Implement SSH port forwarding and improve jump host UI

Port Forwarding (new): - Add PortForward model with local/remote direction, bind/dest addresses - Implement ForwardManager in sshclient/portforward.go with full bidirectional tunnel support for both local and remote forwarding - Integrate ForwardManager into SSH client lifecycle (auto-start on connect, clean shutdown on close) - Add session manager methods: ListPortForwards, StartPortForward, StopPortForward with event emission - Add API surface: ListPortForwards, StartPortForward, StopPortForward - Add validation for port-forward rules in ValidateSSHConfig - Add port forwarding section to profile editor with direction, bind/dest host/port, label, and enable toggle - Add frontend event handling for forward:started/stopped/error - Style port-forward rows with charcoal card design matching jump hosts Jump Host UI improvements: - Add private key path field to jump host editor rows - Collect privateKeyPath in form value collection - Restyle jump host rows as two-line cards with clear field grouping
2026-04-16 00:00:00 +01:00
parent 5e397195b9
commit 6d300f7dba
13 changed files with 664 additions and 8 deletions
@@ -0,0 +1,269 @@
+// Package sshclient — port forwarding support.
+//
+// This file implements local and remote SSH port forwarding (tunnelling).
+// Local forwarding listens on a local address and pipes connections through
+// the SSH channel to a remote destination. Remote forwarding requests the
+// SSH server to listen on a remote address and pipes accepted connections
+// back to a local destination.
+package sshclient
+
+import (
+	"fmt"
+	"io"
+	"net"
+	"sync"
+
+	"github.com/copilot-ssh-client/app/internal/models"
+	"golang.org/x/crypto/ssh"
+)
+
+// ActiveForward tracks a running port-forwarding tunnel.
+type ActiveForward struct {
+	Rule     models.PortForward `json:"rule"`
+	Listener net.Listener       `json:"-"`
+	done     chan struct{}
+	mu       sync.Mutex
+	conns    []net.Conn // tracked connections for clean shutdown
+}
+
+// ForwardManager manages active port-forwarding tunnels for a single SSH connection.
+type ForwardManager struct {
+	mu       sync.Mutex
+	forwards map[string]*ActiveForward
+	client   *ssh.Client
+}
+
+// NewForwardManager creates a ForwardManager bound to the given SSH client.
+func NewForwardManager(client *ssh.Client) *ForwardManager {
+	return &ForwardManager{
+		forwards: make(map[string]*ActiveForward),
+		client:   client,
+	}
+}
+
+// StartForward activates a port-forwarding rule. Returns an error if the
+// rule's ID is already active or the listener cannot be established.
+func (fm *ForwardManager) StartForward(rule models.PortForward) error {
+	fm.mu.Lock()
+	if _, exists := fm.forwards[rule.ID]; exists {
+		fm.mu.Unlock()
+		return fmt.Errorf("forward %q is already active", rule.ID)
+	}
+	fm.mu.Unlock()
+
+	switch rule.Direction {
+	case models.PortForwardLocal:
+		return fm.startLocalForward(rule)
+	case models.PortForwardRemote:
+		return fm.startRemoteForward(rule)
+	default:
+		return fmt.Errorf("unsupported forward direction %q", rule.Direction)
+	}
+}
+
+// StopForward terminates a specific active forward.
+func (fm *ForwardManager) StopForward(forwardID string) error {
+	fm.mu.Lock()
+	af, ok := fm.forwards[forwardID]
+	if !ok {
+		fm.mu.Unlock()
+		return fmt.Errorf("forward %q not found", forwardID)
+	}
+	delete(fm.forwards, forwardID)
+	fm.mu.Unlock()
+
+	return af.shutdown()
+}
+
+// StopAll terminates every active forward. Called on session close.
+func (fm *ForwardManager) StopAll() {
+	fm.mu.Lock()
+	all := make([]*ActiveForward, 0, len(fm.forwards))
+	for id, af := range fm.forwards {
+		all = append(all, af)
+		delete(fm.forwards, id)
+	}
+	fm.mu.Unlock()
+
+	for _, af := range all {
+		_ = af.shutdown()
+	}
+}
+
+// ActiveForwards returns the list of currently active forwarding rules.
+func (fm *ForwardManager) ActiveForwards() []models.PortForward {
+	fm.mu.Lock()
+	defer fm.mu.Unlock()
+
+	result := make([]models.PortForward, 0, len(fm.forwards))
+	for _, af := range fm.forwards {
+		result = append(result, af.Rule)
+	}
+	return result
+}
+
+// ---------------------------------------------------------------------------
+// Local forwarding: listen locally → tunnel to remote via SSH
+// ---------------------------------------------------------------------------
+
+func (fm *ForwardManager) startLocalForward(rule models.PortForward) error {
+	bindAddr := rule.BindHost
+	if bindAddr == "" {
+		bindAddr = "127.0.0.1"
+	}
+	listenAddr := net.JoinHostPort(bindAddr, fmt.Sprintf("%d", rule.BindPort))
+
+	listener, err := net.Listen("tcp", listenAddr)
+	if err != nil {
+		return fmt.Errorf("local forward: listen on %s failed: %w", listenAddr, err)
+	}
+
+	af := &ActiveForward{
+		Rule:     rule,
+		Listener: listener,
+		done:     make(chan struct{}),
+	}
+
+	fm.mu.Lock()
+	fm.forwards[rule.ID] = af
+	fm.mu.Unlock()
+
+	destAddr := net.JoinHostPort(rule.DestHost, fmt.Sprintf("%d", rule.DestPort))
+
+	go func() {
+		defer close(af.done)
+		for {
+			localConn, acceptErr := listener.Accept()
+			if acceptErr != nil {
+				// Listener closed — normal shutdown path.
+				return
+			}
+
+			af.mu.Lock()
+			af.conns = append(af.conns, localConn)
+			af.mu.Unlock()
+
+			go func(lc net.Conn) {
+				defer lc.Close()
+
+				remoteConn, dialErr := fm.client.Dial("tcp", destAddr)
+				if dialErr != nil {
+					return
+				}
+				defer remoteConn.Close()
+
+				af.mu.Lock()
+				af.conns = append(af.conns, remoteConn)
+				af.mu.Unlock()
+
+				pipeBidirectional(lc, remoteConn)
+			}(localConn)
+		}
+	}()
+
+	return nil
+}
+
+// ---------------------------------------------------------------------------
+// Remote forwarding: ask server to listen → tunnel back to local destination
+// ---------------------------------------------------------------------------
+
+func (fm *ForwardManager) startRemoteForward(rule models.PortForward) error {
+	bindAddr := rule.BindHost
+	if bindAddr == "" {
+		bindAddr = "0.0.0.0"
+	}
+	listenAddr := net.JoinHostPort(bindAddr, fmt.Sprintf("%d", rule.BindPort))
+
+	listener, err := fm.client.Listen("tcp", listenAddr)
+	if err != nil {
+		return fmt.Errorf("remote forward: server listen on %s failed: %w", listenAddr, err)
+	}
+
+	af := &ActiveForward{
+		Rule:     rule,
+		Listener: listener,
+		done:     make(chan struct{}),
+	}
+
+	fm.mu.Lock()
+	fm.forwards[rule.ID] = af
+	fm.mu.Unlock()
+
+	destAddr := net.JoinHostPort(rule.DestHost, fmt.Sprintf("%d", rule.DestPort))
+
+	go func() {
+		defer close(af.done)
+		for {
+			remoteConn, acceptErr := listener.Accept()
+			if acceptErr != nil {
+				return
+			}
+
+			af.mu.Lock()
+			af.conns = append(af.conns, remoteConn)
+			af.mu.Unlock()
+
+			go func(rc net.Conn) {
+				defer rc.Close()
+
+				localConn, dialErr := net.Dial("tcp", destAddr)
+				if dialErr != nil {
+					return
+				}
+				defer localConn.Close()
+
+				af.mu.Lock()
+				af.conns = append(af.conns, localConn)
+				af.mu.Unlock()
+
+				pipeBidirectional(rc, localConn)
+			}(remoteConn)
+		}
+	}()
+
+	return nil
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+// shutdown closes the listener and all tracked connections.
+func (af *ActiveForward) shutdown() error {
+	var firstErr error
+	if af.Listener != nil {
+		if err := af.Listener.Close(); err != nil {
+			firstErr = err
+		}
+	}
+
+	af.mu.Lock()
+	conns := af.conns
+	af.conns = nil
+	af.mu.Unlock()
+
+	for _, c := range conns {
+		_ = c.Close()
+	}
+	return firstErr
+}
+
+// pipeBidirectional copies data between two connections until either side closes.
+func pipeBidirectional(a, b net.Conn) {
+	var wg sync.WaitGroup
+	wg.Add(2)
+
+	copy := func(dst, src net.Conn) {
+		defer wg.Done()
+		_, _ = io.Copy(dst, src)
+		// Signal the other direction to stop by closing the write-half.
+		if tc, ok := dst.(*net.TCPConn); ok {
+			_ = tc.CloseWrite()
+		}
+	}
+
+	go copy(a, b)
+	go copy(b, a)
+	wg.Wait()
+}
@@ -15,7 +15,7 @@ import (

