kgess-mirror/freebsd-src
1
0
Fork 0
mirror of https://git.freebsd.org/src.git synced 2026-01-11 19:57:22 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

openssh: Don't attempt to connect to unsupported addresses

Browse source 
When iterating over known addresses for the requested target host name,
skip those that are not supported by the running kernel.

MFC after:	1 week
PR:		195231
Reviewed by:	emaste
Differential Revision:	https://reviews.freebsd.org/D53588
This commit is contained in:
Dag-Erling Smørgrav 2025-11-21 07:28:13 +01:00
parent ac1f48b4a7
commit 5818b6ee55
2 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
crypto/openssh/FREEBSD-upgrade
View file

@ -181,6 +181,13 @@
skip setting DISABLE_LASTLOG which we've applied for FreeBSD, but the
autoconf machinery really ought to be reworked. Reported upstream at
https://lists.mindrot.org/pipermail/openssh-unix-dev/2022-May/040242.html
11) Protocol selection
We use the non-portable feature_present(3) API to determine which
internet protocols are supported by the kernel before trying to
connect to the target host. This avoids confusing the user with
spurious error messages.
This port was brought to you by (in no particular order) DARPA, NAI

9
crypto/openssh/sshconnect.c
View file

@ -458,6 +458,8 @@ ssh_connect_direct(struct ssh *ssh, const char *host, struct addrinfo *aitop,
memset(ntop, 0, sizeof(ntop));
memset(strport, 0, sizeof(strport));
int inet_supported = feature_present("inet");
int inet6_supported = feature_present("inet6");
for (attempt = 0; attempt < connection_attempts; attempt++) {
if (attempt > 0) {
/* Sleep a moment before retrying. */
@ -482,6 +484,13 @@ ssh_connect_direct(struct ssh *ssh, const char *host, struct addrinfo *aitop,
errno = oerrno;
continue;
}
if ((ai->ai_family == AF_INET && !inet_supported) ||
(ai->ai_family == AF_INET6 && !inet6_supported)) {
debug2_f("skipping address [%s]:%s: "
"unsupported address family", ntop, strport);
errno = EAFNOSUPPORT;
continue;
}
if (options.address_family != AF_UNSPEC &&
ai->ai_family != options.address_family) {
debug2_f("skipping address [%s]:%s: "