crypto/openssh/servconf.c

   1
   2 /* $OpenBSD: servconf.c,v 1.312 2017/10/02 19:33:20 djm Exp $ */
   3 /*
   4  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   5  *                    All rights reserved
   6  *
   7  * As far as I am concerned, the code I have written for this software
   8  * can be used freely for any purpose.  Any derived versions of this
   9  * software must be clearly marked as such, and if the derived work is
  10  * incompatible with the protocol description in the RFC file, it must be
  11  * called by a name other than "ssh" or "Secure Shell".
  12  */
  13
  14 #include "includes.h"
  15 __RCSID("$FreeBSD$");
  16
  17 #include <sys/types.h>
  18 #include <sys/socket.h>
  19
  20 #include <netinet/in.h>
  21 #include <netinet/in_systm.h>
  22 #include <netinet/ip.h>
  23
  24 #include <ctype.h>
  25 #include <fcntl.h>
  26 #include <netdb.h>
  27 #include <pwd.h>
  28 #include <stdio.h>
  29 #include <stdlib.h>
  30 #include <string.h>
  31 #include <signal.h>
  32 #include <unistd.h>
  33 #include <limits.h>
  34 #include <stdarg.h>
  35 #include <errno.h>
  36 #ifdef HAVE_UTIL_H
  37 #include <util.h>
  38 #endif
  39
  40 #include "openbsd-compat/sys-queue.h"
  41 #include "xmalloc.h"
  42 #include "ssh.h"
  43 #include "log.h"
  44 #include "buffer.h"
  45 #include "misc.h"
  46 #include "servconf.h"
  47 #include "compat.h"
  48 #include "pathnames.h"
  49 #include "cipher.h"
  50 #include "key.h"
  51 #include "kex.h"
  52 #include "mac.h"
  53 #include "match.h"
  54 #include "channels.h"
  55 #include "groupaccess.h"
  56 #include "canohost.h"
  57 #include "packet.h"
  58 #include "hostfile.h"
  59 #include "auth.h"
  60 #include "myproposal.h"
  61 #include "digest.h"
  62 #include "version.h"
  63
  64 static void add_listen_addr(ServerOptions *, char *, int);
  65 static void add_one_listen_addr(ServerOptions *, char *, int);
  66
  67 /* Use of privilege separation or not */
  68 extern int use_privsep;
  69 extern Buffer cfg;
  70
  71 /* Initializes the server options to their default values. */
  72
  73 void
  74 initialize_server_options(ServerOptions *options)
  75 {
  76         memset(options, 0, sizeof(*options));
  77
  78         /* Portable-specific options */
  79         options->use_pam = -1;
  80
  81         /* Standard Options */
  82         options->num_ports = 0;
  83         options->ports_from_cmdline = 0;
  84         options->queued_listen_addrs = NULL;
  85         options->num_queued_listens = 0;
  86         options->listen_addrs = NULL;
  87         options->address_family = -1;
  88         options->num_host_key_files = 0;
  89         options->num_host_cert_files = 0;
  90         options->host_key_agent = NULL;
  91         options->pid_file = NULL;
  92         options->login_grace_time = -1;
  93         options->permit_root_login = PERMIT_NOT_SET;
  94         options->ignore_rhosts = -1;
  95         options->ignore_user_known_hosts = -1;
  96         options->print_motd = -1;
  97         options->print_lastlog = -1;
  98         options->x11_forwarding = -1;
  99         options->x11_display_offset = -1;
 100         options->x11_use_localhost = -1;
 101         options->permit_tty = -1;
 102         options->permit_user_rc = -1;
 103         options->xauth_location = NULL;
 104         options->strict_modes = -1;
 105         options->tcp_keep_alive = -1;
 106         options->log_facility = SYSLOG_FACILITY_NOT_SET;
 107         options->log_level = SYSLOG_LEVEL_NOT_SET;
 108         options->hostbased_authentication = -1;
 109         options->hostbased_uses_name_from_packet_only = -1;
 110         options->hostbased_key_types = NULL;
 111         options->hostkeyalgorithms = NULL;
 112         options->pubkey_authentication = -1;
 113         options->pubkey_key_types = NULL;
 114         options->kerberos_authentication = -1;
 115         options->kerberos_or_local_passwd = -1;
 116         options->kerberos_ticket_cleanup = -1;
 117         options->kerberos_get_afs_token = -1;
 118         options->gss_authentication=-1;
 119         options->gss_cleanup_creds = -1;
 120         options->gss_strict_acceptor = -1;
 121         options->password_authentication = -1;
 122         options->kbd_interactive_authentication = -1;
 123         options->challenge_response_authentication = -1;
 124         options->permit_empty_passwd = -1;
 125         options->permit_user_env = -1;
 126         options->compression = -1;
 127         options->rekey_limit = -1;
 128         options->rekey_interval = -1;
 129         options->allow_tcp_forwarding = -1;
 130         options->allow_streamlocal_forwarding = -1;
 131         options->allow_agent_forwarding = -1;
 132         options->num_allow_users = 0;
 133         options->num_deny_users = 0;
 134         options->num_allow_groups = 0;
 135         options->num_deny_groups = 0;
 136         options->ciphers = NULL;
 137         options->macs = NULL;
 138         options->kex_algorithms = NULL;
 139         options->fwd_opts.gateway_ports = -1;
 140         options->fwd_opts.streamlocal_bind_mask = (mode_t)-1;
 141         options->fwd_opts.streamlocal_bind_unlink = -1;
 142         options->num_subsystems = 0;
 143         options->max_startups_begin = -1;
 144         options->max_startups_rate = -1;
 145         options->max_startups = -1;
 146         options->max_authtries = -1;
 147         options->max_sessions = -1;
 148         options->banner = NULL;
 149         options->use_dns = -1;
 150         options->client_alive_interval = -1;
 151         options->client_alive_count_max = -1;
 152         options->num_authkeys_files = 0;
 153         options->num_accept_env = 0;
 154         options->permit_tun = -1;
 155         options->permitted_opens = NULL;
 156         options->adm_forced_command = NULL;
 157         options->chroot_directory = NULL;
 158         options->authorized_keys_command = NULL;
 159         options->authorized_keys_command_user = NULL;
 160         options->revoked_keys_file = NULL;
 161         options->trusted_user_ca_keys = NULL;
 162         options->authorized_principals_file = NULL;
 163         options->authorized_principals_command = NULL;
 164         options->authorized_principals_command_user = NULL;
 165         options->ip_qos_interactive = -1;
 166         options->ip_qos_bulk = -1;
 167         options->version_addendum = NULL;
 168         options->fingerprint_hash = -1;
 169         options->disable_forwarding = -1;
 170         options->expose_userauth_info = -1;
 171         options->use_blacklist = -1;
 172 }
 173
 174 /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
 175 static int
 176 option_clear_or_none(const char *o)
 177 {
 178         return o == NULL || strcasecmp(o, "none") == 0;
 179 }
 180
 181 static void
 182 assemble_algorithms(ServerOptions *o)
 183 {
 184         if (kex_assemble_names(KEX_SERVER_ENCRYPT, &o->ciphers) != 0 ||
 185             kex_assemble_names(KEX_SERVER_MAC, &o->macs) != 0 ||
 186             kex_assemble_names(KEX_SERVER_KEX, &o->kex_algorithms) != 0 ||
 187             kex_assemble_names(KEX_DEFAULT_PK_ALG,
 188             &o->hostkeyalgorithms) != 0 ||
 189             kex_assemble_names(KEX_DEFAULT_PK_ALG,
