Compare commits
2 Commits
fdaffca43f
...
bf14a70efe
Author | SHA1 | Date |
---|---|---|
wpetit | bf14a70efe | |
wpetit | c2f8be504e |
|
@ -4,4 +4,8 @@
|
|||
/.env
|
||||
/socks
|
||||
/host.key
|
||||
/custom
|
||||
/custom
|
||||
/dist
|
||||
tools/
|
||||
/CHANGELOG.md
|
||||
/.chglog
|
|
@ -0,0 +1,95 @@
|
|||
project_name: rebound
|
||||
before:
|
||||
hooks:
|
||||
- go mod tidy
|
||||
builds:
|
||||
- id: rebound
|
||||
env:
|
||||
- CGO_ENABLED=0
|
||||
ldflags:
|
||||
- -s
|
||||
- -w
|
||||
- -X 'main.Version=${MKT_PROJECT_VERSION}'
|
||||
gcflags:
|
||||
- -trimpath="${PWD}"
|
||||
asmflags:
|
||||
- -trimpath="${PWD}"
|
||||
goos:
|
||||
- linux
|
||||
goarch:
|
||||
- amd64
|
||||
- "386"
|
||||
main: ./cmd/server
|
||||
archives:
|
||||
- id: rebound
|
||||
builds: ["rebound"]
|
||||
name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}{{ with .Mips }}_{{ . }}{{ end }}{{ if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}'
|
||||
files:
|
||||
- README.md
|
||||
checksum:
|
||||
name_template: 'checksums.txt'
|
||||
snapshot:
|
||||
name_template: "{{ .Version }}"
|
||||
changelog:
|
||||
sort: asc
|
||||
filters:
|
||||
exclude:
|
||||
- '^docs:'
|
||||
- '^test:'
|
||||
nfpms:
|
||||
- id: rebound
|
||||
builds:
|
||||
- "rebound"
|
||||
package_name: rebound
|
||||
homepage: https://forge.cadoles.com/wpetit/rebound
|
||||
maintainer: William Petit <wpetit@cadoles.com>
|
||||
description: |-
|
||||
SSH tunneling for machines behind NATs.
|
||||
license: AGPL-3.0
|
||||
formats:
|
||||
- apk
|
||||
- deb
|
||||
- rpm
|
||||
contents:
|
||||
# Deb
|
||||
- src: misc/packaging/systemd/rebound.systemd.service
|
||||
dst: /usr/lib/systemd/system/rebound.service
|
||||
packager: deb
|
||||
- src: misc/packaging/systemd/rebound.env
|
||||
dst: /etc/rebound/environ
|
||||
type: config|noreplace
|
||||
packager: deb
|
||||
|
||||
# RPM
|
||||
- src: misc/packaging/systemd/rebound.systemd.service
|
||||
dst: /usr/lib/systemd/system/rebound.service
|
||||
packager: rpm
|
||||
- src: misc/packaging/systemd/rebound.env
|
||||
type: config|noreplace
|
||||
dst: /etc/rebound/environ
|
||||
packager: rpm
|
||||
|
||||
# APK
|
||||
- src: misc/packaging/openrc/rebound.openrc.sh
|
||||
dst: /etc/init.d/rebound
|
||||
file_info:
|
||||
mode: 0755
|
||||
packager: apk
|
||||
- src: misc/packaging/openrc/rebound.conf
|
||||
type: config|noreplace
|
||||
dst: /etc/conf.d/rebound
|
||||
file_info:
|
||||
mode: 0755
|
||||
packager: apk
|
||||
|
||||
# All
|
||||
- dst: /var/lib/rebound
|
||||
type: dir
|
||||
file_info:
|
||||
mode: 0700
|
||||
- dst: /var/log/rebound
|
||||
type: dir
|
||||
file_info:
|
||||
mode: 0700
|
||||
scripts:
|
||||
postinstall: "misc/packaging/common/postinstall-rebound.sh"
