riot: add scp

keys: remove pc{0,1}/old,sk0/fido,ph0/sep, update pc1/windows

.ssh/authorized_keys2

@@ -1,13 +1,8 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPmMImRSAhksHUfCwNpcj61izGn0Xkv1KRIuxb0OSdJl pc0/old
-
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4K5S3zDYbxlw7B45zOdmKud95nXU1V6kSxEvbTOsy2 pc1/old
-
 # keys below are the new security system starting from 2022-07
-sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGdLJYOrBhWERmkQ+sNM8tGzJ37UBEKkEuhbtE9B65mOAAAABHNzaDo= sk0/fido
 
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGakUcSuNhuH7tk+Nj9gDfRtxYfGPL9yb8toQ/EpSJAM openpgp:0xD9271B01
 
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUN7IXF4nlFcVfgHesgik3LIAiXlVMYJPm3yD13EVarQx5jqdBgk8Dwgkgf4rPO6MFpvIpinOyEO8zOS6HHQrCLZUv5yTFaDkUuB7eQ0EmpicGbmk9bHqj1HkOZxaobkpEfQUmFKYvkp4EexVw66sO0qfXvjHZ4H6yCAJLK5aUnKfgrE8tODzP82sU/mpJjW+Pq3uanNq754gaHwhxCIXG143/zp8qzBAeKe38xVqqDq9fTkG4hvzFvkRdS88i6l1z++0P3n0HGdOjtSg7P7fO7+7ZyPYr0gO5vB720Om/zxqPrGd9cicWi4P+aVKa+0ujWH/pqufWG6uCjKWHnBs7 sk0.ibd.ink/piv/9a
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUN7IXF4nlFcVfgHesgik3LIAiXlVMYJPm3yD13EVarQx5jqdBgk8Dwgkgf4rPO6MFpvIpinOyEO8zOS6HHQrCLZUv5yTFaDkUuB7eQ0EmpicGbmk9bHqj1HkOZxaobkpEfQUmFKYvkp4EexVw66sO0qfXvjHZ4H6yCAJLK5aUnKfgrE8tODzP82sU/mpJjW+Pq3uanNq754gaHwhxCIXG143/zp8qzBAeKe38xVqqDq9fTkG4hvzFvkRdS88i6l1z++0P3n0HGdOjtSg7P7fO7+7ZyPYr0gO5vB720Om/zxqPrGd9cicWi4P+aVKa+0ujWH/pqufWG6uCjKWHnBs7 sk0/piv/9a
 
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGV/6cLUGA5YWVI6uPhIBOBZvlNBlZLkehHQN0Gxnc+B ltp0/ubuntu
 
@@ -21,9 +16,7 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBN24pvN1RMN+iSZyHPdyExA1Rvt8pdr3e6ih6iX+KrQ
 
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZFTyR+R86fUpZBDkDR9yYzJpmeNsIv2CMHTh6EuEeq pc0/windows
 
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID8WHIpwdZl7+HIZfQpwIAhpxT1huI9sd6Ydeokilg5l pc1/windows
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHLYgVj+NPino6sOmahULN7SbAMaVAgzqPfDjz2S8zDv pc1/windows
-
-ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ/+BWSTv3w1Ru9ksfse3EUbu4ukJruUU94fCG7Sk+5g3+F80KqJGykP9tHueU07iZfAuaYj7Zcy+IWx9Ih+eYA= ph0/sep
 
 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNvHya5i3GNniGww9Yx5ikos4Z5jevu8zz8hCQi05++SgejFPnbw9UjbHFjODK2M+ZHuhRF5mdf996r4/BxWyP8= pad0/sep
 
@@ -32,3 +25,4 @@ ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBC5gu+U4
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF52mPmbLEriZ+DfmrMHFtvg2kiO2JpRpitvs7PbJowh home0
 
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhS4voo3K/Dvzqckr0bouO1WkCI5XxswstHWnuuyKBz ltp1-bd
+

.update.sh

@@ -13,6 +13,11 @@ apost_beacon "sys.online"
 # update dns
 if [[ "$DFS_DDNS_ENABLE" == "1" ]]; then
     fmt_info "updating dns ..."
+    if ! is_tty; then
+        time_to_sleep=$((RANDOM%600))
+        fmt_note "sleep for $time_to_sleep seconds"
+        sleep $time_to_sleep
+    fi
     "$THIS_DIR/tools/frigg-client.sh" ddns || (fmt_error "failed to update dns" && apost_beacon "dfs.ddns.fail")
 fi
 

scripts/riot

@@ -2,75 +2,150 @@
 # connect to iot services
 THIS_DIR=$( cd "$( dirname "${BASH_SOURCE[0]:-${(%):-%x}}" )" && pwd )
 source "$THIS_DIR/../tools/common.sh"
+RIOT_TRUST_CLIENT=${RIOT_TRUST_CLIENT:-${DFS_TRUST:-0}}
+RIOT_TRUST_SERVER=${RIOT_TRUST_SERVER:-0}
 
