ginuerzh/gost · error

%s unsupported

Error message

%s unsupported

What it means

The SSH direct port-forward connector (sshDirectForwardConnector) only supports TCP. Its ConnectContext returns '<network> unsupported' when the network argument is "udp", "udp4", or "udp6", because SSH direct-tcpip channels are TCP-only.

Source

Thrown at ssh.go:74

	return authorizedKeysMap, nil
}

type sshDirectForwardConnector struct{}

// SSHDirectForwardConnector creates a Connector for SSH TCP direct port forwarding.
func SSHDirectForwardConnector() Connector {
	return &sshDirectForwardConnector{}
}

func (c *sshDirectForwardConnector) Connect(conn net.Conn, raddr string, options ...ConnectOption) (net.Conn, error) {
	return c.ConnectContext(context.Background(), conn, "tcp", raddr, options...)
}

func (c *sshDirectForwardConnector) ConnectContext(ctx context.Context, conn net.Conn, network, raddr string, options ...ConnectOption) (net.Conn, error) {
	switch network {
	case "udp", "udp4", "udp6":
		return nil, fmt.Errorf("%s unsupported", network)
	}

	opts := &ConnectOptions{}
	for _, option := range options {
		option(opts)
	}

	cc, ok := conn.(*sshNopConn) // TODO: this is an ugly type assertion, need to find a better solution.
	if !ok {
		return nil, errors.New("ssh: wrong connection type")
	}

	timeout := opts.Timeout
	if timeout <= 0 {
		timeout = ConnectTimeout
	}

	cc.session.conn.SetDeadline(time.Now().Add(timeout))

View on GitHub (pinned to a33fdbf4c9)

Solutions

  1. Use "tcp", "tcp4", or "tcp6" with sshDirectForwardConnector
  2. For UDP over SSH, use a different transport (e.g. a UDP-capable relay or tunnel UDP inside TCP yourself)
  3. Validate network values before dispatching to connector implementations

Example fix

// before
conn, err := sshConn.ConnectContext(ctx, netConn, "udp", raddr)
// after
conn, err := sshConn.ConnectContext(ctx, netConn, "tcp", raddr)
Defensive patterns

Strategy: validation

Validate before calling

if strings.HasPrefix(network, "udp") {
    return errors.New("ssh direct forward supports tcp only")
}

Type guard

func isTCP(n string) bool {
    return n == "tcp" || n == "tcp4" || n == "tcp6"
}

Try / catch

conn, err := sshFwdConnector.ConnectContext(ctx, netConn, network, raddr)
if err != nil && strings.HasSuffix(err.Error(), "unsupported") {
    return fmt.Errorf("ssh forward: %w", err)
}

Prevention

When it happens

Trigger: Calling sshDirectForwardConnector.ConnectContext directly with a UDP network value; its Connect wrapper always passes "tcp", so this occurs only on direct ConnectContext calls.

Common situations: Trying to forward UDP traffic through an SSH direct forwarder; generic routing code that passes the client's requested network (udp) straight through to an SSH TCP forward connector.

Related errors

AI-assisted analysis of ginuerzh/gost@a33fdbf4c9 (2026-09-02). Data as JSON: /api/errors/6b0530a4c7845b23. Report an issue: GitHub.