|
28
Makefile
28
Makefile
|
@ -1,6 +1,15 @@
|
|||
SHELL := /bin/bash
|
||||
DOKKU_URL := dokku@dev.lookingfora.name:rebound
|
||||
|
||||
GORELEASER_VERSION ?= v1.13.1
|
||||
GORELEASER_ARGS ?= release --snapshot --clean
|
||||
|
||||
MKT_GITEA_RELEASE_ORG ?= wpetit
|
||||
MKT_GITEA_RELEASE_PROJECT ?= rebound
|
||||
MKT_GITEA_RELEASE_VERSION ?= $(MKT_PROJECT_VERSION)
|
||||
|
||||
DEPLOY_TARGET ?= root@cadoles-rebound
|
||||
|
||||
all: build
|
||||
|
||||
watch: tools/modd/bin/modd
|
||||
|
@ -34,6 +43,25 @@ dokku-deploy:
|
|||
$(if $(shell git config remote.dokku.url),, git remote add dokku $(DOKKU_URL))
|
||||
git push -f dokku $(shell git rev-parse HEAD):refs/heads/master
|
||||
|
||||
.PHONY: dist
|
||||
dist: .mktools
|
||||
( set -o allexport && source .env && set +o allexport && VERSION=$(GORELEASER_VERSION) curl -sfL https://goreleaser.com/static/run | GORELEASER_CURRENT_TAG="$(MKT_PROJECT_VERSION)" bash /dev/stdin $(GORELEASER_ARGS) )
|
||||
|
||||
.PHONY: release
|
||||
release: changelog
|
||||
$(MAKE) MKT_GITEA_RELEASE_ATTACHMENTS="$$(find dist/* -type f -name '*.apk' -or -name '*.deb' -or -name '*.rpm' -or -name 'checksums.txt' -or -name 'CHANGELOG.md' | tr '\n' ' ')" mkt-gitea-release
|
||||
|
||||
.PHONY: changelog
|
||||
changelog: .mktools
|
||||
$(MAKE) MKT_GIT_CHGLOG_ARGS='--next-tag $(MKT_PROJECT_VERSION) --tag-filter-pattern $(MKT_PROJECT_VERSION_CHANNEL) --output CHANGELOG.md' mkt-changelog
|
||||
|
||||
.PHONY: deploy
|
||||
deploy: dist
|
||||
FILE=$$(find ./dist -name '*amd64.deb') \
|
||||
&& ssh $(DEPLOY_TARGET) rm -f ~/rebound_*amd64.deb \
|
||||
&& scp $${FILE} $(DEPLOY_TARGET):~/ \
|
||||
&& ssh $(DEPLOY_TARGET) dpkg -i $$(basename $${FILE})
|
||||
|
||||
.PHONY: mktools
|
||||
mktools:
|
||||
rm -rf .mktools
|
||||
|
|
|
@ -1,7 +1,6 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"flag"
|
||||
"log"
|
||||
"os"
|
||||
"os/signal"
|
||||
|
@ -19,30 +18,17 @@ func main() {
|
|||
log.Fatalf("[ERROR] %+v", errors.WithStack(err))
|
||||
}
|
||||
|
||||
// Global Options
|
||||
address := flag.String("address", opts.Address, "server listening address")
|
||||
|
||||
// SSH Options
|
||||
sockDir := flag.String("ssh-sock-dir", opts.SSH.SockDir, "ssh sock directory")
|
||||
publicPort := flag.Uint("ssh-public-port", opts.SSH.PublicPort, "ssh public port")
|
||||
publicHost := flag.String("ssh-public-host", opts.SSH.PublicHost, "ssh public host")
|
||||
hostKey := flag.String("ssh-host-key", opts.SSH.HostKey, "ssh host key")
|
||||
|
||||
// HTTP Options
|
||||
customDir := flag.String("http-custom-dir", opts.HTTP.CustomDir, "http custom templates/assets directory")
|
||||
|
||||
flag.Parse()
|
||||
|
||||
server := rebound.NewServer(
|
||||
rebound.WithAddress(*address),
