sshkeys: Test banner and static handling

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys: Fix newline insertion

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys: Tests, wip

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys: Tests: Provide a dummy test key

I threw the private half away.  Nevertheless, this should not be put
into any real file.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys: Fix auth key header newline

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys: Fix magic banner handling

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys: Improve ssh auth key banner and header

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys: Some todos

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: sshkeys: Get line numbers right

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

cmdlistener: Tidy up connnection disconnect error

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: ssh keys: avoid creating account and then bailing

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: ssh keys: create accounts as necessary

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

accounts: Allow otter prep_access_account to never update it

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

accounts: Actually parse ssh: accounts

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: When rejecting removal of current key, print nicely

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Rename inventory_subcmd

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Suppress account selection for mgmtchannel-proxy

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Make ordinary_subcommand handle SubcommandProperties

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Move &Subcommand into MainOpts for convenience

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Make Subcommand Debug

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Make space for SubcommandProperties

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Make Subcommand a named field struct

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Introduce ordinary_subcmd macro

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys: Add paranoid whitespace check

Newlines, in particular, would mess things up.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys: Do not include filename in context

This gets printed when we log the AuthKeysManipError.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys: Fix formatting of ssh authorized_keys files

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys: Allow the creation of a fresh auth keys file

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

errors: Rename AnyhowDisplay and provide .d() and use it

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

errors: Provide AnyhowFormat and use it in two places

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

errors: Drop some spurious uses of {:?} in messages

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

commands: Drop a spurious \n in an error message

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

utils: Introduce anyhow::Error::for_each

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: mgmtchannel-proxy: Exit 0 on command EOF too

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys internal errors: Do not share with client

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

InternalError from anyhow: Add a missing colon to the messages

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

apitest: Initial test of ssh

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

config: Observe that ssh_proxy_command will be split by ssh's shell

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Rename --ssh-proxy-command option

This is shorter and more consistent.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

apitest: Provide OTTER_APITEST_START_DIR

Nothing uses this yet, nor, it appears, is going to, but it may come
in useful in the future, so let's keep it.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

Makefile, ssh proxy: Install a symlink

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Shut down CookedStdout before bundle data

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Shut down CookedStdout before proxying responses

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Tiny fixes to stdout handling

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter: Introduce SubCommandSubArgs

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Completely redo stdout handling

Replace all println.  Use a common stdout buffer for everything.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Switch to CookedStdout for set-link

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Switch to CookedStdout for list-ssh-keys

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: mgmtchannel proxy needs to exit on server conn eof

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Switch to RawStdout for mgmtchannel proxy stdout

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Use copy_interactive for mgmtchannel proxy

Fixes a buffering-induced deadlock.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Switch to CookedStdout for arg parsing

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Switch to RawStdout for bundle download to stdout

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

utils: Provide CookedStdout, buffered and with die on flush fail

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

utils: Provide RawStdout and the associated SigPipeWriter

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

utils: Provide io_copy_interactive

stdlib io::copy insists on buffering.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

debugreader: Make generic over D

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

mgmtchannel: Insist that client connections are Debug

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Do not SelectAccount when we are mgmtchannel-proxy

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Break out connect_chan

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

mgmtchannel: Tiny error message improvement

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

cmdlistener: Rework main loop error handling

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

cmdlistener: Display account in log messages

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

ssh: Forbid SetRestrictedSshScope after SelectAccount

SelectAccount generates an Authorisation in the stream state.  We
don't want to preserve that after we drop privs.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

Slight error message tweaks

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Implement remote ssh connection

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

config: Break out some variables etc.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Rename SL::Socket from a daft long name

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Prep for new kind of server connection

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: provide set-list-keys

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: provide set-ssh-keys

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

otter cli: Provide mgmtchannel-proxy subcommand

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

utils: error end_process: Do not print duplicate messages

Sometimes we use thiserror to put {0} of an inner error in our Display
impl.  If that happens, just skip the repetition.

This is a slight bodge.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

mgmtchannel: Improve Display of MgmtChannelReadError

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

Break out end_process ext method on anyhow::Error

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

Rework hex parsing

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

mgmtchannels: Make ClientMgmtChannel's read be Send too

We are about to need this

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys: Provide more traits for our types

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys: Make KeySpec fields pub (!)

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys: Make MgmtKeyReport fields pub (!)

