From 849951be1d1a7ee9f9302006ccb187bf5b4e36f3 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Wed, 22 Jul 2026 23:51:18 +0300 Subject: =?UTF-8?q?feat:=20DTail=20fork=20=E2=80=94=20server/client=20feat?= =?UTF-8?q?ure=20development?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Squashed development of the snonux/dtail fork's product code (internal/, cmd/) since diverging from mimecast/dtail. Major areas: - Read/output path: the former "turbo" channel-less path is now the single, default server-side read/output path for cat/grep/tail and MapReduce; the old channel-based path and its config/env toggles were removed. - MapReduce: single aggregate implementation (server + serverless) fed directly by a processor pipeline, with input-exhausted finalization via the shutdown coordinator; high-concurrency and data-race fixes. - Journal source reads (journal:unit.service) via journalctl, Linux-gated behind a journal-v1 capability. - Auth-key fast reconnect: in-memory per-user public-key cache with TTL/max-keys, registered over an authenticated session (AUTHKEY), checked before authorized_keys. - Interactive query reload (--interactive-query) with SESSION START/UPDATE generation boundaries and capability negotiation. - Client-side deadlines: --timeout / --shutdownAfter as context deadlines; follow shutdown handling. - Client logging: diagnostics-only daily log by default, opt-in payload tee via --log-payload. - Numerous correctness fixes (buffer-pool double-recycle races, EOF-sentinel leaks, glob-expansion cap, TOCTOU in CSV parsing) with accompanying unit tests. Co-Authored-By: Claude Opus 4.8 --- internal/server/handlers/authkeycommand_test.go | 117 ++++++++++++++++++++++++ 1 file changed, 117 insertions(+) create mode 100644 internal/server/handlers/authkeycommand_test.go (limited to 'internal/server/handlers/authkeycommand_test.go') diff --git a/internal/server/handlers/authkeycommand_test.go b/internal/server/handlers/authkeycommand_test.go new file mode 100644 index 0000000..a454e94 --- /dev/null +++ b/internal/server/handlers/authkeycommand_test.go @@ -0,0 +1,117 @@ +package handlers + +import ( + "context" + "crypto/ed25519" + "encoding/base64" + "testing" + "time" + + "github.com/mimecast/dtail/internal" + "github.com/mimecast/dtail/internal/config" + "github.com/mimecast/dtail/internal/lcontext" + sshserver "github.com/mimecast/dtail/internal/ssh/server" + userserver "github.com/mimecast/dtail/internal/user/server" + + gossh "golang.org/x/crypto/ssh" +) + +func TestHandleAuthKeyCommandSuccess(t *testing.T) { + handler := newAuthKeyTestHandler("authkey-success-user", true) + key := handlerTestPublicKey(t, 31) + keyArg := base64.StdEncoding.EncodeToString(key.Marshal()) + + commandFinished := false + handler.handleAuthKeyCommand(context.Background(), lcontext.LContext{}, 2, + []string{"AUTHKEY", keyArg}, func() { + commandFinished = true + }) + + if !commandFinished { + t.Fatalf("Expected commandFinished callback to be called") + } + if message := readServerMessage(t, handler.serverMessages); message != "AUTHKEY OK\n" { + t.Fatalf("Unexpected response: %q", message) + } + if !handler.authKeyStore.Has(handler.user.Name, key) { + t.Fatalf("Expected key to be stored for user") + } + handler.authKeyStore.Remove(handler.user.Name, key) +} + +func TestHandleAuthKeyCommandFeatureDisabled(t *testing.T) { + handler := newAuthKeyTestHandler("authkey-disabled-user", false) + key := handlerTestPublicKey(t, 32) + keyArg := base64.StdEncoding.EncodeToString(key.Marshal()) + + handler.handleAuthKeyCommand(context.Background(), lcontext.LContext{}, 2, + []string{"AUTHKEY", keyArg}, func() {}) + + if message := readServerMessage(t, handler.serverMessages); message != "AUTHKEY ERR feature disabled\n" { + t.Fatalf("Unexpected response: %q", message) + } + if handler.authKeyStore.Has(handler.user.Name, key) { + t.Fatalf("Expected no key to be stored while feature is disabled") + } +} + +func TestHandleAuthKeyCommandInvalidPayload(t *testing.T) { + handler := newAuthKeyTestHandler("authkey-invalid-user", true) + + handler.handleAuthKeyCommand(context.Background(), lcontext.LContext{}, 2, + []string{"AUTHKEY", "not-base64"}, func() {}) + + if message := readServerMessage(t, handler.serverMessages); message != "AUTHKEY ERR invalid base64\n" { + t.Fatalf("Unexpected response for invalid base64: %q", message) + } + + validButNonSSH := base64.StdEncoding.EncodeToString([]byte("not-an-ssh-key")) + handler.handleAuthKeyCommand(context.Background(), lcontext.LContext{}, 2, + []string{"AUTHKEY", validButNonSSH}, func() {}) + if message := readServerMessage(t, handler.serverMessages); message != "AUTHKEY ERR invalid public key\n" { + t.Fatalf("Unexpected response for invalid key bytes: %q", message) + } +} + +func newAuthKeyTestHandler(userName string, authKeyEnabled bool) *ServerHandler { + return &ServerHandler{ + baseHandler: baseHandler{ + done: internal.NewDone(), + serverMessages: make(chan string, 4), + user: &userserver.User{Name: userName}, + }, + serverCfg: &config.ServerConfig{ + AuthKeyEnabled: authKeyEnabled, + }, + authKeyStore: sshserver.NewAuthKeyStore(time.Hour, 5), + } +} + +func handlerTestPublicKey(t *testing.T, seedByte byte) gossh.PublicKey { + t.Helper() + + seed := make([]byte, ed25519.SeedSize) + for i := range seed { + seed[i] = seedByte + } + + privateKey := ed25519.NewKeyFromSeed(seed) + publicKey, err := gossh.NewPublicKey(privateKey.Public()) + if err != nil { + t.Fatalf("Unable to build ssh public key: %s", err.Error()) + } + + return publicKey +} + +func readServerMessage(t *testing.T, messages <-chan string) string { + t.Helper() + + select { + case message := <-messages: + return message + case <-time.After(time.Second): + t.Fatalf("Timed out waiting for server message") + return "" + } +} -- cgit v1.2.3