SshTunnel React Native Reference Documentation
SshTunnel
Current Version: 11.6.1
Chilkat.SshTunnel
Listen on a local port and forward accepted client connections through an
SSH server to a configured destination host and port.
Enable SOCKS-style dynamic port forwarding when each client connection
should choose its own destination through the tunnel.
Authenticate to the SSH server using passwords, public keys,
password-plus-key, secure password lookup, or keyboard-interactive
authentication.
Reach the SSH server through HTTP or SOCKS proxies, or build tunnels
through an existing SSH connection for multi-hop scenarios.
Start accepting client connections in the background, inspect current
state, stop accepting new clients, and disconnect active tunnel clients.
Use accept logs, tunnel logs, current-state XML, and
Learn how static forwarding, dynamic SOCKS forwarding, multi-hop tunneling,
proxies, background threads, lifecycle management, and troubleshooting fit
together.
A shorter API-focused introduction is also available in the
SshTunnel Class Overview.
Create SSH tunnels for secure local, fixed-destination, dynamic, and multi-hop forwarding.
Chilkat.SshTunnel creates SSH tunnels for forwarding local
client connections through an SSH server to a destination service, such as a
database server or other TCP service. It supports fixed destination
forwarding, dynamic SOCKS-style port forwarding, password and public-key
authentication, keyboard-interactive authentication, proxy connections to the
SSH server, multi-hop SSH connections, background accept threads,
tunnel/client logging, secure secret lookup, and connection diagnostics.
Local port forwarding
Dynamic forwarding
SSH authentication
Proxy and multi-hop access
Accept and manage clients
Logging and diagnostics
LastErrorText to troubleshoot SSH connection, forwarding,
authentication, or client-connection problems.
BeginAccepting to
start the tunnel. Local client applications connect to the tunnel's listen
port, and SshTunnel forwards the traffic through SSH. Use
Chilkat.SshTunnel for port forwarding; use
Chilkat.Ssh for direct SSH sessions, commands, channels, and
shell access.
Object Creation
// npm install @chilkat/react-native react-native-nitro-modules
// (React Native 0.76+ with the New Architecture; then `pod install` for iOS. The Chilkat
// native library is downloaded and verified during the native build -- see the package README.)
import { Chilkat, SshTunnel } from '@chilkat/react-native'
// Once per app start, before any other Chilkat call:
Chilkat.unlockBundle('Anything for 30-day trial') // shorthand for new Global().unlockBundle(..)
const sshTunnel = new SshTunnel()
// ... the native object is released when `sshTunnel` is garbage collected, or now with sshTunnel.dispose()Creates the underlying native Chilkat object. SshTunnel is a Nitro Module HybridObject: use it from the JavaScript thread only (it cannot be passed to a Worklet or another runtime). Every member is synchronous and blocks the JavaScript thread until Chilkat returns; a method that can take a while also exists as a ...Async twin returning a Promise, which runs the same call on a native worker thread so the UI keeps rendering. While such a call is pending, every other call on this object throws, except abort() and assigning onPercentDone / onProgressInfo.
Releases the native object immediately instead of waiting for garbage collection (useful for a large BinData or an open socket). Calling it more than once is harmless; any other use of the object afterwards throws. An object with a pending ...Async call cannot be disposed until the promise settles.
Errors
A method that can fail throws a plain Error: a method whose only outcome is success or failure returns void and throws on failure; a method producing a string or an object returns it and throws where Chilkat would have returned null. The error's message is "Class.method(...): reason", where the reason is the last informative line of the object's lastErrorText, which holds the full Chilkat log of the failed call. A ...Async twin rejects its promise with the same Error instead of throwing. Properties never throw, and methods that answer a question (has..., is..., ...) return a plain boolean.
try {
sshTunnel.someMethod(...)
} catch (e) {
console.log((e as Error).message) // SshTunnel.someMethod(...): <reason>
console.log(sshTunnel.lastErrorText) // the full Chilkat log of the failed call
}
// The same call without blocking the JavaScript thread:
try {
await sshTunnel.someMethodAsync(...)
} catch (e) {
console.log((e as Error).message) // SshTunnel.someMethodAsync: <reason>
}
Properties
AbortCurrent
abortCurrent: boolean
Set this property to from another thread to request that
the currently running foreground operation be aborted. For example, it can
interrupt a synchronous
trueConnect that is waiting for an SSH
server response.
This property does not stop the background listener or terminate established background tunnel clients.
true; set it back to
false before starting another operation.
AcceptLog
acceptLog: string
Contains the in-memory activity log for the background listener thread started by
BeginAccepting.
