feat: add bounded admin WebSocket backend (Phase 8D.5)

- Require current admin cookie sessions, Origin checks and single-use tickets - Reuse the shared console with session-aware authorization and slot allocation - Add HTTPD-owned I/O, bounded buffering and revocation cleanup - Prevent LRU eviction of serial clients and stale admin socket closure - Reject unsupported web-shell mutations before side effects - Add host regressions, a smoke client and resource accounting Validated by user sign-off after a 15-minute full-client soak at 230400 baud, with a few broker drops under heavy output. Browser UI remains for Phase 8D.6; numeric memory reserves remain open.
2026-09-06 14:41:41 +02:00
parent e5dce12ed4
commit aeb2043396
37 changed files with 3651 additions and 91 deletions
@@ -2,6 +2,14 @@
 static admin_ssh_console_token_t a = { .slot_index=0, .session_id=7, .slot_generation=1 };
 static admin_ssh_console_token_t b = { .slot_index=1, .session_id=7, .slot_generation=1, .transport=1 };
 static user_principal_t admin = { .role=USER_ROLE_ADMIN };
+static bool live[2] = {true, true};
+static void (*current_hook)(void);
+static bool is_current(const admin_ssh_console_token_t *t, const user_principal_t *p)
+{
+    assert(!lock_depth && p->role==USER_ROLE_ADMIN);
+    if (current_hook) current_hook();
+    return live[t->slot_index];
+}
 static bool drained(const admin_ssh_console_token_t *t)
 { assert(!lock_depth); assert(t->session_id==7); return owner_drained; }
 static esp_err_t perform(const admin_ssh_console_token_t *t,
@@ -9,6 +17,7 @@ static esp_err_t perform(const admin_ssh_console_token_t *t,
 { (void)t; (void)arg; assert(!lock_depth); assert(action==ADMIN_CONSOLE_DEFER_SELF_CLOSE); ++actions; return ESP_OK; }
 static const admin_console_owner_t owner = {
    .supported_actions=1U << ADMIN_CONSOLE_DEFER_SELF_CLOSE, .drained=drained, .perform=perform,
+    .is_current=is_current,
 };
 static void pump(void (*task)(void *)) { if (!setjmp(loop_done)) task(NULL); }
 static void feed(const admin_ssh_console_token_t *t, const char *s)
@@ -40,12 +49,141 @@ static void close_during_command(void)
    assert(admin_ssh_console_open_owned(&a,&admin,&owner)==ESP_ERR_INVALID_STATE);
 }
 static void setup_dispatch(void)
-{ s_dispatch_remote=true; s_dispatch_token=a; s_sessions[0].executing=true; s_sessions[0].command_pending=true; }
+{ s_dispatch_remote=true; s_dispatch_token=a; s_dispatch_principal=admin;
+  s_sessions[0].executing=true; s_sessions[0].command_pending=true; }
+static void reopen_during_current(void)
+{
+    current_hook=NULL;
+    admin_ssh_console_close(&a);
+    ++a.slot_generation;
+    assert(admin_ssh_console_open_owned(&a,&admin,&owner)==ESP_OK);
+    live[0]=false; /* Failed old validation must not close the replacement. */
+}
+static void revoked_reply(void) { hidden_reply(); live[0]=false; }
+static unsigned checks;
+static void stale_at_execution(void) { if (++checks==2) live[0]=false; }
+static void account_revoked_reply(void) { hidden_reply(); principal_current=false; }
+static void closed_reply(void) { hidden_reply(); close_prompt(); }
+static unsigned waits;
+static void unanswered(void)
+{
+    ++waits;
+    if (waits==1) xSemaphoreGive(s_prompt_done); /* Stale wake while still waiting. */
+    if (waits==3) live[0]=false; /* No close notification. */
+}
+static void prompt_command(void)
+{
+    uint8_t answer[32]; size_t n=99;
+    assert(admin_ssh_console_dispatch_read_input("Password: ",answer,sizeof(answer),true,&n)==ESP_ERR_NOT_FOUND);
+    assert(n==0);
+    for (size_t i=0;i<sizeof(answer);++i) assert(!answer[i]);
+    assert(!s_sessions[0].active && !s_sessions[0].prompt_length);
+    for (size_t i=0;i<sizeof(s_sessions[0].prompt_input);++i) assert(!s_sessions[0].prompt_input[i]);
