#! /bin/sh
+###
+### SSH forced-command script for establishing dynamic associations.
+###
+### (c) 2012 Mark Wooding
+###
+
+###----- Licensing notice ---------------------------------------------------
+###
+### This file is part of Trivial IP Encryption (TrIPE).
+###
+### TrIPE is free software: you can redistribute it and/or modify it under
+### the terms of the GNU General Public License as published by the Free
+### Software Foundation; either version 3 of the License, or (at your
+### option) any later version.
+###
+### TrIPE is distributed in the hope that it will be useful, but WITHOUT
+### ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+### FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+### for more details.
+###
+### You should have received a copy of the GNU General Public License
+### along with TrIPE. If not, see <https://www.gnu.org/licenses/>.
set -e
### This script performs the passive side of a dynamic association. It is
-### intended to be set as the `tripe' user's shell, and invoked via ssh(1).
-### Specifically, for each dynamic peer, add a line to `.ssh/authorized_keys'
-### of the form
+### intended to be set as the forced command in an `.ssh/authorized_keys'
+### file. Specifically, for each dynamic peer, add a line to
+### `.ssh/authorized_keys' of the form
###
-### command="PEER" ssh-rsa ...
+### environment="TRIPE_USER=PEER" ssh-rsa ...
###
### There's an additional wrinkle. Suppose that the passive TrIPE endpoint
### is behind a NAT, and the SSH gateway is on a different machine. The
### gateway should have its own `tripe' user, and this script should again be
### its shell. On the gateway, add a `.ssh/authorized_keys' entry
###
-### command="tripe@SERVER:PEER" ssh-rsa ...
+### environment="TRIPE_USER=tripe@SERVER:PEER" ssh-rsa ...
###
### for the dynamic endpoint. On the passive endpoint itself, you need an
-### entry for the gateway's `tripe' user's key, with no command.
+### entry for the gateway's `tripe' user's key, with `TRIPE_GATEWAY' set to
+### any value, like
+###
+### environment="TRIPE_GATEWAY=t" ssh-rsa ...
+###
+### For backwards compatibility, it can also be set as the `tripe' user's
+### shell, with the `[tripe@SERVER:]PEER' indicator set as the forced
+### command. If there are no forced command or `TRIPE_*' environment
+### variables then it is assumed that a gateway is calling.
: ${prefix=@prefix@} ${exec_prefix=@exec_prefix@}
: ${bindir=@bindir@}
: ${tripectl=$bindir/tripectl}
export TRIPEDIR TRIPESOCK
-case "$#,$1,$2" in
-
- 2,-c,*:*)
- ## Proxy through to another server.
- server=${2%:*} user=${2##*:}
- exec ssh "$server" "$user"
+## Make sure we're being called properly, and figure out the peer identity.
+case "${TRIPE_USER+t},${TRIPE_GATEWAY+t},$#,$1" in
+ t,,0,) set -- "$TRIPE_USER" ;;
+ ,t,0,) set -- $SSH_ORIGINAL_COMMAND; unset SSH_ORIGINAL_COMMAND ;;
+ ,,2,-c) ;;
+ *)
+ echo >&2 "usage: $0 -c [SERVER:]PEER [ACTION]"
+ exit 1
;;
+esac
- 2,-c,*)
- ## Connect to the local tripe server.
- exec $tripectl SVCSUBMIT connect passive "$2"
- ;;
+## Examine the peer identifier and work out how to proceed.
+case "$#,$1" in
+ 0,*) echo >&2 "missing peer identifier"; exit 1 ;;
+ *:*) mode=proxy server=${1%:*} user=${1##*:} ;;
+ *) mode=local user=$1 ;;
+esac
+shift
+## Fetch the optional command from where SSH stashed it.
+case "$#" in 0) set -- $SSH_ORIGINAL_COMMAND ;; esac
+case "$#,$1" in
+ 0, | 1,hello) act=hello ;;
+ 1,goodbye) act=goodbye ;;
+ *) echo >&2 "$0: unknown action spec \`$*'"; exit 1 ;;
+esac
+
+## Now actually do something.
+case "$mode,$act" in
+ proxy,*)
+ exec ssh "$server" "$user" "$act"
+ ;;
+ local,hello)
+ exec $tripectl SVCSUBMIT connect passive "$user"
+ ;;
+ local,goodbye)
+ peer=$($tripectl SVCSUBMIT connect userpeer "$user")
+ exec $tripectl KILL "$peer"
+ ;;
*)
- ## Anything else is an error.
- echo >&2 "usage: $0 -c [SERVER:]PEER"
+ echo >&2 "$0: unknown mode/action $mode/$act"
exit 1
;;
-
esac
~mdw / tripe / blobdiff