|
||||
rebound.WithAddress(opts.Address),
|
||||
rebound.WithSSHOption(
|
||||
ssh.WithSockDir(*sockDir),
|
||||
ssh.WithPublicHost(*publicHost),
|
||||
ssh.WithPublicPort(*publicPort),
|
||||
ssh.WithHostKey(*hostKey),
|
||||
ssh.WithSockDir(opts.SSH.SockDir),
|
||||
ssh.WithPublicHost(opts.SSH.PublicHost),
|
||||
ssh.WithPublicPort(opts.SSH.PublicPort),
|
||||
ssh.WithHostKey(opts.SSH.HostKey),
|
||||
),
|
||||
rebound.WitHTTPOption(
|
||||
http.WithCustomDir(*customDir),
|
||||
http.WithCustomDir(opts.HTTP.CustomDir),
|
||||
http.WithTemplateData(opts.HTTP.TemplateData),
|
||||
),
|
||||
)
|
||||
|
||||
|
|
|
@ -1,10 +1,19 @@
|
|||
package http
|
||||
|
||||
import "log"
|
||||
import (
|
||||
"log"
|
||||
)
|
||||
|
||||
type Options struct {
|
||||
Logger func(message string, args ...any)
|
||||
CustomDir string `env:"CUSTOM_DIR"`
|
||||
Logger func(message string, args ...any)
|
||||
CustomDir string `env:"CUSTOM_DIR"`
|
||||
TemplateData *TemplateData `envPrefix:"TEMPLATE_DATA_"`
|
||||
}
|
||||
|
||||
type TemplateData struct {
|
||||
Title string `env:"TITLE"`
|
||||
SSHPublicHost string `env:"SSH_PUBLIC_HOST"`
|
||||
SSHPublicPort int `env:"SSH_PUBLIC_PORT"`
|
||||
}
|
||||
|
||||
type OptionFunc func(*Options)
|
||||
|
@ -13,6 +22,11 @@ func DefaultOptions() *Options {
|
|||
return &Options{
|
||||
Logger: log.Printf,
|
||||
CustomDir: "",
|
||||
TemplateData: &TemplateData{
|
||||
Title: "Rebound",
|
||||
SSHPublicHost: "127.0.0.1",
|
||||
SSHPublicPort: 2222,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -27,3 +41,9 @@ func WithCustomDir(customDir string) func(*Options) {
|
|||
opts.CustomDir = customDir
|
||||
}
|
||||
}
|
||||
|
||||
func WithTemplateData(templateData *TemplateData) func(*Options) {
|
||||
return func(opts *Options) {
|
||||
opts.TemplateData = templateData
|
||||
}
|
||||
}
|
||||
|
|
|
@ -30,13 +30,7 @@ type Server struct {
|
|||
}
|
||||
|
||||
func (s *Server) serveHomepage(w http.ResponseWriter, r *http.Request) {
|
||||
data := struct {
|
||||
Title string
|
||||
}{
|
||||
Title: "Rebound",
|
||||
}
|
||||
|
||||
s.renderTemplate(w, "index", data)
|
||||
s.renderTemplate(w, "index", s.opts.TemplateData)
|
||||
}
|
||||
|
||||
func (s *Server) Serve(l net.Listener) error {
|
||||
|
|
|
@ -2,7 +2,7 @@
|
|||
<footer class="footer">
|
||||
<div class="container">
|
||||
<div class="content has-text-centered">
|
||||
Ce service est propulsé par Rebound, un logiciel libre diffusé sous licence <a href="#">AGPL-3.0</a>.
|
||||
Ce service est propulsé par <a href="https://forge.cadoles.com/wpetit/rebound" title="Rebound repository">Rebound</a>, un logiciel libre diffusé sous licence <a href="https://www.gnu.org/licenses/agpl-3.0.en.html#license-text">AGPL-3.0</a>.
