func handleServerRequests(t *testing.T, ctx context.Context, wg *sync.WaitGroup, sshCn ssh.Conn, reqs <-chan *ssh.Request) {
	defer wg.Done()
	for r := range reqs {
		if !r.WantReply {
			continue
		}
		if r.Type != "tcpip-forward" {
			r.Reply(false, nil)
			continue
		}
		var args struct {
			Host string
			Port uint32
		}
		if !unmarshalData(r.Payload, &args) {
			r.Reply(false, nil)
			continue
		}
		ln, err := net.Listen("tcp", net.JoinHostPort(args.Host, strconv.Itoa(int(args.Port))))
		if err != nil {
			r.Reply(false, nil)
			continue
		}
		var resp struct{ Port uint32 }
		_, resp.Port = splitHostPort(ln.Addr().String())
		if err := r.Reply(true, marshalData(resp)); err != nil {
			t.Errorf("request reply error: %v", err)
			ln.Close()
			continue
		}
		wg.Add(1)
		go handleLocalListener(t, ctx, wg, sshCn, ln, args.Host)
	}
}
handleServerRequests handles new requests on a SSH connection.
The client initiates a new request for binding a local TCP socket.
package main
import (
	"bytes"
	"context"
	"encoding/binary"
	"fmt"
	"io"
	"net"
	"reflect"
	"strconv"
	"sync"
	"testing"
	"golang.org/x/crypto/ssh"
)
func runServer(t *testing.T, ctx context.Context, ln net.Listener, serverKey ssh.Signer, clientKeys ...ssh.PublicKey) {
	wg := new(sync.WaitGroup)
	defer wg.Wait()
	conf := ssh.ServerConfig{
		PublicKeyCallback: func(c ssh.ConnMetadata, pubKey ssh.PublicKey) (*ssh.Permissions, error) {
			var uid int
			_, err := fmt.Sscanf(c.User(), "user%d", &uid)
			if err != nil || uid >= len(clientKeys) || !bytes.Equal(clientKeys[uid].Marshal(), pubKey.Marshal()) {
				return nil, fmt.Errorf("unknown public key for %q", c.User())
			}
			return nil, nil
		},
	}
	conf.AddHostKey(serverKey)
	for {
		tcpCn, err := ln.Accept()
		if err != nil {
			if !isDone(ctx) {
				t.Errorf("accept error: %v", err)
			}
			return
		}
		wg.Add(1)
		go handleServerConn(t, ctx, wg, tcpCn, &conf)
	}
}
func handleServerConn(t *testing.T, ctx context.Context, wg *sync.WaitGroup, tcpCn net.Conn, conf *ssh.ServerConfig) {
	defer wg.Done()
	go closeWhenDone(ctx, tcpCn)
	defer tcpCn.Close()
	sshCn, chans, reqs, err := ssh.NewServerConn(tcpCn, conf)
	if err != nil {
		t.Errorf("new connection error: %v", err)
		return
	}
	go closeWhenDone(ctx, sshCn)
	defer sshCn.Close()
	wg.Add(1)
	go handleServerChannels(t, ctx, wg, sshCn, chans)
	wg.Add(1)
	go handleServerRequests(t, ctx, wg, sshCn, reqs)
	if err := sshCn.Wait(); err != nil && err != io.EOF && !isDone(ctx) {
		t.Errorf("connection error: %v", err)
	}
}
func handleServerChannels(t *testing.T, ctx context.Context, wg *sync.WaitGroup, sshCn ssh.Conn, chans <-chan ssh.NewChannel) {
	defer wg.Done()
	for nc := range chans {
		if nc.ChannelType() != "direct-tcpip" {
			nc.Reject(ssh.UnknownChannelType, "not implemented")
			continue
		}
		var args struct {
			DstHost string
			DstPort uint32
			SrcHost string
			SrcPort uint32
		}
		if !unmarshalData(nc.ExtraData(), &args) {
			nc.Reject(ssh.Prohibited, "invalid request")
			continue
		}
		cn, err := net.Dial("tcp", net.JoinHostPort(args.DstHost, strconv.Itoa(int(args.DstPort))))
		if err != nil {
			nc.Reject(ssh.ConnectionFailed, err.Error())
			continue
		}
		ch, reqs, err := nc.Accept()
		if err != nil {
			t.Errorf("accept channel error: %v", err)
			cn.Close()
			continue
		}
		go ssh.DiscardRequests(reqs)
		wg.Add(1)
		go bidirCopyAndClose(t, ctx, wg, cn, ch)
	}
}