Public Access
Add the SSH session layer and the terminal data plane
The throughput harness the plan requires before any UI, plus the SSH plumbing under it. 94 new tests, no WebView involved. Credit-based flow control is what makes `yes` survivable. A terminal renders at 60 Hz at best while a remote produces output as fast as the network allows, and the difference has to accumulate somewhere or be refused. Credit is reserved *before* reading, never after: because the pump cannot read more than the renderer has room for, the coalescing buffer is bounded by the window rather than by how fast the remote can talk. When credit runs out the pump stops reading, SSH's own receive window closes, and the remote sshd blocks -- backpressure to the source with no custom protocol. Verified by falsification, not just by passing: with the credit gate removed three tests fail, including the throughput harness's bounded-memory assertion. Acknowledgements are clamped because they cross into JavaScript, where a buggy or hostile page could otherwise claim to have rendered a gigabyte and talk the host into an unbounded read. Host key trust is enforced by *failing* the connection rather than prompting inside the handshake. SSH.NET raises verification synchronously, so consulting the user there would block the handshake on a UI round trip and deadlock the first time the prompt needed the UI thread. Unknown host and changed key become distinct exceptions the caller resolves asynchronously. A mismatch has no retry path at all: a dialog offering to continue is how users are trained to click through the one warning that actually indicates interception. A legitimately rebuilt server is handled by removing the pin in settings, away from the moment of connecting. The data plane serves the renderer page from the same loopback listener as the socket, which makes Origin predictable -- always http://127.0.0.1:{port} -- where a WebView virtual-host mapping would give a different origin per backend and nothing to validate. The token is substituted at serve time, so it never touches disk and never appears in a URL. Being clear about what that buys: not protection from a process running as this user, which can read our memory anyway, but from a page in the user's browser attempting WebSocket connections to loopback ports, which is a real and routine thing. Two bugs the tests caught. The accept loop handled connections serially, so an upgraded WebSocket parked it inside the receive loop and every later request went unanswered -- the page's own script among them. The suite hung rather than failed, which is how I found it. And SHA-1 is unavoidable here: RFC 6455 mandates it for Sec-WebSocket-Accept, where it authenticates nothing. Suppressed narrowly with that reasoning; the alternative, HttpListener.AcceptWebSocketAsync, throws PlatformNotSupportedException off Windows.
This commit is contained in:
@@ -0,0 +1,181 @@
|
||||
namespace DodoSSH.Client.Terminal.Tests;
|
||||
|
||||
/// <summary>
|
||||
/// The flow-control accounting.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Worth testing on its own, ahead of the pump, because everything else about the terminal depends on
|
||||
/// this arithmetic being right. An off-by-one that leaks credit shows up as a session that stalls
|
||||
/// after several minutes of heavy output — a symptom nobody would trace back to here.
|
||||
/// </remarks>
|
||||
public sealed class CreditWindowTests
|
||||
{
|
||||
[Fact]
|
||||
public void AFreshWindow_OffersItsWholeSize()
|
||||
{
|
||||
var window = new CreditWindow(1024);
|
||||
|
||||
window.Available.ShouldBe(1024);
|
||||
window.Outstanding.ShouldBe(0);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Reserving_ReducesWhatIsAvailable()
|
||||
{
|
||||
var window = new CreditWindow(1024);
|
||||
|
||||
window.TryReserve(400).ShouldBe(400);
|
||||
|
||||
window.Outstanding.ShouldBe(400);
|
||||
window.Available.ShouldBe(624);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ReservingMoreThanRemains_GrantsAPartialAmount()
|
||||
{
|
||||
// All-or-nothing would stall a session that could have made progress with what was left, and
|
||||
// the caller has to cope with a short read regardless.
|
||||
var window = new CreditWindow(1024);
|
||||
window.TryReserve(900);
|
||||
|
||||
window.TryReserve(400).ShouldBe(124);
|
||||
window.Available.ShouldBe(0);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void AFullWindow_GrantsNothing()
|
||||
{
|
||||
var window = new CreditWindow(1024);
|
||||
window.TryReserve(1024);
|
||||
|
||||
window.TryReserve(1).ShouldBe(0);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Returning_RestoresCredit()
|
||||
{
|
||||
var window = new CreditWindow(1024);
|
||||
window.TryReserve(1024);
|
||||
|
||||
window.Return(512);
|
||||
|
||||
window.Available.ShouldBe(512);
|
||||
window.Outstanding.ShouldBe(512);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ReturningMoreThanWasReserved_IsClamped()
|
||||
{
|
||||
// The acknowledgement crosses into JavaScript, so a buggy or tampered page can claim to have
|
||||
// rendered more than it was sent. Letting that drive outstanding negative would hand it an
|
||||
// unbounded window, which is precisely what this class exists to prevent.