|
||||
</div>
|
||||
</div>
|
||||
</footer>
|
||||
|
|
|
@ -17,7 +17,7 @@
|
|||
<p>Rebound est un serveur SSH permettant de créer des tunnels TCP/IP éphémères et privés entre 2 machines positionnées
|
||||
derrière un <abbr title="Network Address Traversal">NAT</abbr>.</p>
|
||||
<p>Pour l'utiliser <strong>un simple client SSH suffit !</strong></p>
|
||||
<pre class="has-background-dark has-text-white-ter is-family-monospace">ssh -R 0:127.0.0.1:<span class="has-text-info"><port></span> rebound@rebound.cadol.es</pre>
|
||||
<pre class="has-background-dark has-text-white-ter is-family-monospace">ssh -R 0:127.0.0.1:<span class="has-text-info"><port></span> rebound@{{ .SSHPublicHost }} -p {{ .SSHPublicPort }}</pre>
|
||||
<p class="is-italic">Où <span class="has-text-info"><port></span> est à remplacer par le port du service
|
||||
s'exécutant sur votre machine en local.</span>
|
||||
<p>Une fois connecté, suivez les instructions. 😉</p>
|
||||
|
|
|
@ -0,0 +1,75 @@
|
|||
#!/bin/sh
|
||||
|
||||
use_systemctl="True"
|
||||
systemd_version=0
|
||||
if ! command -V systemctl >/dev/null 2>&1; then
|
||||
use_systemctl="False"
|
||||
else
|
||||
systemd_version=$(systemctl --version | head -1 | cut -d ' ' -f 2)
|
||||
fi
|
||||
|
||||
service_name=rebound
|
||||
|
||||
cleanup() {
|
||||
if [ "${use_systemctl}" = "False" ]; then
|
||||
rm -f /usr/lib/systemd/system/${service_name}.service
|
||||
else
|
||||
rm -f /etc/chkconfig/${service_name}
|
||||
rm -f /etc/init.d/${service_name}
|
||||
fi
|
||||
}
|
||||
|
||||
cleanInstall() {
|
||||
printf "\033[32m Post Install of an clean install\033[0m\n"
|
||||
if [ "${use_systemctl}" = "False" ]; then
|
||||
if command -V chkconfig >/dev/null 2>&1; then
|
||||
chkconfig --add ${service_name}
|
||||
fi
|
||||
|
||||
service ${service_name} restart || :
|
||||
else
|
||||
if [[ "${systemd_version}" -lt 231 ]]; then
|
||||
printf "\033[31m systemd version %s is less then 231, fixing the service file \033[0m\n" "${systemd_version}"
|
||||
sed -i "s/=+/=/g" /usr/lib/systemd/system/${service_name}.service
|
||||
fi
|
||||
printf "\033[32m Reload the service unit from disk\033[0m\n"
|
||||
systemctl daemon-reload || :
|
||||
printf "\033[32m Unmask the service\033[0m\n"
|
||||
systemctl unmask ${service_name} || :
|
||||
printf "\033[32m Set the preset flag for the service unit\033[0m\n"
|
||||
systemctl preset ${service_name} || :
|
||||
printf "\033[32m Set the enabled flag for the service unit\033[0m\n"
|
||||
systemctl enable ${service_name} || :
|
||||
systemctl restart ${service_name} || :
|
||||
fi
|
||||
}
|
||||
|
||||
upgrade() {
|
||||
printf "\033[32m Post Install of an upgrade\033[0m\n"
|
||||
systemctl daemon-reload || :
|
||||
systemctl restart ${service_name} || :
|
||||
}
|
||||
|
||||
# Step 2, check if this is a clean install or an upgrade
|
||||
action="$1"
|
||||
if [ "$1" = "configure" ] && [ -z "$2" ]; then
|
||||
action="install"
|
||||
elif [ "$1" = "configure" ] && [ -n "$2" ]; then
|
||||
action="upgrade"
|
||||
fi
|
||||
|
||||
case "$action" in
|
||||
"1" | "install")
|
||||
cleanInstall
|
||||
;;
|
||||
"2" | "upgrade")
|
||||
printf "\033[32m Post Install of an upgrade\033[0m\n"
|
||||
upgrade
|
||||
;;
|
||||
*)
|
||||
printf "\033[32m Alpine\033[0m"
|
||||
cleanInstall
|
||||
;;
|
||||
esac
|
||||
|
||||
cleanup
|
|
@ -0,0 +1,9 @@
|
|||
export REBOUND_ADDRESS=:2222
|
||||
export REBOUND_HTTP_CUSTOM_DIR=/etc/rebound/custom
|
||||
