strop-remote 0.25.0

Owned SSH remote-file transport over strop-workspace identity
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117

//! The one safe `ssh(1)` invocation policy for every strop-remote
//! transport (crate-private; pooled SFTP and supervised exec both build
//! on it, so no second flag set can drift into existence).
//!
//! User configuration stays in force — aliases, `Include`/`Match`, keys,
//! agent, `ProxyJump` — because no `-F` is passed and no identity options
//! override it. The options here remove every interactive or
//! side-effecting capability a general `ssh` invocation could have:
//!
//! - `-T` never allocates a TTY, so nothing can prompt or echo;
//! - `BatchMode=yes` fails authentication instead of asking;
//! - `StrictHostKeyChecking=yes` refuses unknown and changed host keys —
//!   never auto-accepts;
//! - `-a`/`-x`/`ClearAllForwardings` disable agent, X11 and port
//!   forwarding;
//! - `ControlMaster=no` with `ControlPath=none` creates no multiplexed
//!   master and attaches to none, so cancelling this operation can
//!   neither leak a master process nor disturb the user's other
//!   sessions, and termination of the local `ssh` really terminates the
//!   transport rather than a client of a persistent master;
//! - `RemoteCommand=none` and `ForkAfterAuthentication=no` neutralize
//!   the same-named user options.
//!
//! Pure construction: nothing here spawns. [`base_command`] carries no
//! destination at all; the destination (and whether it names the `sftp`
//! subsystem or a supervised remote command) is the caller's one
//! remaining decision.

use std::ffi::OsString;
use std::process::{Command, Stdio};
use strop_workspace::RemoteEndpoint;

/// The option argv — program excluded — shared by every transport.
///
/// Exposed separately from [`base_command`] so policy tests assert the
/// exact argv vector instead of pinning `Command` debug formatting.
pub(crate) fn base_argv(endpoint: &RemoteEndpoint) -> Vec<OsString> {
    let mut argv: Vec<OsString> = [
        "-T",
        "-a",
        "-x",
        "-o",
        "BatchMode=yes",
        "-o",
        "StrictHostKeyChecking=yes",
        "-o",
        "ClearAllForwardings=yes",
        "-o",
        "ControlMaster=no",
        "-o",
        "ControlPath=none",
        "-o",
        "RemoteCommand=none",
        "-o",
        "ForkAfterAuthentication=no",
        "-o",
        "ControlPersist=no",
    ]
    .iter()
    .map(OsString::from)
    .collect();
    if let Some(user) = endpoint.user() {
        argv.push("-l".into());
        argv.push(user.into());
    }
    if let Some(port) = endpoint.port() {
        argv.push("-p".into());
        argv.push(port.get().to_string().into());
    }
    argv
}

/// A dedicated, noninteractive connection with no destination selected.
/// Stdio is left to the caller.
pub(crate) fn base_command(endpoint: &RemoteEndpoint) -> Command {
    let mut command = Command::new("ssh");
    for argument in base_argv(endpoint) {
        command.arg(argument);
    }
    command
}

/// A dedicated, noninteractive connection to the remote `sftp`
/// subsystem, with all three pipes owned by the caller.
///
/// `--` ends option parsing so a host alias cannot be read as a flag;
/// the host is a standalone argv (literal IPv6 needs no brackets here)
/// and the only operand after it is the subsystem name. File SFTP stays
/// shell-independent: remote path names never appear in this argv.
pub(crate) fn sftp_subsystem(endpoint: &RemoteEndpoint) -> Command {
    let mut command = base_command(endpoint);
    command.arg("-s").arg("--").arg(endpoint.host()).arg("sftp");
    command
        .stdin(Stdio::piped())
        .stdout(Stdio::piped())
        .stderr(Stdio::piped());
    command
}

/// A dedicated, noninteractive connection whose remote command is the
/// supervised lifecycle bootstrap (`remote_line`), with all three pipes
/// piped for the caller to own.
///
/// `remote_line` is one argv element — the entire supervised command
/// string the remote login shell will parse. OpenSSH remote command
/// arguments are not a native argv transport, so `remote_line` must
/// already be correctly POSIX single-quote escaped by its builder (see
/// `exec::supervisor::command_line`).
pub(crate) fn exec_command(endpoint: &RemoteEndpoint, remote_line: &str) -> Command {
    let mut command = base_command(endpoint);
    command.arg("--").arg(endpoint.host()).arg(remote_line);
    command
        .stdin(Stdio::piped())
        .stdout(Stdio::piped())
        .stderr(Stdio::piped());
    command
}