mnemosyne/mnemosyne_ssh/ at main · isaaccorbrey.com/mnemosyne · Tangled

isaaccorbrey.com / mnemosyne

0

A Rust reimplementation of the Tangled knotserver.

0

mnemosyne / mnemosyne_ssh

2 folders 1 file

at main

Isaac Corbrey observability: Convert SSH subsystem to tracing 2mo ago

observability: Convert SSH subsystem to tracing #[instrument] on the four handler callbacks that delineate a session: auth_publickey, exec_request, start_git_session, plus the spawned git-op task inside dispatch_pending. auth_publickey records algorithm, fingerprint, authenticated_did, outcome (accepted | rejected_unknown_key | accept_any_mode). exec_request records command, parsed service, outcome (started_git_session | rejected_unknown_command | echo_accept_any_mode). start_git_session adds repo_did + advertisement_bytes once known. The spawned dispatch task uses tracing::info_span! + .instrument() because tokio::spawn doesn't propagate spans automatically; without that wrap the receive_pack / upload_pack inner spans would float as orphans. The eprintln on cleanup failure becomes tracing::warn! tied to the dispatch span — the failure stays best-effort but is now queryable. Small visibility tweak in mnemosyne_protocol: Service::as_str() is now `pub` so the SSH instrumentation can record the service as a span field across the crate boundary.

2 months ago

ssh: Proptest SSH public-key canonicalization The auth path stores keys as their OpenSSH text encoding and looks them up by exact-string match. That contract relies on `ssh_key::PublicKey::to_openssh()` being: 1. Deterministic — calling it twice on the same key produces byte-identical output 2. Roundtrip-stable — encode → parse → re-encode is byte- identical If either breaks, a registered key offered by a client could miss the lookup silently and auth fails with no useful diagnostic. These proptests pin both properties across the algorithms we expect in practice (Ed25519, ECDSA P-256). Sanity proptest added as a third case: two independent random keypairs of the same algorithm must produce distinct public keys. Guards against a regression where seeding accidentally collapses to a fixed key — that would make all clients authenticate as the same principal, which would be very bad. RSA omitted from the algorithm strategy: key generation is multi-second per key and the serialization-stability property is algorithm-independent for our exact-match use case. If we ever see RSA-specific drift in the wild, add it back with a dedicated low-case-count branch. 64 cases per property × 3 properties × ~2 algorithms = ~384 verified cases. Test runs in 0.25s on a warm build — Ed25519 and ECDSA generation are both cheap. What's NOT covered here: pack-over-SSH parity (the SSH-transport equivalent of protocol_push_roundtrip's proptest). That needs genuine test infrastructure — a generic git+openssh-client testcontainer for hermetic git invocation, host.docker.internal routing back to our SSH server — flagged as a separate slice worth tackling when there's appetite, not bundled in here.

2 months ago

observability: Convert SSH subsystem to tracing #[instrument] on the four handler callbacks that delineate a session: auth_publickey, exec_request, start_git_session, plus the spawned git-op task inside dispatch_pending. auth_publickey records algorithm, fingerprint, authenticated_did, outcome (accepted | rejected_unknown_key | accept_any_mode). exec_request records command, parsed service, outcome (started_git_session | rejected_unknown_command | echo_accept_any_mode). start_git_session adds repo_did + advertisement_bytes once known. The spawned dispatch task uses tracing::info_span! + .instrument() because tokio::spawn doesn't propagate spans automatically; without that wrap the receive_pack / upload_pack inner spans would float as orphans. The eprintln on cleanup failure becomes tracing::warn! tied to the dispatch span — the failure stays best-effort but is now queryable. Small visibility tweak in mnemosyne_protocol: Service::as_str() is now `pub` so the SSH instrumentation can record the service as a span field across the crate boundary.

2 months ago