67 Commits

Author	SHA1	Message	Date
DuProcess	be98fb8d91	Harden release artifact verification	2026-07-13 01:03:16 -04:00
DuProcess	7ebc6533a7	Reject trailing bytes in protocol packets	2026-07-12 23:42:00 -04:00
DuProcess	fbedd54eaa	Make 1.0 checks run full soaks	2026-07-12 23:34:22 -04:00
DuProcess	247a1669ce	Align CI with release checks	2026-07-12 23:31:16 -04:00
DuProcess	de179dd3e9	Run all-target tests in release gates	2026-07-12 23:28:34 -04:00
DuProcess	52a319fe9d	Preserve restored screen during ticket reattach	2026-07-12 22:54:39 -04:00
DuProcess	ab256285d1	Align Windows client auth defaults	2026-07-12 22:41:48 -04:00
DuProcess	b076a84dc7	Reject unsafe Windows update cache segments	2026-07-12 22:37:51 -04:00
DuProcess	c0b9e17214	Harden Unix update source cache path	2026-07-12 22:35:16 -04:00
DuProcess	c29c43d4db	Reuse Windows update source cache	2026-07-12 22:20:35 -04:00
DuProcess	306a636e32	Mark RC Gitea releases as prereleases	2026-07-12 22:09:19 -04:00
DuProcess	a529061e58	Compare prerelease versions correctly for updates	2026-07-12 22:05:21 -04:00
DuProcess	5a85e6508d	Require checksums for prebuilt installers	2026-07-12 22:00:01 -04:00
DuProcess	7f48af45cd	Require complete release uploads by default	2026-07-12 21:37:27 -04:00
DuProcess	ae619c6a78	Skip stale latest prebuilts in installers	2026-07-12 21:34:25 -04:00
DuProcess	b2c407ab6e	Publish complete release artifacts to Gitea	2026-07-12 12:21:26 -04:00
DuProcess	4b9d05a185	Cover traced ticket reattach recovery	2026-07-12 12:18:09 -04:00
DuProcess	2c5b9ab30d	Preserve symlinks in file copy	2026-07-11 18:07:13 -04:00
DuProcess	bfe75dfbd2	Harden file resume prefix validation	2026-07-11 17:59:41 -04:00
DuProcess	bae0d0ed56	Harden stream queues and hostile network tests	2026-07-11 17:33:49 -04:00
DuProcess	99e318ca6b	Harden reconnect paths under UDP churn	2026-07-11 12:34:18 -04:00
DuProcess	5a29925422	Stamp release builds from exported git metadata	2026-07-11 11:34:23 -04:00
DuProcess	6aa03cca63	Make package artifact checks deterministic	2026-07-10 23:07:50 -04:00
DuProcess	039dc641b3	Fix resumed copy truncation	2026-07-09 19:10:17 -04:00
DuProcess	a23f610f20	Keep generated sessions alive across updates	2026-07-07 15:34:24 -04:00
DuProcess	6b12b3dfe0	Harden terminal reconnect packet handling	2026-07-07 11:48:59 -04:00
DuProcess	5c54601cdf	Prepare Dosh 1.0.0 rc1	2026-07-04 16:58:15 -04:00
DuProcess	c085137250	Add hostile network TUI soak gate	2026-07-04 14:37:23 -04:00
DuProcess	a8ba852f16	Keep Dosh server service alive	2026-07-03 14:51:47 -04:00
DuProcess	80699dcf9d	Stabilize terminal frame recovery	2026-07-03 10:06:23 -04:00
DuProcess	274c0f505e	Stop sandboxing remote shells	2026-07-02 20:03:42 -04:00
DuProcess	b393c0e5d5	Allow netlink for terminal network monitors	2026-07-02 19:40:30 -04:00
DuProcess	c40f5459ba	Keep live TUI output raw under retransmit pressure	2026-07-02 19:21:43 -04:00
DuProcess	a48aa15308	Preserve raw terminal output for TUIs	2026-07-02 18:34:09 -04:00
DuProcess	691b58e531	Harden update and release tooling	2026-07-01 19:48:46 -04:00
DuProcess	bbf6ffd725	Add native services and embeddable transport SDK	2026-06-30 19:21:23 -04:00
DuProcess	9d0396dbf9	Fix reconnect stale keys and TUI status rendering	2026-06-27 11:46:26 -04:00
DuProcess	f9a378a9cd	Harden release readiness gates	2026-06-22 17:14:59 -04:00
DuProcess	fcc21c7aef	Make restart reconnect persistent	2026-06-21 10:51:12 -04:00
DuProcess	a029564d80	Add Mosh parity hardening	2026-06-21 10:23:06 -04:00
DuProcess	7884ea2796	Add prebuilt update path	2026-06-19 16:40:58 -04:00
DuProcess	774da7371e	Chunk terminal output below MTU	2026-06-19 16:30:51 -04:00
DuProcess	90e53f4b68	Add reliable stream retransmission	2026-06-19 16:00:51 -04:00
DuProcess	d0d6f59cdf	Add launch hardening gates	2026-06-18 09:45:27 -04:00
DuProcess	25d9a6aefa	Expand native auth and benchmark gates	2026-06-18 09:29:06 -04:00
