Skip to content

security/openssh-portable: Use SSH_TUN_COMPAT_AF to fix ssh tun device forwarding interoperability with other OSes #439

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

security/openssh-portable: Use SSH_TUN_COMPAT_AF to fix ssh tun device forwarding interoperability with other OSes #439

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion security/openssh-portable/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
PORTNAME= openssh
DISTVERSION= 10.0p1
PORTREVISION= 1
PORTREVISION= 2
PORTEPOCH= 1
CATEGORIES= security
MASTER_SITES= OPENBSD/OpenSSH/portable
Expand Down
23 changes: 23 additions & 0 deletions security/openssh-portable/files/patch-ssh_tun
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
commit 57e76d9b31fd5a5c08e20fd128b09d01e4980274
Author: Maxim Khon <[email protected]>
Date: Mon Aug 18 12:05:42 2025 +0000

Use SSH_TUN_COMPAT_AF on FreeBSD. Otherwise tun forwarding from other OSes
fails as soon as the first IPv6 message is sent by the other side
(which is usually a Router Solicitation ICMPv6 message which is sent as soon
as the interface is up): all other OS'es use SSH_TUN_COMPAT_AF or SSH_TUN_PREPEND_AF
which effectively uses OpenBSD AF_INET/AF_INET6 values.

diff --git a/configure.ac b/configure.ac
index 460ebd3b4..d274d1ab0 100644
--- configure.ac.orig
+++ configure.ac
@@ -1092,6 +1092,8 @@ mips-sony-bsd|mips-sony-newsos4)
*-*-freebsd*)
AC_DEFINE([LOCKED_PASSWD_PREFIX], ["*LOCKED*"], [Account locked with pw(1)])
AC_DEFINE([SSH_TUN_FREEBSD], [1], [Open tunnel devices the FreeBSD way])
+ AC_DEFINE([SSH_TUN_COMPAT_AF], [1],
+ [Use tunnel device compatibility to OpenBSD])
AC_CHECK_HEADER([net/if_tap.h], ,
AC_DEFINE([SSH_TUN_NO_L2], [1], [No layer 2 tunnel support]))
AC_DEFINE([BROKEN_GLOB], [1], [FreeBSD glob does not do what we need])