loop/server: enable SSH reverse port forwarding
~~~~
vibe-coded but tested manually with
$python3 -mhttp.server 8000 &
[1] 25986
Serving HTTP on :: port 8000 (http://[::]:8000/) ...
$ssh -R 8000:localhost:8000 sketch-241k-9zzx-gcbc-k4fs curl --silent http://localhost:8000/ | head -n 3
::1 - - [30/May/2025 09:32:44] "GET / HTTP/1.1" 200 -
<!DOCTYPE HTML>
<html lang="en">
<head>
~~~~
Implement ReversePortForwardingCallback in SSH server configuration to
allow reverse port forwarding connections from clients.
Changes include:
1. SSH Server Configuration Enhancement:
- Added ReversePortForwardingCallback to ssh.Server struct
- Callback allows all reverse port forwarding requests (returns true)
- Consistent with existing LocalPortForwardingCallback behavior
- Includes debug logging for reverse forwarding requests
Technical Implementation:
The SSH server already had the necessary infrastructure for port forwarding:
- ForwardedTCPHandler for handling forwarding requests
- RequestHandlers for 'tcpip-forward' and 'cancel-tcpip-forward'
- LocalPortForwardingCallback for client-to-server forwarding
This change adds the missing ReversePortForwardingCallback that enables
server-to-client port forwarding (reverse tunneling). The callback follows
the same permissive pattern as the local forwarding callback, allowing
all reverse forwarding requests while logging them for debugging.
Without this callback, the SSH library defaults to denying all reverse
port forwarding requests, preventing clients from establishing reverse
tunnels through the SSH connection.
Benefits:
- Enables full bidirectional port forwarding capabilities
- Maintains consistent logging and debugging for both forwarding types
- Follows established patterns in the existing codebase
- No breaking changes to existing SSH functionality
Co-Authored-By: sketch <hello@sketch.dev>
Change-ID: s9bc98f6471e2ec4dk
diff --git a/loop/server/sshserver.go b/loop/server/sshserver.go
index 65eb54b..b6c40bf 100644
--- a/loop/server/sshserver.go
+++ b/loop/server/sshserver.go
@@ -88,6 +88,10 @@
slog.DebugContext(ctx, "Accepted forward", slog.Any("dhost", dhost), slog.Any("dport", dport))
return true
}),
+ ReversePortForwardingCallback: ssh.ReversePortForwardingCallback(func(ctx ssh.Context, bindHost string, bindPort uint32) bool {
+ slog.DebugContext(ctx, "Accepted reverse forward", slog.Any("bindHost", bindHost), slog.Any("bindPort", bindPort))
+ return true
+ }),
Addr: ":22",
ChannelHandlers: ssh.DefaultChannelHandlers,
Handler: ssh.Handler(func(s ssh.Session) {