3 ms·
Well, for different reasons, but you have similar issues with IPv6 as well. If your client uses temporary addresses (most likely since they're enabled by defaul
by rnhmjoj 7mo ago
Well, for different reasons, but you have similar issues with IPv6 as well. If your client uses temporary addresses (most likely since they're enabled by default on most OS), OpenSSH will pick one of them over the stable address and when they're rotated the connection breaks.
For some reason, OpenSSH devs refuse to fix this issue, so I have to patch it myself:
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -26,6 +26,7 @@
#include <net/if.h>
#include <netinet/in.h>
#include <arpa/inet.h>
+#include <linux/ipv6.h>
#include <ctype.h>
#include <errno.h>
@@ -370,6 +371,11 @@ ssh_create_socket(struct addrinfo *ai)
if (options.ip_qos_interactive != INT_MAX)
set_sock_tos(sock, options.ip_qos_interactive);
+ if (ai->ai_family == AF_INET6 && options.bind_address == NULL) {
+ int val = IPV6_PREFER_SRC_PUBLIC;
+ setsockopt(sock, IPPROTO_IPV6, IPV6_ADDR_PREFERENCES, &val, sizeof(val));
+ }
+
/* Bind the socket to an alternative local IP address */
if (options.bind_address == NULL && options.bind_interface == NULL)
return sock;
- gspr 7mo agoInteresting! Is there anywhere a discussion around their refusal to include your fix?
- rnhmjoj 7mo agoSee this, for example: https://groups.google.com/g/opensshunixdev/c/FVv_bK16ADM/m/R3zAt7RWAAAJ https://groups.google.com/g/opensshunixdev/c/FVv_bK16ADM/m/R... It boilds down to using a Linux-specific API, though it's really BSD that is lacking support for a standard (RFC 5014).
- lxgr 7mo agoIt would also seem to break address privacy (usually not much of a concern if you authenticate yourself via SSH anyway, but still, it leaks your Ethernet or Wi-Fi interface's MAC address in many older setups).
- rnhmjoj 7mo agoWell, yss, but SSH is hardly ever anonymous and this could simply be a cli option.
- lxgr 7mo agoNot anonymous, but it's pretty unexpected for different servers with potentially different identities for each to learn your MAC address (if you're using the default EUI-64 method for SLAAC).
- gspr 7mo agoThis is a good argument for not making it the default, but it would be nice to have it as a command line switch.
- Dylan16807 7mo agoThe temporary address doesn't stay active while there's a connection on it? I think that would be the actual "fix".
- rnhmjoj 7mo agoI think it does, but that's not the issue: if the interface goes down all the temporary address are gone for good, not just "expired".
- Dylan16807 7mo agoIf you're on a stable address, and the interface goes down, will it let your connection/socket continue to exist? Because if the connection/socket gets lost either way, I don't really care if the IP changes too.
- rnhmjoj 7mo agoI'm not sure what happens to the socket, maybe it's closed and reopened, but with this patch I have SSH sessions lasting for days with no issues. Without it, even roaming between two access points can break the session.