fix(ssh): remove unreachable code in connectOrDie, wrap last error (#655)

After the retry loop, connectionFailed is always true, making the
final return statement unreachable. Simplify to unconditionally return
the error after the loop. Also wrap the last dial error with %w so
callers see the root cause (e.g. 'connection refused').

Audit findings #5 (HIGH), #6 (HIGH), #27 (LOW).

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

Author: ArangoGutierrez

cmd/cli/dryrun/dryrun.go

@@ -147,22 +147,16 @@ func connectOrDie(keyPath, userName, hostUrl string) error {
 		HostKeyCallback: sshutil.TOFUHostKeyCallback(),
 	}
 
-	connectionFailed := false
+	var lastErr error
 	for range 20 {
 		client, err := ssh.Dial("tcp", hostUrl+":22", sshConfig)
 		if err == nil {
-			client.Close() // nolint:errcheck, gosec
-			return nil     // Connection succeeded,
+			_ = client.Close()
+			return nil
 		}
-		connectionFailed = true
-		// Sleep for a brief moment before retrying.
-		// You can adjust the duration based on your requirements.
+		lastErr = err
 		time.Sleep(1 * time.Second)
 	}
 
-	if connectionFailed {
-		return fmt.Errorf("failed to connect to %s", hostUrl)
-	}
-
-	return nil
+	return fmt.Errorf("failed to connect to %s after 20 retries: %w", hostUrl, lastErr)
 }

pkg/provisioner/provisioner.go

@@ -464,20 +464,13 @@ func connectOrDie(keyPath, userName, hostUrl string) (*ssh.Client, error) {
 		HostKeyCallback: sshutil.TOFUHostKeyCallback(),
 	}
 
-	connectionFailed := false
 	for range sshMaxRetries {
 		client, err = ssh.Dial("tcp", hostUrl+":22", sshConfig)
 		if err == nil {
-			return client, nil // Connection succeeded, return the client.
+			return client, nil
 		}
-		connectionFailed = true
-		// Brief delay before retrying.
 		time.Sleep(sshRetryDelay)
 	}
 
-	if connectionFailed {
-		return nil, fmt.Errorf("failed to connect to %s after %d retries, giving up", hostUrl, sshMaxRetries)
-	}
-
-	return client, nil
+	return nil, fmt.Errorf("failed to connect to %s after %d retries: %w", hostUrl, sshMaxRetries, err)
 }