The log is populated only when
KeepAcceptLog is
.
true
AcceptLogPath
acceptLogPath: string
Specifies the local file path where activity from the background listener thread is written.
This file-based log is separate from the in-memory
AcceptLog.
ClientIdentifier
clientIdentifier: string
Specifies the SSH client-identification string sent when connecting to the SSH server.
Starting in Chilkat v9.5.0.99, the default is
SSH-2.0-Chilkat_ followed by the Chilkat version number, such
as SSH-2.0-Chilkat_9.5.0.99.
SSH-2.0-. Some SSH servers
disconnect clients that send an invalid identification string.
ClientLogDir
clientLogDir: string
Specifies the local directory where a separate log file is created for each tunnel client.
When this property is not empty, files are named using the pattern
tunnel_client_log_{random_id}.txt.
ConnectTimeoutMs
connectTimeoutMs: number
Specifies the maximum number of milliseconds allowed for establishing the SSH connection.
- The default value is
30000milliseconds (30 seconds). - A value of
0disables the connection timeout and allows an unlimited wait.
The timeout applies to more than the initial TCP connection. It also covers connection setup performed through an HTTP or SOCKS proxy and waiting for the SSH server identification string after the TCP connection has been established.
DebugLogFilePath
debugLogFilePath: string
If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. This logging helps identify the context and history of Chilkat calls leading up to any crash or hang, aiding in debugging.
Enabling the VerboseLogging property provides more detailed information. This property is mainly used for debugging rare instances where a Chilkat method call causes a hang or crash, which should generally not happen.
Possible causes of hangs include:
- A timeout property set to 0, indicating an infinite timeout.
- A hang occurring within an event callback in the application code.
- An internal bug in the Chilkat code causing the hang.
DestHostname
destHostname: string
Specifies the destination hostname or IP address for fixed-destination port forwarding. This is typically the host running the database server or other TCP service that local clients need to reach.
The destination is interpreted from the SSH server's network environment. For
example, localhost and 127.0.0.1 refer to the SSH
server itself, not the computer running the application. Hostname resolution is
therefore performed as part of the forwarding request on the SSH-server side.
Traffic accepted by the local listener is carried through SSH, forwarded by the SSH server to this destination, and returned through the same tunnel.
DynamicPortForwarding
is true. Changing the destination while the listener is
running affects new clients only; existing clients remain connected to the
destination selected when they were accepted.
DestPort
destPort: number
Specifies the TCP port of the destination service used for fixed-destination forwarding, such as the port of a database server.
It is used together with
DestHostname and is ignored
when
DynamicPortForwarding
is .
true
DynamicPortForwarding
dynamicPortForwarding: boolean
Controls whether the listener performs fixed-destination or dynamic port forwarding.
-
When
(the default), every accepted connection is forwarded tofalseDestHostnameandDestPort. -
When
, the listener acts as a SOCKS proxy and each inbound client supplies its own destination.true
The SOCKS version is detected independently from each inbound client handshake;
there is no separate inbound SOCKS-version property. SOCKS4 and SOCKS5
CONNECT requests are supported. SOCKS5 BIND and
UDP association are not supported.
Leave
InboundSocksUsername
empty to allow SOCKS5 clients to use the no-authentication method. Set the
inbound username and password to require SOCKS5 username/password
authentication. For SOCKS4, only the user ID can be checked because SOCKS4 has
no password field.
EnableSecrets
enableSecrets: boolean
Enables automatic resolution of credentials from secure storage provided by the operating system.
When set to , supported password properties and methods
may receive a secret specification string beginning with
true!! instead of a literal password. Chilkat resolves the secret
from:
- Windows Credential Manager on Windows.
- Apple Keychain on macOS.
The specification format is:
!![appName|]service[|domain]|username
This applies to
HttpProxyPassword,
SocksPassword,
AuthenticatePw, and
AuthenticatePwPk.
The default value is .
false
HostKeyFingerprint
readonly hostKeyFingerprint: string
Contains the SSH server host-key fingerprint after
Connect or
ConnectThroughSsh
establishes the SSH connection. The value is available before user
authentication.
Example:
ssh-ed25519 256 e0:33:b1:81:a5:c6:9a:d2:2e:c9:d3:15:60:ea:cf:4c
Compare this value with a trusted expected fingerprint to verify the identity
of the SSH server. For
ConnectThroughSsh, the
fingerprint is for the final SSH server, not the first-hop server.
CloseTunnel or after the
connection is lost. Use
IsSshConnected to determine
current connection state.
