Created attachment 3603 [details]
patch for the issue

If tun forwarding is active, in case when ip packet is just plain ip packet (header only), sys_tun_infilter rejects that and takes tunnel down. It seems to be mistake in the openbsd-compat/port-net.c:


sys_tun_infilter(struct ssh *ssh, struct Channel *c, char *buf, int _len)
[...]
#if defined(SSH_TUN_PREPEND_AF)
       if (len <= sizeof(iph) || len > sizeof(rbuf) - 4)
[...]

In the line above length of the packet is checked, but if len == sizeof(iph) it's refused as well, which is likely an off-by-one mistake.

How to reproduce it:

We've got two machines
A - 1.1.1.1 and B - 2.2.2.2

We connect from A to B with tun forwarding and assign IPs as above.

From machine A we issue following command:
hping3 -0 -H 255 -c 1 -D 2.2.2.2

And the tunnel is down due to sys_tun_infilter failure (because it sends naked ip header.

In the attachment I sent simple patch to fix that. Please verify if I don't missed anything.