 190             &o->hostbased_key_types) != 0 ||
 191             kex_assemble_names(KEX_DEFAULT_PK_ALG, &o->pubkey_key_types) != 0)
 192                 fatal("kex_assemble_names failed");
 193 }
 194
 195 void
 196 fill_default_server_options(ServerOptions *options)
 197 {
 198         int i;
 199
 200         /* Portable-specific options */
 201         if (options->use_pam == -1)
 202                 options->use_pam = 1;
 203
 204         /* Standard Options */
 205 #define add_host_key_file(path)                                         \
 206         do {                                                            \
 207                 if (access((path), O_RDONLY) == 0)                      \
 208                         options->host_key_files                         \
 209                             [options->num_host_key_files++] = (path);   \
 210         } while (0)
 211         if (options->num_host_key_files == 0) {
 212                 /* fill default hostkeys for protocols */
 213                 add_host_key_file(_PATH_HOST_RSA_KEY_FILE);
 214                 add_host_key_file(_PATH_HOST_DSA_KEY_FILE);
 215 #ifdef OPENSSL_HAS_ECC
 216                 add_host_key_file(_PATH_HOST_ECDSA_KEY_FILE);
 217 #endif
 218                 add_host_key_file(_PATH_HOST_ED25519_KEY_FILE);
 219         }
 220 #undef add_host_key_file
 221         if (options->num_host_key_files == 0)
 222                 fatal("No host key files found");
 223         /* No certificates by default */
 224         if (options->num_ports == 0)
 225                 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
 226         if (options->address_family == -1)
 227                 options->address_family = AF_UNSPEC;
 228         if (options->listen_addrs == NULL)
 229                 add_listen_addr(options, NULL, 0);
 230         if (options->pid_file == NULL)
 231                 options->pid_file = xstrdup(_PATH_SSH_DAEMON_PID_FILE);
 232         if (options->login_grace_time == -1)
 233                 options->login_grace_time = 120;
 234         if (options->permit_root_login == PERMIT_NOT_SET)
 235                 options->permit_root_login = PERMIT_NO;
 236         if (options->ignore_rhosts == -1)
 237                 options->ignore_rhosts = 1;
 238         if (options->ignore_user_known_hosts == -1)
 239                 options->ignore_user_known_hosts = 0;
 240         if (options->print_motd == -1)
 241                 options->print_motd = 1;
 242         if (options->print_lastlog == -1)
 243                 options->print_lastlog = 1;
 244         if (options->x11_forwarding == -1)
 245                 options->x11_forwarding = 1;
 246         if (options->x11_display_offset == -1)
 247                 options->x11_display_offset = 10;
 248         if (options->x11_use_localhost == -1)
 249                 options->x11_use_localhost = 1;
 250         if (options->xauth_location == NULL)
 251                 options->xauth_location = xstrdup(_PATH_XAUTH);
 252         if (options->permit_tty == -1)
 253                 options->permit_tty = 1;
 254         if (options->permit_user_rc == -1)
 255                 options->permit_user_rc = 1;
 256         if (options->strict_modes == -1)
 257                 options->strict_modes = 1;
 258         if (options->tcp_keep_alive == -1)
 259                 options->tcp_keep_alive = 1;
 260         if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
 261                 options->log_facility = SYSLOG_FACILITY_AUTH;
 262         if (options->log_level == SYSLOG_LEVEL_NOT_SET)
 263                 options->log_level = SYSLOG_LEVEL_INFO;
 264         if (options->hostbased_authentication == -1)
 265                 options->hostbased_authentication = 0;
 266         if (options->hostbased_uses_name_from_packet_only == -1)
 267                 options->hostbased_uses_name_from_packet_only = 0;
 268         if (options->pubkey_authentication == -1)
 269                 options->pubkey_authentication = 1;
 270         if (options->kerberos_authentication == -1)
 271                 options->kerberos_authentication = 0;
 272         if (options->kerberos_or_local_passwd == -1)
 273                 options->kerberos_or_local_passwd = 1;
 274         if (options->kerberos_ticket_cleanup == -1)
 275                 options->kerberos_ticket_cleanup = 1;
 276         if (options->kerberos_get_afs_token == -1)
 277                 options->kerberos_get_afs_token = 0;
 278         if (options->gss_authentication == -1)
 279                 options->gss_authentication = 0;
 280         if (options->gss_cleanup_creds == -1)
 281                 options->gss_cleanup_creds = 1;
 282         if (options->gss_strict_acceptor == -1)
 283                 options->gss_strict_acceptor = 1;
 284         if (options->password_authentication == -1)
 285                 options->password_authentication = 0;
 286         if (options->kbd_interactive_authentication == -1)
 287                 options->kbd_interactive_authentication = 0;
 288         if (options->challenge_response_authentication == -1)
 289                 options->challenge_response_authentication = 1;
 290         if (options->permit_empty_passwd == -1)
 291                 options->permit_empty_passwd = 0;
 292         if (options->permit_user_env == -1)
 293                 options->permit_user_env = 0;
 294         if (options->compression == -1)
 295                 options->compression = COMP_DELAYED;
 296         if (options->rekey_limit == -1)
 297                 options->rekey_limit = 0;
 298         if (options->rekey_interval == -1)
 299                 options->rekey_interval = 0;
 300         if (options->allow_tcp_forwarding == -1)
 301                 options->allow_tcp_forwarding = FORWARD_ALLOW;
 302         if (options->allow_streamlocal_forwarding == -1)
 303                 options->allow_streamlocal_forwarding = FORWARD_ALLOW;
 304         if (options->allow_agent_forwarding == -1)
 305                 options->allow_agent_forwarding = 1;
 306         if (options->fwd_opts.gateway_ports == -1)
 307                 options->fwd_opts.gateway_ports = 0;
 308         if (options->max_startups == -1)
 309                 options->max_startups = 100;
 310         if (options->max_startups_rate == -1)
 311                 options->max_startups_rate = 30;                /* 30% */
 312         if (options->max_startups_begin == -1)
 313                 options->max_startups_begin = 10;
 314         if (options->max_authtries == -1)
 315                 options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
 316         if (options->max_sessions == -1)
 317                 options->max_sessions = DEFAULT_SESSIONS_MAX;
 318         if (options->use_dns == -1)
 319                 options->use_dns = 1;
 320         if (options->client_alive_interval == -1)
 321                 options->client_alive_interval = 0;
 322         if (options->client_alive_count_max == -1)
 323                 options->client_alive_count_max = 3;
 324         if (options->num_authkeys_files == 0) {
 325                 options->authorized_keys_files[options->num_authkeys_files++] =
 326                     xstrdup(_PATH_SSH_USER_PERMITTED_KEYS);
