From e421e4dda8cbdf98896364b4fb8371cf64e9257a Mon Sep 17 00:00:00 2001
From: Johannes Renner <jrenner@suse.com>
Date: Wed, 29 Jun 2016 17:25:51 +0200
Subject: [PATCH] Support remote port forwarding with salt-ssh

---
 salt/client/ssh/__init__.py |  7 ++++++-
 salt/client/ssh/shell.py    | 13 +++++++++++--
 salt/utils/parsers.py       | 14 ++++++++++++++
 3 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/salt/client/ssh/__init__.py b/salt/client/ssh/__init__.py
index 74cf7d4544..c48c438f84 100644
--- a/salt/client/ssh/__init__.py
+++ b/salt/client/ssh/__init__.py
@@ -280,6 +280,9 @@ class SSH(object):
                 'ssh_identities_only',
                 salt.config.DEFAULT_MASTER_OPTS['ssh_identities_only']
             ),
+            'remote_port_forwards': self.opts.get(
+                'ssh_remote_port_forwards'
+            ),
         }
         if self.opts.get('rand_thin_dir'):
             self.defaults['thin_dir'] = os.path.join(
@@ -666,6 +669,7 @@ class Single(object):
             mine=False,
             minion_opts=None,
             identities_only=False,
+            remote_port_forwards=None,
             **kwargs):
         # Get mine setting and mine_functions if defined in kwargs (from roster)
         self.mine = mine
@@ -720,7 +724,8 @@ class Single(object):
                 'sudo': sudo,
                 'tty': tty,
                 'mods': self.mods,
-                'identities_only': identities_only}
+                'identities_only': identities_only,
+                'remote_port_forwards': remote_port_forwards}
         # Pre apply changeable defaults
         self.minion_opts = {
                     'grains_cache': True,
diff --git a/salt/client/ssh/shell.py b/salt/client/ssh/shell.py
index d30e8185cf..201cc52281 100644
--- a/salt/client/ssh/shell.py
+++ b/salt/client/ssh/shell.py
@@ -62,7 +62,8 @@ class Shell(object):
             sudo=False,
             tty=False,
             mods=None,
-            identities_only=False):
+            identities_only=False,
+            remote_port_forwards=None):
         self.opts = opts
         self.host = host
         self.user = user
@@ -74,6 +75,7 @@ class Shell(object):
         self.tty = tty
         self.mods = mods
         self.identities_only = identities_only
+        self.remote_port_forwards = remote_port_forwards
 
     def get_error(self, errstr):
         '''
@@ -223,11 +225,18 @@ class Shell(object):
             opts = self._passwd_opts()
         if self.priv:
             opts = self._key_opts()
-        return "{0} {1} {2} {3} {4}".format(
+
+        ports = ''
+        if self.remote_port_forwards:
+            port_forwards = self.remote_port_forwards.split(',')
+            ports = ' '.join(map(lambda x: '-R {0}'.format(x), port_forwards))
+
+        return "{0} {1} {2} {3} {4} {5}".format(
                 ssh,
                 '' if ssh == 'scp' else self.host,
                 '-t -t' if tty else '',
                 opts,
+                '' if ssh == 'scp' else ports,
                 cmd)
 
     def _old_run_cmd(self, cmd):
diff --git a/salt/utils/parsers.py b/salt/utils/parsers.py
index b7dce6dacd..fa2eec5bc3 100644
--- a/salt/utils/parsers.py
+++ b/salt/utils/parsers.py
@@ -2791,6 +2791,20 @@ class SaltSSHOptionParser(six.with_metaclass(OptionParserMeta,
             help='Pass a JID to be used instead of generating one.'
         )
 
+        ports_group = optparse.OptionGroup(
+            self, 'Port Forwarding Options',
+            'Parameters for setting up SSH port forwarding.'
+        )
+        ports_group.add_option(
+            '--remote-port-forwards',
+            dest='ssh_remote_port_forwards',
+            help='Setup remote port forwarding using the same syntax as with '
+                 'the -R parameter of ssh. A comma separated list of port '
+                 'forwarding definitions will be translated into multiple '
+                 '-R parameters.'
+        )
+        self.add_option_group(ports_group)
+
         auth_group = optparse.OptionGroup(
             self, 'Authentication Options',
             'Parameters affecting authentication.'