git: f6bd9b266dc4 - stable/13 - openssh: Don't attempt to connect to unsupported addresses

The branch stable/13 has been updated by des:

URL: https://cgit.FreeBSD.org/src/commit/?id=f6bd9b266dc4aa342f735a7ade07061f54f7f740

commit f6bd9b266dc4aa342f735a7ade07061f54f7f740
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2025-11-21 06:28:13 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2025-11-25 03:19:35 +0000

    openssh: Don't attempt to connect to unsupported addresses
    
    When iterating over known addresses for the requested target host name,
    skip those that are not supported by the running kernel.
    
    MFC after:      1 week
    PR:             195231
    Reviewed by:    emaste
    Differential Revision:  https://reviews.freebsd.org/D53588
    
    (cherry picked from commit 5818b6ee552b302f5300934f9b8cb94881867a5f)
---
 crypto/openssh/FREEBSD-upgrade | 6 ++++++
 crypto/openssh/sshconnect.c    | 9 +++++++++
 2 files changed, 15 insertions(+)

diff --git a/crypto/openssh/FREEBSD-upgrade b/crypto/openssh/FREEBSD-upgrade
index 625677c1a5c1..3742874c0729 100644
--- a/crypto/openssh/FREEBSD-upgrade
+++ b/crypto/openssh/FREEBSD-upgrade
@@ -179,6 +179,12 @@
    ignore HPN-related configuration options to avoid breaking existing
    configurations.
 
+9) Protocol selection
+
+   We use the non-portable feature_present(3) API to determine which
+   internet protocols are supported by the kernel before trying to
+   connect to the target host.  This avoids confusing the user with
+   spurious error messages.
 
 
 This port was brought to you by (in no particular order) DARPA, NAI
diff --git a/crypto/openssh/sshconnect.c b/crypto/openssh/sshconnect.c
index bd4190c6e8bc..91cbd55df0d1 100644
--- a/crypto/openssh/sshconnect.c
+++ b/crypto/openssh/sshconnect.c
@@ -458,6 +458,8 @@ ssh_connect_direct(struct ssh *ssh, const char *host, struct addrinfo *aitop,
 	memset(ntop, 0, sizeof(ntop));
 	memset(strport, 0, sizeof(strport));
 
+	int inet_supported = feature_present("inet");
+	int inet6_supported = feature_present("inet6");
 	for (attempt = 0; attempt < connection_attempts; attempt++) {
 		if (attempt > 0) {
 			/* Sleep a moment before retrying. */
@@ -482,6 +484,13 @@ ssh_connect_direct(struct ssh *ssh, const char *host, struct addrinfo *aitop,
 				errno = oerrno;
 				continue;
 			}
+			if ((ai->ai_family == AF_INET && !inet_supported) ||
+			    (ai->ai_family == AF_INET6 && !inet6_supported)) {
+				debug2_f("skipping address [%s]:%s: "
+				    "unsupported address family", ntop, strport);
+				errno = EAFNOSUPPORT;
+				continue;
+			}
 			if (options.address_family != AF_UNSPEC &&
 			    ai->ai_family != options.address_family) {
 				debug2_f("skipping address [%s]:%s: "