andy/nexus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Implement SSH port forwarding and improve jump host UI

Browse Source 
Port Forwarding (new):
- Add PortForward model with local/remote direction, bind/dest addresses
- Implement ForwardManager in sshclient/portforward.go with full
  bidirectional tunnel support for both local and remote forwarding
- Integrate ForwardManager into SSH client lifecycle (auto-start on
  connect, clean shutdown on close)
- Add session manager methods: ListPortForwards, StartPortForward,
  StopPortForward with event emission
- Add API surface: ListPortForwards, StartPortForward, StopPortForward
- Add validation for port-forward rules in ValidateSSHConfig
- Add port forwarding section to profile editor with direction, bind/dest
  host/port, label, and enable toggle
- Add frontend event handling for forward:started/stopped/error
- Style port-forward rows with charcoal card design matching jump hosts

Jump Host UI improvements:
- Add private key path field to jump host editor rows
- Collect privateKeyPath in form value collection
- Restyle jump host rows as two-line cards with clear field grouping
This commit is contained in:
andy
2026-04-16 00:00:00 +01:00
parent 5e397195b9
commit 6d300f7dba
13 changed files with 664 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/api.go
+19
View File
@@ -624,6 +624,25 @@ func (s *Service) RefreshGitHubRepos(sessionID string) ([]models.GitHubRepo, err
return s.sessions.FetchGitHubRepos(sessionID)
}
// ---------------------------------------------------------------------------
// Port forwarding
// ---------------------------------------------------------------------------
// ListPortForwards returns the active port-forwarding tunnels for an SSH session.
func (s *Service) ListPortForwards(sessionID string) ([]models.PortForward, error) {
return s.sessions.ListPortForwards(sessionID)
}
// StartPortForward activates a new forwarding tunnel on a live SSH session.
func (s *Service) StartPortForward(sessionID string, rule models.PortForward) error {
return s.sessions.StartPortForward(sessionID, rule)
}
// StopPortForward terminates an active forwarding tunnel.
func (s *Service) StopPortForward(sessionID string, forwardID string) error {
return s.sessions.StopPortForward(sessionID, forwardID)
}
// TestConnection performs a basic TCP reachability check to the given host and port.
// This verifies the network path without establishing a full protocol session.
func (s *Service) TestConnection(host string, port int) (map[string]interface{}, error) {
internal/models/defaults.go
+1
View File
@@ -80,6 +80,7 @@ func NewProfile(protocol Protocol) Profile {
KeepaliveInterval: DefaultKeepaliveInterval,
KeepaliveCountMax: DefaultKeepaliveCountMax,
JumpHosts: []JumpHost{},
PortForwards: []PortForward{},
EnvVars: map[string]string{},
}
case ProtocolTelnet:
internal/models/models.go
+21
View File
@@ -94,6 +94,7 @@ type SSHConfig struct {
KeepaliveCountMax int `json:"keepaliveCountMax"`
Compression bool `json:"compression"`
JumpHosts []JumpHost `json:"jumpHosts"`
PortForwards []PortForward `json:"portForwards"`
StartupCommand string `json:"startupCommand"`
EnvVars map[string]string `json:"envVars"`
}
@@ -108,6 +109,26 @@ type JumpHost struct {
PrivateKeyPath string `json:"privateKeyPath"`
}
// PortForwardDirection indicates the tunnel direction.
type PortForwardDirection string
const (
PortForwardLocal PortForwardDirection = "local"
PortForwardRemote PortForwardDirection = "remote"
)
// PortForward defines a single SSH port-forwarding rule.
type PortForward struct {
ID string `json:"id"`
Direction PortForwardDirection `json:"direction"`
BindHost string `json:"bindHost"` // local address to listen on (local) or remote bind (remote)
BindPort int `json:"bindPort"`
DestHost string `json:"destHost"` // target address to forward to
DestPort int `json:"destPort"`
Enabled bool `json:"enabled"` // whether to activate on connect
Label string `json:"label"` // optional descriptive label
}
// TelnetConfig holds Telnet-specific settings for a connection profile.
type TelnetConfig struct {
LocalEcho bool `json:"localEcho"`
internal/sessions/manager.go
+109
View File
@@ -470,6 +470,33 @@ func (m *Manager) connectSSH(sess *Session, getSecret func(prompt string) (strin
}
sess.sshClient = client
// Start any port-forwarding rules configured in the profile.