 327                 options->authorized_keys_files[options->num_authkeys_files++] =
 328                     xstrdup(_PATH_SSH_USER_PERMITTED_KEYS2);
 329         }
 330         if (options->permit_tun == -1)
 331                 options->permit_tun = SSH_TUNMODE_NO;
 332         if (options->ip_qos_interactive == -1)
 333                 options->ip_qos_interactive = IPTOS_LOWDELAY;
 334         if (options->ip_qos_bulk == -1)
 335                 options->ip_qos_bulk = IPTOS_THROUGHPUT;
 336         if (options->version_addendum == NULL)
 337                 options->version_addendum = xstrdup(SSH_VERSION_FREEBSD);
 338         if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
 339                 options->fwd_opts.streamlocal_bind_mask = 0177;
 340         if (options->fwd_opts.streamlocal_bind_unlink == -1)
 341                 options->fwd_opts.streamlocal_bind_unlink = 0;
 342         if (options->fingerprint_hash == -1)
 343                 options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
 344         if (options->disable_forwarding == -1)
 345                 options->disable_forwarding = 0;
 346         if (options->expose_userauth_info == -1)
 347                 options->expose_userauth_info = 0;
 348         if (options->use_blacklist == -1)
 349                 options->use_blacklist = 0;
 350
 351         assemble_algorithms(options);
 352
 353         /* Turn privilege separation and sandboxing on by default */
 354         if (use_privsep == -1)
 355                 use_privsep = PRIVSEP_ON;
 356
 357 #define CLEAR_ON_NONE(v) \
 358         do { \
 359                 if (option_clear_or_none(v)) { \
 360                         free(v); \
 361                         v = NULL; \
 362                 } \
 363         } while(0)
 364         CLEAR_ON_NONE(options->pid_file);
 365         CLEAR_ON_NONE(options->xauth_location);
 366         CLEAR_ON_NONE(options->banner);
 367         CLEAR_ON_NONE(options->trusted_user_ca_keys);
 368         CLEAR_ON_NONE(options->revoked_keys_file);
 369         CLEAR_ON_NONE(options->authorized_principals_file);
 370         CLEAR_ON_NONE(options->adm_forced_command);
 371         CLEAR_ON_NONE(options->chroot_directory);
 372         for (i = 0; i < options->num_host_key_files; i++)
 373                 CLEAR_ON_NONE(options->host_key_files[i]);
 374         for (i = 0; i < options->num_host_cert_files; i++)
 375                 CLEAR_ON_NONE(options->host_cert_files[i]);
 376 #undef CLEAR_ON_NONE
 377
 378         /* Similar handling for AuthenticationMethods=any */
 379         if (options->num_auth_methods == 1 &&
 380             strcmp(options->auth_methods[0], "any") == 0) {
 381                 free(options->auth_methods[0]);
 382                 options->auth_methods[0] = NULL;
 383                 options->num_auth_methods = 0;
 384         }
 385
 386 #ifndef HAVE_MMAP
 387         if (use_privsep && options->compression == 1) {
 388                 error("This platform does not support both privilege "
 389                     "separation and compression");
 390                 error("Compression disabled");
 391                 options->compression = 0;
 392         }
 393 #endif
 394
 395 }
 396
 397 /* Keyword tokens. */
 398 typedef enum {
 399         sBadOption,             /* == unknown option */
 400         /* Portable-specific options */
 401         sUsePAM,
 402         /* Standard Options */
 403         sPort, sHostKeyFile, sLoginGraceTime,
 404         sPermitRootLogin, sLogFacility, sLogLevel,
 405         sRhostsRSAAuthentication, sRSAAuthentication,
 406         sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
 407         sKerberosGetAFSToken,
 408         sKerberosTgtPassing, sChallengeResponseAuthentication,
 409         sPasswordAuthentication, sKbdInteractiveAuthentication,
 410         sListenAddress, sAddressFamily,
 411         sPrintMotd, sPrintLastLog, sIgnoreRhosts,
 412         sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
 413         sPermitTTY, sStrictModes, sEmptyPasswd, sTCPKeepAlive,
 414         sPermitUserEnvironment, sAllowTcpForwarding, sCompression,
 415         sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
 416         sIgnoreUserKnownHosts, sCiphers, sMacs, sPidFile,
 417         sGatewayPorts, sPubkeyAuthentication, sPubkeyAcceptedKeyTypes,
 418         sXAuthLocation, sSubsystem, sMaxStartups, sMaxAuthTries, sMaxSessions,
 419         sBanner, sUseDNS, sHostbasedAuthentication,
 420         sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedKeyTypes,
 421         sHostKeyAlgorithms,
 422         sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
 423         sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
 424         sAcceptEnv, sPermitTunnel,
 425         sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
 426         sUsePrivilegeSeparation, sAllowAgentForwarding,
 427         sHostCertificate,
 428         sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
 429         sAuthorizedPrincipalsCommand, sAuthorizedPrincipalsCommandUser,
 430         sKexAlgorithms, sIPQoS, sVersionAddendum,
 431         sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
 432         sAuthenticationMethods, sHostKeyAgent, sPermitUserRC,
 433         sStreamLocalBindMask, sStreamLocalBindUnlink,
 434         sAllowStreamLocalForwarding, sFingerprintHash, sDisableForwarding,
 435         sExposeAuthInfo,
 436         sUseBlacklist,
 437         sDeprecated, sIgnore, sUnsupported
 438 } ServerOpCodes;
 439
 440 #define SSHCFG_GLOBAL   0x01    /* allowed in main section of sshd_config */
 441 #define SSHCFG_MATCH    0x02    /* allowed inside a Match section */
 442 #define SSHCFG_ALL      (SSHCFG_GLOBAL|SSHCFG_MATCH)
 443
 444 /* Textual representation of the tokens. */
 445 static struct {
 446         const char *name;
 447         ServerOpCodes opcode;
 448         u_int flags;
 449 } keywords[] = {
 450         /* Portable-specific options */
 451 #ifdef USE_PAM
 452         { "usepam", sUsePAM, SSHCFG_GLOBAL },
 453 #else
 454         { "usepam", sUnsupported, SSHCFG_GLOBAL },
 455 #endif
 456         { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
 457         /* Standard Options */
 458         { "port", sPort, SSHCFG_GLOBAL },
 459         { "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
 460         { "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL },          /* alias */
 461         { "hostkeyagent", sHostKeyAgent, SSHCFG_GLOBAL },
 462         { "pidfile", sPidFile, SSHCFG_GLOBAL },
 463         { "serverkeybits", sDeprecated, SSHCFG_GLOBAL },
 464         { "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
 465         { "keyregenerationinterval", sDeprecated, SSHCFG_GLOBAL },
 466         { "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
 467         { "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
 468         { "loglevel", sLogLevel, SSHCFG_ALL },
 469         { "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL },
 470         { "rhostsrsaauthentication", sDeprecated, SSHCFG_ALL },
 471         { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
 472         { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_ALL },
 473         { "hostbasedacceptedkeytypes", sHostbasedAcceptedKeyTypes, SSHCFG_ALL },
