IPv6 addresses (or domains with AAAA records) cannot be used in the Gateway field for SSH proxies
bug
## Problem summary
In Fedora 42's `gnome-control-center` 48, as well as using the traditional `nm-connection-editor` GUI (to rule out G-C-C being the problem), with NetworkManager-ssh version 1.4.1 (from the Fedora repositories), I was successfully able to use NetworkManager-SSH to connect to a remote host (and create a SOCKS proxy out of that connection) in IPv4, but not IPv6. With the same settings, only the "Gateway" field changing to an IP v6 (such as the standard example `2001:db8::1`), like this:
<img width="1051" height="895" alt="Image" src="https://github.com/user-attachments/assets/b440dbe9-640b-4441-8e3a-afe7edac0035" />
…it will fail without any warnings or explanations in the GUI (and in the case where you are modifying an existing IPv4 NM SSH config to replace its gateway by the IPv6 address, it will silently revert your change after you save and close the dialog, at least in gnome-control-center).
## Differential diagnosis
@s3phy told me that this is unrelated to the "IPv6 Network Settings" ("Use IPv6") section.
They had a quick look at `src/nm-ssh-service.c` (grepping the `"%s: failed to look up VPN gateway address '%s' (%d)` warning message), and it seems the `resolve_hostname` function only checks for IPv4 formats, then falls back to doing name resolve, but that fails because it's an IPv6 address, not a domain name. They also pointed out that with `hints.ai_family = AF_INET`, domain name resolution will only give you IPv4s, so that can't work with IPv6 even if you were to put a domain name with AAAA record into that Gateway field.
## Logs output
In the system logs, we can see that NetworkManager-SSH tells SSH to connect to the IPv6 gateway, and then doesn't understand how to deal with the successful connection. See the log below from `journalctl -f`. All of this happens within 1 second when trying to activate the newly created IPv6 SSH proxy (via GNOME Shell or via `gnome-control-center`) :
```
NetworkManager[1492]: <info> [1754351028.1884] vpn[0x7ff770039a00,some_UUID,"Proxy to bunker via IPv6"]: starting ssh
NetworkManager[1492]: <info> [1754351028.1888] audit: op="connection-activate" uuid="some_UUID" name="Proxy to bunker via IPv6" pid=682935 uid=1000 result="success"
nm-ssh-service[731428]: Found ssh agent socket at: '/run/user/1000/keyring/ssh'
nm-ssh-service[731428]: Will not establish tunnel (will use dummy interface)
nm-ssh-service[731428]: Using -N - no remote command set, or SOCKS mode set
nm-ssh-service[731428]: ssh started with pid 731434
nm-ssh-service[731428]: OpenSSH_9.9p1, OpenSSL 3.2.4 11 Feb 2025
nm-ssh-service[731428]: debug1: Reading configuration data /etc/ssh/ssh_config
nm-ssh-service[731428]: debug1: Reading configuration data /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf
nm-ssh-service[731428]: debug1: Reading configuration data /etc/ssh/ssh_config.d/30-libvirt-ssh-proxy.conf
nm-ssh-service[731428]: debug1: Reading configuration data /etc/ssh/ssh_config.d/50-redhat.conf
nm-ssh-service[731428]: debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config
nm-ssh-service[731428]: debug1: configuration requests final Match pass
nm-ssh-service[731428]: debug1: re-parsing configuration
nm-ssh-service[731428]: debug1: Reading configuration data /etc/ssh/ssh_config
nm-ssh-service[731428]: debug1: Reading configuration data /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf
nm-ssh-service[731428]: debug1: Reading configuration data /etc/ssh/ssh_config.d/30-libvirt-ssh-proxy.conf
nm-ssh-service[731428]: debug1: Reading configuration data /etc/ssh/ssh_config.d/50-redhat.conf
nm-ssh-service[731428]: debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config
nm-ssh-service[731428]: debug1: Connecting to 2001:db8::1 [2001:db8::1] port 22.
nm-ssh-service[731428]: debug1: Connection established.
nm-ssh-service[731428]: debug1: identity file /root/.ssh/id_rsa type -1
nm-ssh-service[731428]: debug1: identity file /root/.ssh/id_rsa-cert type -1
nm-ssh-service[731428]: debug1: identity file /root/.ssh/id_ecdsa type -1
nm-ssh-service[731428]: debug1: identity file /root/.ssh/id_ecdsa-cert type -1
nm-ssh-service[731428]: debug1: identity file /root/.ssh/id_ecdsa_sk type -1
nm-ssh-service[731428]: debug1: identity file /root/.ssh/id_ecdsa_sk-cert type -1
nm-ssh-service[731428]: debug1: identity file /root/.ssh/id_ed25519 type -1
nm-ssh-service[731428]: debug1: identity file /root/.ssh/id_ed25519-cert type -1
nm-ssh-service[731428]: debug1: identity file /root/.ssh/id_ed25519_sk type -1
nm-ssh-service[731428]: debug1: identity file /root/.ssh/id_ed25519_sk-cert type -1
nm-ssh-service[731428]: debug1: identity file /root/.ssh/id_xmss type -1
nm-ssh-service[731428]: debug1: identity file /root/.ssh/id_xmss-cert type -1
nm-ssh-service[731428]: debug1: Local version string SSH-2.0-OpenSSH_9.9
nm-ssh-service[731428]: debug1: Remote protocol version 2.0, remote software version dropbear
nm-ssh-service[731428]: debug1: compat_banner: no match: dropbear
nm-ssh-service[731428]: debug1: Authenticating to 2001:db8::1:22 as 'root'
nm-ssh-service[731428]: debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
nm-ssh-service[731428]: debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
nm-ssh-service[731428]: debug1: SSH2_MSG_KEXINIT sent
nm-ssh-service[731428]: debug1: SSH2_MSG_KEXINIT received
nm-ssh-service[731428]: debug1: kex: algorithm: curve25519-sha256
nm-ssh-service[731428]: debug1: kex: host key algorithm: ssh-ed25519
nm-ssh-service[731428]: debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
nm-ssh-service[731428]: debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
nm-ssh-service[731428]: debug1: kex: curve25519-sha256 need=64 dh_need=64
nm-ssh-service[731428]: debug1: kex: curve25519-sha256 need=64 dh_need=64
nm-ssh-service[731428]: debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
nm-ssh-service[731428]: debug1: SSH2_MSG_KEX_ECDH_REPLY received
nm-ssh-service[731428]: debug1: Server host key: ssh-ed25519 SHA256:49wuldUB9PgUdaz5agIyy3BnWD3WxGKbOt24ksPIh+g
nm-ssh-service[731428]: debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
nm-ssh-service[731428]: debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
nm-ssh-service[731428]: debug1: Host '2001:db8::1' is known and matches the ED25519 host key.
