network-infra-utility 0.3.0 → 0.6.0

data/service/ssh/ext/ssh_core/src/ssh_infra_sup.erl

@@ -0,0 +1,117 @@
+-module(ssh_infra_sup).
+-behaviour(supervisor).
+
+-export([start_link/0, generate_endpoint_file/0]).
+-export([init/1]).
+
+-include("ssh_ipc.hrl").
+
+%% @doc Start the infrastructure supervisor.
+%% Supervises: ssh_known_hosts_proxy, ssh_keepalive_mgr, ssh_ipc_coalesce, ssh_ipc_gateway
+start_link() ->
+    supervisor:start_link({local, ?MODULE}, ?MODULE, []).
+
+%% @doc Return the path to the IPC endpoint file for this VM instance.
+%% The file is written by generate_endpoint_and_token/0 during init.
+generate_endpoint_file() ->
+    Tmp = case os:getenv("TMPDIR") of
+        false ->
+            case os:type() of
+                {win32, _} -> os:getenv("TEMP");
+                _ -> "/tmp"
+            end;
+        Dir -> Dir
+    end,
+    UID = case os:type() of
+        {win32, _} -> os:getenv("USERNAME");
+        _ -> get_uid()
+    end,
+    filename:join(Tmp, "ssh_core_" ++ UID ++ ".endpoint").
+
+%% @doc Cross-version UID retrieval.
+%% os:getuid/0 was introduced in OTP 26; fall back to os:cmd("id -u")
+%% for older OTP versions (or source-compiled musl builds where the BIF
+%% may be absent).
+get_uid() ->
+    case erlang:function_exported(os, getuid, 0) of
+        true ->
+            integer_to_list(os:getuid());
+        false ->
+            %% OTP < 26 or musl build without getuid BIF
+            string:trim(os:cmd("id -u"))
+    end.
+
+%% @doc one_for_one, intensity 5/60s.
+%% Keeping infra processes separate from conn_sup so a single connection
+%% crash never cascades to gateway/keepalive/known_hosts.
+init([]) ->
+    %% Create ETS indices before any workers start
+    ets:new(ch_index, [named_table, public, set]),
+    ets:new(sftp_index, [named_table, public, set]),
+    ets:new(portfwd_index, [named_table, public, set]),
+
+    {ok, EndpointToken} = generate_endpoint_and_token(),
+    Children = [
+        #{
+            id => ssh_known_hosts_proxy,
+            start => {ssh_known_hosts_proxy, start_link, []},
+            restart => permanent,
+            type => worker
+        },
+        #{
+            id => ssh_ipc_coalesce,
+            start => {ssh_ipc_coalesce, start_link, []},
+            restart => permanent,
+            type => worker
+        },
+        #{
+            id => ssh_keepalive_mgr,
+            start => {ssh_keepalive_mgr, start_link, [?KEEPALIVE_DEFAULT_INTERVAL_MS]},
+            restart => permanent,
+            type => worker
+        },
+        #{
+            id => ssh_ipc_gateway,
+            start => {ssh_ipc_gateway, start_link, [EndpointToken]},
+            restart => permanent,
+            type => worker
+        }
+    ],
+    SupFlags = #{
+        strategy => one_for_one,
+        intensity => 5,
+        period => 60
+    },
+    {ok, {SupFlags, Children}}.
+
+%% @doc Generate IPC auth token, write endpoint file placeholder.
+%% Actual port is assigned later by ssh_ipc_gateway:start_listener().
+generate_endpoint_and_token() ->
+    Token = ssh_codec:encode_b64(crypto:strong_rand_bytes(32)),
+    TmpFile = generate_endpoint_file(),
+    %% Write placeholder: endpoint line will be rewritten by gateway
+    ok = file:write_file(TmpFile, <<"\n", Token/binary>>),
+    set_file_perms_600(TmpFile),
+    {ok, #{token => Token, file => TmpFile}}.
+
+build_endpoint() ->
+    case os:type() of
+        {win32, _} ->
+            %% On Windows, write a placeholder; actual port is assigned
+            %% by ssh_ipc_gateway:start_listener() after gen_tcp:listen(0).
+            {ok, <<"tcp://127.0.0.1:0">>};
+        _ ->
+            %% Unix/macOS: Unix socket
+            Path = <<"/tmp/ssh_core_", (integer_to_binary(os:getpid()))/binary, ".sock">>,
+            {ok, <<"unix:", Path/binary>>}
+    end.
+
+select_free_port() ->
+    {ok, Sock} = gen_tcp:listen(0, [{ip, {127, 0, 0, 1}}]),
+    {ok, Port} = inet:port(Sock),
+    gen_tcp:close(Sock),
+    {ok, Port}.
+
+set_file_perms_600(File) ->
+    _ = file:change_mode(File, 8#600),
+    ok.

