#! /bin/sh

set -e

### This script performs the passive side of a dynamic association.  It is
### intended to be set as the `tripe' user's shell, and invoked via ssh(1).
### Specifically, for each dynamic peer, add a line to `.ssh/authorized_keys'
### of the form
###
###	command="PEER" ssh-rsa ...
###
### There's an additional wrinkle.  Suppose that the passive TrIPE endpoint
### is behind a NAT, and the SSH gateway is on a different machine.  The
### gateway should have its own `tripe' user, and this script should again be
### its shell.  On the gateway, add a `.ssh/authorized_keys' entry
###
###	command="tripe@SERVER:PEER" ssh-rsa ...
###
### for the dynamic endpoint.  On the passive endpoint itself, you need an
### entry for the gateway's `tripe' user's key, with no command.

: ${prefix=@prefix@} ${exec_prefix=@exec_prefix@}
: ${bindir=@bindir@}
: ${TRIPEDIR=@configdir@} ${TRIPESOCK=@socketdir@/tripesock}
: ${tripectl=$bindir/tripectl}
export TRIPEDIR TRIPESOCK

## Make sure we're being called properly, and figure out the peer identity.
case "$#,$1" in
  2,-c) ;;
  *)
    echo >&2 "usage: $0 -c '[SERVER:]PEER [hello|goodbye]'"
    exit 1
    ;;
esac

## SSH has smushed all of our arguments together, so let's split them apart
## again.
set -- $2

## Examine the peer identifier and work out how to proceed.
case "$#,$1" in
  0,*) echo >&2 "$0: missing peer identifier"; exit 1 ;;
  *:*) mode=proxy server=${1%:*} user=${1##*:} ;;
  *) mode=local user=$1 ;;
esac
shift

## If there's no action then check to see whether SSH has hidden one
## somewhere.  Make sure the command looks sensible.
case "$#" in 0) set -- $SSH_ORIGINAL_COMMAND ;; esac
case "$#,$1" in
  0, | 1,hello) act=hello ;;
  1,goodbye) act=goodbye ;;
  *) echo >&2 "$0: unknown action spec \`$*'"; exit 1 ;;
esac

## Now actually do something.
case "$mode,$act" in
  proxy,*)
    exec ssh "$server" "$user" "$act"
    ;;
  local,hello)
    exec $tripectl SVCSUBMIT connect passive "$user"
    ;;
  local,goodbye)
    peer=$($tripectl SVCSUBMIT connect userpeer "$user")
    exec $tripectl KILL "$peer"
    ;;
  *)
    echo >&2 "$0: unknown mode/action $mode/$act"
    exit 1
    ;;
esac