ssh: document and test source-address behavior for non-IP transports

The source-address critical option is a comma-separated list of IP
addresses and CIDR blocks, so it can never match a connection whose
remote address is not IP-based, such as a Unix domain socket.

Change-Id: I45e09fe5c8c13922cb0735278acf33320857322c
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/797042
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Junyang Shao <shaojunyang@google.com>

ssh/server_test.go

@@ -849,6 +849,18 @@ func TestAuthCallbacksSourceAddress(t *testing.T) {
 	}
 }
 
+func TestCheckSourceAddressNonIP(t *testing.T) {
+	for _, addr := range []net.Addr{
+		&net.UnixAddr{Name: "/run/test.sock", Net: "unix"},
+		&net.UnixAddr{},
+		nil,
+	} {
+		if err := checkSourceAddress(addr, "127.0.0.0/8,::1/128"); err == nil {
+			t.Errorf("source-address check succeeded for non-IP remote address %v", addr)
+		}
+	}
+}
+
 func TestVerifiedPublicCallbackPartialSuccessBadUsage(t *testing.T) {
 	c1, c2, err := netPipe()
 	if err != nil {