+}
+static void test_currentness(void)
+{
+    ++a.slot_generation;
+    admin_console_owner_t missing=owner; missing.is_current=NULL;
+    assert(admin_ssh_console_open_owned(&a,&admin,&missing)==ESP_ERR_INVALID_ARG);
+    assert(admin_ssh_console_open_owned(&a,&admin,&owner)==ESP_OK);
+    unsigned before=runs;
+    feed(&a,"owner stale\r"); live[0]=false; pump(worker_task);
+    assert(runs==before && !s_sessions[0].active && principal_current);
+    feed(&b,"isolated\r"); pump(worker_task); assert(runs==++before);
+    live[0]=true; ++a.slot_generation;
+    assert(admin_ssh_console_open_owned(&a,&admin,&owner)==ESP_OK);
+    feed(&a,"reuse\r"); current_hook=reopen_during_current; pump(worker_task);
+    assert(runs==before && token_matches(&s_sessions[0],&a));
+    live[0]=true;
+    feed(&a,"last check\r"); checks=0; current_hook=stale_at_execution;
+    pump(worker_task); current_hook=NULL;
+    assert(checks==2 && runs==before && !s_sessions[0].active);
+    live[0]=true; ++a.slot_generation;
+    assert(admin_ssh_console_open_owned(&a,&admin,&owner)==ESP_OK);
+    void (*hooks[])(void)={revoked_reply,account_revoked_reply,closed_reply,unanswered};
+    for (size_t i=0;i<sizeof(hooks)/sizeof(hooks[0]);++i) {
+        clear_output(&a); ticks=0; waits=0;
+        feed(&a,"prompt\r"); prompt_hook=hooks[i]; command_hook=prompt_command;
+        pump(worker_task); prompt_hook=NULL; command_hook=NULL;
+        assert(runs==++before);
+        admin_session_t empty={0}; assert(!memcmp(&empty,&s_sessions[0],sizeof(empty)));
+        if (i==3) assert(waits==3 && ticks==750);
+        /* Dispatcher recovered, so trusted UART0 work still runs. */
+        admin_request_t uart={.origin=ADMIN_REQUEST_UART0};
+        assert(xQueueSend(s_request_queue,&uart,0)); pump(worker_task); assert(runs==++before);
+        live[0]=true; principal_current=true; ++a.slot_generation;
+        assert(admin_ssh_console_open_owned(&a,&admin,&owner)==ESP_OK);
+    }
+    setup_dispatch(); clear_output(&a); live[0]=false;
+    uint8_t answer[32]; size_t n=99;
+    assert(admin_ssh_console_dispatch_read_input("Not published",answer,sizeof(answer),true,&n)==ESP_ERR_NOT_FOUND);
+    assert(!n && !s_sessions[0].output_length);
+    secure_wipe(&s_sessions[0],sizeof(s_sessions[0])); live[0]=true;
+    ++a.slot_generation; assert(admin_ssh_console_open_owned(&a,&admin,&owner)==ESP_OK);
+    clear_output(&a);
+    s_sessions[0].output_start=4094;
+    assert(worker_write(&a,"abcdef"));
+    uint8_t out[8];
+    assert(admin_ssh_console_read_output(&a,out,3,&n)==ESP_OK && n==3 && !memcmp(out,"abc",3));
+    assert(!s_sessions[0].output[4094] && !s_sessions[0].output[4095] && !s_sessions[0].output[0]);
+    assert(!memcmp(s_sessions[0].output+1,"def",3));
+    assert(admin_ssh_console_read_output(&a,out,sizeof(out),&n)==ESP_OK && n==3 && !memcmp(out,"def",3));
+    for (size_t i=0;i<sizeof(s_sessions[0].output);++i) assert(!s_sessions[0].output[i]);
+    admin_ssh_console_close(&a);
+    puts("PASS: owner stale/account current isolation, callback close/reuse, revoked submitted prompts, periodic unanswered invalidation/stale wake, UART recovery, consumed output wiping");
+}
+static void test_shared_admission(void)
+{
+    admin_ssh_console_token_t web={.slot_index=255, .session_id=7,
+        .slot_generation=42, .transport=ADMIN_CONSOLE_TRANSPORT_WEB};
+    admin_ssh_console_token_t ssh=web; ssh.transport=ADMIN_CONSOLE_TRANSPORT_SSH;
+    static const admin_console_owner_t second_owner={
+        .supported_actions=1U << ADMIN_CONSOLE_DEFER_SELF_CLOSE,
+        .drained=drained, .perform=perform, .is_current=is_current,
+    };