data/service/ssh/ext/ssh_core/src/ssh_ipc.hrl

@@ -0,0 +1,80 @@
+%% ssh_ipc.hrl — Shared records, macros, and types for IPC and core modules.
+
+%% ---------- Protocol ----------
+-define(PROTOCOL_VER, <<"1.0">>).
+-define(MSG_DELIMITER, <<"\n">>).
+-define(MAX_MSG_SIZE, 2 * 1024 * 1024).  % 2 MB
+
+%% ---------- Timeouts (ms) ----------
+-define(CONNECT_TIMEOUT_MS, 60_000).
+-define(RPC_DEFAULT_TIMEOUT_MS, 30_000).
+-define(HELLO_ID, 1).
+-define(HOSTKEY_RESOLVE_TIMEOUT_MS, 30_000).
+
+%% ---------- Coalesce ----------
+-define(COALESCE_TICK_MS, 8).
+-define(COALESCE_WATERMARK_BYTES, 16 * 1024).
+-define(FLOW_PAUSE_THRESHOLD, 512 * 1024).
+-define(FLOW_RESUME_THRESHOLD, 128 * 1024).
+
+%% ---------- Keepalive ----------
+-define(KEEPALIVE_DEFAULT_INTERVAL_MS, 30_000).
+-define(KEEPALIVE_DEFAULT_MAX_FAIL, 3).
+
+%% ---------- Reconnect ----------
+-define(RECONNECT_BASE_MS, 5_000).
+-define(RECONNECT_MAX_MS, 60_000).
+-define(RECONNECT_MAX_ATTEMPTS, 5).
+
+%% ---------- IPC client record ----------
+-record(client, {
+    socket :: gen_tcp:socket() | port(),
+    authed = false :: boolean(),
+    pending = #{} :: #{integer() => {erlang:timestamp(), term()}},
+    send_q = queue:new() :: queue:queue(binary()),
+    flow_blocked = false :: boolean()
+}).
+
+%% ---------- Connection record (conn_worker) ----------
+-record(conn, {
+    id :: binary(),
+    spec :: map(),
+    ssh_ref :: reference() | undefined,
+    channels = #{} :: #{binary() => pid()},
+    next_ch_seq = 1 :: pos_integer(),
+    reconnect_count = 0 :: non_neg_integer(),
+    options :: [proplists:property()],
+    fail_reason :: term() | undefined,
+    proxy_sock_fun :: function() | undefined
+}).
+
+%% ---------- Channel record (channel_stm) ----------
+-record(ch, {
+    id :: binary(),
+    conn_id :: binary(),
+    ssh_ref :: reference(),
+    ssh_chan_id :: integer(),
+    type :: shell | exec | subsystem,
+    term_type :: binary() | undefined,
+    cols :: pos_integer(),
+    rows :: pos_integer(),
+    command :: binary() | undefined,
+    coalesce_ref :: pid() | undefined
+}).
+
+%% ---------- SFTP session record ----------
+-record(sftp, {
+    id :: binary(),
+    conn_id :: binary(),
+    ssh_ref :: reference(),
+    sftp_pid :: pid() | undefined
+}).
+
+%% ---------- Gateway state ----------
+-record(gw_state, {
+    listen_sock,
+    clients = #{} :: #{reference() => #client{}},
+    auth_token :: binary(),
+    routes :: #{binary() => {module(), atom()}},
+    coalesce_ref :: pid() | undefined
+}).

