66 "encoding/json"
77 "errors"
88 "fmt"
9+ "hash/fnv"
910 "io"
1011 "net/http"
1112 "net/netip"
@@ -340,7 +341,7 @@ func (a *agent) collectMetadata(ctx context.Context, md codersdk.WorkspaceAgentM
340341 // if it can guarantee the clocks are synchronized.
341342 CollectedAt : now ,
342343 }
343- cmdPty , err := a .sshServer .CreateCommand (ctx , md .Script , nil )
344+ cmdPty , err := a .sshServer .CreateCommand (ctx , md .Script , nil , nil )
344345 if err != nil {
345346 result .Error = fmt .Sprintf ("create cmd: %+v" , err )
346347 return result
@@ -372,7 +373,6 @@ func (a *agent) collectMetadata(ctx context.Context, md codersdk.WorkspaceAgentM
372373 // Important: if the command times out, we may see a misleading error like
373374 // "exit status 1", so it's important to include the context error.
374375 err = errors .Join (err , ctx .Err ())
375-
376376 if err != nil {
377377 result .Error = fmt .Sprintf ("run cmd: %+v" , err )
378378 }
@@ -995,7 +995,6 @@ func (a *agent) createOrUpdateNetwork(manifestOK, networkOK *checkpoint) func(co
995995 if err := manifestOK .wait (ctx ); err != nil {
996996 return xerrors .Errorf ("no manifest: %w" , err )
997997 }
998- var err error
999998 defer func () {
1000999 networkOK .complete (retErr )
10011000 }()
@@ -1004,9 +1003,20 @@ func (a *agent) createOrUpdateNetwork(manifestOK, networkOK *checkpoint) func(co
10041003 network := a .network
10051004 a .closeMutex .Unlock ()
10061005 if network == nil {
1006+ keySeed , err := WorkspaceKeySeed (manifest .WorkspaceID , manifest .AgentName )
1007+ if err != nil {
1008+ return xerrors .Errorf ("generate seed from workspace id: %w" , err )
1009+ }
10071010 // use the graceful context here, because creating the tailnet is not itself tied to the
10081011 // agent API.
1009- network , err = a .createTailnet (a .gracefulCtx , manifest .AgentID , manifest .DERPMap , manifest .DERPForceWebSockets , manifest .DisableDirectConnections )
1012+ network , err = a .createTailnet (
1013+ a .gracefulCtx ,
1014+ manifest .AgentID ,
1015+ manifest .DERPMap ,
1016+ manifest .DERPForceWebSockets ,
1017+ manifest .DisableDirectConnections ,
1018+ keySeed ,
1019+ )
10101020 if err != nil {
10111021 return xerrors .Errorf ("create tailnet: %w" , err )
10121022 }
@@ -1146,7 +1156,13 @@ func (a *agent) trackGoroutine(fn func()) error {
11461156 return nil
11471157}
11481158
1149- func (a * agent ) createTailnet (ctx context.Context , agentID uuid.UUID , derpMap * tailcfg.DERPMap , derpForceWebSockets , disableDirectConnections bool ) (_ * tailnet.Conn , err error ) {
1159+ func (a * agent ) createTailnet (
1160+ ctx context.Context ,
1161+ agentID uuid.UUID ,
1162+ derpMap * tailcfg.DERPMap ,
1163+ derpForceWebSockets , disableDirectConnections bool ,
1164+ keySeed int64 ,
1165+ ) (_ * tailnet.Conn , err error ) {
11501166 // Inject `CODER_AGENT_HEADER` into the DERP header.
11511167 var header http.Header
11521168 if client , ok := a .client .(* agentsdk.Client ); ok {
@@ -1173,6 +1189,10 @@ func (a *agent) createTailnet(ctx context.Context, agentID uuid.UUID, derpMap *t
11731189 }
11741190 }()
11751191
1192+ if err := a .sshServer .UpdateHostSigner (keySeed ); err != nil {
1193+ return nil , xerrors .Errorf ("update host signer: %w" , err )
1194+ }
1195+
11761196 sshListener , err := network .Listen ("tcp" , ":" + strconv .Itoa (workspacesdk .AgentSSHPort ))
11771197 if err != nil {
11781198 return nil , xerrors .Errorf ("listen on the ssh port: %w" , err )
@@ -1850,3 +1870,20 @@ func PrometheusMetricsHandler(prometheusRegistry *prometheus.Registry, logger sl
18501870 }
18511871 })
18521872}
1873+
1874+ // WorkspaceKeySeed converts a WorkspaceID UUID and agent name to an int64 hash.
1875+ // This uses the FNV-1a hash algorithm which provides decent distribution and collision
1876+ // resistance for string inputs.
1877+ func WorkspaceKeySeed (workspaceID uuid.UUID , agentName string ) (int64 , error ) {
1878+ h := fnv .New64a ()
1879+ _ , err := h .Write (workspaceID [:])
1880+ if err != nil {
1881+ return 42 , err
1882+ }
1883+ _ , err = h .Write ([]byte (agentName ))
1884+ if err != nil {
1885+ return 42 , err
1886+ }
1887+
1888+ return int64 (h .Sum64 ()), nil
1889+ }
0 commit comments