git: 5818b6ee552b - main - openssh: Don't attempt to connect to unsupported addresses

The branch main has been updated by des:

URL: https://cgit.FreeBSD.org/src/commit/?id=5818b6ee552b302f5300934f9b8cb94881867a5f

commit 5818b6ee552b302f5300934f9b8cb94881867a5f
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2025-11-21 06:28:13 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2025-11-21 06:28:24 +0000

    openssh: Don't attempt to connect to unsupported addresses
    
    When iterating over known addresses for the requested target host name,
    skip those that are not supported by the running kernel.
    
    MFC after:      1 week
    PR:             195231
    Reviewed by:    emaste
    Differential Revision:  https://reviews.freebsd.org/D53588
---
 crypto/openssh/FREEBSD-upgrade | 7 +++++++
 crypto/openssh/sshconnect.c    | 9 +++++++++
 2 files changed, 16 insertions(+)

diff --git a/crypto/openssh/FREEBSD-upgrade b/crypto/openssh/FREEBSD-upgrade
index 98503de12ddb..815c11a8f8ca 100644
--- a/crypto/openssh/FREEBSD-upgrade
+++ b/crypto/openssh/FREEBSD-upgrade
@@ -181,6 +181,13 @@
    skip setting DISABLE_LASTLOG which we've applied for FreeBSD, but the
    autoconf machinery really ought to be reworked.  Reported upstream at
    https://lists.mindrot.org/pipermail/openssh-unix-dev/2022-May/040242.html
+
+11) Protocol selection
+
+   We use the non-portable feature_present(3) API to determine which
+   internet protocols are supported by the kernel before trying to
+   connect to the target host.  This avoids confusing the user with
+   spurious error messages.
 
 
 This port was brought to you by (in no particular order) DARPA, NAI
diff --git a/crypto/openssh/sshconnect.c b/crypto/openssh/sshconnect.c
index c86182d13673..24da9aed0007 100644
--- a/crypto/openssh/sshconnect.c
+++ b/crypto/openssh/sshconnect.c
@@ -458,6 +458,8 @@ ssh_connect_direct(struct ssh *ssh, const char *host, struct addrinfo *aitop,
 	memset(ntop, 0, sizeof(ntop));
 	memset(strport, 0, sizeof(strport));
 
+	int inet_supported = feature_present("inet");
+	int inet6_supported = feature_present("inet6");
 	for (attempt = 0; attempt < connection_attempts; attempt++) {
 		if (attempt > 0) {
 			/* Sleep a moment before retrying. */
@@ -482,6 +484,13 @@ ssh_connect_direct(struct ssh *ssh, const char *host, struct addrinfo *aitop,
 				errno = oerrno;
 				continue;
 			}
+			if ((ai->ai_family == AF_INET && !inet_supported) ||
+			    (ai->ai_family == AF_INET6 && !inet6_supported)) {
+				debug2_f("skipping address [%s]:%s: "
+				    "unsupported address family", ntop, strport);
+				errno = EAFNOSUPPORT;
+				continue;
+			}
 			if (options.address_family != AF_UNSPEC &&
 			    ai->ai_family != options.address_family) {
 				debug2_f("skipping address [%s]:%s: "