New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
sshd: fix startWhenNeeded and listenAddresses combination #56326
Conversation
Previously, if startWhenNeeded was set, listenAddresses option was ignored and daemon was listening on all interfaces. Fixes NixOS#56325.
@GrahamcOfBorg test openssh |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
socketConfig.ListenStream = if cfg.listenAddresses != [] then | ||
map (l: "${l.addr}:${toString (if l.port != null then l.port else 22)}") cfg.listenAddresses | ||
else | ||
cfg.ports; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Eh, this means IPv6 addresses in listenAddresses
have to be enclosed in brackets, right? Maybe that's a bit confusing, though I haven't studied nixos customs there.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@vcunat good point! I'll try to find some solution for it...
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It seems that sshd understands [ipv6]:port
notation as well: https://linux.die.net/man/5/sshd_config.
Motivation for this change
Previously, if startWhenNeeded was set, listenAddresses option was
ignored and daemon was listening on all interfaces.
Fixes #56325.
This should probably be backported as well.
Things done
sandbox
innix.conf
on non-NixOS)nix-shell -p nox --run "nox-review wip"
./result/bin/
)nix path-info -S
before and after)