Add web request timeout and unify user-facing failure messages

Apply a 30s per-request timeout to the web API client so a wedged web
backend cannot keep an SSH session hanging indefinitely.

When a container connection fails after auth, send a UUID-tagged
message on stderr that recommends retrying first and falling back to
contacting course staff. The same wording is now used for the
auth-time backend-failure path and for the shell, exec, and subsystem
request paths, so support can correlate the error code the student
reports against a single log site.

Author: Nils Bars

ssh-reverse-proxy/src/api.rs

@@ -85,6 +85,11 @@ pub struct ApiClient {
     signing_key: Vec<u8>,
 }
 
+/// Per-request timeout for web API calls. The web side can stall under load
+/// (e.g. waiting for Docker to start a container during provision); 30s gives
+/// it room while still bounding the SSH session if the web is wedged.
+const WEB_REQUEST_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(30);
+
 /// Response from /api/getkeys
 #[derive(Debug, Deserialize)]
 pub struct GetKeysResponse {
@@ -135,8 +140,12 @@ struct ProvisionRequest {
 impl ApiClient {
     /// Create a new API client.
     pub fn new(base_url: String, signing_key: Vec<u8>) -> Self {
+        let client = Client::builder()
+            .timeout(WEB_REQUEST_TIMEOUT)
+            .build()
+            .expect("failed to build reqwest client");
         Self {
-            client: Client::new(),
+            client,
             base_url,
             signing_key,
         }

ssh-reverse-proxy/src/server.rs

@@ -216,14 +216,45 @@ impl SshConnection {
                 );
                 self.state.startup_error = Some(format!(
                     "The {} environment could not be started.\r\n\
-                     Please contact the course staff and include error code {}.\r\n",
+                     This may be a temporary issue — please try connecting again in a moment.\r\n\
+                     If the problem persists, contact the course staff and include error code {}.\r\n",
                     self.state.exercise_name, error_id
                 ));
                 None
             }
         }
     }
 
+    /// Deliver a UUID-tagged failure message to the client when a runtime
+    /// container connection fails (after auth has already succeeded). Logs
+    /// the underlying error server-side, writes a retry-recommending message
+    /// to the channel's stderr, sets a non-zero exit status, and closes the
+    /// channel. Always returns `()` for the caller to bubble up.
+    fn emit_container_failure(
+        &self,
+        channel_id: ChannelId,
+        session: &mut Session,
+        stage: &str,
+        err: &anyhow::Error,
+    ) -> Result<(), russh::Error> {
+        let error_id = Uuid::new_v4();
+        error!(
+            "{} container connection failed [error_id={}]: {:#}",
+            stage, error_id, err
+        );
+        let msg = format!(
+            "Failed to connect to your {} environment.\r\n\
+             This may be a temporary issue — please try connecting again in a moment.\r\n\
+             If the problem persists, contact the course staff and include error code {}.\r\n",
+            self.state.exercise_name, error_id
+        );
+        session.channel_success(channel_id)?;
+        session.extended_data(channel_id, 1, CryptoVec::from_slice(msg.as_bytes()))?;
+        session.exit_status_request(channel_id, 1)?;
+        session.close(channel_id)?;
+        Ok(())
+    }
+
     /// If a startup error was recorded during auth, deliver it to the client
     /// on the given channel and close the channel with exit status 1.
     /// Returns `true` if an error was delivered.
@@ -568,14 +599,7 @@ impl server::Handler for SshConnection {
         {
             Ok(f) => f,
             Err(e) => {
-                let error_id = Uuid::new_v4();
-                error!("Failed to connect to container [error_id={}]: {}", error_id, e);
-                let msg = format!(
-                    "Error: Internal error (id: {}). If this issue persists, please contact a supervisor and provide the error id.\r\n",
-                    error_id
-                );
-                session.data(channel_id, CryptoVec::from_slice(msg.as_bytes()))?;
-                session.close(channel_id)?;
+                self.emit_container_failure(channel_id, session, "shell", &e)?;
                 return Ok(());
             }
         };
@@ -668,10 +692,7 @@ impl server::Handler for SshConnection {
         {
             Ok(f) => f,
             Err(e) => {
-                let error_id = Uuid::new_v4();
-                error!("Failed to connect to container [error_id={}]: {}", error_id, e);
-                session.channel_failure(channel_id)?;
-                session.close(channel_id)?;
+                self.emit_container_failure(channel_id, session, "exec", &e)?;
                 return Ok(());
             }
         };
@@ -743,10 +764,7 @@ impl server::Handler for SshConnection {
         {
             Ok(f) => f,
             Err(e) => {
-                let error_id = Uuid::new_v4();
-                error!("Failed to connect to container [error_id={}]: {}", error_id, e);
-                session.channel_failure(channel_id)?;
-                session.close(channel_id)?;
+                self.emit_container_failure(channel_id, session, "subsystem", &e)?;
                 return Ok(());
             }
         };