eve.net.ssh.forwarding

TCP forwarding bridges coupling EVE sockets to SSH channels.

The bridges sit on top of the existing channel contracts: every byte passes through SshChannel reads/writes and every wakeup runs through the session driver, so flow control, window accounting, and EOF/close semantics stay owned by the SSH layer. Per-direction bridge queues are bounded and couple socket read pause/resume to channel writability.

Half-close propagation is independent in both directions: a socket read EOF becomes a channel sendEof after the queued bytes, and a channel peer EOF becomes a socket write shutdown while socket data keeps flowing into the channel.

Bind, destination, and access decisions are explicit caller policy through EveLocalForwardPolicy and EveForwardedBridgePolicy; no bridge accepts traffic on its own.

enum EveForwardBridgeLimits
struct EveBridgeHost EveForwardedBridgePolicy EveLocalForwardPolicy
class EveChannelSocketBridge EveForwardedChannelBridge EveLocalForwardBridge
fn bridgeHost safeAcceptCb safeCloseCb safeConnectCb safeDataCb safeEofCb safeTimerCb safeWritableCb

Types 7

enumEveForwardBridgeLimits

Bounds and defaults for the forwarding bridges.

bridgeQueueMaxDefault = 256 * 1024Default bounded queue per bridge direction (bytes)
bridgeQueueLowWaterDivisor = 2Bytes at which paused socket reads resume
connectTimeoutMs = 5000Default destination connect timeout
structEveBridgeHost

Scheduling surface the bridges need from the session driver.

EveBridgeHost.of adapts an EveSessionDriver; tests may provide their own host.

Fields
void delegate(SshChannel, void delegate()) watchChannelWatches a channel for readable data or send-window relief.
void delegate(SshChannel) unwatchChannelStops watching a channel.
void delegate() requestPumpRequests a coalesced session pump.
void delegate(SshChannelOpenOperation, void delegate(SshChannelOpenOperation)) watchOpenWatches a channel-open operation for terminal completion.
void delegate(SshChannelOpenOperation) unwatchOpenStops watching a channel-open operation.
Token delegate(Duration, void delegate()) registerDeadlineRegisters a one-shot deadline.
void delegate(Token) cancelDeadlineCancels a registered deadline.
structEveLocalForwardPolicy

Caller-controlled policy for a local forwarding bridge.

Fields
string listenAddressAddress the bridge listens on (bind policy).
ushort listenPortPort to bind; 0 lets the OS allocate one.
string destinationHostDestination host as seen by the SSH server (direct-tcpip).
ushort destinationPortDestination port as seen by the SSH server.
string originatorAddressOriginator identity reported to the SSH server.
ushort originatorPortOriginator port reported to the SSH server.
size_t bridgeQueueMaxBounded queue per bridge direction, in bytes.
bool delegate() admitAccess policy consulted for every accepted socket; returning false closes the connection without opening a channel. A null delegate refuses everything.
structEveForwardedBridgePolicy

Caller-controlled policy for bridging incoming forwarded channels.

Fields
size_t bridgeQueueMaxBounded queue per bridge direction, in bytes.
Duration connectTimeoutTimeout for the destination connection attempt.
bool delegate(scope const SshForwardedChannelInfo info, out string destinationHost, out ushort destinationPort) admitAccess and destination policy consulted for every incoming forwarded channel. Returning false refuses the channel; otherwise destinationHost/destinationPort receive where to connect. A null delegat...
classEveChannelSocketBridge

Bridges one EVE TCP connection and one SSH channel.

Data flows in both directions through bounded queues: socket reads pause when the channel-side queue is full and channel reads wait for socket writability. Independent half-closes propagate as described in the module documentation.

Fields
private EveBridgeHost host_
private TcpConnection conn_
private SshChannel channel_
private size_t queueMax_
private ubyte[] inbound_
private ubyte[] outbound_
private bool socketReadPaused_
private bool socketEof_
private bool channelEofToSocket_
private bool socketWriteFailed_
private bool unwatched_
private bool doneNotified_
private void delegate(EveChannelSocketBridge) onDone_
private bool bridgeDone_
Methods
void attachChannel(SshChannel channel)Attaches the SSH channel and starts forwarding.
SshChannel channel() @propertyReturns: the bridged channel (null before attachment).
TcpConnection connection() @propertyReturns: the bridged socket.
void shutdown()Shuts the bridge down: closes the socket and the channel.
bool done() @property constReturns: whether this bridge finished and can be pruned.
void onDone(void delegate(EveChannelSocketBridge) onDone) @propertySets the callback invoked once when the bridge becomes terminal.
private void onChannelProgress()Reads ready channel bytes into the bounded outbound queue.
private void pumpOutbound()Fills the outbound queue from the channel and flushes it to the socket.
private void flushOutbound()Sends as much of the outbound queue as the socket accepts.
private void drainInbound()Writes queued socket bytes to the channel and completes a socket read EOF behind them.
private void maybeShutdownWrite()Shuts the socket write direction down once the channel peer's EOF is fully forwarded (independent half-close).
private void finishIfDone()Tears the pair down once both directions have finished.
private void unwatch()
private void notifyDone()Notifies the owner once after terminal bridge cleanup.
Constructors
this(EveBridgeHost host, TcpConnection conn, SshChannel channel = null, size_t queueMax = EveForwardBridgeLimits.bridgeQueueMaxDefault)Constructs a bridge over an established socket.
classEveLocalForwardBridge