nm-ssh-service[731428]: debug1: Found key in /home/username/.ssh/known_hosts:35
nm-ssh-service[731428]: debug1: ssh_packet_send2_wrapped: resetting send seqnr 3
nm-ssh-service[731428]: debug1: rekey out after 134217728 blocks
nm-ssh-service[731428]: debug1: SSH2_MSG_NEWKEYS sent
nm-ssh-service[731428]: debug1: expecting SSH2_MSG_NEWKEYS
nm-ssh-service[731428]: debug1: ssh_packet_read_poll2: resetting read seqnr 3
nm-ssh-service[731428]: debug1: SSH2_MSG_NEWKEYS received
nm-ssh-service[731428]: debug1: rekey in after 134217728 blocks
nm-ssh-service[731428]: debug1: SSH2_MSG_EXT_INFO received
nm-ssh-service[731428]: debug1: kex_ext_info_client_parse: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,ssh-rsa>
nm-ssh-service[731428]: debug1: SSH2_MSG_SERVICE_ACCEPT received
nm-ssh-service[731428]: debug1: Authentications that can continue: publickey
nm-ssh-service[731428]: debug1: Next authentication method: publickey
nm-ssh-service[731428]: debug1: get_agent_identities: bound agent to hostkey
nm-ssh-service[731428]: debug1: get_agent_identities: agent returned 3 keys
nm-ssh-service[731428]: debug1: Will attempt key: /home/username/.ssh/id_rsa RSA SHA256:my_key_hash agent
nm-ssh-service[731428]: debug1: Offering public key: /home/username/.ssh/id_rsa RSA SHA256:my_key_hash agent
nm-ssh-service[731428]: debug1: Server accepts key: /home/username/.ssh/id_rsa RSA SHA256:my_key_hash agent
nm-ssh-service[731428]: Authenticated to 2001:db8::1 ([2001:db8::1]:22) using "publickey".
nm-ssh-service[731428]: debug1: pkcs11_del_provider: called, provider_id = (null)
nm-ssh-service[731428]: debug1: Local connections to localhost:8000 forwarded to remote address socks:0
nm-ssh-service[731428]: Port forwarding mode detected
nm-ssh-service[731428]: Sending network configuration (no remote_command)
nm-ssh-service[731428]: resolve_hostname: failed to look up VPN gateway address '2001:db8::1' (-9)
nm-ssh-service[731428]: Could not resolve remote_gw.
nm-ssh-service[731428]: debug1: Local forwarding listening on ::1 port 8000.
nm-ssh-service[731428]: debug1: channel 0: new port-listener [port listener] (inactive timeout: 0)
nm-ssh-service[731428]: Port forwarding mode detected
nm-ssh-service[731428]: Sending network configuration (no remote_command)
nm-ssh-service[731428]: debug1: Local forwarding listening on 127.0.0.1 port 8000.
nm-ssh-service[731428]: debug1: channel 1: new port-listener [port listener] (inactive timeout: 0)
nm-ssh-service[731428]: debug1: Entering interactive session.
nm-ssh-service[731428]: debug1: pledge: network
nm-ssh-service[731428]: debug1: pledge: network
NetworkManager[1492]: <warn> [1754351028.4745] vpn[0x7ff770039a00,some_UUID,"Proxy to bunker via IPv6",if:4,dev:2:(dummy0)]: config: no VPN gateway address received
NetworkManager[1492]: <warn> [1754351028.4748] vpn[0x7ff770039a00,some_UUID,"Proxy to bunker via IPv6",if:4,dev:2:(dummy0)]: did not receive valid IP config information
nm-ssh-service[731428]: Terminated ssh daemon with PID 731434.
nm-ssh-service[731428]: debug1: channel 0: free: port listener, nchannels 2
nm-ssh-service[731428]: debug1: channel 1: free: port listener, nchannels 1
nm-ssh-service[731428]: Transferred: sent 2540, received 1116 bytes, in 0.0 seconds
nm-ssh-service[731428]: Bytes per second: sent 1048038.1, received 460476.6
nm-ssh-service[731428]: debug1: Exit status 0
firewalld[1323]: ERROR: UNKNOWN_INTERFACE: 'dummy0' is not in any zone
```
3 条评论