Add opt-in remote shell

Author: myobie

Cargo.lock

@@ -1,12 +1,14 @@
 [package]
 name = "fabric"
-version = "0.1.3"
+version = "0.1.4"
 edition = "2024"
 
 [dependencies]
 anyhow = "1"
 clap = { version = "4", features = ["derive"] }
+crossterm = "0.29.0"
 iroh = "1.0.2"
+portable-pty = "0.9.0"
 rand = "0.10.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

Cargo.toml

@@ -134,14 +134,17 @@ fabric remove <nodeid-or-name>
 Remove a trusted peer.
 
 ```sh
-fabric up [--foreground]
+fabric up [--foreground] [--allow-shell]
 ```
 
 Start the local fabric daemon. Without `--foreground`, this spawns a background
 daemon and logs to `<home>/logs/daemon.log`. After the daemon is ready, `fabric
 up` runs the same echo-ping reachability check used by `fabric status` and
 prints one line per trusted peer.
 
+`--allow-shell` opts this daemon into serving remote shells for trusted peers.
+It is off by default.
+
 ```sh
 fabric down
 ```
@@ -179,6 +182,20 @@ back, and prints the round-trip latency. When available, it also reports whether
 iroh used a direct, relay, or mixed path. Use this first when bringing up a new
 machine.
 
+```sh
+fabric shell <peer>
+```
+
+Open an interactive remote shell on a trusted peer over fabric. The server side
+must have been started with `fabric up --allow-shell`; a default `fabric up`
+refuses shell requests. The shell runs as the remote daemon's user and uses the
+remote user's `$SHELL`.
+
+Enabling shell is a security-sensitive opt-in: every trusted peer in
+`peers.toml` can obtain a remote shell while `--allow-shell` is active. Keep the
+allow-list tight, enable shell only on machines where that access is intended,
+and stop/restart the daemon without `--allow-shell` to turn it back off.
+
 ## Declarative Peer Config
 
 `peers.toml` is intentionally human-editable. The minimal form is:

README.md

@@ -1,6 +1,7 @@
 use std::{
-    collections::{HashMap, HashSet},
+    collections::{HashMap, HashSet, hash_map::DefaultHasher},
     env, fs,
+    hash::{Hash, Hasher},
     io::Write,
     path::{Path, PathBuf},
     str::FromStr,
@@ -91,10 +92,10 @@ impl FabricHome {
 
     pub fn dial_socket_path(&self, peer: EndpointId, protocol: &str) -> PathBuf {
         let peer = peer.to_string();
-        let short_peer = &peer[..peer.len().min(12)];
+        let short_peer = &peer[..peer.len().min(8)];
         self.root
             .join("dials")
-            .join(format!("{}-{}.sock", short_peer, safe_component(protocol)))
+            .join(format!("{}-{:08x}.sock", short_peer, short_hash(protocol)))
     }
 }
 
@@ -311,20 +312,8 @@ pub fn validate_protocol(protocol: &str) -> Result<Vec<u8>> {
     Ok(protocol.as_bytes().to_vec())
 }
 
-fn safe_component(input: &str) -> String {
-    let out: String = input
-        .chars()
-        .map(|ch| {
-            if ch.is_ascii_alphanumeric() || matches!(ch, '-' | '_' | '.') {
-                ch
-            } else {
-                '_'
-            }
-        })
-        .collect();
-    if out.is_empty() {
-        "protocol".to_string()
-    } else {
-        out
-    }
+fn short_hash(input: &str) -> u64 {
+    let mut hasher = DefaultHasher::new();
+    input.hash(&mut hasher);
+    hasher.finish()
 }

src/config.rs

@@ -11,6 +11,7 @@ pub enum ControlRequest {
     Expose { protocol: String, socket: PathBuf },
     Dial { peer: String, protocol: String },
     Ping { peer: String },
+    Shell { peer: String },
     Shutdown,
 }
 
@@ -34,6 +35,9 @@ pub enum ControlResponse {
     Dial {
         socket: PathBuf,
     },
+    Shell {
+        socket: PathBuf,
+    },
     Pong {
         peer: String,
         bytes: usize,

src/control.rs

@@ -28,6 +28,7 @@ use tokio_util::sync::CancellationToken;
 use crate::{
     config::{FabricHome, Peer, PeerBook, load_or_create_identity, validate_protocol},
     control::{ControlRequest, ControlResponse, PeerReachability},
+    shell,
 };
 
 const BUILTIN_ECHO_ALPN: &[u8] = b"fabric/echo/0";
@@ -64,18 +65,23 @@ pub struct DaemonState {
     exposures: RwLock<HashMap<Vec<u8>, PathBuf>>,
     dial_sockets: Mutex<HashMap<(String, String), PathBuf>>,
     builtin_echo_hits: AtomicUsize,
+    allow_shell: bool,
     cancel: CancellationToken,
 }
 