if sshConf != nil && len(sshConf.PortForwards) > 0 {
fwdMgr := client.Forwards()
if fwdMgr != nil {
for _, pf := range sshConf.PortForwards {
if !pf.Enabled {
continue
}
if err := fwdMgr.StartForward(pf); err != nil {
// Non-fatal — log and notify but don't abort the session.
m.emitEvent("session:forward:error", map[string]interface{}{
"sessionID": sess.Info.ID,
"forwardID": pf.ID,
"label": pf.Label,
"error": err.Error(),
})
} else {
m.emitEvent("session:forward:started", map[string]interface{}{
"sessionID": sess.Info.ID,
"forward": pf,
})
}
}
}
}
return nil
}
@@ -668,6 +695,88 @@ func (m *Manager) FetchGitHubRepos(sessionID string) ([]models.GitHubRepo, error
return repos, nil
}
// ---------------------------------------------------------------------------
// Port-forwarding management
// ---------------------------------------------------------------------------
// ListPortForwards returns the active port-forwarding rules for a session.
func (m *Manager) ListPortForwards(sessionID string) ([]models.PortForward, error) {
m.mu.RLock()
sess, ok := m.sessions[sessionID]
m.mu.RUnlock()
if !ok {
return nil, fmt.Errorf("sessions: session %q not found", sessionID)
}
if sess.sshClient == nil {
return nil, fmt.Errorf("sessions: session %q is not an SSH connection", sessionID)
}
fwdMgr := sess.sshClient.Forwards()
if fwdMgr == nil {
return []models.PortForward{}, nil
}
return fwdMgr.ActiveForwards(), nil
}
// StartPortForward activates a new forwarding tunnel on a live SSH session.
func (m *Manager) StartPortForward(sessionID string, rule models.PortForward) error {
m.mu.RLock()
sess, ok := m.sessions[sessionID]
m.mu.RUnlock()
if !ok {
return fmt.Errorf("sessions: session %q not found", sessionID)
}
if sess.sshClient == nil {
return fmt.Errorf("sessions: session %q is not an SSH connection", sessionID)
}
fwdMgr := sess.sshClient.Forwards()
if fwdMgr == nil {
return fmt.Errorf("sessions: forward manager not initialised")
}
if err := fwdMgr.StartForward(rule); err != nil {
return err
}
m.emitEvent("session:forward:started", map[string]interface{}{
"sessionID": sessionID,
"forward": rule,
})
return nil
}
// StopPortForward terminates an active forwarding tunnel.
func (m *Manager) StopPortForward(sessionID string, forwardID string) error {
m.mu.RLock()
sess, ok := m.sessions[sessionID]
m.mu.RUnlock()
if !ok {
return fmt.Errorf("sessions: session %q not found", sessionID)
}
if sess.sshClient == nil {
return fmt.Errorf("sessions: session %q is not an SSH connection", sessionID)
}
fwdMgr := sess.sshClient.Forwards()
if fwdMgr == nil {
return fmt.Errorf("sessions: forward manager not initialised")
}
if err := fwdMgr.StopForward(forwardID); err != nil {
return err
}
m.emitEvent("session:forward:stopped", map[string]interface{}{
"sessionID": sessionID,
"forwardID": forwardID,
})
return nil
}
// ---------------------------------------------------------------------------
// Internal: helpers
// ---------------------------------------------------------------------------
internal/sshclient/portforward.go
+269
View File
@@ -0,0 +1,269 @@
// Package sshclient — port forwarding support.
//
// This file implements local and remote SSH port forwarding (tunnelling).
// Local forwarding listens on a local address and pipes connections through
// the SSH channel to a remote destination. Remote forwarding requests the
// SSH server to listen on a remote address and pipes accepted connections
// back to a local destination.
package sshclient
import (
"fmt"
"io"
"net"
"sync"
"github.com/copilot-ssh-client/app/internal/models"
"golang.org/x/crypto/ssh"
)
// ActiveForward tracks a running port-forwarding tunnel.
type ActiveForward struct {
Rule models.PortForward `json:"rule"`
Listener net.Listener `json:"-"`
done chan struct{}
mu sync.Mutex
conns []net.Conn // tracked connections for clean shutdown
}
// ForwardManager manages active port-forwarding tunnels for a single SSH connection.
type ForwardManager struct {
mu sync.Mutex
forwards map[string]*ActiveForward
client *ssh.Client
}
// NewForwardManager creates a ForwardManager bound to the given SSH client.
func NewForwardManager(client *ssh.Client) *ForwardManager {
return &ForwardManager{
forwards: make(map[string]*ActiveForward),
client: client,
}
}
// StartForward activates a port-forwarding rule. Returns an error if the
// rule's ID is already active or the listener cannot be established.
