Detailed Description

SSH direct-tcpip port-forwarding owner (the ssh -L target side).

The forwarding owner that the channel codec's forward seam (ssh_channel_set_forward_open_cb / _data_cb) plugs into. The codec parses a direct-tcpip request and routes channel data; this layer does the actual I/O - it opens the outbound TCP connection through the client transport (det_client) and bridges bytes both ways - so no socket code leaks into the codec. One fixed table maps each forward channel to a client-transport connection; all storage is static (no heap). Compiled only when DETWS_SSH_PORT_FORWARD is set.

Security: any authenticated client can ask the server to connect anywhere (an open proxy / SSRF surface), so forwarding is opt-in twice over - compiled out by default, and inert until the application calls ssh_forward_begin(). Install a policy callback to restrict the reachable targets.

Definition in file ssh_forward.h.