openSSH prevents usage of remote_dns subnet

openssh tries to be smarter than its users and refuses to accept IP adresses from our default remote_dns_subnet.

this patch fixes it:

--- openssh-8.4p1.org/sshconnect.c
+++ openssh-8.4p1/sshconnect.c
@@ -755,10 +755,13 @@
 
 	/*
 	 * Turn off check_host_ip if the connection is to localhost, via proxy
-	 * command or if we don't have a hostname to compare with
+	 * command or if we don't have a hostname to compare with, or
+	 * if PROXYCHAINS-NG is active and the ip starts with "224."
+	 * (default remote-dns subnet).
 	 */
 	if (options.check_host_ip && (local ||
-	    strcmp(hostname, ip) == 0 || options.proxy_command != NULL))
+	    strcmp(hostname, ip) == 0 || options.proxy_command != NULL ||
+	    (strncmp(ip, "224.", 4) == 0 && getenv("PROXYCHAINS_CONF_FILE"))))
 		options.check_host_ip = 0;
 
 	host_hostkeys = init_hostkeys();

since "options.check_host_ip" sounds like a configurable setting, there may also be a way to disable the misfeature using the openssh config file. post here if you know how.

Start with the proposed OpenSSH change in sshconnect.c, focusing on options.check_host_ip and the PROXYCHAINS_CONF_FILE check. Verify how proxychains-ng integrates with OpenSSH and whether the OpenSSH configuration can address the behavior; done means SSH accepts addresses from the default remote_dns_subnet without breaking host-key checking.