server

type AuthRequest struct {
	ClientVersion string `protobuf:"bytes,1,opt,name=client_version,json=clientVersion,proto3" json:"client_version,omitempty"`
	RemoteAddr    string `protobuf:"bytes,2,opt,name=remote_addr,json=remoteAddr,proto3" json:"remote_addr,omitempty"`
	AuthorizedKey []byte `protobuf:"bytes,3,opt,name=authorized_key,json=authorizedKey,proto3" json:"authorized_key,omitempty"`
	// The relay's own end of the guest's connection, as remote_addr is the
	// guest's: the server half of the SSH_CONNECTION a guest's forced command
	// sees. Empty from a relay that predates it.
	LocalAddr string `protobuf:"bytes,4,opt,name=local_addr,json=localAddr,proto3" json:"local_addr,omitempty"`
	// contains filtered or unexported fields
}

type CreateSessionRequest struct {
	HostUser             string   `protobuf:"bytes,1,opt,name=hostUser,proto3" json:"hostUser,omitempty"`
	HostPublicKeys       [][]byte `protobuf:"bytes,2,rep,name=hostPublicKeys,proto3" json:"hostPublicKeys,omitempty"`
	ClientAuthorizedKeys [][]byte `protobuf:"bytes,3,rep,name=clientAuthorizedKeys,proto3" json:"clientAuthorizedKeys,omitempty"`
	// The next three fields claim a session ID derived from the host's key. The
	// relay honours them only with a proof; a request without one gets a random
	// ID.
	//
	// The per-run secret the ID derives from, together with the single host key
	// in hostPublicKeys.
	SessionSecret []byte `protobuf:"bytes,4,opt,name=sessionSecret,proto3" json:"sessionSecret,omitempty"`
	// Orders registrations of the same ID; at least 1.
	Generation uint64 `protobuf:"varint,5,opt,name=generation,proto3" json:"generation,omitempty"`
	// The host key's signature over this connection's SSH session ID, the
	// secret and the generation.
	HostKeyProof []byte `protobuf:"bytes,6,opt,name=hostKeyProof,proto3" json:"hostKeyProof,omitempty"`
	// contains filtered or unexported fields
}

type CreateSessionResponse struct {
	SessionID string `protobuf:"bytes,1,opt,name=sessionID,proto3" json:"sessionID,omitempty"`
	NodeAddr  string `protobuf:"bytes,2,opt,name=nodeAddr,proto3" json:"nodeAddr,omitempty"`
	SshUser   string `protobuf:"bytes,3,opt,name=ssh_user,json=sshUser,proto3" json:"ssh_user,omitempty"` // SSH username for client connections
	// True when this relay admits any host key (no --authorized-keys), so a
	// host can authenticate a redial with its session key alone.
	SessionKeyRedial bool `protobuf:"varint,4,opt,name=sessionKeyRedial,proto3" json:"sessionKeyRedial,omitempty"`
	// contains filtered or unexported fields
}

type ErrSessionNotFound struct {
	SessionID string
}

type HostCertSigner struct {
	Hostnames []string
}

type MemoryProvider struct {
	SocketPath string
	// contains filtered or unexported fields
}

type NetworkOptions map[string]string

type NetworkProvider interface {
	SetOpts(opts NetworkOptions) error
	Session() SessionDialListener
	SSHD() SSHDDialListener
	Name() string
	Opts() string
}

type Opt struct {
	HandshakeTimeout    time.Duration `mapstructure:"handshake-timeout"`
	SSHAddr             string        `mapstructure:"ssh-addr"`
	SSHProxyProtocol    bool          `mapstructure:"ssh-proxy-protocol"`
	WSAddr              string        `mapstructure:"ws-addr"`
	NodeAddr            string        `mapstructure:"node-addr"`
	AuthorizedKeysFiles []string      `mapstructure:"authorized-keys"`
	PrivateKeys         []string      `mapstructure:"private-key"`
	Hostnames           []string      `mapstructure:"hostname"`
	Network             string        `mapstructure:"network"`
	NetworkOpts         []string      `mapstructure:"network-opt"`
	MetricAddr          string        `mapstructure:"metric-addr"`
	Debug               bool          `mapstructure:"debug"`
	Routing             routing.Mode  `mapstructure:"routing"`
	ConsulURL           string        `mapstructure:"consul-url"`
	ConsulSessionTTL    string        `mapstructure:"consul-session-ttl"`
	SentryDSN           string        `mapstructure:"sentry-dsn"`
}

type Registration struct {
	Session *Session
	// ConfirmedAt is the send time of the lock-session creation this
	// registration's lease came from (memory: taken before the write). The
	// expiry budget counts from it, and the lease's TTL clock can't have
	// started earlier, so the budget can only end early.
	ConfirmedAt time.Time
	// contains filtered or unexported fields
}

type Route struct {
	NodeAddr   string
	Generation uint64
}

type SSHDDialListener interface {
	Listen() (net.Listener, error)
	Dial() (net.Conn, error)
	DialContext(ctx context.Context) (net.Conn, error)
}