HttpProxyAuthMethod
httpProxyAuthMethod: string
Specifies the authentication method to use when the outbound connection to the SSH server passes through an HTTP proxy that requires authentication.
Valid values are Basic and NTLM.
If SocksVersion is set to 4 or 5, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.
HttpProxyDomain
httpProxyDomain: string
Specifies the optional Windows domain used for NTLM authentication with the HTTP proxy.
This applies only to the outbound proxy connection used to reach the SSH server,
and only when
HttpProxyAuthMethod
is NTLM.
If SocksVersion is set to 4 or 5, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.
HttpProxyHostname
httpProxyHostname: string
Specifies the hostname or IPv4 address of the HTTP proxy through which the outbound connection to the SSH server is made.
Leave this property empty when no HTTP proxy is required.
If SocksVersion is set to 4 or 5, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.
HttpProxyPassword
httpProxyPassword: string
Specifies the password used to authenticate with the HTTP proxy for the outbound connection to the SSH server.
If SocksVersion is set to 4 or 5, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.
HttpProxyPort
httpProxyPort: number
Specifies the TCP port of the HTTP proxy used for the outbound connection to the SSH server.
Common HTTP proxy ports include 8080 and
3128.
If SocksVersion is set to 4 or 5, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.
HttpProxyUsername
httpProxyUsername: string
Specifies the username used to authenticate with the HTTP proxy for the outbound connection to the SSH server.
If SocksVersion is set to 4 or 5, the SOCKS proxy takes precedence and these HTTP proxy settings are ignored. The proxies are not chained.
IdleTimeoutMs
idleTimeoutMs: number
Specifies a stall timeout, in milliseconds, for tunnel data-transfer operations.
The default value is 30000 milliseconds (30 seconds). A value of
0 disables the timeout.
InboundSocksPassword
inboundSocksPassword: string
Specifies the password required from inbound SOCKS5 clients when
DynamicPortForwarding
is .
true
This property is used together with
InboundSocksUsername.
It does not apply to SOCKS4 because the SOCKS4 protocol has no password field.
InboundSocksUsername
inboundSocksUsername: string
Specifies the username required from inbound SOCKS clients when
DynamicPortForwarding
is .
true
- For SOCKS5, setting this property enables username/password authentication.
- For SOCKS4, the value is compared with the client-supplied user ID.
- Leave it empty to require no inbound SOCKS username.
IsAccepting
readonly isAccepting: boolean
when the local listener thread is running and accepting
inbound TCP connections; otherwise true.
false
This property describes only the local listener. It can remain
after the SSH connection is lost or after
trueCloseTunnel is called. In those
states a client may connect to the local port even though its traffic cannot be
forwarded.
Use IsSshConnected separately
when the application also needs to know whether the SSH transport is available.
KeepAcceptLog
keepAcceptLog: boolean
Controls whether activity from the background listener thread is retained in memory.
The default value is . When enabled, retrieve the log
from falseAcceptLog.
KeepTunnelLog
keepTunnelLog: boolean
Controls whether SSH tunnel-thread activity is retained in memory.
The default value is . When enabled, retrieve the log
from falseTunnelLog.
LastErrorHtml
readonly lastErrorHtml: string
Provides HTML-formatted information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.
topLastErrorText
readonly lastErrorText: string
Provides plain text information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.
LastErrorXml
readonly lastErrorXml: string
Provides XML-formatted information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.
topLastMethodSuccess
lastMethodSuccess: boolean
Indicates the success or failure of the most recent method call: true means success, false means failure. This property remains unchanged by property setters or getters. This method is present to address challenges in checking for null or Nothing returns in certain programming languages. Note: This property does not apply to methods that return integer values or to boolean-returning methods where the boolean does not indicate success or failure.
ListenBindIpAddress
listenBindIpAddress: string
Specifies the local IPv4 address to which the tunnel's listening socket is bound.
| Value | Listener exposure |
|---|---|
| Empty string | Binds to 0.0.0.0 and accepts connections on all local IPv4 interfaces, subject to firewall rules. |
127.0.0.1 |
Accepts connections only from the local computer through loopback. |
| A specific local LAN address | Accepts connections through that interface only; loopback is not included automatically. |
127.0.0.1. Leaving it empty may expose the listening port to
other computers on the network.
If the value is malformed or is not assigned to a local interface,
BeginAccepting returns
and the bind failure is available in
falseLastErrorText and the accept log.
ListenPort
readonly listenPort: number
Contains the local TCP port used by the listener started by
BeginAccepting.
