11c67a7fb1
Replace HMAC-based registration with proper 9P Tauth flow: - First client to connect sets the secret via Tauth afid write - Server stores secret in memory, returns session token - Subsequent clients must provide matching secret - Secret never in env vars or disk, only transmitted over socket Changes: - server9p.go: Authenticate() replaces RegisterAgent/GetAgent - client9p.go: Dial() does Tauth handshake (write secret, read token) - spawn.go: generates secret, no longer passes via TOOLSRV_SECRET env - auth9p.go: simplified to just GenerateSecret() - spec9p.go: removed /register file, token validation at connection level - cmd/toolsrv/server.go: handleAuth/handleAuthWrite/handleAuthRead Security model: - Session generates secret on Spawn() - All agents share session's secret via ProcessKeeper - Socket permissions (local) or SSH (remote) protect transport - Secret dies with toolsrv process, new secret on respawn Added integration tests verifying: - First connection sets secret - Reconnect with same secret works - Wrong secret rejected - ProcessKeeper reconnect/respawn behavior - Concurrent connections |
||
|---|---|---|
| .. | ||
| test | ||
| .gitignore | ||
| main.go | ||
| sandbox-remote.yaml | ||
| server.go | ||