 impl DaemonState {
-    async fn new(home: FabricHome, cancel: CancellationToken) -> Result<Arc<Self>> {
+    async fn new(
+        home: FabricHome,
+        cancel: CancellationToken,
+        allow_shell: bool,
+    ) -> Result<Arc<Self>> {
         home.prepare()?;
         let secret_key = load_or_create_identity(&home)?;
         let peer_book = PeerBook::load(&home)?;
         let allowed = Arc::new(RwLock::new(peer_book.trusted_ids()));
         let endpoint = Endpoint::builder(presets::N0)
             .secret_key(secret_key)
-            .alpns(vec![BUILTIN_ECHO_ALPN.to_vec()])
+            .alpns(accepted_alpns(&HashMap::new()))
             .hooks(AllowListHook {
                 allowed: allowed.clone(),
             })
@@ -92,6 +98,7 @@ impl DaemonState {
             exposures: RwLock::new(HashMap::new()),
             dial_sockets: Mutex::new(HashMap::new()),
             builtin_echo_hits: AtomicUsize::new(0),
+            allow_shell,
             cancel,
         }))
     }
@@ -113,8 +120,8 @@ impl DaemonState {
 
     pub async fn expose(&self, protocol: &str, socket: PathBuf) -> Result<()> {
         let alpn = validate_protocol(protocol)?;
-        if alpn == BUILTIN_ECHO_ALPN {
-            bail!("{protocol:?} is reserved for fabric's built-in echo protocol");
+        if matches_reserved_alpn(&alpn) {
+            bail!("{protocol:?} is reserved for fabric's built-in protocols");
         }
         if !socket.is_absolute() {
             bail!("expose socket must be an absolute path");
@@ -170,6 +177,10 @@ impl DaemonState {
 
     pub async fn dial(&self, peer: &str, protocol: &str) -> Result<PathBuf> {
         let alpn = validate_protocol(protocol)?;
+        self.dial_alpn(peer, protocol, alpn).await
+    }
+
+    async fn dial_alpn(&self, peer: &str, protocol: &str, alpn: Vec<u8>) -> Result<PathBuf> {
         let peer_addr = self.peer_book.read().await.resolve(peer)?;
         let key = (peer_addr.id.to_string(), protocol.to_string());
 
@@ -314,8 +325,12 @@ pub struct FabricNode {
 
 impl FabricNode {
     pub async fn start(home: FabricHome) -> Result<Self> {
+        Self::start_with_options(home, false).await
+    }
+
+    pub async fn start_with_options(home: FabricHome, allow_shell: bool) -> Result<Self> {
         let cancel = CancellationToken::new();
-        let state = DaemonState::new(home, cancel).await?;
+        let state = DaemonState::new(home, cancel, allow_shell).await?;
         let task = tokio::spawn(serve(state.clone()));
         Ok(Self { state, task })
     }
@@ -354,8 +369,11 @@ impl FabricNode {
     }
 }
 
-pub async fn run_daemon(home: FabricHome) -> Result<()> {
-    FabricNode::start(home).await?.wait().await
+pub async fn run_daemon(home: FabricHome, allow_shell: bool) -> Result<()> {
+    FabricNode::start_with_options(home, allow_shell)
+        .await?
+        .wait()
+        .await
 }
 
 pub async fn send_control(home: &FabricHome, request: ControlRequest) -> Result<ControlResponse> {
@@ -464,6 +482,12 @@ async fn process_control_request(
                 transport: pong.transport,
             }
         }
+        ControlRequest::Shell { peer } => {
+            let socket = state
+                .dial_alpn(&peer, shell::SHELL_PROTOCOL, shell::SHELL_ALPN.to_vec())
+                .await?;
+            ControlResponse::Shell { socket }
+        }
         ControlRequest::Shutdown => {
             state.cancel.cancel();
             ControlResponse::Ok
@@ -501,6 +525,11 @@ async fn process_incoming_iroh(incoming: Incoming, state: Arc<DaemonState>) -> R
         handle_builtin_echo(connection, state).await?;
         return Ok(());
     }
+    if alpn == shell::SHELL_ALPN {
+        let connection = accepting.await?;
+        handle_builtin_shell(connection, state).await?;
+        return Ok(());
+    }
 
     let socket = {
         let exposures = state.exposures.read().await;
@@ -528,13 +557,30 @@ async fn handle_builtin_echo(connection: Connection, state: Arc<DaemonState>) ->
     Ok(())
 }
 
+async fn handle_builtin_shell(connection: Connection, state: Arc<DaemonState>) -> Result<()> {
+    let (mut send, mut recv) = connection.accept_bi().await?;
+    if state.allow_shell {
+        shell::serve_shell_session(&mut recv, &mut send).await?;
+    } else {
+        shell::serve_shell_disabled(&mut send).await?;
+    }
+    send.finish()?;
+    connection.closed().await;
+    Ok(())
+}
+
 fn accepted_alpns(exposures: &HashMap<Vec<u8>, PathBuf>) -> Vec<Vec<u8>> {
-    let mut alpns = Vec::with_capacity(exposures.len() + 1);
+    let mut alpns = Vec::with_capacity(exposures.len() + 2);
     alpns.push(BUILTIN_ECHO_ALPN.to_vec());
+    alpns.push(shell::SHELL_ALPN.to_vec());
     alpns.extend(exposures.keys().cloned());
     alpns
 }
 
+fn matches_reserved_alpn(alpn: &[u8]) -> bool {
+    alpn == BUILTIN_ECHO_ALPN || alpn == shell::SHELL_ALPN
+}
+
 fn classify_connection_transport(connection: &Connection) -> Option<String> {
     let paths = connection.paths();
     let mut selected_ip = false;

src/daemon.rs

@@ -8,6 +8,7 @@ use iroh::{
 pub mod config;
 pub mod control;
 pub mod daemon;
+pub mod shell;
 
 const SPIKE_ALPN: &[u8] = b"fabric/spike/echo/0";