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

sshkeys: Change authorized_keys command to what we are going to impl

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

Provide parsing for sshkey::Id and Nonce and so on

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

childio: Rename STATUS_1 from vague name

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

childio: Add some dbgs to tests

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

childio: Add a test case to simulate the Linux kernel race

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

childio: When getting EOF when reading, wait blockingly for child

The t_false read test was flaky.  It would sometimes panic at the
"unwrap_err".

This is because on Linux we can get EOF on a pipe which is being
closed by the kernel as a result of process termination, and then
still find that wait4 returns 0 meaning the child cannot be reaped.

I think this is quite undesirable, and I regard it as a kernel bug.
It is certainly untraditional.  For example, it is conventional for a
process that is coredumpting to finish dumping core before its fds
show up as closed.

However, the spec I have here does not appear to give a clear
guarentee that this sequence of events is impossible.  And whatever,
we have to live with it.  Bah.

In our situation we can generally expect that it is sensible to assume
that EOF means the child is in the process of exiting, and to reap it
blockingly.

Emprically I can no longer reproduce the race now.

The sequence of events as seen from the parent looks like this:

  pipe2([5, 6], O_CLOEXEC)                = 0

This is the stdin pipe.  We don't use it in this test.

  pipe2([7, 8], O_CLOEXEC)                = 0

This is the stdout pipe for the child.

I have verified in another strace that these descriptors are right,
since the post-fork child does this:
  23597 dup2(5, 0)                        = 0
  23597 dup2(8, 1)                        = 1

So, continuing with the parent:

  prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=4*1024}) = 0
  prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=4*1024}) = 0
  prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=4*1024}) = 0
  prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=4*1024}) = 0
  mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f14d9a56000
  rt_sigprocmask(SIG_BLOCK, ~[], [], 8)   = 0

  clone(child_stack=0x7f14d9a5eff0, flags=CLONE_VM|CLONE_VFORK|SIGCHLD) = 12678

Here we fork.  The child runs in parallel, and is going to exit.

  munmap(0x7f14d9a56000, 36864)           = 0
  rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
  close(5)                                = 0
  close(8)                                = 0

We close our copies of the child's ends of the pipes.

  read(7, "", 10)                         = 0

We read EOF from the child's stdout.

  write(2, "[src/childio.rs:103] self.rw.rea"..., 45) = 45

This is a dbg print I put in.

  wait4(12678, 0x7fff03c3d16c, WNOHANG, NULL) = 0

Here wait4 returns 0 meaning "child has not terminated".

  write(2, "[src/childio.rs:36] self.child.l"..., 64) = 64

  write(2, "[", 1)                        = 1
  write(2, "src/childio.rs", 14)          = 14
  write(2, ":", 1)                        = 1
  write(2, "209", 3)                      = 3
  write(2, "] ", 2)                       = 2

Again some dbg print.

  --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=12678, si_uid=1001, si_status=1, si_utime=0, si_stime=0} ---

Finally we get a signal about the child but it is too late.

  write(2, "r.read(&mut buf)", 16)        = 16
  write(2, " = ", 3)                      = 3
  write(2, "Ok", 2)                       = 2
  write(2, "(\n", 2)                      = 2
  write(2, "    ", 4)                     = 4
  write(2, "0", 1)                        = 1
  write(2, ",\n", 2)                      = 2
  write(2, ")", 1)                        = 1
  write(2, "\n", 1)                       = 1

Another dbg print.

  write(2, "thread '", 8)                 = 8
  write(2, "main", 4)                     = 4
  write(2, "' panicked at '", 15)         = 15
  write(2, "called `Result::unwrap_err()` on"..., 50) = 50

And here we are panicking.

(NB that source code line numbers here and debug output are different
because this strace was not made with the exact code you find in this
commit's parent.)

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

childio: Break out assert_is_status_1

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

packetframe: Provide methods for (partial) disassembly

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

mgmtchannels: Change type of ClientMgmtChannel

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

mgmtchannels: Break out new()

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

mgmtchannels: Genericise again

Client wants to be Box<dyn Read> etc. so it can be ssh pipes.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

timefd: Make Timed a trait

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

childio: tests: Properly indent mod test

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

childio: t_cat: Test leak

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

childio: Fix spurious error from leak drop when SIGTERMed

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

childio: tests: Test leaked false

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

childio: tests: Break out ENDING

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

childio: tests: Provide warning capture machinery

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

childio: tests: refactoring

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

childio: t_false: use type aliases

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

childio: t_false: break out setup

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>