 474         { "hostkeyalgorithms", sHostKeyAlgorithms, SSHCFG_GLOBAL },
 475         { "rsaauthentication", sDeprecated, SSHCFG_ALL },
 476         { "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
 477         { "pubkeyacceptedkeytypes", sPubkeyAcceptedKeyTypes, SSHCFG_ALL },
 478         { "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
 479 #ifdef KRB5
 480         { "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
 481         { "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
 482         { "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
 483 #ifdef USE_AFS
 484         { "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL },
 485 #else
 486         { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
 487 #endif
 488 #else
 489         { "kerberosauthentication", sUnsupported, SSHCFG_ALL },
 490         { "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
 491         { "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
 492         { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
 493 #endif
 494         { "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
 495         { "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
 496 #ifdef GSSAPI
 497         { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
 498         { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
 499         { "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
 500 #else
 501         { "gssapiauthentication", sUnsupported, SSHCFG_ALL },
 502         { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
 503         { "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
 504 #endif
 505         { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
 506         { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
 507         { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
 508         { "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
 509         { "checkmail", sDeprecated, SSHCFG_GLOBAL },
 510         { "listenaddress", sListenAddress, SSHCFG_GLOBAL },
 511         { "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
 512         { "printmotd", sPrintMotd, SSHCFG_GLOBAL },
 513 #ifdef DISABLE_LASTLOG
 514         { "printlastlog", sUnsupported, SSHCFG_GLOBAL },
 515 #else
 516         { "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
 517 #endif
 518         { "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
 519         { "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
 520         { "x11forwarding", sX11Forwarding, SSHCFG_ALL },
 521         { "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
 522         { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
 523         { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
 524         { "strictmodes", sStrictModes, SSHCFG_GLOBAL },
 525         { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
 526         { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
 527         { "uselogin", sDeprecated, SSHCFG_GLOBAL },
 528         { "compression", sCompression, SSHCFG_GLOBAL },
 529         { "rekeylimit", sRekeyLimit, SSHCFG_ALL },
 530         { "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL },
 531         { "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL },  /* obsolete alias */
 532         { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
 533         { "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL },
 534         { "allowusers", sAllowUsers, SSHCFG_ALL },
 535         { "denyusers", sDenyUsers, SSHCFG_ALL },
 536         { "allowgroups", sAllowGroups, SSHCFG_ALL },
 537         { "denygroups", sDenyGroups, SSHCFG_ALL },
 538         { "ciphers", sCiphers, SSHCFG_GLOBAL },
 539         { "macs", sMacs, SSHCFG_GLOBAL },
 540         { "protocol", sIgnore, SSHCFG_GLOBAL },
 541         { "gatewayports", sGatewayPorts, SSHCFG_ALL },
 542         { "subsystem", sSubsystem, SSHCFG_GLOBAL },
 543         { "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
 544         { "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
 545         { "maxsessions", sMaxSessions, SSHCFG_ALL },
 546         { "banner", sBanner, SSHCFG_ALL },
 547         { "usedns", sUseDNS, SSHCFG_GLOBAL },
 548         { "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
 549         { "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
 550         { "clientaliveinterval", sClientAliveInterval, SSHCFG_ALL },
 551         { "clientalivecountmax", sClientAliveCountMax, SSHCFG_ALL },
 552         { "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_ALL },
 553         { "authorizedkeysfile2", sDeprecated, SSHCFG_ALL },
 554         { "useprivilegeseparation", sDeprecated, SSHCFG_GLOBAL},
 555         { "acceptenv", sAcceptEnv, SSHCFG_ALL },
 556         { "permittunnel", sPermitTunnel, SSHCFG_ALL },
 557         { "permittty", sPermitTTY, SSHCFG_ALL },
 558         { "permituserrc", sPermitUserRC, SSHCFG_ALL },
 559         { "match", sMatch, SSHCFG_ALL },
 560         { "permitopen", sPermitOpen, SSHCFG_ALL },
 561         { "forcecommand", sForceCommand, SSHCFG_ALL },
 562         { "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
 563         { "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
 564         { "revokedkeys", sRevokedKeys, SSHCFG_ALL },
 565         { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
 566         { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
 567         { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
 568         { "ipqos", sIPQoS, SSHCFG_ALL },
 569         { "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL },
 570         { "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL },
 571         { "authorizedprincipalscommand", sAuthorizedPrincipalsCommand, SSHCFG_ALL },
 572         { "authorizedprincipalscommanduser", sAuthorizedPrincipalsCommandUser, SSHCFG_ALL },
 573         { "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL },
 574         { "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL },
 575         { "streamlocalbindmask", sStreamLocalBindMask, SSHCFG_ALL },
 576         { "streamlocalbindunlink", sStreamLocalBindUnlink, SSHCFG_ALL },
 577         { "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL },
 578         { "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL },
 579         { "disableforwarding", sDisableForwarding, SSHCFG_ALL },
 580         { "exposeauthinfo", sExposeAuthInfo, SSHCFG_ALL },
 581         { "useblacklist", sUseBlacklist, SSHCFG_GLOBAL },
 582         { "noneenabled", sUnsupported, SSHCFG_ALL },
 583         { "hpndisabled", sDeprecated, SSHCFG_ALL },
 584         { "hpnbuffersize", sDeprecated, SSHCFG_ALL },
 585         { "tcprcvbufpoll", sDeprecated, SSHCFG_ALL },
 586         { NULL, sBadOption, 0 }
 587 };
 588
 589 static struct {
 590         int val;
 591         char *text;
 592 } tunmode_desc[] = {
 593         { SSH_TUNMODE_NO, "no" },
 594         { SSH_TUNMODE_POINTOPOINT, "point-to-point" },
 595         { SSH_TUNMODE_ETHERNET, "ethernet" },
 596         { SSH_TUNMODE_YES, "yes" },
 597         { -1, NULL }
 598 };
 599
 600 /*
 601  * Returns the number of the token pointed to by cp or sBadOption.
