DataFlex

SSH Tunnel (Port Forwarding via direct-tcpip Channel)

Demonstrates creating an SSH tunnel to a remote host:port using a direct-tcpip channel. Data written to the channel is forwarded by the SSH server to the target, and data read back is whatever the target sent. This example tunnels a simple HTTP GET request to a web server.

Background: This is SSH local port forwarding at the API level, and the target need not be a web server — it can be a database, a message broker, or any TCP service. The key detail is that the SSH server resolves and connects to the target, not your machine, so the destination only has to be reachable from the server's network. That is what makes tunneling useful for reaching services behind a firewall. Note the receive pattern here: read until the double CRLF that ends an HTTP header, extract exactly that with GetReceivedTextS, then poll briefly for the body, which may already have arrived.

Chilkat DataFlex Downloads

Download Chilkat for DataFlex

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoSsh
    String sHostname
    Integer iPort
    String sPassword
    String sTargetHost
    Integer iTargetPort
    Integer iChannelNum
    String sHttpReq
    Boolean iCaseSensitive
    String sMatchStr
    String sResponseHeader
    Integer iPollTimeoutMs
    Integer iNumBytesRead
    String sHtmlBody
    String sTemp1
    Boolean bTemp1

    Move False To iSuccess

    //  This example requires the Chilkat API to have been previously unlocked.
    //  See Global Unlock Sample for sample code.

    //  Demonstrates creating an SSH tunnel to a remote host:port using a direct-tcpip channel.
    //  Data written to the channel is forwarded by the SSH server to the target host:port, and data
    //  read from the channel is whatever the target sent back.

    Get Create (RefClass(cComChilkatSsh)) To hoSsh
    If (Not(IsComObjectCreated(hoSsh))) Begin
        Send CreateComObject of hoSsh
    End

    Move "ssh.example.com" To sHostname
    Move 22 To iPort
    Get ComConnect Of hoSsh sHostname iPort To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Normally you would not hard-code the password in source.  You should instead obtain it
    //  from an interactive prompt, environment variable, or a secrets vault.
    Move "mySshPassword" To sPassword

    Get ComAuthenticatePw Of hoSsh "mySshLogin" sPassword To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Ask the SSH server to connect onward to this host:port.  The target is resolved by the SSH
    //  server, not by this computer, so it must be reachable from the server's network.  The target
    //  need not be a web server -- it can be any TCP service.
    Move "www.chilkatsoft.com" To sTargetHost
    Move 80 To iTargetPort
    Get ComOpenDirectTcpIpChannel Of hoSsh sTargetHost iTargetPort To iChannelNum
    If (iChannelNum < 0) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Send a simple HTTP GET request through the tunnel.
    Move "GET /xyz123.html HTTP/1.1" + (character(13)) + (character(10)) + "Host: www.chilkatsoft.com" + (character(13)) + (character(10)) + (character(13)) + (character(10)) To sHttpReq
    Get ComChannelSendString Of hoSsh iChannelNum sHttpReq "utf-8" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  IMPORTANT: Set a read timeout before receiving until a match.  ReadTimeoutMs defaults to 0,
    //  which means no limit -- without it, this call waits forever if the received data never
    //  contains a match.
    Set ComReadTimeoutMs Of hoSsh To 15000

    //  An HTTP response header ends with a blank line, so receive until a double CRLF is seen.
    //  The method may read beyond the match, but it stops waiting as soon as the match appears.
    Move False To iCaseSensitive
    Move (character(13)) + (character(10)) + (character(13)) + (character(10)) To sMatchStr
    Get ComChannelReceiveUntilMatch Of hoSsh iChannelNum sMatchStr "utf-8" iCaseSensitive To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  GetReceivedTextS removes everything through and including the match, which is exactly the
    //  response header.
    Get ComGetReceivedTextS Of hoSsh iChannelNum sMatchStr "utf-8" To sResponseHeader
    Get ComLastMethodSuccess Of hoSsh To bTemp1
    If (bTemp1 = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "---- HTTP Response Header ----"
    Showln sResponseHeader

    //  The body may already have arrived along with the header.  Poll briefly for anything more.
    //  A -2 return simply means nothing further arrived, which is not an error here.
    Move 200 To iPollTimeoutMs
    Get ComChannelPoll Of hoSsh iChannelNum iPollTimeoutMs To iNumBytesRead
    If (iNumBytesRead = -1) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get ComGetReceivedText Of hoSsh iChannelNum "utf-8" To sHtmlBody
    Get ComLastMethodSuccess Of hoSsh To bTemp1
    If (bTemp1 = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "---- HTML BODY ----"
    Showln sHtmlBody

    Get ComChannelSendClose Of hoSsh iChannelNum To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Send ComDisconnect To hoSsh


End_Procedure