From 353a572642c825c5bd815bb7ee3fec3e88142da3 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Mon, 5 May 2025 07:49:25 +0300
Subject: [PATCH] Revert "tests/openssh: write a test for CVE-2025-32728"

---
 nixos/tests/openssh.nix | 44 -----------------------------------------
 1 file changed, 44 deletions(-)

diff --git a/nixos/tests/openssh.nix b/nixos/tests/openssh.nix
index 074d36e3fbe5..d7ddf478d91a 100644
--- a/nixos/tests/openssh.nix
+++ b/nixos/tests/openssh.nix
@@ -35,38 +35,6 @@ import ./make-test-python.nix (
           ];
         };
 
-      server-x11 =
-        { ... }:
-
-        {
-          environment.systemPackages = [ pkgs.xorg.xauth ];
-          services.openssh = {
-            enable = true;
-            settings.X11Forwarding = true;
-          };
-          users.users.root.openssh.authorizedKeys.keys = [
-            snakeOilPublicKey
-          ];
-        };
-
-      server-x11-disable =
-        { ... }:
-
-        {
-          environment.systemPackages = [ pkgs.xorg.xauth ];
-          services.openssh = {
-            enable = true;
-            settings = {
-              X11Forwarding = true;
-              # CVE-2025-32728: the following line is ineffectual
-              DisableForwarding = true;
-            };
-          };
-          users.users.root.openssh.authorizedKeys.keys = [
-            snakeOilPublicKey
-          ];
-        };
-
       server-allowed-users =
         { ... }:
 
@@ -272,8 +240,6 @@ import ./make-test-python.nix (
       start_all()
 
       server.wait_for_unit("sshd", timeout=30)
-      server_x11.wait_for_unit("sshd", timeout=30)
-      server_x11_disable.wait_for_unit("sshd", timeout=30)
       server_allowed_users.wait_for_unit("sshd", timeout=30)
       server_localhost_only.wait_for_unit("sshd", timeout=30)
       server_match_rule.wait_for_unit("sshd", timeout=30)
@@ -341,16 +307,6 @@ import ./make-test-python.nix (
               timeout=30
           )
 
-      with subtest("x11-forwarding"):
-          client.succeed(
-              "[ \"$(ssh -Y -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-x11 'xauth list' | tee /dev/stderr | wc -l)\" -eq 1 ]",
-              timeout=30
-          )
-          client.succeed(
-              "[ \"$(ssh -Y -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-x11-disable 'xauth list' | tee /dev/stderr | wc -l)\" -eq 0 ]",
-              timeout=30
-          )
-
       with subtest("localhost-only"):
           server_localhost_only.succeed("ss -nlt | grep '127.0.0.1:22'")
           server_localhost_only_lazy.succeed("ss -nlt | grep '127.0.0.1:22'")