Public Access
jaap-jan
eb354bcdd9
The throughput harness the plan requires before any UI, plus the SSH plumbing under it. 94 new tests, no WebView involved. Credit-based flow control is what makes `yes` survivable. A terminal renders at 60 Hz at best while a remote produces output as fast as the network allows, and the difference has to accumulate somewhere or be refused. Credit is reserved *before* reading, never after: because the pump cannot read more than the renderer has room for, the coalescing buffer is bounded by the window rather than by how fast the remote can talk. When credit runs out the pump stops reading, SSH's own receive window closes, and the remote sshd blocks -- backpressure to the source with no custom protocol. Verified by falsification, not just by passing: with the credit gate removed three tests fail, including the throughput harness's bounded-memory assertion. Acknowledgements are clamped because they cross into JavaScript, where a buggy or hostile page could otherwise claim to have rendered a gigabyte and talk the host into an unbounded read. Host key trust is enforced by *failing* the connection rather than prompting inside the handshake. SSH.NET raises verification synchronously, so consulting the user there would block the handshake on a UI round trip and deadlock the first time the prompt needed the UI thread. Unknown host and changed key become distinct exceptions the caller resolves asynchronously. A mismatch has no retry path at all: a dialog offering to continue is how users are trained to click through the one warning that actually indicates interception. A legitimately rebuilt server is handled by removing the pin in settings, away from the moment of connecting. The data plane serves the renderer page from the same loopback listener as the socket, which makes Origin predictable -- always http://127.0.0.1:{port} -- where a WebView virtual-host mapping would give a different origin per backend and nothing to validate. The token is substituted at serve time, so it never touches disk and never appears in a URL. Being clear about what that buys: not protection from a process running as this user, which can read our memory anyway, but from a page in the user's browser attempting WebSocket connections to loopback ports, which is a real and routine thing. Two bugs the tests caught. The accept loop handled connections serially, so an upgraded WebSocket parked it inside the receive loop and every later request went unanswered -- the page's own script among them. The suite hung rather than failed, which is how I found it. And SHA-1 is unavoidable here: RFC 6455 mandates it for Sec-WebSocket-Accept, where it authenticates nothing. Suppressed narrowly with that reasoning; the alternative, HttpListener.AcceptWebSocketAsync, throws PlatformNotSupportedException off Windows.
83 lines
3.6 KiB
C#
83 lines
3.6 KiB
C#
namespace DodoSSH.Client.Ssh;
|
|
|
|
/// <summary>How to authenticate to a host.</summary>
|
|
/// <remarks>
|
|
/// Always decrypted from the vault immediately before use and never persisted outside it. Because
|
|
/// SSH terminates on the client, using a credential requires its plaintext here — which is exactly
|
|
/// why the <c>Connect</c> permission is a UI hint and not an enforceable boundary. See ADR 0001.
|
|
/// </remarks>
|
|
public abstract record SshCredential;
|
|
|
|
/// <summary>Password authentication, and keyboard-interactive where the server prefers it.</summary>
|
|
public sealed record SshPasswordCredential(string Password) : SshCredential;
|
|
|
|
/// <summary>Public-key authentication.</summary>
|
|
/// <param name="PrivateKeyPem">The private key in PEM form, as stored in the vault.</param>
|
|
/// <param name="Passphrase">Passphrase protecting the key, when it has one.</param>
|
|
public sealed record SshPrivateKeyCredential(byte[] PrivateKeyPem, string? Passphrase) : SshCredential;
|
|
|
|
/// <summary>Everything needed to reach one host.</summary>
|
|
/// <param name="Host">Hostname or address.</param>
|
|
/// <param name="Port">Port.</param>
|
|
/// <param name="Username">Remote account.</param>
|
|
/// <param name="Credential">How to authenticate.</param>
|
|
/// <param name="ConnectTimeout">How long to wait for the transport and handshake.</param>
|
|
public sealed record SshConnectionRequest(
|
|
string Host,
|
|
int Port,
|
|
string Username,
|
|
SshCredential Credential,
|
|
TimeSpan? ConnectTimeout = null);
|
|
|
|
/// <summary>An interactive shell over a pseudo-terminal.</summary>
|
|
public interface ISshShellSession : IAsyncDisposable
|
|
{
|
|
/// <summary>Whether the channel is still usable.</summary>
|
|
bool IsOpen { get; }
|
|
|
|
/// <summary>Reads whatever output is available, blocking until at least one byte arrives.</summary>
|
|
/// <returns>Bytes read, or 0 once the remote closes the channel.</returns>
|
|
ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken cancellationToken);
|
|
|
|
/// <summary>Sends keystrokes to the remote.</summary>
|
|
ValueTask WriteAsync(ReadOnlyMemory<byte> data, CancellationToken cancellationToken);
|
|
|
|
/// <summary>
|
|
/// Tells the remote the terminal has been resized.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// Verified to reach the remote against a real sshd; see <c>PtyAndResizeSpikeTests</c>. Sizes
|
|
/// that are not <see cref="TerminalSize.IsUsable"/> are dropped rather than forwarded.
|
|
/// </remarks>
|
|
void Resize(TerminalSize size);
|
|
}
|
|
|
|
/// <summary>An authenticated connection to one host.</summary>
|
|
public interface ISshConnection : IAsyncDisposable
|
|
{
|
|
/// <summary>Whether the transport is still up.</summary>
|
|
bool IsConnected { get; }
|
|
|
|
/// <summary>The host key that was accepted for this connection.</summary>
|
|
HostKeyPresentation HostKey { get; }
|
|
|
|
/// <summary>Opens an interactive shell with a pseudo-terminal.</summary>
|
|
Task<ISshShellSession> OpenShellAsync(TerminalSize size, CancellationToken cancellationToken);
|
|
}
|
|
|
|
/// <summary>Opens connections, enforcing host key trust before authenticating.</summary>
|
|
public interface ISshConnectionFactory
|
|
{
|
|
/// <summary>
|
|
/// Connects and authenticates.
|
|
/// </summary>
|
|
/// <exception cref="SshHostKeyUnknownException">
|
|
/// The host has no pinned key. The caller must show the fingerprint, and only on explicit
|
|
/// confirmation record it via <see cref="IKnownHostStore.TrustAsync"/> and retry.
|
|
/// </exception>
|
|
/// <exception cref="SshHostKeyMismatchException">
|
|
/// The presented key differs from the pin. There is no retry path: this is a hard block.
|
|
/// </exception>
|
|
Task<ISshConnection> ConnectAsync(SshConnectionRequest request, CancellationToken cancellationToken);
|
|
}
|