Local forwarding bridge: a caller-bound TCP listener whose accepted sockets each become one direct-tcpip channel.

The bridge never chooses the bind address, destination, or access decision; those come from EveLocalForwardPolicy.

Fields
private EveBridgeHost host_
private EventLoop * loop_
private SshSessionImpl session_
private EveLocalForwardPolicy policy_
private TcpListener listener_
private bool stopped_
private Opening[] opening_
EveChannelSocketBridge[] bridgesLive bridges for accepted connections.
Methods
ushort listenPort() @property constReturns: the actually bound listen port (after OS allocation).
void stop()Stops the bridge: closes the listener and every live bridge.
private void onAccept(Handle clientHandle)
private void completeOpen(SshChannelOpenOperation open)Completes and retires a watched local channel open.
private void timeoutOpen(SshChannelOpenOperation open)Cancels and retires a local channel open at its deadline.
private Duration openTimeout()Returns: the direct-tcpip open timeout: the bridge connect timeout, so a stalled server fails the accepted socket rather than buffering it forever.
private void pruneBridges()Drops finished bridges so long-lived listeners do not accumulate completed state.
private void retireBridge(EveChannelSocketBridge bridge)Removes a terminal local bridge from owner tracking.
private void rejectAccepted(Handle clientHandle)
Constructors
this(EveBridgeHost host, ref EventLoop loop, SshSessionImpl session, scope const EveLocalForwardPolicy policy)Binds the listener described by the policy.
Nested Templates
OpeningOne accepted socket waiting for its SSH channel to open.
classEveForwardedChannelBridge : SshForwardedChannelHandler

Destination bridge for incoming forwarded TCP/IP channels.

Implements SshForwardedChannelHandler: each admitted channel triggers a destination connection, and the decision stays PENDING until the connection attempt succeeds or fails. Pass handler to SshSession.setForwardedChannelHandler.

Fields
private EveBridgeHost host_
private EventLoop * loop_
private EveForwardedBridgePolicy policy_
private Pending[] pending_
private EveChannelSocketBridge[] active_
private bool stopped_
Methods
EveForwardedChannelBridge handler() @propertyThe handler surface to register with the session.
void stop()Shuts every pending and live bridge down and refuses further channels.
SshForwardAcceptResult decideForwardedChannel( scope const SshForwardedChannelInfo info, SshChannel channel)
private void onConnected(SshChannel channel)Bridges the pair once the destination connection succeeds.
private void onConnectFailed(SshChannel channel)Refuses the channel when the destination connect fails or times out.
private void retireBridge(EveChannelSocketBridge bridge)Removes a terminal forwarded bridge from owner tracking.
Constructors
this(EveBridgeHost host, ref EventLoop loop, scope const EveForwardedBridgePolicy policy)Constructs the bridge.
Nested Templates
Pending

Functions 8

private fnauto safeAcceptCb( void delegate(ref TcpListener, Handle) @system dg) pure nothrow @trustedCasts a system accept callback to the safe EVE callback type.
private fnauto safeConnectCb(void delegate(ref TcpConnection) @system dg) pure nothrow @trustedCasts a system connect callback to the safe EVE callback type.
private fnauto safeEofCb(void delegate(ref TcpConnection) @system dg) pure nothrow @trustedCasts a system EOF callback to the safe EVE callback type.
private fnauto safeDataCb( void delegate(ref TcpConnection, scope const(ubyte)[]) @system dg) pure nothrow @trustedCasts a system data callback to the safe EVE callback type.
private fnauto safeWritableCb(void delegate(ref TcpConnection) @system dg) pure nothrow @trustedCasts a system writable callback to the safe EVE callback type.
private fnauto safeCloseCb( void delegate(ref TcpConnection, SocketCloseReason) @system dg) pure nothrow @trustedCasts a system close callback to the safe EVE callback type.
private fnauto safeTimerCb(void delegate(ref EventLoop, Token) @system dg) pure nothrow @trustedCasts a system timer callback to the safe nothrow EVE callback type.
fnEveBridgeHost bridgeHost(EveSessionDriver driver)Adapts an EveSessionDriver into a bridge host.