bin/60512: sshd: hosts.deny and hosts.allow for NetBSD 10 not working for 11

["rokuyama.rk%gmail.com@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60512
>Category:       bin
>Synopsis:       sshd: hosts.deny and hosts.allow for NetBSD 10 not working for 11
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jul 28 08:40:00 +0000 2026
>Originator:     Rin Okuyama
>Release:        netbsd-11 and -current
>Organization:
Internet Initiative Japan Inc.
>Environment:
NetBSD sakaizumii.local 11.99.7 NetBSD 11.99.7 (AMD64_NET_MPSAFE) #1: Sat Jul 25 21:45:12 JST 2026  rin@sakaizumii.local:/home/rin/src/sys/arch/amd64/compile/AMD64_NET_MPSAFE amd64
>Description:
/etc/hosts.{deny,allow} configured for sshd shipped with NetBSD 10 and
prior do not work for NetBSD 11. For NetBSD 10, with these files,

hosts.deny
```
ALL: ALL
```

hosts.allow
```
sshd: .example.com
```

you can log in this host from .example.com. However, on the other hand,
you cannot log in this host for NetBSD 11. This is because TCP wrapper
support has been separated into sshd-session. For NetBSD 11, both
sshd and sshd-session should be explicitly allowed by hosts.allow:

hosts.allow
```
sshd: .example.com
sshd-session: .example.com
```

See https://nxr.netbsd.org/xref/src/crypto/external/bsd/openssh/dist/sshd-session.c#1171
>How-To-Repeat:
Described above.
>Fix:
If compatibility with NetBSD 10 and prior is important, stop checking
hosts_access(3) for __progname == "sshd-session". However, I'm not
100% sure whether this is a safe option...