SSH port forwarding

[bbkr]

Hi

I want to implement SSH port forwarding scenario. For typical administrative tasks, where you must connect to some service through jump host and to do it expose it as local port. Here is my working (yay!) code so far. I'm fairly new to Rust so I've created flow deliberately stripped of any abstractions to understand it better.

use russh::ChannelMsg;
use russh_keys::{self, key};
use russh::client;
use tokio::{io::{AsyncReadExt, AsyncWriteExt}, net::TcpListener};
use std::sync::Arc;
use async_trait::async_trait;

#[tokio::main]
async fn main() {

    let jump_host = "jump.example.com";
    let jump_port = 123;
    let jump_user = "u1";
    let ssh_key_path = "/home/me/.ssh/jump_host_key";
    let ssh_key_password = None;

    let local_host = "127.0.0.1";
    let local_port = 5000;

    let service_host = "service.example.com";
    let service_port = 456;

    let ssh_config = client::Config::default();

    struct Client {}
    #[async_trait]
    impl client::Handler for Client {

        type Error = russh::Error;

        async fn check_server_key (&mut self, _server_public_key: &key::PublicKey) -> Result<bool, Self::Error> {
            Ok(true)
        }

    }
    let ssh_client = Client{};

    let ssh_key_secret = russh_keys::load_secret_key(ssh_key_path, ssh_key_password).expect("Cannot load SSH private key");

    let mut ssh_session = russh::client::connect(Arc::new(ssh_config), (jump_host, jump_port), ssh_client).await.expect("Cannot connect to SSH host");

    ssh_session.authenticate_publickey(jump_user, Arc::new(ssh_key_secret)).await.expect("Cannot authenticate using SSH key");

    let mut ssh_channel = ssh_session.channel_open_direct_tcpip(service_host, service_port, local_host, local_port).await.expect("Cannot open SSH forwarding channel");

    let local_listener = TcpListener::bind((local_host, local_port as u16)).await.expect("Cannot bind local port");

    tokio::spawn(
        async move {
            let (mut socket, _) = local_listener.accept().await.expect("Cannot process local client");
            println!("Client connected");

            let mut buf = vec![0; 1024];
            loop {
                tokio::select! {
                    n = socket.read(&mut buf) => {
                        match n {
                            Ok(0) => {
                                println!("Client disconnected");
                                ssh_channel.eof().await.expect("Cannot close SSH forwarding channel");
                                break;
                            }
                            Ok(n) => ssh_channel.data(&buf[..n]).await.expect("Cannot send data to SSH forwarding channel"),
                            Err(e) => panic!("Client error: {}", e)
                        }
                    }
                    Some(msg) = ssh_channel.wait() => {
                        match msg {
                            ChannelMsg::Data { ref data } => socket.write_all(data).await.expect("Cannot send data to local client"),
                            ChannelMsg::ExitStatus { exit_status } => {
                                println!("Channel closed: {}", exit_status);
                                break;
                            }
                            _ => {}
                        }
                    }
                }
            }
            ssh_channel.close().await.expect("Cannot close SSH forwarding channel");
            println!("Forwarding stopped");
        }
    );

    println!("Connect to {}:{} to be forwarded to {}:{}", local_host, local_port, service_host, service_port);
    do_some_administrative_work();
}

Questions:

1. Did I use right Client method at all? I'm a bit confused by tcpip_forward described as Requests the server to open a TCP/IP forward channel and channel_open_direct_tcpip described as Open a TCP/IP forwarding channel.
2. Can this local<->jump data passing be done in more simple or more idiomatic way? Should I for example send data from channel to local by implementing and reacting to data callback in Client::Handler trait?
3. Am I terminating channel correctly? I have to break when local socket read size is 0 (otherwise it's always selectable handle for tokio::select) so I never actually receive ChannelMsg::ExitStatus. That's why I added explicit close after loop. But this feels hacky.
4. In case I want to forward port for multiple connections (for example I need to make few concurrent connections to database service behind jump host) I have to accept multiple local clients and for each of them open separate channel and bridge their socket to their channel data, right? Can I use the same local_port though? Will Client distinguish where data from the same originator should go?
5. What are server_channel_open_forwarded_tcpip / server_channel_open_direct_tcpip methods for in Client::Handler trait? If I implement them for Client they never get called.

Thank you in advance for reviewing this code (and pushing me in right direction if I messed something up). And thank you for your time and effort creating this module.

[Eugeny]

Hi, you're missing a few parts. Currently, your program can only handle a single connection.

You need to channel_open_direct_tcpip() once after every connection your listener receives, and then pipe the data back and forth between your socket and the channel.

To save yourself some trouble, you can turn a Channel into an impl AsyncRead + AsyncWrite object using Channel::into_stream, and then use e.g. tokio::io::split + tokio::io::copy x 2 to let tokio pipe the data for you.

The server_channel_open_forwarded_tcpip/server_channel_open_direct_tcpip methods are non-standard extensions that allow direcft-tcpip forwarding but backwards (server to client)

[bbkr]

Hi, you're missing a few parts. Currently, your program can only handle a single connection.

Yes, I mentioned in 4. But thanks for confirmation that I need separate channels and can use the same local port.

To save yourself some trouble, you can turn a Channel into an impl AsyncRead + AsyncWrite object using Channel::into_stream, and then use e.g. tokio::io::split + tokio::io::copy x 2 to let tokio pipe the data for you.

I was not aware of io::copy, but while reading about it I found even shorter solution:

    let ssh_channel = ssh_session.channel_open_direct_tcpip(service_host, service_port, local_host, local_port).await.expect("Cannot open SSH forwarding channel");
    let mut ssh_stream = ssh_channel.into_stream();

    let local_listener = TcpListener::bind((local_host, local_port as u16)).await.expect("Cannot bind local port");

    tokio::spawn(
        async move {
            let (mut socket, _) = local_listener.accept().await.expect("Cannot process local client");
            println!("Client connected");
            tokio::io::copy_bidirectional(&mut socket, &mut ssh_stream).await.expect("Local to channel copy error");
            println!("Forwarding stopped");
        }
    );

So +1 knowledge.

Thanks for taking time to look at my code.