func (fm *ForwardManager) StartForward(rule models.PortForward) error {
fm.mu.Lock()
if _, exists := fm.forwards[rule.ID]; exists {
fm.mu.Unlock()
return fmt.Errorf("forward %q is already active", rule.ID)
}
fm.mu.Unlock()
switch rule.Direction {
case models.PortForwardLocal:
return fm.startLocalForward(rule)
case models.PortForwardRemote:
return fm.startRemoteForward(rule)
default:
return fmt.Errorf("unsupported forward direction %q", rule.Direction)
}
}
// StopForward terminates a specific active forward.
func (fm *ForwardManager) StopForward(forwardID string) error {
fm.mu.Lock()
af, ok := fm.forwards[forwardID]
if !ok {
fm.mu.Unlock()
return fmt.Errorf("forward %q not found", forwardID)
}
delete(fm.forwards, forwardID)
fm.mu.Unlock()
return af.shutdown()
}
// StopAll terminates every active forward. Called on session close.
func (fm *ForwardManager) StopAll() {
fm.mu.Lock()
all := make([]*ActiveForward, 0, len(fm.forwards))
for id, af := range fm.forwards {
all = append(all, af)
delete(fm.forwards, id)
}
fm.mu.Unlock()
for _, af := range all {
_ = af.shutdown()
}
}
// ActiveForwards returns the list of currently active forwarding rules.
func (fm *ForwardManager) ActiveForwards() []models.PortForward {
fm.mu.Lock()
defer fm.mu.Unlock()
result := make([]models.PortForward, 0, len(fm.forwards))
for _, af := range fm.forwards {
result = append(result, af.Rule)
}
return result
}
// ---------------------------------------------------------------------------
// Local forwarding: listen locally → tunnel to remote via SSH
// ---------------------------------------------------------------------------
func (fm *ForwardManager) startLocalForward(rule models.PortForward) error {
bindAddr := rule.BindHost
if bindAddr == "" {
bindAddr = "127.0.0.1"
}
listenAddr := net.JoinHostPort(bindAddr, fmt.Sprintf("%d", rule.BindPort))
listener, err := net.Listen("tcp", listenAddr)
if err != nil {
return fmt.Errorf("local forward: listen on %s failed: %w", listenAddr, err)
}
af := &ActiveForward{
Rule: rule,
Listener: listener,
done: make(chan struct{}),
}
fm.mu.Lock()
fm.forwards[rule.ID] = af
fm.mu.Unlock()
destAddr := net.JoinHostPort(rule.DestHost, fmt.Sprintf("%d", rule.DestPort))
go func() {
defer close(af.done)
for {
localConn, acceptErr := listener.Accept()
if acceptErr != nil {
// Listener closed — normal shutdown path.
return
}
af.mu.Lock()
af.conns = append(af.conns, localConn)
af.mu.Unlock()
go func(lc net.Conn) {
defer lc.Close()
remoteConn, dialErr := fm.client.Dial("tcp", destAddr)
if dialErr != nil {
return
}
defer remoteConn.Close()
af.mu.Lock()
af.conns = append(af.conns, remoteConn)
af.mu.Unlock()
pipeBidirectional(lc, remoteConn)
}(localConn)
}
}()
return nil
}
// ---------------------------------------------------------------------------
// Remote forwarding: ask server to listen → tunnel back to local destination
// ---------------------------------------------------------------------------
func (fm *ForwardManager) startRemoteForward(rule models.PortForward) error {
bindAddr := rule.BindHost
if bindAddr == "" {
bindAddr = "0.0.0.0"
}
listenAddr := net.JoinHostPort(bindAddr, fmt.Sprintf("%d", rule.BindPort))
listener, err := fm.client.Listen("tcp", listenAddr)
if err != nil {
return fmt.Errorf("remote forward: server listen on %s failed: %w", listenAddr, err)
}
af := &ActiveForward{
Rule: rule,
Listener: listener,
done: make(chan struct{}),
}
fm.mu.Lock()
fm.forwards[rule.ID] = af
fm.mu.Unlock()
destAddr := net.JoinHostPort(rule.DestHost, fmt.Sprintf("%d", rule.DestPort))
go func() {
defer close(af.done)
for {
remoteConn, acceptErr := listener.Accept()
if acceptErr != nil {
return
}
af.mu.Lock()
af.conns = append(af.conns, remoteConn)
af.mu.Unlock()
go func(rc net.Conn) {
defer rc.Close()
localConn, dialErr := net.Dial("tcp", destAddr)
if dialErr != nil {
return
}
defer localConn.Close()
af.mu.Lock()
af.conns = append(af.conns, localConn)
af.mu.Unlock()
pipeBidirectional(rc, localConn)
}(remoteConn)
}
}()
return nil
}
// ---------------------------------------------------------------------------
// Helpers
// ---------------------------------------------------------------------------
// shutdown closes the listener and all tracked connections.
