fix: daemon hang, postinst mkdir, hub key authorization, boot persistence
SPK daemon fixes (x5925 testing feedback): - register_with_hub: added --max-time 15 to prevent indefinite hang - Removed bash 'local' keyword for busybox ash compatibility - postinst: mkdir -p /usr/local/bin before copying Tailscale binaries - postinst: chmod +x all bin/*.sh (fixes 644 execute bit bug) - Added x5925-boot.sh for reboot persistence (stopgap until daemon fixed) Hub security hardening: - Added POST /api/authorize-key endpoint with device_id + pubkey - Keys auto-authorized with restrict,port-forwarding,permitlisten="<port>" - No shell access allowed — only tunnel forwarding to assigned port - Server.py updated with input validation on key format - register.sh --authorize-key subcommand for secure key management GL daemon: same --max-time fix applied for curl timeout Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Regular → Executable
+18
-11
@@ -91,7 +91,7 @@ start_tailscale() {
|
||||
--accept-routes=false \
|
||||
--accept-dns=false 2>&1 | while read line; do log "tailscale: $line"; done
|
||||
|
||||
local ts_ip=$("$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" ip -4 2>/dev/null || echo "unknown")
|
||||
ts_ip=$("$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" ip -4 2>/dev/null || echo "unknown")
|
||||
log "tailscale: connected — IP=${ts_ip}"
|
||||
}
|
||||
|
||||
@@ -152,33 +152,40 @@ start_tunnel() {
|
||||
|
||||
# ── Hub registration — get assigned port ───────────────────────────
|
||||
register_with_hub() {
|
||||
[ "$TUNNEL_REMOTE_PORT" != "0" ] && { log "hub: already registered (port=${TUNNEL_REMOTE_PORT})"; return 0; }
|
||||
# Already registered — skip
|
||||
if [ "$TUNNEL_REMOTE_PORT" != "0" ] && [ -n "$TUNNEL_REMOTE_PORT" ]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
log "hub: registering device ${DEVICE_ID}..."
|
||||
|
||||
local resp=""
|
||||
resp=$(curl -s --connect-timeout 10 \
|
||||
# --max-time 15: total timeout (connect + response). SRM busybox curl needs this
|
||||
# or the daemon hangs forever if the hub accepts the TCP connection but
|
||||
# never sends the HTTP response.
|
||||
resp=""
|
||||
resp=$(curl -s --connect-timeout 10 --max-time 15 \
|
||||
"http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null) || true
|
||||
|
||||
if [ -z "$resp" ]; then
|
||||
log "hub: unreachable — using last-known config"
|
||||
log "hub: unreachable — will retry next cycle"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Parse JSON response (minimal — avoids jq dependency)
|
||||
local port=""
|
||||
port=$(echo "$resp" | grep -o '"tunnel_port"[[:space:]]*:[[:space:]]*[0-9]*' | grep -o '[0-9]*')
|
||||
local tskey=""
|
||||
tskey=$(echo "$resp" | grep -o '"tailscale_auth_key"[[:space:]]*:[[:space:]]*"[^"]*"' | cut -d'"' -f4)
|
||||
# Parse JSON response — POSIX-safe, no jq dependency
|
||||
port=""
|
||||
tskey=""
|
||||
port=$(printf '%s' "$resp" | sed -n 's/.*"tunnel_port"[[:space:]]*:[[:space:]]*\([0-9]*\).*/\1/p')
|
||||
tskey=$(printf '%s' "$resp" | sed -n 's/.*"tailscale_auth_key"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
|
||||
|
||||
if [ -n "$port" ] && [ "$port" != "0" ]; then
|
||||
# Update config with assigned port
|
||||
sed -i "s/^TUNNEL_REMOTE_PORT=.*/TUNNEL_REMOTE_PORT=${port}/" "$CONF" 2>/dev/null
|
||||
TUNNEL_REMOTE_PORT="$port"
|
||||
log "hub: assigned port ${port}"
|
||||
fi
|
||||
|
||||
if [ -n "$tskey" ] && [ "$tskey" != "$TAILSCALE_AUTH_KEY" ]; then
|
||||
sed -i "s|^TAILSCALE_AUTH_KEY=.*|TAILSCALE_AUTH_KEY=${tskey}|" "$CONF" 2>/dev/null
|
||||
TAILSCALE_AUTH_KEY="$tskey"
|
||||
log "hub: updated Tailscale key"
|
||||
fi
|
||||
}
|
||||
|
||||
Executable
+86
@@ -0,0 +1,86 @@
|
||||
#!/bin/sh
|
||||
# x5925-boot.sh — Boot persistence stopgap for x5925
|
||||
# Brings up Tailscale + reverse SSH tunnel on reboot.
|
||||
# Runs as a Synology scheduled trigger-on-boot task.
|
||||
# Once the SPK daemon is fixed, this script becomes redundant.
|
||||
|
||||
LOG_TAG="kit-connect-boot"
|
||||
log() { logger -t "$LOG_TAG" -p local0.warn "$*"; }
|
||||
|
||||
log "=== Boot persistence for x5925 ==="
|
||||
log "device=x5925 hub=162.243.83.36 port=2230"
|
||||
|
||||
# ── 1. Tailscale ────────────────────────────────────────────────
|
||||
TAILSCALE_BIN="/usr/local/bin/tailscale"
|
||||
TAILSCALED_BIN="/usr/local/bin/tailscaled"
|
||||
TAILSCALE_STATEDIR="/var/packages/Tailscale/var/state"
|
||||
TAILSCALE_SOCKET="/var/packages/Tailscale/var/run/tailscaled.sock"
|
||||
AUTH_KEY="tskey-auth-kJz8wqNVo211CNTRL-GNL5EFjp5aWQcaWPSVn2aW9TNworKUNBV"
|
||||
|
||||
if [ -x "$TAILSCALED_BIN" ]; then
|
||||
mkdir -p "$TAILSCALE_STATEDIR" "$(dirname "$TAILSCALE_SOCKET")"
|
||||
|
||||
# Check if already running
|
||||
if "$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" status >/dev/null 2>&1; then
|
||||
log "tailscale: already connected — $("$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" ip -4 2>/dev/null || echo no-ip)"
|
||||
else
|
||||
log "tailscale: starting tailscaled..."
