Add native doctor auth diagnostics

src/bin/dosh-server.rs

@@ -13,9 +13,10 @@ use dosh::native::{
 };
 use dosh::protocol::{
     self, AttachOk, AttachReject, BootstrapAttachRequest, CLIENT_TO_SERVER, Frame, Input,
-    NativeAuthOkBody, NativeClientHelloBody, NativeServerHelloBody, NativeUserAuthBody, PacketKind,
-    ReplayWindow, Resize, ResumeRequest, SERVER_TO_CLIENT, StreamClose, StreamData, StreamOpen,
-    StreamOpenOk, StreamOpenReject, TicketAttachBody, TicketAttachEnvelope, TicketAttachOkEnvelope,
+    NativeAuthCheckOkBody, NativeAuthOkBody, NativeClientHelloBody, NativeServerHelloBody,
+    NativeUserAuthBody, PacketKind, ReplayWindow, Resize, ResumeRequest, SERVER_TO_CLIENT,
+    StreamClose, StreamData, StreamOpen, StreamOpenOk, StreamOpenReject, TicketAttachBody,
+    TicketAttachEnvelope, TicketAttachOkEnvelope,
 };
 use dosh::pty::{PtyHandle, PtyOutput, spawn_pty_session};
 use std::collections::{HashMap, VecDeque};
@@ -402,6 +403,38 @@ async fn handle_native_user_auth(
     }
     let body = protocol::decrypt_body(packet, &pending.session_key, CLIENT_TO_SERVER)?;
     let req: NativeUserAuthBody = protocol::from_body(&body)?;
+    if pending.client.requested_mode == "doctor" {
+        let check = {
+            let locked = state.lock().expect("server state poisoned");
+            verify_native_user_auth_from_config(
+                &locked.config,
+                &pending.client,
+                &pending.server,
+                &req.auth,
+            )
+            .context("verify native user auth")?;
+            NativeAuthCheckOkBody {
+                requested_user: pending.client.requested_user.clone(),
+                native_auth_enabled: locked.config.native_auth,
+                allow_tcp_forwarding: locked.config.allow_tcp_forwarding,
+                allow_remote_forwarding: locked.config.allow_remote_forwarding,
+                allow_agent_forwarding: locked.config.allow_agent_forwarding,
+                policy_flags: Vec::new(),
+            }
+        };
+        let body = protocol::to_body(&check)?;
+        let out = protocol::encode_encrypted(
+            PacketKind::NativeAuthCheckOk,
+            packet.header.conn_id,
+            1,
+            packet.header.seq,
+            &pending.session_key,
+            SERVER_TO_CLIENT,
+            &body,
+        )?;
+        socket.send_to(&out, peer).await?;
+        return Ok(());
+    }
 
     let attached: Result<(
         [u8; 16],