Merge pull request #278539 from Ma27/sshd-socket-activation-ports

nixos/sshd: fix socket activated ports when using ListenAddress

nixos/modules/services/networking/ssh/sshd.nix

@@ -600,7 +600,11 @@ in
           { description = "SSH Socket";
             wantedBy = [ "sockets.target" ];
             socketConfig.ListenStream = if cfg.listenAddresses != [] then
-              map (l: "${l.addr}:${toString (if l.port != null then l.port else 22)}") cfg.listenAddresses
+              concatMap
+                ({ addr, port }:
+                  if port != null then [ "${addr}:${toString port}" ]
+                  else map (p: "${addr}:${toString p}") cfg.ports)
+                cfg.listenAddresses
             else
               cfg.ports;
             socketConfig.Accept = true;

nixos/tests/openssh.nix

@@ -34,6 +34,19 @@ in {
         ];
       };
 
+    server-lazy-socket = {
+      virtualisation.vlans = [ 1 2 ];
+      services.openssh = {
+        enable = true;
+        startWhenNeeded = true;
+        ports = [ 2222 ];
+        listenAddresses = [ { addr = "0.0.0.0"; } ];
+      };
+      users.users.root.openssh.authorizedKeys.keys = [
+        snakeOilPublicKey
+      ];
+    };
+
     server-localhost-only =
       { ... }:
 
@@ -96,7 +109,9 @@ in {
       };
 
     client =
-      { ... }: { };
+      { ... }: {
+        virtualisation.vlans = [ 1 2 ];
+      };
 
   };
 
@@ -109,6 +124,7 @@ in {
 
     server_lazy.wait_for_unit("sshd.socket", timeout=30)
     server_localhost_only_lazy.wait_for_unit("sshd.socket", timeout=30)
+    server_lazy_socket.wait_for_unit("sshd.socket", timeout=30)
 
     with subtest("manual-authkey"):
         client.succeed("mkdir -m 700 /root/.ssh")
@@ -145,6 +161,16 @@ in {
             timeout=30
         )
 
+    with subtest("socket activation on a non-standard port"):
+        client.succeed(
+            "cat ${snakeOilPrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ssh -p 2222 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.2.4 true",
+            timeout=30
+        )
+
     with subtest("configured-authkey"):
         client.succeed(
             "cat ${snakeOilPrivateKey} > privkey.snakeoil"