Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sshd: fix startWhenNeeded and listenAddresses combination #56326

Merged
merged 1 commit into from Feb 25, 2019

Conversation

@uvNikita
Copy link
Contributor

uvNikita commented Feb 24, 2019

Motivation for this change

Previously, if startWhenNeeded was set, listenAddresses option was
ignored and daemon was listening on all interfaces.
Fixes #56325.

This should probably be backported as well.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Assured whether relevant documentation is up to date
  • Fits CONTRIBUTING.md.

Previously, if startWhenNeeded was set, listenAddresses option was
ignored and daemon was listening on all interfaces.
Fixes #56325.
@uvNikita uvNikita requested a review from Infinisil as a code owner Feb 24, 2019
@uvNikita

This comment has been minimized.

Copy link
Contributor Author

uvNikita commented Feb 24, 2019

@xeji

This comment has been minimized.

Copy link
Contributor

xeji commented Feb 25, 2019

@GrahamcOfBorg test openssh

@xeji
xeji approved these changes Feb 25, 2019
Copy link
Contributor

xeji left a comment

LGTM

socketConfig.ListenStream = if cfg.listenAddresses != [] then
map (l: "${l.addr}:${toString (if l.port != null then l.port else 22)}") cfg.listenAddresses
else
cfg.ports;

This comment has been minimized.

Copy link
@vcunat

vcunat Feb 25, 2019

Member

Eh, this means IPv6 addresses in listenAddresses have to be enclosed in brackets, right? Maybe that's a bit confusing, though I haven't studied nixos customs there.

This comment has been minimized.

Copy link
@uvNikita

uvNikita Feb 25, 2019

Author Contributor

@vcunat good point! I'll try to find some solution for it...

This comment has been minimized.

Copy link
@uvNikita

uvNikita Feb 25, 2019

Author Contributor

It seems that sshd understands [ipv6]:port notation as well: https://linux.die.net/man/5/sshd_config.

@lheckemann lheckemann merged commit dd25140 into NixOS:master Feb 25, 2019
11 checks passed
11 checks passed
grahamcofborg-eval ^.^!
Details
grahamcofborg-eval-check-meta config.nix: checkMeta = true
Details
grahamcofborg-eval-nixos-manual nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./nixos/release.nix -A manual
Details
grahamcofborg-eval-nixos-options nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./nixos/release.nix -A options
Details
grahamcofborg-eval-nixpkgs-manual nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./pkgs/top-level/release.nix -A manual
Details
grahamcofborg-eval-nixpkgs-tarball nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./pkgs/top-level/release.nix -A tarball
Details
grahamcofborg-eval-nixpkgs-unstable-jobset nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./pkgs/top-level/release.nix -A unstable
Details
grahamcofborg-eval-package-list nix-env -qa --json --file .
Details
grahamcofborg-eval-package-list-no-aliases nix-env -qa --json --file . --arg config { allowAliases = false; }
Details
tests.openssh on aarch64-linux Success
Details
tests.openssh on x86_64-linux Success
Details
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

5 participants
You can’t perform that action at this time.