-
If
BeginAcceptingsucceeds with a nonzero requested port, this property contains that port. -
If
BeginAcceptingsucceeds with0, the operating system chooses an available port and this property contains the allocated port when the method returns. -
After a bind failure for an explicitly requested port, this property may still
contain the requested port even though
IsAcceptingis.false - The value is initially
0.
OutboundBindIpAddress
outboundBindIpAddress: string
Specifies the local IP address to which the outbound socket is bound before connecting to the SSH server.
Most applications should leave this property empty. Set it only on a multihomed computer when the SSH connection must originate from a specific local network interface or IP address.
OutboundBindPort
outboundBindPort: number
Specifies the local TCP port to bind before making the outbound connection to the SSH server.
The default value is 0, which allows the operating system to
choose an available ephemeral port. Nearly all applications should leave this
property unchanged.
PreferIpv6
preferIpv6: boolean
Controls which IP version is preferred when a hostname resolves to both IPv4 and IPv6 addresses.
(the default) prefers IPv4.falseprefers IPv6.true
SocksHostname
socksHostname: string
Specifies the hostname or IPv4 address of the outbound SOCKS4 or SOCKS5 proxy used to reach the SSH server.
This property is used only when
SocksVersion is
4 or 5.
SocksPassword
socksPassword: string
Specifies the password for authenticating with an outbound SOCKS5 proxy used to reach the SSH server.
SOCKS4 does not support password authentication, so this property does not apply
when SocksVersion is
4.
SocksPort
socksPort: number
Specifies the TCP port of the outbound SOCKS4 or SOCKS5 proxy used to reach the SSH server.
The default value is 1080. This property is used only when
SocksVersion is
4 or 5.
SocksUsername
socksUsername: string
Specifies the username for the outbound SOCKS4 or SOCKS5 proxy used to reach the SSH server.
This property is used only when
SocksVersion is
4 or 5.
SocksVersion
socksVersion: number
Selects whether the outbound connection to the SSH server is made through a SOCKS proxy.
| Value | Behavior |
|---|---|
0 |
Do not use a SOCKS proxy. This is the default. |
4 |
Connect through a SOCKS4 proxy. |
5 |
Connect through a SOCKS5 proxy. |
When this property is 4 or 5, the SOCKS proxy
settings take precedence over the HTTP proxy settings. The SOCKS and HTTP
proxies are not chained.
SoRcvBuf
soRcvBuf: number
Sets the receive-buffer size for the underlying TCP socket.
The default value is 4194304 bytes. Normally this property
should remain unchanged. If receive performance is unusually slow, testing a
larger value that is a multiple of 4096 may help.
SoSndBuf
soSndBuf: number
Sets the send-buffer size for the underlying TCP socket.
The default value is 262144 bytes. Normally this property
should remain unchanged. If send performance is unusually slow, testing values
such as 524288 or 1048576 may help. A
multiple of 4096 is recommended.
TcpNoDelay
tcpNoDelay: boolean
Controls the TCP_NODELAY socket option for the underlying TCP
connection.
The default value is . Setting it to
false disables the Nagle algorithm, which can reduce latency
when many small amounts of data are sent.
true
TunnelLog
tunnelLog: string
Contains the in-memory activity log for the SSH tunnel and client-manager
threads. The log is populated only when
KeepTunnelLog is
.
true
TunnelLogPath
tunnelLogPath: string
Specifies the local file path where SSH tunnel-thread activity is written.
This file-based log is separate from the in-memory
TunnelLog.
UncommonOptions
uncommonOptions: string
Provides optional behavior for uncommon requirements. The default value is an empty string, which is appropriate for most applications.
To enable more than one option, provide a comma-separated list of keywords.
| Keyword | Effect |
|---|---|
ForceUserAuthRsaSha1 |
Forces rsa-sha1 for public-key user authentication. Set this before connecting. Added in v9.5.0.98. |
NoKeepAliveIgnoreMsg |
Disables the default SSH ignore message sent every 20 seconds to keep an idle connection alive. Added in v9.5.0.76. |
no-weak-mac-algs |
Removes hmac-sha1-96, hmac-sha1, hmac-md5, and hmac-ripemd160 from the offered MAC algorithms. Added in v9.5.0.98. |
ProtectFromVpn |
On Android, bypasses an installed or active VPN. Added in v9.5.0.80. |
+ssh-hmac-etm |
Re-enables SSH encrypt-then-MAC algorithms that were disabled by default in v9.5.0.97 as part of the Terrapin mitigation. |
+chacha20-poly1305@openssh.com |
Re-enables chacha20-poly1305@openssh.com, which was removed from the default offer in v9.5.0.97 as part of the Terrapin mitigation. |
VerboseLogging
verboseLogging: boolean
If set to true, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. The default value is false. Verbose logging should only be used for debugging. The potentially large quantity of logged information may adversely affect peformance.
