In which RFC is ssh dynamic tunneling specified?

Question

By reading the sources, it is handled by a channel of type dynamic-tcpip.
Both the SSH RFC and IANA for SSH do not contain this string while they do contain the other types of port forwarding channels.
The internet and GitHub also do not contain much of this string.
Where is it specified?

Answer 1

I don't think "dynamic-tcpip" is a "real" channel type. It's a label used internally by the ssh client for dynamic port forward listening ports.

Both dynamic and non-dynamic port forwards open a "direct-tcpip" channel to the remote server for each individual forwarded client connection. The request to open the direct-tcpip channel includes the host and port which the channel should be forwarded to.

For a non-dynamic forward, the host and port is specified when you create the forward. When you run ssh -L 1234:somehost:5678..., the remote host and port are "somehost" port 5678. For a dynamic forward, created by running something like ssh -D 1234, a client will connect to the dynamic listening port and use the SOCKS protocol to send the host and port that it wants to connect to. Either way, the ssh client uses the host and port to create a direct-tcpip channel with the host and port as the target. It's not important to the remote server that the channel open request came from a dynamic forward instead of something else.

In the source code, you'll see a function called channel_pre_dynamic() handles connections to SOCKS listening ports. It decodes the SOCKS message from the client and opens a direct-tcpip channel to handle the connection:

            /* switch to the next state */
            c->type = SSH_CHANNEL_OPENING;
            port_open_helper(ssh, c, "direct-tcpip");

You will see "dynamic-tcpip" appear in messages from the client about the dynamic listening port:

$ ssh -vD 1234 localhost
...
debug1: Connection to port 1234 forwarding to socks port 0 requested.
debug1: channel 3: new [dynamic-tcpip]
~#
The following connections are open:
  #2 client-session (t4 r0 i0/0 o0/0 e[write]/4 fd 11/12/13 sock -1 cc -1 io 0x01/0x01)
  #3 dynamic-tcpip (t13 nr0 i0/0 o0/0 e[closed]/0 fd 14/14/-1 sock 14 cc -1 io 0x01/0x00)

Here, connecting to the dynamic listening port triggers a debug message mentioning the dynamic-tcpip channel type, and it also shows up in the list of channels from typing "~#".