External port forwarding control mechanism

[RR_ITCSEC]

Hi,

I'm looking for the best way to include an external decision mechanism into 
OpenSSH, which allows it to restrict port forwarding only to destination 
ports  which are defined in a special external control file for the 
authenticated session. The authenticated ssh user should only be allowed to 
connect to this dedicated port to tunnel a VNC session through ssh. So the 
server side has to decide if the received client data in the ssh channel 
could be forwarded or not.
Does there already exist a solution for the current OpenSSH version?

Last year I read in a mailing list, that such behavior was included in 
earlier versions of OpenSSH.


Regards,
    Roland