From 8a4adeec32d227c79560cdf260264b293fd19c4b Mon Sep 17 00:00:00 2001 From: Ben Potter Date: Mon, 3 Aug 2026 11:50:36 -0700 Subject: [PATCH] fix(agent): detect IPv6-bound listening ports (#27765) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes https://github.com/coder/coder/issues/15675 Dev servers that bind to the IPv6 wildcard address (Next.js, Node's default `http.Server`, Go's `net.Listen` on wildcard addresses, and others) never showed up in the dashboard Ports panel, even though they were listening and reachable. The agent's port scanner only called `netstat.TCPSocks`, which reads `/proc/net/tcp` (IPv4 only); an `[::]` dual-stack socket lives exclusively in `/proc/net/tcp6`, so the panel reported "No open ports were detected." Also scan `netstat.TCP6Socks` and merge the results into the existing dedupe loop. The IPv6 scan failure is non-fatal so hosts with IPv6 disabled (missing `/proc/net/tcp6`, Windows with the v6 stack off) keep their IPv4 results instead of the Ports panel 500ing. Both captures below: `python3 -m http.server 5123 --bind ::` running in the same workspace, built from main vs this branch ([full recordings](https://github.com/coder/coder/tree/recordings/recordings/ipv6-listening-ports)). ## Before ![before](https://raw.githubusercontent.com/coder/coder/recordings/recordings/ipv6-listening-ports/before.jpg) ## After ![after](https://raw.githubusercontent.com/coder/coder/recordings/recordings/ipv6-listening-ports/after.jpg)
Debugging and decision log - Reproduced on a dogfood workspace: `next-server` listening on `*:3000` per `ss -tlnp`, `curl` returning 200, but `GET /api/v2/workspaceagents/{agent}/listening-ports` returning `{"ports": []}`. Port 3000 (hex `0BB8`) present in `/proc/net/tcp6`, absent from `/proc/net/tcp`. - Confirmed `agent/ports_supported.go` only calls `netstat.TCPSocks`; the library's `TCP6Socks` (parses `/proc/net/tcp6` on Linux, `GetTcp6Table2` on Windows) was never referenced. - Control test: an IPv4-bound (`0.0.0.0`) listener was detected correctly, isolating the bug to the missing IPv6 scan. - Made the IPv6 scan failure non-fatal after review: returning an error would break the entire ports endpoint (HTTP 500 on every poll) on IPv6-disabled hosts, a regression from the current behavior of "IPv4 ports only." Silent fallback matches the spirit of `ports_unsupported.go`, which returns an empty list rather than erroring. - The fix lives in the OS-backed `osListeningPortsGetter` behind the `ListeningPortsGetter` interface from #20842, so the fake used by coderd tests is unaffected. - Dedupe by port in the existing `seen` map covers dual-stack sockets that appear in both tables on Windows. - `TestOSListeningPortsGetter_IPv6` listens on `[::]:0` and asserts detection; it skips when the host can't bind IPv6. Verified it fails against the pre-fix code.
> 🤖 This PR was opened by [Coder Agents](https://coder.com/docs/ai-coder/agents) on behalf of @bpmct. --- agent/ports_supported.go | 20 +++++++++++++++-- agent/ports_supported_internal_test.go | 30 ++++++++++++++++++++++++++ 2 files changed, 48 insertions(+), 2 deletions(-) diff --git a/agent/ports_supported.go b/agent/ports_supported.go index 30df6caf7a..d1199b47b2 100644 --- a/agent/ports_supported.go +++ b/agent/ports_supported.go @@ -30,13 +30,29 @@ func (lp *osListeningPortsGetter) GetListeningPorts() ([]codersdk.WorkspaceAgent return ports, nil } - tabs, err := netstat.TCPSocks(func(s *netstat.SockTabEntry) bool { + acceptListening := func(s *netstat.SockTabEntry) bool { return s.State == netstat.Listen - }) + } + + tabs, err := netstat.TCPSocks(acceptListening) if err != nil { return nil, xerrors.Errorf("scan listening ports: %w", err) } + // Include IPv6 listeners too. Many dev servers (e.g. Next.js, Node's + // default http.Server) bind to the IPv6 wildcard address "::", which is + // a dual-stack socket that also accepts IPv4 connections, but only shows + // up in the IPv6 socket table (/proc/net/tcp6), not /proc/net/tcp. + // + // The IPv6 scan fails on systems with IPv6 disabled (e.g. missing + // /proc/net/tcp6 on Linux). Fall back to the IPv4 results instead of + // failing the whole scan, otherwise the ports UI breaks entirely on + // such systems. + tabs6, err := netstat.TCP6Socks(acceptListening) + if err == nil { + tabs = append(tabs, tabs6...) + } + seen := make(map[uint16]struct{}, len(tabs)) ports := []codersdk.WorkspaceAgentListeningPort{} for _, tab := range tabs { diff --git a/agent/ports_supported_internal_test.go b/agent/ports_supported_internal_test.go index e16bd8a0c8..56f688d601 100644 --- a/agent/ports_supported_internal_test.go +++ b/agent/ports_supported_internal_test.go @@ -43,3 +43,33 @@ func TestOSListeningPortsGetter(t *testing.T) { // note that it's unsafe to try to assert that a port does not exist in the response // because the OS may reallocate the port very quickly. } + +func TestOSListeningPortsGetter_IPv6(t *testing.T) { + t.Parallel() + + uut := &osListeningPortsGetter{ + cacheDuration: 1 * time.Hour, + } + + // Many dev servers (e.g. Next.js) bind to the IPv6 wildcard address, + // which is dual-stack and only shows up in the IPv6 socket table. + l, err := net.Listen("tcp", "[::]:0") + if err != nil { + t.Skipf("unable to listen on IPv6 wildcard address: %s", err) + } + defer l.Close() + + // #nosec G115 - Safe conversion as TCP port numbers are within uint16 range (0-65535) + want := uint16(l.Addr().(*net.TCPAddr).Port) + + ports, err := uut.GetListeningPorts() + require.NoError(t, err) + found := false + for _, port := range ports { + if port.Port == want { + found = true + break + } + } + require.True(t, found, "port %d not found in %v", want, ports) +}