func (af *ActiveForward) shutdown() error {
var firstErr error
if af.Listener != nil {
if err := af.Listener.Close(); err != nil {
firstErr = err
}
}
af.mu.Lock()
conns := af.conns
af.conns = nil
af.mu.Unlock()
for _, c := range conns {
_ = c.Close()
}
return firstErr
}
// pipeBidirectional copies data between two connections until either side closes.
func pipeBidirectional(a, b net.Conn) {
var wg sync.WaitGroup
wg.Add(2)
copy := func(dst, src net.Conn) {
defer wg.Done()
_, _ = io.Copy(dst, src)
// Signal the other direction to stop by closing the write-half.
if tc, ok := dst.(*net.TCPConn); ok {
_ = tc.CloseWrite()
}
}
go copy(a, b)
go copy(b, a)
wg.Wait()
}
internal/sshclient/sshclient.go
+16 -1
View File
@@ -15,7 +15,7 @@ import (
// Client manages a single SSH session lifecycle.
// It handles connection establishment, authentication, PTY allocation,
// terminal resize propagation, and clean shutdown.
// terminal resize propagation, port forwarding, and clean shutdown.
type Client struct {
mu sync.Mutex
config *models.Profile
@@ -30,6 +30,7 @@ type Client struct {
onClose func()
ctx context.Context
cancel context.CancelFunc
forwards *ForwardManager // port forwarding tunnels
}
// NewClient creates a new SSH client bound to the given profile.
@@ -193,6 +194,7 @@ func (c *Client) connectInternal(
c.stdout = stdoutPipe
c.stderr = stderrPipe
c.connected = true
c.forwards = NewForwardManager(sshConn)
c.mu.Unlock()
go c.readLoop()
@@ -242,11 +244,17 @@ func (c *Client) Close() error {
c.connected = false
session := c.session
sshClient := c.sshClient
fwdMgr := c.forwards
onClose := c.onClose
c.mu.Unlock()
c.cancel()
// Shut down any active port forwards first.
if fwdMgr != nil {
fwdMgr.StopAll()
}
var firstErr error
if session != nil {
if err := session.Close(); err != nil && firstErr == nil {
@@ -272,6 +280,13 @@ func (c *Client) IsConnected() bool {
return c.connected
}
// Forwards returns the ForwardManager for this client, or nil if not connected.
func (c *Client) Forwards() *ForwardManager {
c.mu.Lock()
defer c.mu.Unlock()
return c.forwards
}
// buildAuthMethods constructs the SSH authentication method list from the
// profile's SSHConfig and the provided credential callbacks.
func (c *Client) buildAuthMethods(sc models.SSHConfig, getPassword func() (string, error), getPassphrase func() (string, error)) ([]ssh.AuthMethod, error) {
internal/validation/validation.go
+19
View File
@@ -93,6 +93,8 @@ func ValidateProfile(p *models.Profile) error {
errs.Errors = append(errs.Errors, ve.Errors...)
}
}
case models.ProtocolGitHub:
// GitHub profiles require no host-level validation beyond the common checks.
default:
errs.Add("protocol", fmt.Sprintf("unsupported protocol %q", p.Protocol))
}
@@ -217,6 +219,23 @@ func ValidateSSHConfig(cfg *models.SSHConfig) error {
}
}
// Validate each port-forwarding rule.
for i, pf := range cfg.PortForwards {
prefix := fmt.Sprintf("ssh.portForwards[%d]", i)
if pf.Direction != models.PortForwardLocal && pf.Direction != models.PortForwardRemote {
errs.Add(prefix+".direction", fmt.Sprintf("unsupported forwarding direction %q", pf.Direction))
}
if pf.BindPort < 1 || pf.BindPort > 65535 {
errs.Add(prefix+".bindPort", "bind port must be between 1 and 65535")
}
if pf.DestPort < 1 || pf.DestPort > 65535 {
errs.Add(prefix+".destPort", "destination port must be between 1 and 65535")
}
if strings.TrimSpace(pf.DestHost) == "" {
errs.Add(prefix+".destHost", "destination host must not be empty")
}
}
if errs.HasErrors() {
return errs
}