 602  */
 603
 604 static ServerOpCodes
 605 parse_token(const char *cp, const char *filename,
 606             int linenum, u_int *flags)
 607 {
 608         u_int i;
 609
 610         for (i = 0; keywords[i].name; i++)
 611                 if (strcasecmp(cp, keywords[i].name) == 0) {
 612                         *flags = keywords[i].flags;
 613                         return keywords[i].opcode;
 614                 }
 615
 616         error("%s: line %d: Bad configuration option: %s",
 617             filename, linenum, cp);
 618         return sBadOption;
 619 }
 620
 621 char *
 622 derelativise_path(const char *path)
 623 {
 624         char *expanded, *ret, cwd[PATH_MAX];
 625
 626         if (strcasecmp(path, "none") == 0)
 627                 return xstrdup("none");
 628         expanded = tilde_expand_filename(path, getuid());
 629         if (*expanded == '/')
 630                 return expanded;
 631         if (getcwd(cwd, sizeof(cwd)) == NULL)
 632                 fatal("%s: getcwd: %s", __func__, strerror(errno));
 633         xasprintf(&ret, "%s/%s", cwd, expanded);
 634         free(expanded);
 635         return ret;
 636 }
 637
 638 static void
 639 add_listen_addr(ServerOptions *options, char *addr, int port)
 640 {
 641         u_int i;
 642
 643         if (port == 0)
 644                 for (i = 0; i < options->num_ports; i++)
 645                         add_one_listen_addr(options, addr, options->ports[i]);
 646         else
 647                 add_one_listen_addr(options, addr, port);
 648 }
 649
 650 static void
 651 add_one_listen_addr(ServerOptions *options, char *addr, int port)
 652 {
 653         struct addrinfo hints, *ai, *aitop;
 654         char strport[NI_MAXSERV];
 655         int gaierr;
 656
 657         memset(&hints, 0, sizeof(hints));
 658         hints.ai_family = options->address_family;
 659         hints.ai_socktype = SOCK_STREAM;
 660         hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
 661         snprintf(strport, sizeof strport, "%d", port);
 662         if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
 663                 fatal("bad addr or host: %s (%s)",
 664                     addr ? addr : "<NULL>",
 665                     ssh_gai_strerror(gaierr));
 666         for (ai = aitop; ai->ai_next; ai = ai->ai_next)
 667                 ;
 668         ai->ai_next = options->listen_addrs;
 669         options->listen_addrs = aitop;
 670 }
 671
 672 /*
 673  * Queue a ListenAddress to be processed once we have all of the Ports
 674  * and AddressFamily options.
 675  */
 676 static void
 677 queue_listen_addr(ServerOptions *options, char *addr, int port)
 678 {
 679         options->queued_listen_addrs = xreallocarray(
 680             options->queued_listen_addrs, options->num_queued_listens + 1,
 681             sizeof(addr));
 682         options->queued_listen_ports = xreallocarray(
 683             options->queued_listen_ports, options->num_queued_listens + 1,
 684             sizeof(port));
 685         options->queued_listen_addrs[options->num_queued_listens] =
 686             xstrdup(addr);
 687         options->queued_listen_ports[options->num_queued_listens] = port;
 688         options->num_queued_listens++;
 689 }
 690
 691 /*
 692  * Process queued (text) ListenAddress entries.
 693  */
 694 static void
 695 process_queued_listen_addrs(ServerOptions *options)
 696 {
 697         u_int i;
 698
 699         if (options->num_ports == 0)
 700                 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
 701         if (options->address_family == -1)
 702                 options->address_family = AF_UNSPEC;
 703
 704         for (i = 0; i < options->num_queued_listens; i++) {
 705                 add_listen_addr(options, options->queued_listen_addrs[i],
 706                     options->queued_listen_ports[i]);
 707                 free(options->queued_listen_addrs[i]);
 708                 options->queued_listen_addrs[i] = NULL;
 709         }
 710         free(options->queued_listen_addrs);
 711         options->queued_listen_addrs = NULL;
 712         free(options->queued_listen_ports);
 713         options->queued_listen_ports = NULL;
 714         options->num_queued_listens = 0;
 715 }
 716
 717 /*
 718  * Inform channels layer of permitopen options from configuration.
 719  */
 720 void
 721 process_permitopen(struct ssh *ssh, ServerOptions *options)
 722 {
 723         u_int i;
 724         int port;
 725         char *host, *arg, *oarg;
 726
 727         channel_clear_adm_permitted_opens(ssh);
 728         if (options->num_permitted_opens == 0)
 729                 return; /* permit any */
 730
 731         /* handle keywords: "any" / "none" */
 732         if (options->num_permitted_opens == 1 &&
 733             strcmp(options->permitted_opens[0], "any") == 0)
 734                 return;
 735         if (options->num_permitted_opens == 1 &&
 736             strcmp(options->permitted_opens[0], "none") == 0) {
 737                 channel_disable_adm_local_opens(ssh);
 738                 return;
 739         }
 740         /* Otherwise treat it as a list of permitted host:port */
 741         for (i = 0; i < options->num_permitted_opens; i++) {
 742                 oarg = arg = xstrdup(options->permitted_opens[i]);
 743                 host = hpdelim(&arg);
 744                 if (host == NULL)
 745                         fatal("%s: missing host in PermitOpen", __func__);
 746                 host = cleanhostname(host);
 747                 if (arg == NULL || ((port = permitopen_port(arg)) < 0))
 748                         fatal("%s: bad port number in PermitOpen", __func__);
 749                 /* Send it to channels layer */
 750                 channel_add_adm_permitted_opens(ssh, host, port);
 751                 free(oarg);
 752         }
 753 }
 754
 755 struct connection_info *
 756 get_connection_info(int populate, int use_dns)
 757 {
 758         struct ssh *ssh = active_state; /* XXX */
 759         static struct connection_info ci;
 760
 761         if (!populate)
 762                 return &ci;
 763         ci.host = auth_get_canonical_hostname(ssh, use_dns);
 764         ci.address = ssh_remote_ipaddr(ssh);
 765         ci.laddress = ssh_local_ipaddr(ssh);
 766         ci.lport = ssh_local_port(ssh);
 767         return &ci;
 768 }
 769
 770 /*
 771  * The strategy for the Match blocks is that the config file is parsed twice.
 772  *
 773  * The first time is at startup.  activep is initialized to 1 and the
 774  * directives in the global context are processed and acted on.  Hitting a
 775  * Match directive unsets activep and the directives inside the block are
 776  * checked for syntax only.
 777  *
 778  * The second time is after a connection has been established but before
 779  * authentication.  activep is initialized to 2 and global config directives
 780  * are ignored since they have already been processed.  If the criteria in a
 781  * Match block is met, activep is set and the subsequent directives
 782  * processed and actioned until EOF or another Match block unsets it.  Any
 783  * options set are copied into the main server config.
