allen/kit-busrouter
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: audit gaps — GL local keyword, key authorization in wizards, register script parity

Browse Source 
GL daemon: removed remaining 'local ts_ip' (busybox ash compat)
Synology wizard: auto-authorizes tunnel key via POST /api/authorize-key
GL wizard: same key authorization flow added
Synology: added connect-register.sh for parity with GL
syno-balance build.sh: removed deprecated checksum file (same lesson as kit-connect)

All four curl hubs (wizards + register scripts) now have --max-time 15.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
kitadmin
2026-07-22 04:20:40 +00:00
parent 14d46d96a4
commit 34f8074ee7
6 changed files with 102 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kit-connect/bin/connect-register.sh
Executable
+59
View File
@@ -0,0 +1,59 @@
#!/bin/sh
# connect-register.sh — Standalone hub registration for Synology routers.
# Callable from the wizard, postinst, or manually.
# Usage: connect-register.sh [--force]
# --force Re-register even if already assigned
HUB_HOST="162.243.83.36"
HUB_PORT="8080"
CONF="/etc/kit-connect/connect.conf"
FORCE=0
[ "$1" = "--force" ] && FORCE=1
DEVICE_ID=$(cat /etc/busrouter/device-id 2>/dev/null || hostname 2>/dev/null | sed 's/[^a-zA-Z0-9_-]//g')
CURRENT_PORT=$(grep '^TUNNEL_REMOTE_PORT=' "$CONF" 2>/dev/null | cut -d= -f2 || echo "0")
[ "$FORCE" = "1" ] && CURRENT_PORT="0"
[ "$CURRENT_PORT" != "0" ] && {
echo "Already registered (port ${CURRENT_PORT}). Use --force to re-register."
exit 0
}
echo "Registering device ${DEVICE_ID} with hub ${HUB_HOST}:${HUB_PORT}..."
resp=$(curl -s --connect-timeout 10 --max-time 15 \
"http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null)
[ -z "$resp" ] && {
echo "ERROR: Hub unreachable at ${HUB_HOST}:${HUB_PORT}"
exit 1
}
port=$(printf '%s' "$resp" | sed -n 's/.*"tunnel_port"[[:space:]]*:[[:space:]]*\([0-9]*\).*/\1/p')
status=$(printf '%s' "$resp" | sed -n 's/.*"status"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
echo ""
echo " Device: ${DEVICE_ID}"
echo " Status: ${status:-unknown}"
echo " Port: ${port:-none}"
echo ""
if [ -n "$port" ] && [ "$port" != "0" ]; then
sed -i "s/^TUNNEL_REMOTE_PORT=.*/TUNNEL_REMOTE_PORT=${port}/" "$CONF" 2>/dev/null
echo "Port ${port} saved to ${CONF}."
fi
# Authorize key with hub
TUNNEL_KEY="/var/packages/kit-connect/target/bin/connect_id_ed25519"
if [ -f "$TUNNEL_KEY" ] && [ -n "$port" ]; then
PUBKEY=$(awk '{print $1" "$2}' "${TUNNEL_KEY}.pub" 2>/dev/null)
if [ -n "$PUBKEY" ]; then
curl -s --connect-timeout 10 --max-time 15 \
-X POST "http://${HUB_HOST}:${HUB_PORT}/api/authorize-key" \
-H "Content-Type: application/json" \
-d "{\"device_id\":\"${DEVICE_ID}\",\"pubkey\":\"${PUBKEY}\"}" \
>/dev/null 2>&1 || true
echo "Tunnel key sent to hub for authorization."
fi
fi
if [ "$status" = "new" ]; then echo ""; echo " ✓ Device registered — restart kit-connect to apply"; fi
kit-connect/wizard.sh
+13 -1
View File
@@ -86,7 +86,7 @@ ok "Config written to ${CONF}"
# ── Step 4: Register with hub ──────────────────────────────────
step "Registering with fleet hub (${HUB_HOST}:${HUB_PORT})..."
resp=$(curl -s --connect-timeout 10 "http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null) || true
resp=$(curl -s --connect-timeout 10 --max-time 15 "http://${HUB_HOST}:${HUB_PORT}/api/register/${DEVICE_ID}" 2>/dev/null) || true
if [ -z "$resp" ]; then
warn "Hub unreachable — will retry on next daemon start"
@@ -105,6 +105,18 @@ else
sed -i "s|^TAILSCALE_AUTH_KEY=.*|TAILSCALE_AUTH_KEY=${tskey}|" "$CONF" 2>/dev/null
ok "Tailscale key configured"
fi
# ── Authorize tunnel key with hub ──────────────────────
if [ -n "$port" ] && [ "$port" != "0" ] && [ -f /var/packages/kit-connect/target/bin/connect_id_ed25519.pub ]; then
PUBKEY=$(awk '{print $1" "$2}' /var/packages/kit-connect/target/bin/connect_id_ed25519.pub 2>/dev/null)
if [ -n "$PUBKEY" ]; then
curl -s --connect-timeout 10 --max-time 15 \
-X POST "http://${HUB_HOST}:${HUB_PORT}/api/authorize-key" \
-H "Content-Type: application/json" \
-d "{\"device_id\":\"${DEVICE_ID}\",\"pubkey\":\"${PUBKEY}\"}" \
>/dev/null 2>&1 && ok "Tunnel key authorized (restrict, port ${port})" || true
fi
fi
fi
# ── Step 5: Dashboard server ───────────────────────────────────