Version
readonly version: string
Methods
AuthenticatePk
Authenticates with the SSH server using public-key authentication.
The public key corresponding to privateKey must already be
installed for username on the SSH server.
Call Connect or
ConnectThroughSsh
before calling this method.
LastErrorText.
Returns normally on success; throws an Error on failure.
AuthenticatePkAsync
Asynchronous form of AuthenticatePk: the same call on a native worker thread, so the JavaScript thread (and the UI) stays responsive. Takes the same arguments and resolves with the same result. While the returned Promise is pending, every other call on this object throws (the object is busy), except abort(), which cancels the call, and assigning the onPercentDone / onProgressInfo callbacks, which report its progress.
Note: the onPercentDone and onProgressInfo callbacks run on the JavaScript thread while the promise is pending, so they can update the UI directly. A rejection's message is "Class.methodAsync: reason"; the full log is in lastErrorText.
Returns a Promise that resolves with the synchronous method's result (undefined for a void method) and rejects with an Error where the synchronous method would throw.
AuthenticatePw
Authenticates with the SSH server using login and
password.
Establish the SSH connection first by calling
Connect or
ConnectThroughSsh.
After authentication succeeds, call
BeginAccepting to begin
accepting tunnel clients.
- A rejected username or password does not close the SSH connection; the application may correct the credentials and call this method again.
- Calling this method again after authentication has already succeeded returns
with an “Already authenticated” error.false
LastErrorText captured immediately after the failed call.
Returns normally on success; throws an Error on failure.
AuthenticatePwAsync
Asynchronous form of AuthenticatePw: the same call on a native worker thread, so the JavaScript thread (and the UI) stays responsive. Takes the same arguments and resolves with the same result. While the returned Promise is pending, every other call on this object throws (the object is busy), except abort(), which cancels the call, and assigning the onPercentDone / onProgressInfo callbacks, which report its progress.
Note: the onPercentDone and onProgressInfo callbacks run on the JavaScript thread while the promise is pending, so they can update the UI directly. A rejection's message is "Class.methodAsync: reason"; the full log is in lastErrorText.
Returns a Promise that resolves with the synchronous method's result (undefined for a void method) and rejects with an Error where the synchronous method would throw.
AuthenticatePwPk
Authenticates with an SSH server that requires both a password and a private key.
The public key corresponding to privateKey must already be
installed for username on the SSH server. Most SSH servers
require either password authentication or public-key authentication rather than
both.
LastErrorText.
Returns normally on success; throws an Error on failure.
AuthenticatePwPkAsync
Asynchronous form of AuthenticatePwPk: the same call on a native worker thread, so the JavaScript thread (and the UI) stays responsive. Takes the same arguments and resolves with the same result. While the returned Promise is pending, every other call on this object throws (the object is busy), except abort(), which cancels the call, and assigning the onPercentDone / onProgressInfo callbacks, which report its progress.
Note: the onPercentDone and onProgressInfo callbacks run on the JavaScript thread while the promise is pending, so they can update the UI directly. A rejection's message is "Class.methodAsync: reason"; the full log is in lastErrorText.
Returns a Promise that resolves with the synchronous method's result (undefined for a void method) and rejects with an Error where the synchronous method would throw.
AuthenticateSecPw
Performs the same password authentication as
AuthenticatePw, but receives
the login and password in SecureString objects.
Returns normally on success; throws an Error on failure.
AuthenticateSecPwAsync
Asynchronous form of AuthenticateSecPw: the same call on a native worker thread, so the JavaScript thread (and the UI) stays responsive. Takes the same arguments and resolves with the same result. While the returned Promise is pending, every other call on this object throws (the object is busy), except abort(), which cancels the call, and assigning the onPercentDone / onProgressInfo callbacks, which report its progress.
Note: the onPercentDone and onProgressInfo callbacks run on the JavaScript thread while the promise is pending, so they can update the UI directly. A rejection's message is "Class.methodAsync: reason"; the full log is in lastErrorText.
Returns a Promise that resolves with the synchronous method's result (undefined for a void method) and rejects with an Error where the synchronous method would throw.
AuthenticateSecPwPk
Performs the same combined password-and-private-key authentication as
AuthenticatePwPk, but
receives the username and password in SecureString objects.
Returns normally on success; throws an Error on failure.