 784  *
 785  * Potential additions/improvements:
 786  *  - Add Match support for pre-kex directives, eg. Ciphers.
 787  *
 788  *  - Add a Tag directive (idea from David Leonard) ala pf, eg:
 789  *      Match Address 192.168.0.*
 790  *              Tag trusted
 791  *      Match Group wheel
 792  *              Tag trusted
 793  *      Match Tag trusted
 794  *              AllowTcpForwarding yes
 795  *              GatewayPorts clientspecified
 796  *              [...]
 797  *
 798  *  - Add a PermittedChannelRequests directive
 799  *      Match Group shell
 800  *              PermittedChannelRequests session,forwarded-tcpip
 801  */
 802
 803 static int
 804 match_cfg_line_group(const char *grps, int line, const char *user)
 805 {
 806         int result = 0;
 807         struct passwd *pw;
 808
 809         if (user == NULL)
 810                 goto out;
 811
 812         if ((pw = getpwnam(user)) == NULL) {
 813                 debug("Can't match group at line %d because user %.100s does "
 814                     "not exist", line, user);
 815         } else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
 816                 debug("Can't Match group because user %.100s not in any group "
 817                     "at line %d", user, line);
 818         } else if (ga_match_pattern_list(grps) != 1) {
 819                 debug("user %.100s does not match group list %.100s at line %d",
 820                     user, grps, line);
 821         } else {
 822                 debug("user %.100s matched group list %.100s at line %d", user,
 823                     grps, line);
 824                 result = 1;
 825         }
 826 out:
 827         ga_free();
 828         return result;
 829 }
 830
 831 /*
 832  * All of the attributes on a single Match line are ANDed together, so we need
 833  * to check every attribute and set the result to zero if any attribute does
 834  * not match.
 835  */
 836 static int
 837 match_cfg_line(char **condition, int line, struct connection_info *ci)
 838 {
 839         int result = 1, attributes = 0, port;
 840         char *arg, *attrib, *cp = *condition;
 841
 842         if (ci == NULL)
 843                 debug3("checking syntax for 'Match %s'", cp);
 844         else
 845                 debug3("checking match for '%s' user %s host %s addr %s "
 846                     "laddr %s lport %d", cp, ci->user ? ci->user : "(null)",
 847                     ci->host ? ci->host : "(null)",
 848                     ci->address ? ci->address : "(null)",
 849                     ci->laddress ? ci->laddress : "(null)", ci->lport);
 850
 851         while ((attrib = strdelim(&cp)) && *attrib != '\0') {
 852                 attributes++;
 853                 if (strcasecmp(attrib, "all") == 0) {
 854                         if (attributes != 1 ||
 855                             ((arg = strdelim(&cp)) != NULL && *arg != '\0')) {
 856                                 error("'all' cannot be combined with other "
 857                                     "Match attributes");
 858                                 return -1;
 859                         }
 860                         *condition = cp;
 861                         return 1;
 862                 }
 863                 if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
 864                         error("Missing Match criteria for %s", attrib);
 865                         return -1;
 866                 }
 867                 if (strcasecmp(attrib, "user") == 0) {
 868                         if (ci == NULL || ci->user == NULL) {
 869                                 result = 0;
 870                                 continue;
 871                         }
 872                         if (match_pattern_list(ci->user, arg, 0) != 1)
 873                                 result = 0;
 874                         else
 875                                 debug("user %.100s matched 'User %.100s' at "
 876                                     "line %d", ci->user, arg, line);
 877                 } else if (strcasecmp(attrib, "group") == 0) {
 878                         if (ci == NULL || ci->user == NULL) {
 879                                 result = 0;
 880                                 continue;
 881                         }
 882                         switch (match_cfg_line_group(arg, line, ci->user)) {
 883                         case -1:
 884                                 return -1;
 885                         case 0:
 886                                 result = 0;
 887                         }
 888                 } else if (strcasecmp(attrib, "host") == 0) {
 889                         if (ci == NULL || ci->host == NULL) {
 890                                 result = 0;
 891                                 continue;
 892                         }
 893                         if (match_hostname(ci->host, arg) != 1)
 894                                 result = 0;
 895                         else
 896                                 debug("connection from %.100s matched 'Host "
 897                                     "%.100s' at line %d", ci->host, arg, line);
 898                 } else if (strcasecmp(attrib, "address") == 0) {
 899                         if (ci == NULL || ci->address == NULL) {
 900                                 result = 0;
 901                                 continue;
 902                         }
 903                         switch (addr_match_list(ci->address, arg)) {
 904                         case 1:
 905                                 debug("connection from %.100s matched 'Address "
 906                                     "%.100s' at line %d", ci->address, arg, line);
 907                                 break;
 908                         case 0:
 909                         case -1:
 910                                 result = 0;
 911                                 break;
 912                         case -2:
 913                                 return -1;
 914                         }
 915                 } else if (strcasecmp(attrib, "localaddress") == 0){
 916                         if (ci == NULL || ci->laddress == NULL) {
 917                                 result = 0;
 918                                 continue;
 919                         }
 920                         switch (addr_match_list(ci->laddress, arg)) {
 921                         case 1:
 922                                 debug("connection from %.100s matched "
 923                                     "'LocalAddress %.100s' at line %d",
 924                                     ci->laddress, arg, line);
 925                                 break;
 926                         case 0:
 927                         case -1:
 928                                 result = 0;
 929                                 break;
 930                         case -2:
 931                                 return -1;
 932                         }
 933                 } else if (strcasecmp(attrib, "localport") == 0) {
 934                         if ((port = a2port(arg)) == -1) {
 935                                 error("Invalid LocalPort '%s' on Match line",
 936                                     arg);
 937                                 return -1;
 938                         }
 939                         if (ci == NULL || ci->lport == 0) {
 940                                 result = 0;
 941                                 continue;
 942                         }
 943                         /* TODO support port lists */
 944                         if (port == ci->lport)
 945                                 debug("connection from %.100s matched "
 946                                     "'LocalPort %d' at line %d",
 947                                     ci->laddress, port, line);
 948                         else
 949                                 result = 0;
 950                 } else {
 951                         error("Unsupported Match attribute %s", attrib);
 952                         return -1;
 953                 }
 954         }
 955         if (attributes == 0) {
 956                 error("One or more attributes required for Match");
 957                 return -1;
 958         }
 959         if (ci != NULL)
 960                 debug3("match %sfound", result ? "" : "not ");
 961         *condition = cp;
 962         return result;
 963 }
 964
 965 #define WHITESPACE " \t\r\n"
 966
 967 /* Multistate option parsing */
 968 struct multistate {
 969         char *key;
 970         int value;
 971 };
 972 static const struct multistate multistate_addressfamily[] = {
 973         { "inet",                       AF_INET },
 974         { "inet6",                      AF_INET6 },
 975         { "any",                        AF_UNSPEC },
 976         { NULL, -1 }
 977 };
 978 static const struct multistate multistate_permitrootlogin[] = {
