allen/kit-busrouter
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: audit gaps — GL local keyword, key authorization in wizards, register script parity

Browse Source 
GL daemon: removed remaining 'local ts_ip' (busybox ash compat)
Synology wizard: auto-authorizes tunnel key via POST /api/authorize-key
GL wizard: same key authorization flow added
Synology: added connect-register.sh for parity with GL
syno-balance build.sh: removed deprecated checksum file (same lesson as kit-connect)

All four curl hubs (wizards + register scripts) now have --max-time 15.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
kitadmin
2026-07-22 04:20:40 +00:00
parent 14d46d96a4
commit 34f8074ee7
6 changed files with 102 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gl-kit-connect/files/usr/sbin/connect-daemon.sh
-1
View File
@@ -78,7 +78,6 @@ start_tailscale() {
--accept-routes=false \
--accept-dns=false 2>&1 | while read -r line; do log "tailscale: $line"; done
local ts_ip
ts_ip=$("$TAILSCALE_BIN" ip -4 2>/dev/null || echo "unknown")
log "tailscale: connected — IP=${ts_ip}"
}
gl-kit-connect/files/usr/sbin/connect-register.sh
+1 -1
View File
@@ -16,7 +16,7 @@ CURRENT_PORT=$(uci -q get kitconnect.main.tunnel_remote_port 2>/dev/null || echo
}
echo "Registering device ${DEVICE_ID} with hub ${HUB_HOST}:${HUB_PORT}..."
resp=$(curl -s --connect-timeout 10 "http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null)
resp=$(curl -s --connect-timeout 10 --max-time 15 "http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null)
[ -z "$resp" ] && {
echo "ERROR: Hub unreachable at ${HUB_HOST}:${HUB_PORT}"
gl-kit-connect/files/usr/sbin/connect-wizard.sh
+13 -1
View File
@@ -107,7 +107,7 @@ step "Registering with fleet hub (${HUB_HOST}:${HUB_PORT})..."
REG_FLAG=""
[ "$FORCE" = "1" ] && REG_FLAG="--force"
resp=$(curl -s --connect-timeout 10 "http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null) || true
resp=$(curl -s --connect-timeout 10 --max-time 15 "http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null) || true
if [ -z "$resp" ]; then
warn "Hub unreachable — will retry on next daemon start"
@@ -127,6 +127,18 @@ else
uci commit kitconnect
ok "Tailscale key configured"
fi
# Authorize tunnel key with hub (restrict,port-forwarding)
if [ -n "$port" ] && [ "$port" != "0" ] && [ -f /etc/kitconnect/connect_id_ed25519.pub ]; then
PUBKEY=$(awk '{print $1" "$2}' /etc/kitconnect/connect_id_ed25519.pub 2>/dev/null)
if [ -n "$PUBKEY" ]; then
curl -s --connect-timeout 10 --max-time 15 \
-X POST "http://${HUB_HOST}:${HUB_PORT}/api/authorize-key" \
-H "Content-Type: application/json" \
-d "{\"device_id\":\"${DEVICE_ID}\",\"pubkey\":\"${PUBKEY}\"}" \
>/dev/null 2>&1 && ok "Tunnel key authorized (restrict, port ${port})" || true
fi
fi
fi
# ── Step 6: Enable & start service ─────────────────────────────