mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-10-30 14:11:21 +00:00
nixos/sshd: fix socket activated ports when using ListenAddress
Noticed that issue while reviewing #275633: when declaring `ListenAddress host` without a port, all ports declared by `Port`/`cfg.ports` will be used with `host` according to `sshd_config(5)`. However, if this is done and socket activation is used, only a socket for port 22 is created instead of a sockets for each port from `Port`/`cfg.ports`. This patch corrects that behavior. Also added a regression test for this case.
This commit is contained in:
parent
cb274aea01
commit
7e45990c06
@ -600,7 +600,11 @@ in
|
||||
{ description = "SSH Socket";
|
||||
wantedBy = [ "sockets.target" ];
|
||||
socketConfig.ListenStream = if cfg.listenAddresses != [] then
|
||||
map (l: "${l.addr}:${toString (if l.port != null then l.port else 22)}") cfg.listenAddresses
|
||||
concatMap
|
||||
({ addr, port }:
|
||||
if port != null then [ "${addr}:${toString port}" ]
|
||||
else map (p: "${addr}:${toString p}") cfg.ports)
|
||||
cfg.listenAddresses
|
||||
else
|
||||
cfg.ports;
|
||||
socketConfig.Accept = true;
|
||||
|
@ -34,6 +34,19 @@ in {
|
||||
];
|
||||
};
|
||||
|
||||
server-lazy-socket = {
|
||||
virtualisation.vlans = [ 1 2 ];
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
startWhenNeeded = true;
|
||||
ports = [ 2222 ];
|
||||
listenAddresses = [ { addr = "0.0.0.0"; } ];
|
||||
};
|
||||
users.users.root.openssh.authorizedKeys.keys = [
|
||||
snakeOilPublicKey
|
||||
];
|
||||
};
|
||||
|
||||
server-localhost-only =
|
||||
{ ... }:
|
||||
|
||||
@ -96,7 +109,9 @@ in {
|
||||
};
|
||||
|
||||
client =
|
||||
{ ... }: { };
|
||||
{ ... }: {
|
||||
virtualisation.vlans = [ 1 2 ];
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
@ -109,6 +124,7 @@ in {
|
||||
|
||||
server_lazy.wait_for_unit("sshd.socket", timeout=30)
|
||||
server_localhost_only_lazy.wait_for_unit("sshd.socket", timeout=30)
|
||||
server_lazy_socket.wait_for_unit("sshd.socket", timeout=30)
|
||||
|
||||
with subtest("manual-authkey"):
|
||||
client.succeed("mkdir -m 700 /root/.ssh")
|
||||
@ -145,6 +161,16 @@ in {
|
||||
timeout=30
|
||||
)
|
||||
|
||||
with subtest("socket activation on a non-standard port"):
|
||||
client.succeed(
|
||||
"cat ${snakeOilPrivateKey} > privkey.snakeoil"
|
||||
)
|
||||
client.succeed("chmod 600 privkey.snakeoil")
|
||||
client.succeed(
|
||||
"ssh -p 2222 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.2.4 true",
|
||||
timeout=30
|
||||
)
|
||||
|
||||
with subtest("configured-authkey"):
|
||||
client.succeed(
|
||||
"cat ${snakeOilPrivateKey} > privkey.snakeoil"
|
||||
|
Loading…
Reference in New Issue
Block a user