type SSHRouting struct {
	HandshakeTimeout time.Duration
	HostSigners      []ssh.Signer
	Auth             *proxyAuth
	Logger           *slog.Logger
	MetricsProvider  provider.Provider
	// contains filtered or unexported fields
}

type Server struct {
	HandshakeTimeout    time.Duration
	NodeAddr            string
	AuthorizedKeysFiles []string
	HostSigners         []ssh.Signer
	Signers             []ssh.Signer
	NetworkProvider     NetworkProvider
	MetricsProvider     provider.Provider
	SessionManager      *SessionManager
	Logger              *slog.Logger
	// contains filtered or unexported fields
}

type ServerInfo struct {
	NodeAddr string
}

type Session struct {
	ID       string
	NodeAddr string
	// Generation orders registrations of the same ID. 0 is a legacy
	// registration: a random ID with no proof behind it.
	Generation           uint64
	HostUser             string
	HostPublicKeys       []ssh.PublicKey
	ClientAuthorizedKeys []ssh.PublicKey
}

type SessionDialListener interface {
	Listen(sesisonID string) (net.Listener, error)
	Dial(sessionID string) (net.Conn, error)
	DialContext(ctx context.Context, sessionID string) (net.Conn, error)
}

type SessionManager struct {
	// contains filtered or unexported fields
}

type SessionManagerConfig struct {
	Mode      routing.Mode
	Logger    *slog.Logger
	ConsulURL *url.URL
	ConsulTTL time.Duration
}

type SessionManagerOption func(*SessionManagerConfig)

type SessionStore interface {
	// Register stores s when its ID is absent or s has a higher generation
	// than the stored entry. Otherwise it returns an error wrapping
	// ErrSuperseded and writes nothing. A Register that fails may outlast ctx
	// by up to DefaultConsulTimeout, while it destroys a lease it created.
	Register(ctx context.Context, s *Session) (*Registration, error)
	// Reregister is the owner's rebuild of reg after a known loss: it stores
	// reg's session again under a new lease, as Register does, and may also
	// replace an entry of reg's own identity, which Register refuses. A store
	// with leases also replaces a value reg's own lease holds, whatever was
	// written into it. It orders, retries and cleans up as Register does.
	Reregister(ctx context.Context, reg *Registration) (*Registration, error)
	// Release removes reg's entry if reg still holds it.
	Release(ctx context.Context, reg *Registration) error
	// Renew keeps reg's entry alive. An error wrapping ErrLeaseLost means reg
	// no longer holds it; any other error leaves that unknown.
	Renew(ctx context.Context, reg *Registration) error
	// LeaseTTL is how long an unrenewed entry lasts; 0 if it doesn't expire.
	LeaseTTL() time.Duration
	// Get complete session data
	Get(sessionID string) (*Session, error)
	// Entry is Get with the lock session that holds the entry, "" in a store
	// without leases.
	Entry(sessionID string) (StoreEntry, error)
	// GetFresh reads sessionID from the store itself, skipping any cache, and
	// updates the cache with what it finds, the entry or its absence, as Get's
	// read-through does. It gives up once ctx is done.
	GetFresh(ctx context.Context, sessionID string) (*Session, error)
	// Delete session data, only for an entry this instance holds
	Delete(sessionID string) error
	// BatchDelete multiple sessions efficiently, likewise
	BatchDelete(sessionIDs []string) error
	// List all sessions (for cleanup and management)
	List() ([]*Session, error)
	// Observe has fn called with each view of every entry the store's watch
	// delivers; see SessionManager.Observe. A store no other writer shares
	// has nothing to watch, and never calls fn.
	Observe(fn func(epoch, index uint64, entries map[string]StoreEntry))
	// Close cleans up resources and stops background processes
	Close() error
}

type StoreEntry struct {
	Session *Session
	Lease   string
}

type UnixProvider struct {
	// contains filtered or unexported fields
}

type UserCertChecker struct {
	// IsUserAuthority reports whether a key may vouch for a certificate's
	// AuthRequest. Nil trusts nothing, so a call site that names no authority
	// gets no certificate identities: the safe direction to fail in, and the
	// one a future call site that forgets this field lands in.
	//
	// The relay names its own signing keys, because it is the only party that
	// mints upterm certificates. A host names the single relay key its host
	// key callback accepted.
	//
	// A relay offers one certificate per signing key, and x/crypto counts a
	// rejected public-key query against MaxAuthTries -- 6 by default, which
	// charm.land/ssh does not change. So a host pinning one key survives five
	// rejected offers and is disconnected on the sixth: the pinned key must be
	// among the first six a relay offers. One key, or two through a rotation,
	// is always fine. Raising the guest door's MaxAuthTries through a
	// ServerConfigCallback is the escape hatch if that ever binds.
	IsUserAuthority func(auth ssh.PublicKey) bool

	UserKeyFallback func(user string, key ssh.PublicKey) (ssh.PublicKey, error)
}

type UserCertSigner struct {
	SessionID   string
	User        string
	AuthRequest *AuthRequest
}