Pascal (Lazarus/Delphi)

SSH Tunnel Dynamic Port Forwarding (Local SOCKS Proxy)

Demonstrates dynamic port forwarding with the DynamicPortForwarding, InboundSocksUsername, and InboundSocksPassword properties. In dynamic mode the listener acts as a local SOCKS proxy, so each client chooses its own destination and one tunnel can reach many hosts on the SSH server's network.

Background: This is the ssh -D scenario: instead of pinning one local port to one destination, the tunnel speaks SOCKS and lets each client name where it wants to go. Any SOCKS-capable application — a browser, a mail client — can then reach the remote network through the single tunnel. Setting an inbound SOCKS username and password restricts who may use the local proxy, which matters because it would otherwise accept unauthenticated connections from any local process.

Chilkat Pascal (Lazarus/Delphi) Downloads

Download Chilkat for Pascal (Lazarus/Delphi)

Pascal (Lazarus/Delphi)

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.SshTunnel;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  tunnel: TSshTunnel;
  sshPort: Integer;
  password: string;
  listenPort: Integer;
  waitForThreadExit: Boolean;

begin
  success := False;

  //  Demonstrates dynamic port forwarding with the SshTunnel properties DynamicPortForwarding,
  //  InboundSocksUsername, and InboundSocksPassword.
  //  
  //  In dynamic mode the listener behaves as a local SOCKS proxy: each client chooses its own
  //  destination, so one tunnel can reach many hosts on the SSH server's network.

  tunnel := TSshTunnel.Create;

  //  Enable dynamic (SOCKS) forwarding instead of a single fixed destination.  No DestHostname or
  //  DestPort is needed.
  tunnel.DynamicPortForwarding := True;

  //  Optionally require inbound SOCKS5 clients to authenticate with the local proxy.  If left unset,
  //  the local proxy accepts unauthenticated SOCKS4 and SOCKS5 connections.
  tunnel.InboundSocksUsername := 'myLocalSocksLogin';
  tunnel.InboundSocksPassword := 'myLocalSocksPassword';

  sshPort := 22;
  success := tunnel.Connect('ssh.example.com',sshPort);
  if (success = False) then
    begin
      WriteLn(tunnel.LastErrorText);
      Exit;
    end;

  //  Normally you would not hard-code the password in source.  You should instead obtain it
  //  from an interactive prompt, environment variable, or a secrets vault.
  password := 'mySshPassword';

  success := tunnel.AuthenticatePw('mySshLogin',password);
  if (success = False) then
    begin
      WriteLn(tunnel.LastErrorText);
      Exit;
    end;

  //  Start the local SOCKS proxy on port 1080.  SOCKS-capable clients point at 127.0.0.1:1080.
  listenPort := 1080;
  success := tunnel.BeginAccepting(listenPort);
  if (success = False) then
    begin
      WriteLn(tunnel.LastErrorText);
      Exit;
    end;
  WriteLn('Local SOCKS proxy running on port ' + listenPort);

  waitForThreadExit := True;
  success := tunnel.CloseTunnel(waitForThreadExit);
  if (success = False) then
    begin
      WriteLn(tunnel.LastErrorText);
      Exit;
    end;


  tunnel.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.