data/service/ssh/ext/ssh_core/src/ssh_ipc_coalesce.erl

@@ -0,0 +1,94 @@
+-module(ssh_ipc_coalesce).
+-behaviour(gen_server).
+
+%% High-frequency push coalescer with backpressure watermark.
+%% Receives per-channel data via enqueue/2 and flushes batched
+%% channel.data.batch pushes every COALESCE_TICK_MS or when
+%% the buffer reaches COALESCE_WATERMARK_BYTES.
+
+-export([start_link/0, enqueue/3, pause/1, resume/1]).
+-export([init/1, handle_call/3, handle_cast/2, handle_info/2, terminate/2]).
+
+-include("ssh_ipc.hrl").
+
+-record(st, {
+    buffer = #{} :: #{binary() => [binary()]},  % channel_id => [data]
+    buffer_size = 0 :: non_neg_integer(),
+    tick_ref :: reference() | undefined
+}).
+
+%% ---------- Public API ----------
+
+%% @doc Start the coalesce gen_server.
+start_link() ->
+    gen_server:start_link({local, ?MODULE}, ?MODULE, [], []).
+
+%% @doc Enqueue data for a channel. Called by ssh_channel_stm.
+enqueue(CoalesceRef, ChannelId, Data) ->
+    gen_server:cast(CoalesceRef, {enqueue, ChannelId, Data}).
+
+%% @doc Signal flow pause for a channel (backpressure).
+pause(ChannelId) ->
+    gen_server:cast(?MODULE, {pause, ChannelId}).
+
+%% @doc Signal flow resume for a channel.
+resume(ChannelId) ->
+    gen_server:cast(?MODULE, {resume, ChannelId}).
+
+%% ---------- Callbacks ----------
+
+init([]) ->
+    TickRef = schedule_tick(),
+    {ok, #st{tick_ref = TickRef}}.
+
+handle_call(_Req, _From, State) ->
+    {reply, {error, not_implemented}, State}.
+
+handle_cast({enqueue, ChannelId, Data}, #st{buffer = Buf, buffer_size = Sz} = S) ->
+    NewBuf = maps:update_with(ChannelId, fun(Items) -> Items ++ [Data] end, [Data], Buf),
+    NewSz = Sz + byte_size(Data),
+    S1 = S#st{buffer = NewBuf, buffer_size = NewSz},
+    %% Flush immediately if watermark reached
+    S2 = case NewSz >= ?COALESCE_WATERMARK_BYTES of
+        true -> do_flush(S1);
+        false -> S1
+    end,
+    {noreply, S2};
+
+handle_cast({pause, ChannelId}, S) ->
+    ssh_ipc_gateway:push_event(<<"channel.flow.pause">>, #{<<"channel_id">> => ChannelId}),
+    {noreply, S};
+
+handle_cast({resume, ChannelId}, S) ->
+    ssh_ipc_gateway:push_event(<<"channel.flow.resume">>, #{<<"channel_id">> => ChannelId}),
+    {noreply, S};
+
+handle_cast(_Msg, State) ->
+    {noreply, State}.
+
+handle_info(tick, S) ->
+    S1 = do_flush(S),
+    S2 = S1#st{tick_ref = schedule_tick()},
+    {noreply, S2};
+
+handle_info(_Info, State) ->
+    {noreply, State}.
+
+terminate(_Reason, _State) ->
+    ok.
+
+%% ---------- Internal ----------
+
+schedule_tick() ->
+    erlang:send_after(?COALESCE_TICK_MS, self(), tick).
+
+%% @doc Flush the coalesce buffer as a channel.data.batch push.
+do_flush(#st{buffer = Buf} = S) when map_size(Buf) =:= 0 ->
+    S;
+do_flush(#st{buffer = Buf} = S) ->
+    Items = maps:fold(fun(ChId, Datas, Acc) ->
+        B64 = ssh_codec:encode_b64(iolist_to_binary(Datas)),
+        [#{<<"id">> => ChId, <<"data">> => B64} | Acc]
+    end, [], Buf),
+    ssh_ipc_gateway:push_batch(#{<<"items">> => Items}),
+    S#st{buffer = #{}, buffer_size = 0}.