+    assert(admin_ssh_console_open_available(&web,&admin,&owner)==ESP_OK);
+    assert(web.slot_index==0 && web.session_id==7 && web.slot_generation==42 &&
+           web.transport==ADMIN_CONSOLE_TRANSPORT_WEB);
+    assert(admin_ssh_console_open_available(&ssh,&admin,&second_owner)==ESP_OK);
+    assert(ssh.slot_index==1 && ssh.session_id==7 && ssh.slot_generation==42 && !ssh.transport);
+    assert(s_sessions[0].owner==&owner && s_sessions[1].owner==&second_owner);
+    unsigned before=runs;
+    clear_output(&web);
+    feed(&web,"\"web\" \"stop\"\r"); pump(worker_task);
+    assert(runs==before && !s_control_queue->count);
+    uint8_t diagnostic[512]={0}; size_t received=0;
+    assert(admin_ssh_console_read_output(&web,diagnostic,sizeof(diagnostic)-1,&received)==ESP_OK);
+    assert(strstr((char *)diagnostic,"unavailable from the web console"));
+    feed(&web,"\"user\" \"password\" admin --generate\r"); pump(worker_task);
+    assert(runs==before && !s_control_queue->count);
+    feed(&web,"\"web\" \"status\"\r"); pump(worker_task); assert(runs==before+1);
+    /* UART0 bypasses remote policy and remains the recovery path. */
+    admin_request_t uart={.origin=ADMIN_REQUEST_UART0, .line="user recover --force"};
+    assert(xQueueSend(s_request_queue,&uart,0)); pump(worker_task); assert(runs==before+2);
+    runs=before;
+    admin_ssh_console_token_t full=web; full.slot_index=99;
+    assert(admin_ssh_console_open_available(&full,&admin,&owner)==ESP_ERR_INVALID_STATE);
+    assert(full.slot_index==99);
+    admin_ssh_console_token_t stale=web;
+    s_sessions[0].executing=true;
+    admin_ssh_console_close(&web);
+    assert(admin_ssh_console_open_available(&full,&admin,&owner)==ESP_ERR_INVALID_STATE);
+    assert(full.slot_index==99); /* Inactive executing slots still consume capacity. */
+    s_sessions[0].executing=false;
+    ++web.slot_generation;
+    assert(admin_ssh_console_open_available(&web,&admin,&owner)==ESP_OK);
+    admin_ssh_console_close(&stale);
+    assert(!admin_ssh_console_accepts_input(&stale) && admin_ssh_console_accepts_input(&web));
+    assert(admin_ssh_console_accepts_input(&ssh));
+    admin_ssh_console_close(&web); admin_ssh_console_close(&ssh);
+    puts("PASS: two-owner shared admission, colliding preferred indices/IDs, full capacity, executing reservation and stale tokens");
+}
 int main(void)
 {
    assert(admin_ssh_console_init()==ESP_OK);
    assert(admin_ssh_console_open_owned(&a,&admin,&owner)==ESP_ERR_INVALID_STATE);
    assert(admin_ssh_console_start_uart_frontend()==ESP_OK);
+    test_shared_admission();
    principal_current=false;
    assert(admin_ssh_console_open_owned(&a,&admin,&owner)==ESP_ERR_INVALID_STATE);
    principal_current=true;
@@ -74,6 +212,7 @@ int main(void)
    ++a.slot_generation; assert(admin_ssh_console_open_owned(&a,&admin,&owner)==ESP_OK);
    pump(worker_task); assert(runs==1);
    feed(&a,"revoked\r"); principal_current=false; pump(worker_task); assert(runs==1); principal_current=true;
+    ++a.slot_generation; assert(admin_ssh_console_open_owned(&a,&admin,&owner)==ESP_OK);
    admin_request_t uart={ .origin=ADMIN_REQUEST_UART0 };
    assert(xQueueSend(s_request_queue,&uart,0)); pump(worker_task); assert(runs==2);
    feed(&a,"close\r"); command_hook=close_during_command; pump(worker_task); command_hook=NULL;
@@ -128,5 +267,6 @@ int main(void)
    admin_ssh_console_close(&a);
    assert(ssh_output_write(&a,"x",1)==-1 && errno==EPIPE);
    assert(!lock_depth);
+    test_currentness();
    puts("PASS: admission/identity, two owners, completion contention/reopen, history, queued stale/revoked work, UART dispatch, hidden/disconnected prompts, exit-to-SELF_CLOSE, deferred rejection/drain/close, 5s output backpressure");
 }