Function run_ssh_server

crates/openshell-supervisor-process/src/ssh.rs:101–162

(
    listen_path: PathBuf,
    ready_tx: tokio::sync::oneshot::Sender<Result<()>>,
    policy: SandboxPolicy,
    workdir: Option<String>,
    netns_fd: Option<RawFd>,
    proxy_url: Option<String>,

#[allow(clippy::too_many_arguments, clippy::implicit_hasher)]
pub async fn run_ssh_server(
    listen_path: PathBuf,
    ready_tx: tokio::sync::oneshot::Sender<Result<()>>,
    policy: SandboxPolicy,
    workdir: Option<String>,
    netns_fd: Option<RawFd>,
    proxy_url: Option<String>,
    ca_file_paths: Option<(PathBuf, PathBuf)>,
    provider_credentials: ProviderCredentialState,
    user_environment: HashMap<String, String>,
) -> Result<()> {
    let (listener, config, ca_paths) = match ssh_server_init(&listen_path, &ca_file_paths) {
        Ok(v) => {
            // Signal that the SSH server has bound the socket and is ready to
            // accept connections. The parent task awaits this before spawning
            // the entrypoint process, ensuring exec requests won't race
            // against server startup.
            let _ = ready_tx.send(Ok(()));
            v
        }
        Err(err) => {
            let _ = ready_tx.send(Err(err));
            return Ok(());
        }
    };

    loop {
        let (stream, _peer) = listener.accept().await.into_diagnostic()?;
        let config = config.clone();
        let policy = policy.clone();
        let workdir = workdir.clone();
        let proxy_url = proxy_url.clone();
        let ca_paths = ca_paths.clone();
        let provider_credentials = provider_credentials.clone();
        let user_environment = user_environment.clone();

        tokio::spawn(async move {
            if let Err(err) = handle_connection(
                stream,
                config,
                policy,
                workdir,
                netns_fd,
                proxy_url,
                ca_paths,
                provider_credentials,
                user_environment,
            )
            .await
            {
                ocsf_emit!(
                    SshActivityBuilder::new(openshell_ocsf::ctx::ctx())
                        .activity(ActivityId::Fail)
                        .severity(SeverityId::Low)
                        .status(StatusId::Failure)
                        .message(format!("SSH connection failed: {err}"))
                        .build()
                );