SSH_CONNECTION must contain client address/port and server a

Error message

SSH_CONNECTION must contain client address/port and server address/port

What it means

parse_ssh_connection (src/system/firewall.rs) parses the sshd-provided SSH_CONNECTION env var, which has the form "client-addr client-port server-addr server-port". During firewall bootstrap mise reads it to detect the active SSH session so generated rules cannot lock the user out. The error fires when the value does not split into exactly 4 whitespace-separated tokens (the client port, fields[1], is not even consumed; fields[0]/[2]/[3] must also parse as address/port afterwards).

Source

Thrown at src/system/firewall.rs:1983

    Ok(())
}

fn validate_interface(interface: &str) -> Result<String> {
    if interface.is_empty()
        || interface.len() > 15
        || !interface
            .bytes()
            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.' | b':'))
    {
        bail!("firewall interface '{interface}' is invalid");
    }
    Ok(interface.to_string())
}

fn parse_ssh_connection(value: &str) -> Result<SshConnection> {
    let fields = value.split_ascii_whitespace().collect::<Vec<_>>();
    if fields.len() != 4 {
        bail!("SSH_CONNECTION must contain client address/port and server address/port");
    }
    Ok(SshConnection {
        peer: fields[0].parse()?,
        server: fields[2].parse()?,
        server_port: fields[3].parse()?,
    })
}

/// Detect an sshd ancestor when SSH_CONNECTION was stripped by sudo, env -i,
/// or a wrapper. `None` fails closed because ancestry could not be inspected.
fn ssh_ancestor_present() -> Option<bool> {
    let mut pid = std::process::id();
    let mut visited = HashSet::new();
    for _ in 0..64 {
        if !visited.insert(pid) {
            return None;
        }
        let comm = fs::read_to_string(format!("/proc/{pid}/comm")).ok()?;

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

If not inside a real sshd session, unset it: `env -u SSH_CONNECTION mise bootstrap`
If it must be set, use the exact sshd format 'client-ip client-port server-ip server-port' (e.g. "203.0.113.9 51234 10.0.0.1 22")
Run bootstrap from a genuine ssh login rather than a wrapper that mangles the environment

Example fix

# before
export SSH_CONNECTION="10.0.0.5"

# after
export SSH_CONNECTION="203.0.113.9 51234 10.0.0.1 22"
# or, when not in a real ssh session:
# unset SSH_CONNECTION

Defensive patterns

Strategy: validation

Validate before calling

# only forward SSH_CONNECTION when it is well-formed
if [ -n "${SSH_CONNECTION:-}" ] && [ "$(echo "$SSH_CONNECTION" | wc -w)" -ne 4 ]; then
  unset SSH_CONNECTION
fi
mise bootstrap

Prevention

Do not set SSH_CONNECTION manually; let sshd provide it
In wrappers around mise bootstrap, drop malformed SSH_CONNECTION values before exec
Treat SSH_CONNECTION as an sshd-owned variable in CI images and never seed it with partial data

When it happens

Trigger: mise bootstrap reaches the firewall step while SSH_CONNECTION holds fewer or more than 4 tokens — e.g. exported manually as "10.0.0.5", rewritten by a wrapper script, or seeded from a partial env dump in a container/CI image.

Common situations: sudo/env -i wrappers that strip or truncate env vars; CI or container images that set SSH_CONNECTION for tooling detection; test scripts faking an SSH environment; users copying shell rc files that re-export the variable.

Related errors

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/65b598badf012ea7. Report an issue: GitHub.