1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
//! Port-forwarding building blocks used by `puressh::server` (and `client`
//! in a follow-up commit).
//!
//! Two channel types live here:
//!
//! - **`direct-tcpip`** (RFC 4254 §7.2): the client asks the server to
//! connect to a TCP destination and proxy bytes over the SSH channel.
//! This is what `ssh -L` opens. The server-side glue is
//! [`direct::DefaultDirectTcpipHandler`] plus the
//! [`crate::server::DirectTcpipHandler`] trait.
//! - **`tcpip-forward`** + **`forwarded-tcpip`** (RFC 4254 §7.1, §7.2):
//! the inbound bookend of `ssh -R`. A client global-request asks the
//! server to bind a TCP listener; once bound, the server is meant to
//! open a `forwarded-tcpip` channel back to the client for each
//! accepted connection on that port. The bind/unbind half lives in
//! [`reverse::DefaultTcpipForwardHandler`] plus the
//! [`crate::server::TcpipForwardHandler`] trait; the back-channel
//! opens land in a follow-up commit alongside the matching
//! client-side multi-channel dispatcher.
//! - **`auth-agent-req@openssh.com`** + **`auth-agent@openssh.com`**
//! (OpenSSH's ssh-agent forwarding, `ssh -A`): the client asks the
//! server to expose a Unix-domain socket inside the session env as
//! `SSH_AUTH_SOCK`. Each connection on that socket triggers an
//! `auth-agent@openssh.com` channel-open back toward the client, which
//! the client proxies to its own local agent. Server-side glue lives
//! in [`agent::DefaultAgentForwardHandler`] plus the
//! [`crate::server::AgentForwardHandler`] trait.
//! - **`x11-req`** + **`x11`** (RFC 4254 §6.3, `ssh -X` / `ssh -Y`):
//! the client asks the server to set up an X display proxy. The
//! server binds `127.0.0.1:6000+N` for some free display number `N`
//! and injects `DISPLAY=localhost:N.<screen>` into the session env.
//! Each accepted TCP connection on that port triggers an `x11`
//! channel-open back toward the client, which the client proxies to
//! its own local `$DISPLAY`. Server-side glue lives in
//! [`x11::DefaultX11ForwardHandler`] plus the
//! [`crate::server::X11ForwardHandler`] trait.
// Agent and X11 forwarding depend on Unix-domain sockets and Unix-only
// permission bits; gate them out on Windows. The other two modules
// (direct-tcpip, reverse port-forward) are TCP-only and stay portable.
//
// `direct` and `reverse` are entirely server-side handlers (no client-
// callable helpers), so they're additionally gated on `feature = "server"`.
// `agent` and `x11` straddle the line: their `Default*Handler` types are
// server-only, but they also expose `splice_to_local_*_callback` helpers the
// client binary uses, so each file uses per-item `#[cfg(feature = "server")]`
// internally rather than a single module-level gate.