rcmd

type Handler func(req *Request) error

type Request struct {
	RemoteUser string
	LocalUser  string
	Command    string
	Addr       netip.Addr

	// Stdout is the primary connection. Stderr is the dial-back
	// connection when the client asked for one, io.Discard otherwise.
	Stdout io.Writer
	Stderr io.Writer

	// Stdin is the rest of the primary connection after the command,
	// which a shell command (rsh exec /bin/sh) reads its command stream
	// from. It carries only what the client sends next, unbounded.
	Stdin io.Reader
}

type Server struct {
	Handler Handler

	// AllowIP filters clients; nil allows everyone.
	AllowIP func(netip.Addr) bool

	// AllowHighPorts disables the reserved-port check on the client's
	// source port. The check stays on in production - the miniroot's
	// rcmd client uses reserved ports - and off in unprivileged tests.
	AllowHighPorts bool

	// Logger, when set, receives leveled log output: DEBUG for every
	// connection and the parsed request/stderr dial-back detail, INFO
	// for each command run, WARN for a connection refused or malformed,
	// ERROR for a command the Handler refused or failed - a command
	// this side couldn't or wouldn't serve must show up here, not just
	// on the client's own stderr. A nil Logger is silent.
	Logger *logging.Logger

	// IdleTimeout bounds the time between reads on a connection: every
	// read - the request-head fields and, for a shell command, every
	// line a Handler pulls from Request.Stdin - resets it. Zero means
	// no timeout, unbounded wait, the historical behavior. Without this,
	// a shell session (rsh exec /bin/sh) blocks its handler goroutine
	// reading Stdin for as long as the client holds the connection open
	// and stays silent - stuck, hostile, or simply gone.
	IdleTimeout time.Duration

	// RejectHook, when set, is called when a connection is refused before
	// any command runs - a non-reserved source port or a client outside the
	// filter - with the client address and a short reason. It lets a caller
	// record a refusal the Handler never sees.
	RejectHook func(addr netip.Addr, reason string)
	// contains filtered or unexported fields
}