From 4341ba091dd1074d3d8c41e2a4e6f155d0a7b79f Mon Sep 17 00:00:00 2001 From: Nick Rosbrook Date: Fri, 20 Mar 2026 11:13:28 -0400 Subject: [PATCH 1/2] ssh-proxy: return an error if user supplies VMADDR_CID_ANY Right now, if a user tries to pass VMADDR_CID_ANY to systemd-ssh-proxy, an assert is triggered: $ ssh vsock%4294967295 Assertion 'cid != VMADDR_CID_ANY' failed at src/ssh-generator/ssh-proxy.c:21, function process_vsock_cid(). Aborting. mm_receive_fd: recvmsg: expected received 1 got 0 proxy dialer did not pass back a connection This is becauase the value returned from vsock_parse_cid is not checked before being passed to process_vsock_string. Add a check to prevent that. --- src/ssh-generator/ssh-proxy.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/ssh-generator/ssh-proxy.c b/src/ssh-generator/ssh-proxy.c index 337153787e..bfb91b5867 100644 --- a/src/ssh-generator/ssh-proxy.c +++ b/src/ssh-generator/ssh-proxy.c @@ -62,6 +62,9 @@ static int process_vsock_string(const char *host, const char *port) { if (r < 0) return log_error_errno(r, "Failed to parse vsock cid: %s", host); + if (cid == VMADDR_CID_ANY) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot use VMADDR_CID_ANY to connect to a remote host."); + return process_vsock_cid(cid, port); } From 83359c4da02a82d2972cf957d9855ea957359287 Mon Sep 17 00:00:00 2001 From: Nick Rosbrook Date: Fri, 20 Mar 2026 11:23:39 -0400 Subject: [PATCH 2/2] socket-util: filter out VMADDR_CID_ANY in vsock_get_local_cid() It has been observed on some systems[1] that ssh-issue may print out: Try contacting this VM's SSH server via 'ssh vsock%4294967295' from host. i.e. it suggests connecting with VMADDR_CID_ANY, which is not valid. It seems that IOCTL_VM_SOCKETS_GET_LOCAL_CID may return VMADDR_CID_ANY in some cases, e.g. when vsock is not full initialized or so. Treat VMADDR_CID_ANY as special in vsock_get_local_cid(), the same as VMADDR_CID_LOCAL and VMADDR_CID_HOST, and return an error. [1] https://launchpad.net/bugs/2145027 --- src/basic/socket-util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/basic/socket-util.c b/src/basic/socket-util.c index 159486f7f1..eab09786b6 100644 --- a/src/basic/socket-util.c +++ b/src/basic/socket-util.c @@ -1794,7 +1794,7 @@ int vsock_get_local_cid(unsigned *ret) { /* If ret == NULL, we're just want to check if AF_VSOCK is available, so accept * any address. Otherwise, filter out special addresses that are cannot be used * to identify _this_ machine from the outside. */ - if (ret && IN_SET(tmp, VMADDR_CID_LOCAL, VMADDR_CID_HOST)) + if (ret && IN_SET(tmp, VMADDR_CID_LOCAL, VMADDR_CID_HOST, VMADDR_CID_ANY)) return log_debug_errno(SYNTHETIC_ERRNO(EADDRNOTAVAIL), "IOCTL_VM_SOCKETS_GET_LOCAL_CID returned special value (%u), ignoring.", tmp);