AuthenticateSecPwPkAsync
Asynchronous form of AuthenticateSecPwPk: the same call on a native worker thread, so the JavaScript thread (and the UI) stays responsive. Takes the same arguments and resolves with the same result. While the returned Promise is pending, every other call on this object throws (the object is busy), except abort(), which cancels the call, and assigning the onPercentDone / onProgressInfo callbacks, which report its progress.
Note: the onPercentDone and onProgressInfo callbacks run on the JavaScript thread while the promise is pending, so they can update the UI directly. A rejection's message is "Class.methodAsync: reason"; the full log is in lastErrorText.
Returns a Promise that resolves with the synchronous method's result (undefined for a void method) and rejects with an Error where the synchronous method would throw.
BeginAccepting
Creates and starts the local listener on listenPort.
The SSH connection must already have been established. Although the listener can be started before user authentication, clients accepted in that state cannot be forwarded. The recommended sequence is to connect, authenticate, and then call this method.
- The requested port must not already be in use on the selected local interface.
- Pass
0to let the operating system choose an available port, then readListenPort. - Calling this method while the listener is already running returns
.false
The method waits for the initial bind-and-listen result. It returns
for errors such as an occupied port, a malformed bind
address, or an address that is not assigned to the local computer. Details are
available immediately in falseLastErrorText and, when enabled, the
accept log.
Returns normally on success; throws an Error on failure.
BeginAcceptingAsync
Asynchronous form of BeginAccepting: the same call on a native worker thread, so the JavaScript thread (and the UI) stays responsive. Takes the same arguments and resolves with the same result. While the returned Promise is pending, every other call on this object throws (the object is busy), except abort(), which cancels the call, and assigning the onPercentDone / onProgressInfo callbacks, which report its progress.
Note: the onPercentDone and onProgressInfo callbacks run on the JavaScript thread while the promise is pending, so they can update the UI directly. A rejection's message is "Class.methodAsync: reason"; the full log is in lastErrorText.
Returns a Promise that resolves with the synchronous method's result (undefined for a void method) and rejects with an Error where the synchronous method would throw.
CloseTunnel
Disconnects active tunnel clients and stops the tunnel-manager thread.
When waitForThreads is , the method waits
for the client and tunnel-manager threads to exit. It returns
true if a worker thread does not stop; capture
falseLastErrorText immediately for details.
StopAccepting separately to
stop accepting local TCP connections. After this method returns, the listener
may still accept a local connection even though the connection cannot be
forwarded.
Calling this method more than once is allowed. However, it does not reset the
object for a new call to
Connect. Use a new
SshTunnel object when connecting to a different SSH server.
Returns normally on success; throws an Error on failure.
Connect
Establishes the SSH connection that will carry tunneled traffic. This method performs the TCP or proxy connection, the SSH protocol handshake, and host-key negotiation, but it does not authenticate the SSH user.
After connecting, verify
HostKeyFingerprint, then
authenticate by calling one of the Authenticate* methods. Finally,
call BeginAccepting to start
the local listener.
The host-key fingerprint is available immediately after this method succeeds,
before user authentication. Calling Connect again while an SSH
tunnel already exists returns .
false
Chilkat sends an SSH ignore message every 20 seconds to help
keep an unused SSH connection alive. To disable this behavior, add
NoKeepAliveIgnoreMsg to
UncommonOptions before
connecting.
Returns normally on success; throws an Error on failure.
ConnectAsync
Asynchronous form of Connect: the same call on a native worker thread, so the JavaScript thread (and the UI) stays responsive. Takes the same arguments and resolves with the same result. While the returned Promise is pending, every other call on this object throws (the object is busy), except abort(), which cancels the call, and assigning the onPercentDone / onProgressInfo callbacks, which report its progress.
Note: the onPercentDone and onProgressInfo callbacks run on the JavaScript thread while the promise is pending, so they can update the UI directly. A rejection's message is "Class.methodAsync: reason"; the full log is in lastErrorText.
Returns a Promise that resolves with the synchronous method's result (undefined for a void method) and rejects with an Error where the synchronous method would throw.
ConnectThroughSsh
Connects to a second SSH server through the existing connected and authenticated
Ssh object supplied in ssh.
application -> first SSH server -> second SSH server
hostname and port identify the second SSH server.
After this method succeeds, call an authentication method on this
SshTunnel object to authenticate with the second server.
The supplied Ssh object is borrowed, not copied. It must remain
alive, connected, and authenticated for as long as this tunnel is used. If the
first-hop object is disconnected, existing forwarded clients stop working and
new local connections cannot be forwarded. The local listener may nevertheless
remain active until explicitly stopped.
HostKeyFingerprint reports
the fingerprint of the second SSH server. After the connection is established,
fixed forwarding destinations such as 127.0.0.1 are interpreted
from the second server's network environment.
