From 849951be1d1a7ee9f9302006ccb187bf5b4e36f3 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Wed, 22 Jul 2026 23:51:18 +0300 Subject: =?UTF-8?q?feat:=20DTail=20fork=20=E2=80=94=20server/client=20feat?= =?UTF-8?q?ure=20development?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Squashed development of the snonux/dtail fork's product code (internal/, cmd/) since diverging from mimecast/dtail. Major areas: - Read/output path: the former "turbo" channel-less path is now the single, default server-side read/output path for cat/grep/tail and MapReduce; the old channel-based path and its config/env toggles were removed. - MapReduce: single aggregate implementation (server + serverless) fed directly by a processor pipeline, with input-exhausted finalization via the shutdown coordinator; high-concurrency and data-race fixes. - Journal source reads (journal:unit.service) via journalctl, Linux-gated behind a journal-v1 capability. - Auth-key fast reconnect: in-memory per-user public-key cache with TTL/max-keys, registered over an authenticated session (AUTHKEY), checked before authorized_keys. - Interactive query reload (--interactive-query) with SESSION START/UPDATE generation boundaries and capability negotiation. - Client-side deadlines: --timeout / --shutdownAfter as context deadlines; follow shutdown handling. - Client logging: diagnostics-only daily log by default, opt-in payload tee via --log-payload. - Numerous correctness fixes (buffer-pool double-recycle races, EOF-sentinel leaks, glob-expansion cap, TOCTOU in CSV parsing) with accompanying unit tests. Co-Authored-By: Claude Opus 4.8 --- internal/ssh/ssh_test.go | 113 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 113 insertions(+) create mode 100644 internal/ssh/ssh_test.go (limited to 'internal/ssh/ssh_test.go') diff --git a/internal/ssh/ssh_test.go b/internal/ssh/ssh_test.go new file mode 100644 index 0000000..f413145 --- /dev/null +++ b/internal/ssh/ssh_test.go @@ -0,0 +1,113 @@ +package ssh + +import ( + "crypto/rand" + "crypto/rsa" + "encoding/pem" + "errors" + "os" + "path/filepath" + "testing" + + gossh "golang.org/x/crypto/ssh" +) + +func TestPrivateKeySignerLoadsUnencryptedKey(t *testing.T) { + keyFile := filepath.Join(t.TempDir(), "id_rsa") + privateKey, err := rsa.GenerateKey(rand.Reader, 1024) + if err != nil { + t.Fatalf("GenerateKey failed: %v", err) + } + + if err := os.WriteFile(keyFile, EncodePrivateKeyToPEM(privateKey), 0o600); err != nil { + t.Fatalf("WriteFile failed: %v", err) + } + + signer, err := PrivateKeySigner(keyFile) + if err != nil { + t.Fatalf("PrivateKeySigner failed: %v", err) + } + if signer == nil { + t.Fatalf("PrivateKeySigner returned nil signer") + } +} + +func TestPrivateKeySignerLoadsEncryptedKeyWithEnvPassphrase(t *testing.T) { + keyFile := filepath.Join(t.TempDir(), "id_rsa") + privateKey, err := rsa.GenerateKey(rand.Reader, 1024) + if err != nil { + t.Fatalf("GenerateKey failed: %v", err) + } + + block, err := gossh.MarshalPrivateKeyWithPassphrase(privateKey, "", []byte("secret-passphrase")) + if err != nil { + t.Fatalf("MarshalPrivateKeyWithPassphrase failed: %v", err) + } + if err := os.WriteFile(keyFile, pem.EncodeToMemory(block), 0o600); err != nil { + t.Fatalf("WriteFile failed: %v", err) + } + + t.Setenv("DTAIL_KEY_PASSPHRASE", "secret-passphrase") + + signer, err := PrivateKeySigner(keyFile) + if err != nil { + t.Fatalf("PrivateKeySigner failed: %v", err) + } + if signer == nil { + t.Fatalf("PrivateKeySigner returned nil signer") + } +} + +func TestPrivateKeySignerReturnsPassphraseMissingWithoutEnv(t *testing.T) { + keyFile := filepath.Join(t.TempDir(), "id_rsa") + privateKey, err := rsa.GenerateKey(rand.Reader, 1024) + if err != nil { + t.Fatalf("GenerateKey failed: %v", err) + } + + block, err := gossh.MarshalPrivateKeyWithPassphrase(privateKey, "", []byte("secret-passphrase")) + if err != nil { + t.Fatalf("MarshalPrivateKeyWithPassphrase failed: %v", err) + } + if err := os.WriteFile(keyFile, pem.EncodeToMemory(block), 0o600); err != nil { + t.Fatalf("WriteFile failed: %v", err) + } + + _, err = PrivateKeySigner(keyFile) + if err == nil { + t.Fatalf("PrivateKeySigner succeeded without passphrase env") + } + + var passphraseMissingErr *gossh.PassphraseMissingError + if !errors.As(err, &passphraseMissingErr) { + t.Fatalf("PrivateKeySigner returned %T, want PassphraseMissingError", err) + } +} + +func TestPrivateKeySignerRejectsIncorrectEnvPassphrase(t *testing.T) { + keyFile := filepath.Join(t.TempDir(), "id_rsa") + privateKey, err := rsa.GenerateKey(rand.Reader, 1024) + if err != nil { + t.Fatalf("GenerateKey failed: %v", err) + } + + block, err := gossh.MarshalPrivateKeyWithPassphrase(privateKey, "", []byte("secret-passphrase")) + if err != nil { + t.Fatalf("MarshalPrivateKeyWithPassphrase failed: %v", err) + } + if err := os.WriteFile(keyFile, pem.EncodeToMemory(block), 0o600); err != nil { + t.Fatalf("WriteFile failed: %v", err) + } + + t.Setenv("DTAIL_KEY_PASSPHRASE", "wrong-passphrase") + + _, err = PrivateKeySigner(keyFile) + if err == nil { + t.Fatalf("PrivateKeySigner succeeded with wrong passphrase env") + } + + var passphraseMissingErr *gossh.PassphraseMissingError + if errors.As(err, &passphraseMissingErr) { + t.Fatalf("PrivateKeySigner returned PassphraseMissingError instead of parse failure") + } +} -- cgit v1.2.3