Remote port forwarding

[smoqadam]

hey guys, thank you for this great library.

As far as I know, when we run ssh -R0:localhost:9999 server-ip a random port will be chosen by OS (hence the 0: at the beginning), but I can't see which port has been chosen in the ReversePortForwardingCallback in the following example (taken from: https://github.com/gliderlabs/ssh/blob/master/_examples/ssh-remoteforward/portforward.go):

package main

import (
	"io"
	"log"

	"github.com/gliderlabs/ssh"
)

func main() {

	log.Println("starting ssh server on port 2222...")

	forwardHandler := &ssh.ForwardedTCPHandler{}

	server := ssh.Server{
		LocalPortForwardingCallback: ssh.LocalPortForwardingCallback(func(ctx ssh.Context, dhost string, dport uint32) bool {
			log.Println("Accepted forward", dhost, dport)
			return true
		}),
		Addr: ":2222",
		Handler: ssh.Handler(func(s ssh.Session) {
			io.WriteString(s, "Remote forwarding available...\n")
			select {}
		}),
		ReversePortForwardingCallback: ssh.ReversePortForwardingCallback(func(ctx ssh.Context, host string, port uint32) bool {
			log.Println("attempt to bind", host, port, "granted")
			return true
		}),
		RequestHandlers: map[string]ssh.RequestHandler{
			"tcpip-forward":        forwardHandler.HandleSSHRequest,
			"cancel-tcpip-forward": forwardHandler.HandleSSHRequest,
		},
	}

	log.Fatal(server.ListenAndServe())
}

If I connect to this server by ssh -R0:localhost:9999 server-ip I get this message on my terminal: attempt to bind localhost 0 granted.

Now, does this library choose a random port, and if yes how can I access it?

[mohammed90]

For the sake of xkcd 979, do you have an answer?

[smoqadam]

@mohammed90 I ended up using "golang.org/x/crypto/ssh" package, and checking for the requested port if it's 0 I chose a random port. Here is a rough overview of what I've done to achieve this:

    type remoteForwardRequest struct {
	BindAddr string
	BindPort uint32
    }

	srvCon, channs, reqChannel, err := ssh.NewServerConn(conn, config)
        .... 
        req := <-reqChannel
	var reqPayload remoteForwardRequest
	ssh.Unmarshal(req.Payload, &reqPayload)
        port := reqPayload.BindPort
        if port == 0 {
             port = randomPort()
        } 

I took the logic from here: https://github.com/gliderlabs/ssh/blob/master/tcpip.go#L97

---

After digging a bit more and based on SSH manual page, if the listen port is 0 the server should inform the client by sending the dynamically allocated port. We can achieve that by this:

	if port == 0 {
		port = randomPort()
	}
	replyPayload := make([]byte, 4)
	binary.BigEndian.PutUint32(replyPayload, uint32(port))
	req.Reply(true, replyPayload)