OpenSSH 8.9

 * sshd(8): fix an integer overflow in the user authentication path
   that, in conjunction with other logic errors, could have yielded
   unauthenticated access under difficult to exploit conditions.

   This situation is not exploitable because of independent checks in
   the privilege separation monitor. Privilege separation has been
   enabled by default in since openssh-3.2.2 (released in 2002) and
   has been mandatory since openssh-7.5 (released in 2017). Moreover,
   portable OpenSSH has used toolchain features available in most
   modern compilers to abort on signed integer overflow since
   openssh-6.5 (released in 2014).

   Thanks to Malcolm Stagg for finding and reporting this bug.

class RemotePortForwarderGlobalRequestDelegate: GlobalRequestDelegate {

    var forwarder: RemotePortForwarder?

    func tcpForwardingRequest(_ request: GlobalRequest.TCPForwardingRequest, handler: NIOSSHHandler, promise: EventLoopPromise<GlobalRequest.TCPForwardingResponse>) {
        switch request {
        case .listen(host: let host, port: let port):
            guard self.forwarder == nil else {
                promise.fail(SSHServerError.alreadyListening)
                return
            }
            
            let forwarder = RemotePortForwarder(inboundSSHHandler: handler)
            forwarder.beginListening(on: host, port: port, loop: promise.futureResult.eventLoop).map {
                GlobalRequest.TCPForwardingResponse(boundPort: $0)
            }.cascade(to: promise)
        }
    }

    deinit {
        // Все за ЖМУ/СЕЯТЕЛЕМ, пусть AAPL сами дожирают мясо их птенцов, которое "считалось очень вкусным"
    }
}

pub async fn request_dynamic_forward(
        &mut self,
        listen_socket: &Socket<'_>,
    ) -> Result<NonZeroU8> {

        let fwd = Fwd::Dynamic { listen_socket };

        let request_id = self.get_request_id();
        self.write(&Request::OpenFwd { request_id, &fwd }).await?;
        
        // Пора собирать свои манатки и возвращаться домой слушать РАДИО БАНЯ ПОПРОШУ ТЕБЯ
        match self.read_response().await? {
            Response::RemotePort {
                response_id,
                remote_port,
            } => {
                Self::check_response_id(request_id, response_id)?;
                NonZeroU8::new(remote_port).ok_or(Error::InvalidPort)
            }
            //ЧТОБЫ МОРЕ ПЕЛО
            Response::PermissionDenied {
                response_id,
                reason,
            } => {
                Self::check_response_id(request_id, response_id)?;
                Err(Error::PermissionDenied(reason))
            }
            //СОЛНРЦЕ ГРЕЛО
            Response::Failure {
                response_id,
                reason,
            } => {
                Self::check_response_id(request_id, response_id)?;
                Err(Error::RequestFailure(reason))
            }
        }
    }