permitopen after no-port-forwarding should allow local port forwarding while disabling all other forms of port forwarding

[mitar]

Currently it seems it is not possible to disable all other forms of port forwarding except TCP local port forwarding to a particular host and port. Listing permitopen after no-port-forwarding in authorized keys file seems to have no effect and port forwarding is still disabled.

[mitar]

cc @mkj what about this feature request? Do you have any input on it? Is this something you would entertain? And guidance on how you would like to have it implemented?

[mkj]

Sounds reasonable. Because that diverges from OpenSSH behaviour of no-port-forwarding, I wonder if it should be a different name. Otherwise the same config has different behaviour if authorized_keys are shared between hosts.
There's an old OpenSSH request for the same kind of thing https://bugzilla.mindrot.org/show_bug.cgi?id=3159 (no replies, login required).

I guess svr_pubkey_allows_tcpfwd() could be replaced by logic in svr_pubkey_allows_local_tcpfwd() and maybe svr_pubkey_allows_remote_tcpfwd(). It'd still need to remain as-is for unix forwards.

Would permitlisten be allowed to enable specific remote forwards? I guess probably yes?

There's a question of whether ordering of options should matter. I'm leaning towards no, but haven't thought that long about it.

[mitar]

Ah, if that diverges from OpenSSH, then maybe it is not as reasonable as what I thought initially.

Also, after looking at my use case more, I think this feature is not necessary for me. What I in fact need is to control remote port forwarding. I want to configure dropbear to allow only a remote port forwarding from a particular port and disable everything else. I think running it with -j and with permitlisten (#382) and no-agent-forwarding,no-X11-forwarding,no-pty,command="/sbin/nologin in authorized_keys should achieve that now.