From e2c08da6a77e21f51bb3bf8d11ec7878c81a5155 Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Fri, 31 Jul 2026 09:21:07 +0100 Subject: [PATCH] fix: bound and complete console relay teardown, restore proxy_failed audit - Arm the unclaimed-relay watchdog in NewSession rather than Serve, so an agent that never opens its ProxyStream is bounded to 10s and reports reason "agent_timeout", per the design spec's failure-mode table. - Session.Close now also closes the accepted net.Conn (stored via setConn), so ConsoleProxy.Close() is an unconditional kill of the whole relay chain instead of only closing an already-idle listener. - Emit console.proxy_failed and end the console session from a defer in consoleTunnel guarded on relay.Reason(), since guac's OnDisconnect never runs when the connect callback errors -- which is the path every relay failure this feature introduces takes. Update the two docsite troubleshooting rows to match what the audit event can now actually show. --- docs/reference/troubleshooting.md | 2 +- docs/vantage/browser-console.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/reference/troubleshooting.md b/docs/reference/troubleshooting.md index d37119d..c7a012b 100644 --- a/docs/reference/troubleshooting.md +++ b/docs/reference/troubleshooting.md @@ -86,7 +86,7 @@ instantaneous. | Connects, then closes at once | guacd unreachable. Check `GUACD_ADDR` and that the container is running | | SSH rejects the key | The stored key has no private half, or is not on the target | | RDP fails on retry | Credentials are single-use and consumed at tunnel open enter them again | -| Hangs at connecting | The agent is offline, or nothing is listening on the protocol port on the target's own loopback address. Check the audit log for `console.proxy_failed` — its reason names which | +| Hangs, then disconnects | The agent never claimed the relay, nothing is listening on the protocol port on the target's own loopback address, or guacd never dialled in time. Check the audit log for `console.proxy_failed` — its reason (`agent_timeout`, `dial_refused`, `guacd_timeout`, `rejected`) names which | | Fails only in production | The reverse proxy is not forwarding WebSocket upgrade headers | ## Monitors report down when the service is up diff --git a/docs/vantage/browser-console.md b/docs/vantage/browser-console.md index f35afa1..796d59c 100644 --- a/docs/vantage/browser-console.md +++ b/docs/vantage/browser-console.md @@ -70,4 +70,4 @@ keystroke log. If you need that, it has to come from the target machine. | Connects then closes immediately | guacd unreachable check `GUACD_ADDR` and that the container is up | | SSH refuses the key | The stored key has no private half, or is not in the target's `authorized_keys` | | RDP fails on a fresh credential | Credentials are consumed on open; a retry needs them entered again | -| Hangs at connecting | The agent is offline, or nothing is listening on the protocol port on the target's own loopback address. Check the audit log for `console.proxy_failed` — its reason names which | +| Hangs, then disconnects | The agent never claimed the relay, nothing is listening on the protocol port on the target's own loopback address, or guacd never dialled in time. Check the audit log for `console.proxy_failed` — its reason (`agent_timeout`, `dial_refused`, `guacd_timeout`, `rejected`) names which |