DuProcess	8b1af51bc6	Persist sessions across server restarts via per-session holders ... Make dosh terminal sessions survive a dosh-server restart (crash/upgrade/systemctl restart): a reattaching client lands on the SAME shell with screen state intact, instead of a fresh one. Design: when persist_sessions is on (new config, default true) each terminal session's shell runs in a small detached per-session holder process (the dosh-server binary re-exec'd as `dosh-server hold`). The holder double-forks + setsid into its own session, opens the PTY, spawns the shell as ITS child, and serves the PTY master fd over a per-session Unix socket via SCM_RIGHTS. The server adopts that fd to build a PtyHandle that DETACHES (does not kill the shell) on drop, so a server exit leaves holder + shell alive. On startup the server scans the runtime dir under sessions_dir/run, reconnects to each live holder, receives the master fd again, restores the persisted vt100 screen, and rebuilds the Session. Screen/scrollback (server-memory only) is mirrored to disk atomically: byte-throttled on the output hot path plus a 2s periodic flush, and restored on re-adoption so reattach repaints. Truly-abandoned persistent sessions are still reaped per the existing grace logic by asking the holder to shut down. Anything in the persistent path failing degrades gracefully to the original in-process shell. PtyHandle gains an Owned (kill-on-drop, unchanged default) vs Adopted (detach-on-drop) backing; resize on an adopted master uses TIOCSWINSZ. No wire-format change, so protocol::VERSION stays 3. New deps: libc (direct). New config: persist_sessions (default true); existing integration tests pin it false to keep exercising the non-persistent path unchanged. Adds tests/integration_smoke.rs::session_survives_server_restart_same_ shell_and_screen: attaches, sets `cd /tmp; export MARK=...`, paints a screen marker, KILLs the server, restarts it on the same config, reattaches and asserts same shell pid + MARK + PWD + restored screen. Plus persist.rs unit tests (name round-trip, screen save/load, dead-holder scan cleanup, SCM_RIGHTS fd round-trip). cargo fmt --check and cargo test green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 14:19:09 -04:00
DuProcess	9a52d65beb	Add opt-in, security-gated SSH-agent forwarding ... Item 3: SSH-agent forwarding, double-gated (client -A/forward_agent AND server allow_agent_forwarding) and off by default on both ends. Wire: new ForwardingKind::Agent (appended, existing bincode discriminants unchanged). Bumped protocol VERSION 2 -> 3 so a pre-agent peer answers with a clear version-mismatch reject instead of a deserialize error. Client: -A / --forward-agent flag; requires local SSH_AUTH_SOCK. Requests an Agent forwarding during native auth (agent forwarding requires native auth) and, on a server-initiated StreamOpen carrying the reserved @dosh-agent sentinel, splices the stream into the local agent unix socket (separate agent_writers map, TCP forwarding paths untouched). Rejects agent StreamOpens unless it opted in, so a server cannot reach the agent without consent. Server: when the client opted in and allow_agent_forwarding is set, binds a per-session proxy unix socket (dir 0700, socket 0600) before the shell spawns, exports its path as the session's SSH_AUTH_SOCK, and tunnels each connection back to the client over the agent sentinel stream. Applies only to freshly spawned shells (documented). Socket cleaned up on auth/forward failure and when the accept loop ends. SECURITY rationale documented in comments. Tests: 2 end-to-end integration tests (full chain identities round-trip via a PTY-hosted client + looping fake agent; and "no -A => no proxy socket"). Docs updated (README forwarding + disconnect-status note, spec §12.1). fmt + full test suite green (122 tests). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 11:10:44 -04:00