Returns normally on success; throws an Error on failure.
ConnectThroughSshAsync
Asynchronous form of ConnectThroughSsh: the same call on a native worker thread, so the JavaScript thread (and the UI) stays responsive. Takes the same arguments and resolves with the same result. While the returned Promise is pending, every other call on this object throws (the object is busy), except abort(), which cancels the call, and assigning the onPercentDone / onProgressInfo callbacks, which report its progress.
Note: the onPercentDone and onProgressInfo callbacks run on the JavaScript thread while the promise is pending, so they can update the UI directly. A rejection's message is "Class.methodAsync: reason"; the full log is in lastErrorText.
Returns a Promise that resolves with the synchronous method's result (undefined for a void method) and rejects with an Error where the synchronous method would throw.
ContinueKeyboardAuth
Continues a keyboard-interactive authentication exchange started by
StartKeyboardAuth.
If the server requested one response, pass that value directly in
response. If it requested multiple responses, pass XML in the
following form:
<response> <response1>response to first prompt</response1> <response2>response to second prompt</response2> ... <responseN>response to Nth prompt</responseN> </response>
When authentication completes, the returned XML indicates success or failure:
<success>success message</success> <error>error message</error>
If another challenge is required, the method returns another
infoRequest XML document containing the next set of prompts.
Throws an Error on failure (where the description says null is returned, the method throws instead).
ContinueKeyboardAuthAsync
Asynchronous form of ContinueKeyboardAuth: the same call on a native worker thread, so the JavaScript thread (and the UI) stays responsive. Takes the same arguments and resolves with the same result. While the returned Promise is pending, every other call on this object throws (the object is busy), except abort(), which cancels the call, and assigning the onPercentDone / onProgressInfo callbacks, which report its progress.
Note: the onPercentDone and onProgressInfo callbacks run on the JavaScript thread while the promise is pending, so they can update the UI directly. A rejection's message is "Class.methodAsync: reason"; the full log is in lastErrorText.
Returns a Promise that resolves with the synchronous method's result (undefined for a void method) and rejects with an Error where the synchronous method would throw.
DisconnectAllClients
Disconnects all active tunnel clients while leaving the local listener and SSH connection available.
When waitForThreads is , the method waits
for the current client threads to exit before returning. The listener continues
accepting new clients, and newly accepted clients can be forwarded normally.
true
Returns normally on success; throws an Error on failure.
GetCurrentState
Returns an XML snapshot describing the tunnel manager, SSH channels, and current tunnel clients. The returned data is intended for diagnostics and monitoring.
A typical result has the following structure:
<CurrentState>
<tunnelManager rcvByteCount="433" sndByteCount="34"
threadRunning="1" dynamicPortForwarding="0"
staticDestHost="localhost" staticDestPort="18080">
<openChannels count="1">
<channel num="101" channelType="direct-tcpip"
clientWinSize="2096927" serverWinSize="2097127" />
</openChannels>
<closedChannels count="0" />
</tunnelManager>
<clients count="1">
<client destIp="localhost" destPort="18080"
sshChannelNum="101" threadRunning="1"
rcvByteCount="25" sndByteCount="225" />
</clients>
</CurrentState>
The exact child elements can vary with state. For example, channel collections may be empty, and some transport details may be omitted before the tunnel is started or after it stops.
| Section | Information |
|---|---|
tunnelManager |
Aggregate byte counts, worker-thread state, forwarding mode, and configured fixed destination. |
openChannels and closedChannels |
SSH channel numbers, close/EOF flags, packet sizes, and flow-control window sizes. |
clients |
Per-client destination, SSH channel number, worker state, age/activity counters, pending-data flags, and byte counts. |
Throws an Error on failure (where the description says null is returned, the method throws instead).
IsSshConnected
Returns when the SSH transport used by this tunnel is
connected; otherwise returns true.
false
This is independent of the local listener state. The listener may still be
accepting local TCP connections when this method returns ,
but those connections cannot be forwarded until a usable SSH transport exists.
false
For a tunnel created with
ConnectThroughSsh, this
method becomes when the borrowed first-hop
falseSsh connection is disconnected.
SetAllowedAlgorithms
Restricts the SSH connection to the algorithms specified in
json.
This allows an application to define the exact algorithm set that may be used during SSH negotiation.
Returns normally on success; throws an Error on failure.
StartKeyboardAuth
Begins keyboard-interactive authentication for login.
