_KEY"; then
|
||||
die "no host key: set SISH_HOST_KEY (e.g. 'ssh-ed25519 AAAA...') or SISH_KNOWN_HOSTS_FILE"
|
||||
else
|
||||
log "WARNING: host key verification disabled (SISH_STRICT_HOST_KEY=false)"
|
||||
HOST_KEY_OPTS="-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
|
||||
fi
|
||||
|
||||
# --- routes ------------------------------------------------------------------
|
||||
# Entry: <host>[:<bind-port>][=<target-host>:<target-port>]
|
||||
# Without "=target", TARGET is used. Bind port defaults to DEFAULT_BIND_PORT.
|
||||
|
||||
route_entries() {
|
||||
{
|
||||
printf '%s\n' "$ROUTES" | tr ', ' '\n\n'
|
||||
if [ -n "$ROUTES_FILE" ]; then
|
||||
[ -r "$ROUTES_FILE" ] || die "ROUTES_FILE $ROUTES_FILE is not readable"
|
||||
sed 's/#.*//' "$ROUTES_FILE" | tr ', \t' '\n\n\n'
|
||||
fi
|
||||
} | sed '/^[[:space:]]*$/d'
|
||||
}
|
||||
|
||||
FORWARDS=""
|
||||
ROUTE_COUNT=0
|
||||
for entry in $(route_entries); do
|
||||
case "$entry" in
|
||||
*=*) bind=${entry%%=*} target=${entry#*=} ;;
|
||||
*) bind=$entry target=$TARGET ;;
|
||||
esac
|
||||
[ -n "$target" ] || die "route '$entry' has no target and TARGET is not set"
|
||||
case "$target" in *:*) ;; *) die "target '$target' of route '$entry' must be host:port" ;; esac
|
||||
case "$bind" in *:*) ;; *) bind="$bind:$DEFAULT_BIND_PORT" ;; esac
|
||||
FORWARDS="$FORWARDS -R $bind:$target"
|
||||
ROUTE_COUNT=$((ROUTE_COUNT + 1))
|
||||
log "route: $bind -> $target"
|
||||
done
|
||||
[ "$ROUTE_COUNT" -gt 0 ] || die "no routes: set ROUTES and/or ROUTES_FILE"
|
||||
|
||||
# --- sish session options (sent as the remote "command") ---------------------
|
||||
|
||||
REMOTE_CMD=""
|
||||
is_true "$SNI_PROXY" && REMOTE_CMD="$REMOTE_CMD sni-proxy=true"
|
||||
case "$PROXY_PROTOCOL" in 1 | 2) REMOTE_CMD="$REMOTE_CMD proxy-protocol=$PROXY_PROTOCOL" ;; esac
|
||||
|
||||
SSH_OPTS="-T -p $SISH_PORT -i $KEY
|
||||
-o IdentitiesOnly=yes -o BatchMode=yes -o LogLevel=ERROR
|
||||
-o ExitOnForwardFailure=yes
|
||||
-o ConnectTimeout=$CONNECT_TIMEOUT
|
||||
-o ServerAliveInterval=$KEEPALIVE_INTERVAL -o ServerAliveCountMax=3
|
||||
$HOST_KEY_OPTS $SSH_EXTRA_OPTS"
|
||||
|
||||
# --- run loop ----------------------------------------------------------------
|
||||
|
||||
SSH_PID=""
|
||||
shutdown() {
|
||||
log "received signal, shutting down"
|
||||
rm -f "$READY_FILE"
|
||||
[ -n "$SSH_PID" ] && kill "$SSH_PID" 2>/dev/null
|
||||
exit 0
|
||||
}
|
||||
trap shutdown TERM INT
|
||||
|
||||
# Runs one ssh session. Marks ready once sish confirmed every forward.
|
||||
WAS_READY=0
|
||||
run_once() {
|
||||
WAS_READY=0
|
||||
rm -f "$READY_FILE" "$FIFO"
|
||||
mkfifo "$FIFO"
|
||||
# shellcheck disable=SC2086 # word splitting of option strings is intended
|
||||
ssh $SSH_OPTS $FORWARDS "$SISH_USER@$SISH_HOST" $REMOTE_CMD > "$FIFO" 2>&1 &
|
||||
SSH_PID=$!
|
||||
confirmed=0
|
||||
while IFS= read -r line; do
|
||||
line=$(printf '%s' "$line" | sed "s/${ESC}\[[0-9;]*m//g; s/\r\$//")
|
||||
[ -n "$line" ] || continue
|
||||
log "edge: $line"
|
||||
case "$line" in
|
||||
*"Starting SSH Forwarding service"*)
|
||||
confirmed=$((confirmed + 1))
|
||||
if [ "$confirmed" -ge "$ROUTE_COUNT" ] && [ "$WAS_READY" -eq 0 ]; then
|
||||
WAS_READY=1
|
||||
: > "$READY_FILE"
|
||||
log "ready: $confirmed/$ROUTE_COUNT forward(s) active"
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
done < "$FIFO"
|
||||
rc=0
|
||||
wait "$SSH_PID" || rc=$?
|
||||
SSH_PID=""
|
||||
rm -f "$READY_FILE" "$FIFO"
|
||||
return "$rc"
|
||||
}
|
||||
|
||||
delay=$BACKOFF_MIN
|
||||
# -F /dev/null: ignore all ssh_config files, every option is set here.
|
||||
# The server can only open channels for the forwards requested above; agent and
|
||||
# X11 forwarding are off by default.
|
||||
while :; do
|
||||
log "connecting to $SISH_USER@$SISH_HOST:$SISH_PORT ($ROUTE_COUNT route(s))"
|
||||
rc=0
|
||||
run_once || rc=$?
|
||||
[ "$WAS_READY" -eq 1 ] && delay=$BACKOFF_MIN
|
||||
log "tunnel closed (exit $rc), reconnecting in ${delay}s"
|
||||
sleep "$delay" &
|
||||
wait $! || true
|
||||
delay=$((delay * 2))
|
||||
[ "$delay" -le "$BACKOFF_MAX" ] || delay=$BACKOFF_MAX
|
||||
# shellcheck disable=SC2086 # $forwards and $opts are split on purpose
|
||||
ssh -F /dev/null -T -p "${SISH_PORT:-2222}" -i "$KEY" \
|
||||
-o BatchMode=yes -o IdentitiesOnly=yes -o ExitOnForwardFailure=yes \
|
||||
-o ServerAliveInterval=15 -o ServerAliveCountMax=3 \
|
||||
-o HostKeyAlias=sish-edge -o StrictHostKeyChecking=yes \
|
||||
-o UserKnownHostsFile="$KNOWN_HOSTS" -o GlobalKnownHostsFile=/dev/null \
|
||||
$forwards "connector@$SISH_HOST" $opts \
|
||||
|| echo "sish-client: ssh exited ($?), reconnecting in 5s" >&2
|
||||
sleep 5
|
||||
done
|
||||
|
||||
Reference in New Issue
Block a user