DuProcess	2c7654138b	Merge track A: VERSION discipline, rekey, migration, rate limiting, O(1) index	2026-06-14 10:47:14 -04:00
DuProcess	f9c1973c13	Harden native protocol: version discipline, rekey, migration, rate limit, O(1) client index ... Track A protocol hardening for native-v1. 1. Protocol VERSION discipline (protocol.rs, native.rs, dosh-server.rs, dosh-client.rs): bump protocol::VERSION to 2 and NATIVE_PROTOCOL_VERSION to 2. Foreign wire-version datagrams now get a clear named "protocol version mismatch - upgrade dosh" reject from the server instead of a silent timeout (peek_foreign_wire_version + VERSION_MISMATCH_REASON). The native handshake's plaintext protocol_version is also checked server-side before any crypto via check_native_protocol_version, returning a typed ProtocolVersionMismatch. 2. Transport rekey (spec section 11/9): server rotates a client's traffic key after rekey_after_packets OR rekey_after_secs (config knobs). Rotated keys are derived independently of the handshake keys from the current key plus fresh server CSPRNG material shipped confidentially in an AEAD Rekey packet (derive_rekey_session_key). The previous epoch's key is retained briefly so in-flight pre-rekey packets still decrypt (matched by session_key_id), and stale-epoch packets are ignored, not fatal. Client handles Rekey/RekeyAck. 3. Connection migration (spec section 11): every authenticated, replay-accepted packet now migrates client.endpoint to the new source address (input, resize, ping, ack, resume, stream*, rekey-ack), not just resume. Ping now verifies its AEAD tag before acting so migration cannot be spoofed. 4. Native auth rate limiting: per-source-IP token bucket (native_auth_rate_limit_per_minute) enforced in handle_native_client_hello BEFORE any X25519/Ed25519 work; over-limit hellos get a non-crypto reject. 5. Speed: replaced O(sessions x clients) per-packet linear scans with an O(1) HashMap<conn_id, session_name> index in ServerState, kept in sync on every client insert/remove (attach handlers, detach, remove_client, cleanup reap, session-exit drain). New config keys (ServerConfig, with defaults): rekey_after_packets = 100000, rekey_after_secs = 3600. Tests: version-mismatch reject (no hang), rate-limit flood reject, rekey round-trip end-to-end + key-derivation unit tests, source-address migration, client-index sync + cleanup purge. fmt and full test suite green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 10:45:44 -04:00
DuProcess	9b0f09a8a8	Add hostile-network tests, parser fuzzing, and CI fuzz job ... Track B (milestone 5 / §16 hardening): - tests/hostile_network.rs: in-process UDP relay/shim between a test client and a real dosh-server that can drop, reorder, and duplicate datagrams, and rebind its upstream socket mid-session. Asserts: session survives loss/reorder, duplicated/replayed Input is applied at most once, stale packets after resume are ignored (not fatal), and a client source-address change preserves the session. - tests/parser_robustness.rs: deterministic randomized tests throwing garbage at every reachable public parser (packet decode, from_body for all protocol/native structs, authorized_keys, known_hosts, host-key line, ssh-ed25519 blob, bootstrap, attach ticket); asserts none panic. - fuzz/: standalone cargo-fuzz crate (own [workspace], non-default member) with libfuzzer-sys harnesses for packet decode, from_body, authorized_keys, known_hosts, handshake structs+verifiers, and attach tickets. README documents the run command. - .github/workflows/ci.yml: add fuzz-smoke job (nightly + cargo-fuzz, short -max_total_time per target, tolerant if tooling unavailable); existing fmt/test/build/bench steps unchanged. cargo fmt --check and cargo test are green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 10:31:47 -04:00