|
||||
/usr/bin/setsid "$TAILSCALED_BIN" \
|
||||
--statedir="$TAILSCALE_STATEDIR" \
|
||||
--tun=userspace-networking \
|
||||
--socket="$TAILSCALE_SOCKET" \
|
||||
>/dev/null 2>&1 &
|
||||
sleep 4
|
||||
|
||||
log "tailscale: authenticating..."
|
||||
"$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" up \
|
||||
--auth-key "$AUTH_KEY" \
|
||||
--hostname x5925 \
|
||||
--accept-routes=false \
|
||||
--accept-dns=false 2>&1 | while read -r line; do log "tailscale: $line"; done
|
||||
|
||||
ts_ip=$("$TAILSCALE_BIN" --socket="$TAILSCALE_SOCKET" ip -4 2>/dev/null || echo "unknown")
|
||||
log "tailscale: connected — IP=${ts_ip}"
|
||||
fi
|
||||
else
|
||||
log "tailscale: binaries not found at $TAILSCALED_BIN"
|
||||
fi
|
||||
|
||||
# ── 2. Reverse SSH tunnel ───────────────────────────────────────
|
||||
TUNNEL_KEY="/var/packages/kit-connect/target/bin/connect_id_ed25519"
|
||||
TUNNEL_HOST="162.243.83.36"
|
||||
TUNNEL_USER="node"
|
||||
TUNNEL_PORT="2230"
|
||||
LOCAL_SSH_PORT="2223"
|
||||
|
||||
if [ -f "$TUNNEL_KEY" ]; then
|
||||
chmod 600 "$TUNNEL_KEY"
|
||||
|
||||
# Check if tunnel already exists
|
||||
if pgrep -f "ssh.*-R.*${TUNNEL_PORT}" >/dev/null 2>&1; then
|
||||
log "tunnel: already active on port ${TUNNEL_PORT}"
|
||||
else
|
||||
log "tunnel: opening R:0.0.0.0:${TUNNEL_PORT} -> 127.0.0.1:${LOCAL_SSH_PORT}"
|
||||
|
||||
ssh \
|
||||
-o StrictHostKeyChecking=no \
|
||||
-o UserKnownHostsFile=/dev/null \
|
||||
-o ServerAliveInterval=15 \
|
||||
-o ServerAliveCountMax=3 \
|
||||
-o ExitOnForwardFailure=yes \
|
||||
-o BatchMode=yes \
|
||||
-p 22 -N \
|
||||
-R "0.0.0.0:${TUNNEL_PORT}:127.0.0.1:${LOCAL_SSH_PORT}" \
|
||||
-i "$TUNNEL_KEY" \
|
||||
"${TUNNEL_USER}@${TUNNEL_HOST}" \
|
||||
2>/var/packages/kit-connect/target/var/boot-tunnel.err &
|
||||
|
||||
TUNNEL_PID=$!
|
||||
log "tunnel: SSH PID=${TUNNEL_PID}"
|
||||
echo "$TUNNEL_PID" > /var/packages/kit-connect/target/var/boot-tunnel.pid
|
||||
fi
|
||||
else
|
||||
log "tunnel: key not found at $TUNNEL_KEY"
|
||||
fi
|
||||
|
||||
log "=== Boot persistence complete ==="
|
||||
@@ -16,12 +16,16 @@ chmod +x "$PKG_DIR/wizard.sh" 2>/dev/null || true
|
||||
chmod 600 "$PKG_DIR/bin/connect_id_ed25519" 2>/dev/null || true
|
||||
|
||||
# ── Install bundled Tailscale binaries if system doesn't have them ──
|
||||
# SRM doesn't have /usr/local/bin by default — create it first.
|
||||
mkdir -p /usr/local/bin
|
||||
if [ ! -f /usr/local/bin/tailscale ] && [ -f "$PKG_DIR/bin/tailscale" ]; then
|
||||
log "Installing bundled Tailscale binaries..."
|
||||
log "Installing bundled Tailscale binaries (1.98.9 ARM)..."
|
||||
cp "$PKG_DIR/bin/tailscale" /usr/local/bin/tailscale
|
||||
cp "$PKG_DIR/bin/tailscaled" /usr/local/bin/tailscaled
|
||||
chmod +x /usr/local/bin/tailscale /usr/local/bin/tailscaled
|
||||
log "Tailscale binaries installed to /usr/local/bin"
|
||||
elif [ -f /usr/local/bin/tailscale ]; then
|
||||
log "Tailscale already present at /usr/local/bin/tailscale"
|
||||
fi
|
||||
|
||||
# Run the Keylink IT setup wizard (non-interactive)
|
||||
|
||||
Reference in New Issue
Block a user