 # get target settings
 # provides:
 SERVER=""
-PORT=""
+PORT=""  # optional
-SSH_USERNAME=""
+USERNAME=""  # optional
 SSH_OPTIONS=""
+if [[ "$RIOT_TRUST_CLIENT" == "1" ]]; then
+    SSH_OPTIONS='-o ControlMaster=auto -o ControlPath=/tmp/sshcm-%C -o PermitLocalCommand=yes'
+fi
 get_server_meta()
 {
-    local domain=${1##*.}
+    local trust_server="$RIOT_TRUST_SERVER"
-    local host=${1%.*}
+    local arg="$1"
+    # overwrite
+    if [[ "$arg" == *@* ]]; then
+        USERNAME=${arg%%@*}
+        arg=${arg#*@}
+    fi
+    if [[ "$arg" == *:* ]]; then
+        PORT=${arg##*:}
+        arg=${arg%:*}
+    fi
+    # presets
+    local domain=${arg##*.}
+    local host=${arg%.*}
+    if [[ -z "$domain" ]]; then
+        domain="ibd"
+    fi
     if [[ "$host" == "$domain" ]]; then
-        domain=""
+        domain="proxied"
     fi
     case $domain in
         ibd|ebd )
             SERVER=$host.$domain.ink
-            PORT=12022
+            PORT=${PORT:-12022}
-            SSH_USERNAME=root
+            USERNAME=${USERNAME:-root}
+            trust_server=1
             ;;
         nasp )
             SERVER=$host
-            PORT=12022
+            PORT=${PORT:-12022}
-            SSH_USERNAME=dictxiong
+            USERNAME=${USERNAME:-dictxiong}
-            SSH_OPTIONS='-o ProxyJump="ssh@nasp.ob.ac.cn:36022"'
+            SSH_OPTIONS="$SSH_OPTIONS -o ProxyJump=ssh@nasp.ob.ac.cn:36022"
+            trust_server=1
             ;;
-        "" )
+        proxied )
             SERVER=proxy.beardic.cn
             local tmp=$(sha256sum <<< "$host" | tr -cd "[:digit:]")
             tmp=${tmp:0:4}
             PORT=$((10#$tmp+36000))
-            SSH_USERNAME=root
+            USERNAME=root
+            trust_server=1
             ;;
         * )
-            fmt_fatal "unknown domain: $domain"
+            fmt_warning "unknown domain: $domain. will try as server name"
+            SERVER="$arg"
     esac
+    if [[ "$trust_server" == "1" ]]; then
+        SSH_OPTIONS="$SSH_OPTIONS -o ForwardX11=yes -o ForwardAgent=yes"
+    fi
+}
+
+eval_or_echo() {
+    if [[ "$DFS_DRY_RUN" == "1" ]]; then
+        echo $@
+    else
+        eval $@
+    fi
 }
 
 # ssh
+prepare_ssh_cmd() {
+    local ssh_bin="${1:-ssh}"
+    if [[ "$ssh_bin" == "scp" || "$ssh_bin" == "sftp" ]]; then
+        local port_param='-P'
+    else
+        local port_param='-p'
+    fi
+    echo "$ssh_bin ${PORT:+$port_param} $PORT $SSH_OPTIONS $SCP_SRC $USERNAME${USERNAME:+@}$SERVER $SCP_DST"
+}
+
 run_ssh()
 {
-    CMD="ssh -p $PORT $SSH_OPTIONS $SSH_USERNAME@$SERVER"
+    local cmd="$(prepare_ssh_cmd $1)"
-    fmt_note "-->" $CMD
+    fmt_note "-->" $cmd
-    eval $CMD
+    eval_or_echo $cmd
 }
 
 # sshl
 run_sshl()
 {
-    if [[ -z "$1" || "$1" != *":"* ]]; then
+    if [[ -z "$1" ]]; then
         fmt_fatal "invalid remote address: $1"
     fi
+    arg="$1"
+    if [[ "$arg" != *":"* ]]; then
+        # treat as a port number
+        arg=localhost:$arg
+    fi
     while
         local port=$(shuf -n 1 -i 49152-65535)
         netstat -atun | grep -q "$port"
     do
         continue
     done
-    CMD="ssh -p $PORT $SSH_OPTIONS -NC -L $port:$1 $SSH_USERNAME@$SERVER"
+
-    fmt_note "-->" $CMD
+    SSH_OPTIONS="$SSH_OPTIONS -NC -L $port:$arg"
+    local cmd="$(prepare_ssh_cmd ssh)"
+    fmt_note "-->" $cmd
     fmt_note "  > please access localhost:$port"
-    eval $CMD
+    eval_or_echo $cmd
+}
+
+# scp
+run_scp() {
+    local src="$1"
+    local dst="$2"
+    local dst_is_remote=1
+    # whoever is ./*, it can't be the remote; whoever not exists on local, it's possible the remote.
+    # it is suggested to use ./* for local files.
+    if [[ "$src" != "./"* && ( "$dst" == "./"* || ( ! -e "$src" && -e "$dst" ) ) ]]; then
+        dst_is_remote=0
+    fi
+    if [[ "$dst_is_remote" == "1" ]]; then
+        SCP_SRC=\""$src"\"
+        SERVER="$SERVER":\""$dst"\"
+    else
+        SERVER="$SERVER":\""$src"\"
+        SCP_DST=\""$dst"\"
+    fi
+    SSH_OPTIONS="$SSH_OPTIONS -r"
+    local cmd="$(prepare_ssh_cmd scp)"
+    fmt_note "-->" $cmd
+    eval_or_echo $cmd
 }
 
 # main
 print_help()
 {
     fmt_info "usage: $0 <service> [command] [options]"
-    echo "available commands: ssh (default), sshl (ssh -L)"
+    echo "available commands: ssh (default), sshl (ssh -L), zssh, sftp"
 }
 
 router()
@@ -88,9 +163,18 @@ router()
         ssh|"" )
             run_ssh
             ;;
+        zssh )
+            run_ssh zssh
+            ;;
+        sftp )
+            run_ssh sftp
+            ;;
         sshl )
             run_sshl "$3"
             ;;
+        scp )
+            run_scp "$3" "$4"
+            ;;
         * )
             print_help
             fmt_fatal "unknown command: $2"