I'm looking to build a firewall that will perform "man-in-the-middle" inspections on SSH traffic. It will decrypt, inspect and re-encrypt traffic. There are quite a few free solutions for SSL deep inspection that do this, but none for SSH.
I am particularly interested in the ability to do fine grained filtering of applications and commands (like preventing a user from launching a remote web browser through X11 over SSH).
Open source dpi tools include nDPI, Libprotoident, and Netifyd but I don't think they have this feature.