 979         { "without-password",           PERMIT_NO_PASSWD },
 980         { "prohibit-password",          PERMIT_NO_PASSWD },
 981         { "forced-commands-only",       PERMIT_FORCED_ONLY },
 982         { "yes",                        PERMIT_YES },
 983         { "no",                         PERMIT_NO },
 984         { NULL, -1 }
 985 };
 986 static const struct multistate multistate_compression[] = {
 987         { "yes",                        COMP_DELAYED },
 988         { "delayed",                    COMP_DELAYED },
 989         { "no",                         COMP_NONE },
 990         { NULL, -1 }
 991 };
 992 static const struct multistate multistate_gatewayports[] = {
 993         { "clientspecified",            2 },
 994         { "yes",                        1 },
 995         { "no",                         0 },
 996         { NULL, -1 }
 997 };
 998 static const struct multistate multistate_tcpfwd[] = {
 999         { "yes",                        FORWARD_ALLOW },
1000         { "all",                        FORWARD_ALLOW },
1001         { "no",                         FORWARD_DENY },
1002         { "remote",                     FORWARD_REMOTE },
1003         { "local",                      FORWARD_LOCAL },
1004         { NULL, -1 }
1005 };
1006
1007 int
1008 process_server_config_line(ServerOptions *options, char *line,
1009     const char *filename, int linenum, int *activep,
1010     struct connection_info *connectinfo)
1011 {
1012         char *cp, **charptr, *arg, *arg2, *p;
1013         int cmdline = 0, *intptr, value, value2, n, port;
1014         SyslogFacility *log_facility_ptr;
1015         LogLevel *log_level_ptr;
1016         ServerOpCodes opcode;
1017         u_int i, flags = 0;
1018         size_t len;
1019         long long val64;
1020         const struct multistate *multistate_ptr;
1021
1022         /* Strip trailing whitespace. Allow \f (form feed) at EOL only */
1023         if ((len = strlen(line)) == 0)
1024                 return 0;
1025         for (len--; len > 0; len--) {
1026                 if (strchr(WHITESPACE "\f", line[len]) == NULL)
1027                         break;
1028                 line[len] = '\0';
1029         }
1030
1031         cp = line;
1032         if ((arg = strdelim(&cp)) == NULL)
1033                 return 0;
1034         /* Ignore leading whitespace */
1035         if (*arg == '\0')
1036                 arg = strdelim(&cp);
1037         if (!arg || !*arg || *arg == '#')
1038                 return 0;
1039         intptr = NULL;
1040         charptr = NULL;
1041         opcode = parse_token(arg, filename, linenum, &flags);
1042
1043         if (activep == NULL) { /* We are processing a command line directive */
1044                 cmdline = 1;
1045                 activep = &cmdline;
1046         }
1047         if (*activep && opcode != sMatch)
1048                 debug3("%s:%d setting %s %s", filename, linenum, arg, cp);
1049         if (*activep == 0 && !(flags & SSHCFG_MATCH)) {
1050                 if (connectinfo == NULL) {
1051                         fatal("%s line %d: Directive '%s' is not allowed "
1052                             "within a Match block", filename, linenum, arg);
1053                 } else { /* this is a directive we have already processed */
1054                         while (arg)
1055                                 arg = strdelim(&cp);
1056                         return 0;
1057                 }
1058         }
1059
1060         switch (opcode) {
1061         /* Portable-specific options */
1062         case sUsePAM:
1063                 intptr = &options->use_pam;
1064                 goto parse_flag;
1065
1066         /* Standard Options */
1067         case sBadOption:
1068                 return -1;
1069         case sPort:
1070                 /* ignore ports from configfile if cmdline specifies ports */
1071                 if (options->ports_from_cmdline)
1072                         return 0;
1073                 if (options->num_ports >= MAX_PORTS)
1074                         fatal("%s line %d: too many ports.",
1075                             filename, linenum);
1076                 arg = strdelim(&cp);
1077                 if (!arg || *arg == '\0')
1078                         fatal("%s line %d: missing port number.",
1079                             filename, linenum);
1080                 options->ports[options->num_ports++] = a2port(arg);
1081                 if (options->ports[options->num_ports-1] <= 0)
1082                         fatal("%s line %d: Badly formatted port number.",
1083                             filename, linenum);
1084                 break;
1085
1086         case sLoginGraceTime:
1087                 intptr = &options->login_grace_time;
1088  parse_time:
1089                 arg = strdelim(&cp);
1090                 if (!arg || *arg == '\0')
1091                         fatal("%s line %d: missing time value.",
1092                             filename, linenum);
1093                 if ((value = convtime(arg)) == -1)
1094                         fatal("%s line %d: invalid time value.",
1095                             filename, linenum);
1096                 if (*activep && *intptr == -1)
1097                         *intptr = value;
1098                 break;
1099
1100         case sListenAddress:
1101                 arg = strdelim(&cp);
1102                 if (arg == NULL || *arg == '\0')
1103                         fatal("%s line %d: missing address",
1104                             filename, linenum);
1105                 /* check for bare IPv6 address: no "[]" and 2 or more ":" */
1106                 if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL
1107                     && strchr(p+1, ':') != NULL) {
1108                         queue_listen_addr(options, arg, 0);
1109                         break;
1110                 }
1111                 p = hpdelim(&arg);
1112                 if (p == NULL)
1113                         fatal("%s line %d: bad address:port usage",
1114                             filename, linenum);
1115                 p = cleanhostname(p);
1116                 if (arg == NULL)
1117                         port = 0;
1118                 else if ((port = a2port(arg)) <= 0)
1119                         fatal("%s line %d: bad port number", filename, linenum);
1120
1121                 queue_listen_addr(options, p, port);
1122
1123                 break;
1124
1125         case sAddressFamily:
1126                 intptr = &options->address_family;
1127                 multistate_ptr = multistate_addressfamily;
1128  parse_multistate:
1129                 arg = strdelim(&cp);
1130                 if (!arg || *arg == '\0')
1131                         fatal("%s line %d: missing argument.",
1132                             filename, linenum);
1133                 value = -1;
1134                 for (i = 0; multistate_ptr[i].key != NULL; i++) {
1135                         if (strcasecmp(arg, multistate_ptr[i].key) == 0) {
1136                                 value = multistate_ptr[i].value;
1137                                 break;
1138                         }
1139                 }
1140                 if (value == -1)
1141                         fatal("%s line %d: unsupported option \"%s\".",
1142                             filename, linenum, arg);
1143                 if (*activep && *intptr == -1)
1144                         *intptr = value;
1145                 break;
1146
1147         case sHostKeyFile:
1148                 intptr = &options->num_host_key_files;
1149                 if (*intptr >= MAX_HOSTKEYS)
1150                         fatal("%s line %d: too many host keys specified (max %d).",
1151                             filename, linenum, MAX_HOSTKEYS);
1152                 charptr = &options->host_key_files[*intptr];
1153  parse_filename:
1154                 arg = strdelim(&cp);
1155                 if (!arg || *arg == '\0')
1156                         fatal("%s line %d: missing file name.",
1157                             filename, linenum);
1158                 if (*activep && *charptr == NULL) {
1159                         *charptr = derelativise_path(arg);
1160                         /* increase optional counter */
1161                         if (intptr != NULL)
1162                                 *intptr = *intptr + 1;
1163                 }
1164                 break;
1165
1166         case sHostKeyAgent:
1167                 charptr = &options->host_key_agent;
1168                 arg = strdelim(&cp);
1169                 if (!arg || *arg == '\0')
1170                         fatal("%s line %d: missing socket name.",
1171                             filename, linenum);
1172                 if (*activep && *charptr == NULL)
1173                         *charptr = !strcmp(arg, SSH_AUTHSOCKET_ENV_NAME) ?