When the server requests one or more responses, the returned XML contains the request name, instructions, and prompts:
<infoRequest numPrompts="N"> <name>name text</name> <instruction>instruction text</instruction> <prompt1 echo="1_or_0">prompt text</prompt1> ... <promptN echo="1_or_0">prompt text</promptN> </infoRequest>
The echo attribute indicates whether the response should be
displayed while entered.
If authentication immediately succeeds or fails without requiring a response, the returned XML has one of these forms:
<success>success message</success> <error>error message</error>
Pass the requested response or responses to
ContinueKeyboardAuth.
Throws an Error on failure (where the description says null is returned, the method throws instead).
StartKeyboardAuthAsync
Asynchronous form of StartKeyboardAuth: the same call on a native worker thread, so the JavaScript thread (and the UI) stays responsive. Takes the same arguments and resolves with the same result. While the returned Promise is pending, every other call on this object throws (the object is busy), except abort(), which cancels the call, and assigning the onPercentDone / onProgressInfo callbacks, which report its progress.
Note: the onPercentDone and onProgressInfo callbacks run on the JavaScript thread while the promise is pending, so they can update the UI directly. A rejection's message is "Class.methodAsync: reason"; the full log is in lastErrorText.
Returns a Promise that resolves with the synchronous method's result (undefined for a void method) and rejects with an Error where the synchronous method would throw.
StopAccepting
Stops the local listener so that no new client connections are accepted. Existing forwarded clients remain connected and continue exchanging data.
- When
waitForThreadis, the method waits for the listener thread to exit before returning.true - When it is
, shutdown is asynchronous andfalseIsAcceptingmay remainbriefly after the method returns.true
Call BeginAccepting again to
resume accepting connections. The listener can be restarted on the same port
after the previous listener has stopped.
Returns normally on success; throws an Error on failure.
Events
While a method runs, SshTunnel reports progress through two optional callback properties. Assign a function to receive the event, or undefined to stop receiving it. The callbacks are delivered on the JavaScript thread, so they are useful with the ...Async methods: during a synchronous call the JavaScript thread is busy inside Chilkat, and the events can only arrive after it returns.
const sshTunnel = new SshTunnel()
sshTunnel.onPercentDone = (pct) => setProgress(pct) // pct is 0..100
sshTunnel.onProgressInfo = (name, value) => console.log(`${name}: ${value}`)
sshTunnel.heartbeatMs = 250 // let abort() take effect within a quarter second
const pending = sshTunnel.someMethodAsync(...)
cancelButton.onPress = () => sshTunnel.abort() // the promise then rejects
await pendingPercentDone fires when an operation's completion percentage is known; ProgressInfo delivers named progress values (what is reported depends on the class and method). There is no AbortCheck callback: to cancel a pending ...Async call, call abort() on the object. Chilkat notices the request at its next progress check, which happens at least every heartbeatMs milliseconds on the classes that have that property (0, the default, disables the heartbeat, so set it for a responsive cancel), and the promise rejects with Chilkat's abort error. abort() is harmless when nothing is pending.
PercentDone
onPercentDone?: (pctDone: number) => void
This provides the percentage completion for any method involving network communications or time-consuming processing, assuming the progress can be measured as a percentage. This event is triggered only when it's possible and logical to express the operation's progress as a percentage. The pctDone argument will range from 1 to 100. For methods that finish quickly, the number of PercentDone callbacks may vary, but the final callback will have pctDone equal to 100. For longer operations, callbacks will not exceed one per percentage point (e.g., 1, 2, 3, ..., 98, 99, 100).
The PercentDone callback also acts as an AbortCheck event. For fast methods where PercentDone fires, an AbortCheck event may not trigger since the PercentDone callback already provides an opportunity to abort. For longer operations, where time between PercentDone callbacks is extended, AbortCheck callbacks enable more responsive operation termination.
To abort the operation, set the abort output argument to true. This will cause the method to terminate and return a failure status or corresponding failure value.
Example:
sshTunnel.onPercentDone = (pct) => {
// pct ranges from 0 to 100.
setProgress(pct) // runs on the JavaScript thread: React state may be updated directly
}
await sshTunnel.someMethodAsync(...)
// To stop an operation from within the callback, call sshTunnel.abort()ProgressInfo
onProgressInfo?: (name: string, value: string) => void
This event callback provides tag name/value pairs that detail what occurs during a method call. To discover existing tag names, create code to handle the event, emit the pairs, and review them. Most tag names are self-explanatory.
Note: Some Chilkat methods don't fire any ProgressInfo events.
Example:
sshTunnel.onProgressInfo = (name, value) => console.log(`${name}: ${value}`)
await sshTunnel.someMethodAsync(...)