[Citrix] - failed to open channel handle: virtual channel open failed (last_error = 5)

[Emastermind]

Hello,

First of all, thank you for the project and the idea !
I tried to use the tool with a remote citrix machine but as mentionned in the title, I get an error while running the backend:

Wu, 20 Feb 2025 17:53:40 +0000 [DEBUG] (main) open static channel "SOXY"
Wu, 20 Feb 2025 17:53:4@ +0000 [ERROR] (main) failed to open channel handle: virtual channel open failed (last _error = 5)`

I tried using differents methods (using dll with rundll32, as local admin, ect ...). Frontend is a kali linux host and socks, ftp ... ports are listening on it but doesn't responds to any action.

Error seems to came from :

soxy/backend/src/lib.rs

Line 96 in 6feaf9d

common::error!("failed to open channel handle: {e}");

with a failing svc.open function.

Do you have any clue on how I can investigate this ? Maybe some parameters on citrix machine block usage of virtual channel for soxy ?
I did'nt get the "error 5" from ws::Win32::Foundation::GetLastError(), if you have any idea about it ...
I will try to gives more details on host / guest and any useful details if need.

Thank you

[af-airbus]

Hello,

thank you for your interest in our project!

The error code 5 is actually "access denied" from Windows documentation.

Unfortunately you are connecting to a Citrix host where customized virtual channels are forbidden, which is unfortunately (for us) the default behavior on the last version of Citrix.

[af-airbus]

If you have admin rights on the Citrix host, you should be able to whitelist the SOXY virtual channel following the Citrix documentation.
We did not investigate this "allow list" feature; we would greatly appreciate if you do have a working solution to provide your feedback here or even better with a contribution in a dedicated "troubleshooting" section of the README.md file :)

[Emastermind]

Hello,

Thanks for your quick answer and all the details. You guided me in the right direction, indeed, we can whitelist soxy virtual channel or completely disable restrictions using registry key. I detailed this in the merge request I did.

It could be nice to add a feature to check that restrictions are set and if so, update registry key to allow soxy to run (maybe in a next PR :) ).
Once again, thank you for the project and for the help!