export REBOUND_SSH_PUBLIC_HOST=rebound
|
||||
export REBOUND_SSH_PUBLIC_PORT=2222
|
||||
export REBOUND_SSH_SOCK_DIR=/var/lib/rebound/socks
|
||||
export REBOUND_SSH_HOST_KEY=/etc/rebound/host.key
|
||||
export REBOUND_HTTP_TEMPLATE_DATA_TITLE=Rebound
|
||||
export REBOUND_HTTP_TEMPLATE_DATA_SSH_PUBLIC_HOST=127.0.0.1
|
||||
export REBOUND_HTTP_TEMPLATE_DATA_SSH_PUBLIC_PORT=8080
|
|
@ -0,0 +1,11 @@
|
|||
#!/sbin/openrc-run
|
||||
|
||||
command="/usr/bin/rebound"
|
||||
command_args=""
|
||||
supervisor=supervise-daemon
|
||||
output_log="/var/log/rebound.log"
|
||||
error_log="$output_log"
|
||||
|
||||
depend() {
|
||||
need net
|
||||
}
|
|
@ -0,0 +1,9 @@
|
|||
REBOUND_ADDRESS=:8080
|
||||
REBOUND_HTTP_CUSTOM_DIR=/var/lib/rebound/custom
|
||||
REBOUND_SSH_PUBLIC_HOST=rebound
|
||||
REBOUND_SSH_PUBLIC_PORT=8080
|
||||
REBOUND_SSH_SOCK_DIR=/var/lib/rebound/socks
|
||||
REBOUND_SSH_HOST_KEY=/var/lib/rebound/host.key
|
||||
REBOUND_HTTP_TEMPLATE_DATA_TITLE=Rebound
|
||||
REBOUND_HTTP_TEMPLATE_DATA_SSH_PUBLIC_HOST=127.0.0.1
|
||||
REBOUND_HTTP_TEMPLATE_DATA_SSH_PUBLIC_PORT=8080
|
|
@ -0,0 +1,35 @@
|
|||
[Unit]
|
||||
Description=rebound service
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
Restart=on-failure
|
||||
EnvironmentFile=/etc/rebound/environ
|
||||
ExecStart=/usr/bin/rebound
|
||||
EnvironmentFile=/etc/rebound/environ
|
||||
NoNewPrivileges=yes
|
||||
PrivateTmp=yes
|
||||
PrivateDevices=yes
|
||||
PrivateUsers=yes
|
||||
DynamicUser=yes
|
||||
StateDirectory=rebound
|
||||
DevicePolicy=closed
|
||||
ProtectSystem=true
|
||||
ProtectHome=read-only
|
||||
ProtectKernelLogs=yes
|
||||
ProtectProc=invisible
|
||||
ProtectClock=yes
|
||||
ProtectControlGroups=yes
|
||||
ProtectKernelModules=yes
|
||||
ProtectKernelTunables=yes
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
|
||||
RestrictNamespaces=yes
|
||||
RestrictRealtime=yes
|
||||
RestrictSUIDSGID=yes
|
||||
MemoryDenyWriteExecute=yes
|
||||
LockPersonality=yes
|
||||
CapabilityBoundingSet=~CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER CAP_NET_ADMIN CAP_WAKE_ALARM CAP_SYS_TTY_CONFIG
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
|
@ -47,6 +47,7 @@ func (s *Server) Start() error {
|
|||
|
||||
server := http.NewServer(
|
||||
http.WithCustomDir(s.opts.HTTP.CustomDir),
|
||||
http.WithTemplateData(s.opts.HTTP.TemplateData),
|
||||
http.WithLogger(s.opts.HTTP.Logger),
|
||||
)
|
||||
|
||||
|
|
|
@ -80,6 +80,11 @@ func (s *Server) handleRequest(ctx ssh.Context, srv *ssh.Server, req *gossh.Requ
|
|||
|
||||
addr := s.getSocketPath(sessionID)
|
||||
|
||||
if err := s.ensureFileDir(addr); err != nil {
|
||||
s.log("[ERROR] %+v", errors.WithStack(err))
|
||||
return false, []byte("internal server error")
|
||||
}
|
||||
|
||||
ln, err := net.Listen("unix", addr)
|
||||
if err != nil {
|
||||
s.log("[ERROR] %+v", errors.WithStack(err))
|
||||
|
@ -200,6 +205,15 @@ func (s *Server) getSocketPath(sessionID SessionID) string {
|
|||
return filepath.Join(s.opts.SockDir, fmt.Sprintf("%s.sock", sessionID))
|
||||
}
|
||||
|
||||
func (s *Server) ensureFileDir(file string) error {
|
||||
dir := filepath.Dir(file)
|
||||
if err := os.MkdirAll(dir, os.FileMode(0750)); err != nil {
|
||||
return errors.WithStack(err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func generateToken(length int) (string, error) {
|
||||
chars := []rune(
|
||||
"ABCDEFGHIJKLMNOPQRSTUVWXYZ" +
|
||||
|
|
Loading…
Reference in New Issue