 // Client manages a single SSH session lifecycle.
 // It handles connection establishment, authentication, PTY allocation,
-// terminal resize propagation, and clean shutdown.
+// terminal resize propagation, port forwarding, and clean shutdown.
 type Client struct {
 	mu        sync.Mutex
 	config    *models.Profile
@@ -30,6 +30,7 @@ type Client struct {
 	onClose   func()
 	ctx       context.Context
 	cancel    context.CancelFunc
+	forwards  *ForwardManager // port forwarding tunnels
 }

 // NewClient creates a new SSH client bound to the given profile.
@@ -193,6 +194,7 @@ func (c *Client) connectInternal(
 	c.stdout = stdoutPipe
 	c.stderr = stderrPipe
 	c.connected = true
+	c.forwards = NewForwardManager(sshConn)
 	c.mu.Unlock()

 	go c.readLoop()
@@ -242,11 +244,17 @@ func (c *Client) Close() error {
 	c.connected = false
 	session := c.session
 	sshClient := c.sshClient
+	fwdMgr := c.forwards
 	onClose := c.onClose
 	c.mu.Unlock()

 	c.cancel()

+	// Shut down any active port forwards first.
+	if fwdMgr != nil {
+		fwdMgr.StopAll()
+	}
+
 	var firstErr error
 	if session != nil {
 		if err := session.Close(); err != nil && firstErr == nil {
@@ -272,6 +280,13 @@ func (c *Client) IsConnected() bool {
 	return c.connected
 }

+// Forwards returns the ForwardManager for this client, or nil if not connected.
+func (c *Client) Forwards() *ForwardManager {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.forwards
+}
+
 // buildAuthMethods constructs the SSH authentication method list from the
 // profile's SSHConfig and the provided credential callbacks.
 func (c *Client) buildAuthMethods(sc models.SSHConfig, getPassword func() (string, error), getPassphrase func() (string, error)) ([]ssh.AuthMethod, error) {