[openssh-commits] [openssh] 07/87: check IP options from IPv4-mapped IPv6 addrs too

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 976332e15e4535b813c9164e639c778861ea4d7a
Author: Damien Miller <djm at mindrot.org>
AuthorDate: Fri Oct 30 19:02:51 2026 +1100

    check IP options from IPv4-mapped IPv6 addrs too
    
    Anthropic ANT-2026-MUH7FLBQ
---
 sshd-session.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sshd-session.c b/sshd-session.c
index 1af9bcf4c..0e4c1b309 100644
--- a/sshd-session.c
+++ b/sshd-session.c
@@ -707,6 +707,12 @@ check_ip_options(struct ssh *ssh)
 	if (getpeername(sock_in, (struct sockaddr *)&from,
 	    &fromlen) == -1)
 		return;
+	/*
+	 * IPv4 clients of a dual-stack socket (e.g. inherited via sshd -i)
+	 * appear as IPv4-mapped IPv6 addresses; they are still IPv4
+	 * connections and can carry IPv4 options, so check them too.
+	 */
+	ipv64_normalise_mapped(&from, &fromlen);
 	if (from.ss_family != AF_INET)
 		return;
 	/* XXX IPv6 options? */

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.