|
||||
var window = new CreditWindow(1024);
|
||||
window.TryReserve(100);
|
||||
|
||||
window.Return(100_000);
|
||||
|
||||
window.Outstanding.ShouldBe(0);
|
||||
window.Available.ShouldBe(1024);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ReturningWithNothingOutstanding_ChangesNothing()
|
||||
{
|
||||
var window = new CreditWindow(1024);
|
||||
|
||||
window.Return(500);
|
||||
|
||||
window.Available.ShouldBe(1024);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task WaitingWithCreditAvailable_ReturnsImmediately()
|
||||
{
|
||||
var window = new CreditWindow(1024);
|
||||
|
||||
await window.WaitForCreditAsync(TestContext.Current.CancellationToken);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task WaitingOnAFullWindow_BlocksUntilCreditIsReturned()
|
||||
{
|
||||
var window = new CreditWindow(1024);
|
||||
window.TryReserve(1024);
|
||||
|
||||
var wait = window.WaitForCreditAsync(TestContext.Current.CancellationToken).AsTask();
|
||||
|
||||
wait.IsCompleted.ShouldBeFalse("A full window must not let a reader proceed.");
|
||||
|
||||
window.Return(1);
|
||||
|
||||
await wait;
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Reset_UnblocksAWaiter()
|
||||
{
|
||||
// A session being torn down must not leave its reader parked forever on credit that will
|
||||
// never be acknowledged.
|
||||
var window = new CreditWindow(1024);
|
||||
window.TryReserve(1024);
|
||||
|
||||
var wait = window.WaitForCreditAsync(TestContext.Current.CancellationToken).AsTask();
|
||||
wait.IsCompleted.ShouldBeFalse();
|
||||
|
||||
window.Reset();
|
||||
|
||||
await wait;
|
||||
window.Outstanding.ShouldBe(0);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Waiting_ObservesCancellation()
|
||||
{
|
||||
var window = new CreditWindow(1024);
|
||||
window.TryReserve(1024);
|
||||
|
||||
using var cts = new CancellationTokenSource();
|
||||
var wait = window.WaitForCreditAsync(cts.Token).AsTask();
|
||||
|
||||
await cts.CancelAsync();
|
||||
|
||||
await Should.ThrowAsync<OperationCanceledException>(async () => await wait);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ConcurrentReservesAndReturns_KeepTheAccountingConsistent()
|
||||
{
|
||||
// The pump reserves on one task and returns on another, so the arithmetic has to hold under
|
||||
// real contention rather than only in a single-threaded walkthrough.
|
||||
const int Window = 64 * 1024;
|
||||
var window = new CreditWindow(Window);
|
||||
|
||||
var reserved = 0;
|
||||
var returned = 0;
|
||||
|
||||
var workers = Enumerable.Range(0, 8).Select(_ => Task.Run(() =>
|
||||
{
|
||||
for (var i = 0; i < 2_000; i++)
|
||||
{
|
||||
var granted = window.TryReserve(97);
|
||||
Interlocked.Add(ref reserved, granted);
|
||||
|
||||
window.Return(granted);
|
||||
Interlocked.Add(ref returned, granted);
|
||||
}
|
||||
}, TestContext.Current.CancellationToken));
|
||||
|
||||
await Task.WhenAll(workers);
|
||||
|
||||
reserved.ShouldBe(returned);
|
||||
window.Outstanding.ShouldBe(0);
|
||||
window.Available.ShouldBe(Window);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void AWindowOfZeroOrLess_IsRejected()
|
||||
{
|
||||
Should.Throw<ArgumentOutOfRangeException>(() => new CreditWindow(0));
|
||||
Should.Throw<ArgumentOutOfRangeException>(() => new CreditWindow(-1));
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user