1174                             xstrdup(arg) : derelativise_path(arg);
1175                 break;
1176
1177         case sHostCertificate:
1178                 intptr = &options->num_host_cert_files;
1179                 if (*intptr >= MAX_HOSTKEYS)
1180                         fatal("%s line %d: too many host certificates "
1181                             "specified (max %d).", filename, linenum,
1182                             MAX_HOSTCERTS);
1183                 charptr = &options->host_cert_files[*intptr];
1184                 goto parse_filename;
1185
1186         case sPidFile:
1187                 charptr = &options->pid_file;
1188                 goto parse_filename;
1189
1190         case sPermitRootLogin:
1191                 intptr = &options->permit_root_login;
1192                 multistate_ptr = multistate_permitrootlogin;
1193                 goto parse_multistate;
1194
1195         case sIgnoreRhosts:
1196                 intptr = &options->ignore_rhosts;
1197  parse_flag:
1198                 arg = strdelim(&cp);
1199                 if (!arg || *arg == '\0')
1200                         fatal("%s line %d: missing yes/no argument.",
1201                             filename, linenum);
1202                 value = 0;      /* silence compiler */
1203                 if (strcmp(arg, "yes") == 0)
1204                         value = 1;
1205                 else if (strcmp(arg, "no") == 0)
1206                         value = 0;
1207                 else
1208                         fatal("%s line %d: Bad yes/no argument: %s",
1209                                 filename, linenum, arg);
1210                 if (*activep && *intptr == -1)
1211                         *intptr = value;
1212                 break;
1213
1214         case sIgnoreUserKnownHosts:
1215                 intptr = &options->ignore_user_known_hosts;
1216                 goto parse_flag;
1217
1218         case sHostbasedAuthentication:
1219                 intptr = &options->hostbased_authentication;
1220                 goto parse_flag;
1221
1222         case sHostbasedUsesNameFromPacketOnly:
1223                 intptr = &options->hostbased_uses_name_from_packet_only;
1224                 goto parse_flag;
1225
1226         case sHostbasedAcceptedKeyTypes:
1227                 charptr = &options->hostbased_key_types;
1228  parse_keytypes:
1229                 arg = strdelim(&cp);
1230                 if (!arg || *arg == '\0')
1231                         fatal("%s line %d: Missing argument.",
1232                             filename, linenum);
1233                 if (*arg != '-' &&
1234                     !sshkey_names_valid2(*arg == '+' ? arg + 1 : arg, 1))
1235                         fatal("%s line %d: Bad key types '%s'.",
1236                             filename, linenum, arg ? arg : "<NONE>");
1237                 if (*activep && *charptr == NULL)
1238                         *charptr = xstrdup(arg);
1239                 break;
1240
1241         case sHostKeyAlgorithms:
1242                 charptr = &options->hostkeyalgorithms;
1243                 goto parse_keytypes;
1244
1245         case sPubkeyAuthentication:
1246                 intptr = &options->pubkey_authentication;
1247                 goto parse_flag;
1248
1249         case sPubkeyAcceptedKeyTypes:
1250                 charptr = &options->pubkey_key_types;
1251                 goto parse_keytypes;
1252
1253         case sKerberosAuthentication:
1254                 intptr = &options->kerberos_authentication;
1255                 goto parse_flag;
1256
1257         case sKerberosOrLocalPasswd:
1258                 intptr = &options->kerberos_or_local_passwd;
1259                 goto parse_flag;
1260
1261         case sKerberosTicketCleanup:
1262                 intptr = &options->kerberos_ticket_cleanup;
1263                 goto parse_flag;
1264
1265         case sKerberosGetAFSToken:
1266                 intptr = &options->kerberos_get_afs_token;
1267                 goto parse_flag;
1268
1269         case sGssAuthentication:
1270                 intptr = &options->gss_authentication;
1271                 goto parse_flag;
1272
1273         case sGssCleanupCreds:
1274                 intptr = &options->gss_cleanup_creds;
1275                 goto parse_flag;
1276
1277         case sGssStrictAcceptor:
1278                 intptr = &options->gss_strict_acceptor;
1279                 goto parse_flag;
1280
1281         case sPasswordAuthentication:
1282                 intptr = &options->password_authentication;
1283                 goto parse_flag;
1284
1285         case sKbdInteractiveAuthentication:
1286                 intptr = &options->kbd_interactive_authentication;
1287                 goto parse_flag;
1288
1289         case sChallengeResponseAuthentication:
1290                 intptr = &options->challenge_response_authentication;
1291                 goto parse_flag;
1292
1293         case sPrintMotd:
1294                 intptr = &options->print_motd;
1295                 goto parse_flag;
1296
1297         case sPrintLastLog:
1298                 intptr = &options->print_lastlog;
1299                 goto parse_flag;
1300
1301         case sX11Forwarding:
1302                 intptr = &options->x11_forwarding;
1303                 goto parse_flag;
1304
1305         case sX11DisplayOffset:
1306                 intptr = &options->x11_display_offset;
1307  parse_int:
1308                 arg = strdelim(&cp);
1309                 if (!arg || *arg == '\0')
1310                         fatal("%s line %d: missing integer value.",
1311                             filename, linenum);
1312                 value = atoi(arg);
1313                 if (*activep && *intptr == -1)
1314                         *intptr = value;
1315                 break;
1316
1317         case sX11UseLocalhost:
1318                 intptr = &options->x11_use_localhost;
1319                 goto parse_flag;
1320
1321         case sXAuthLocation:
1322                 charptr = &options->xauth_location;
1323                 goto parse_filename;
1324
1325         case sPermitTTY:
1326                 intptr = &options->permit_tty;
1327                 goto parse_flag;
1328
1329         case sPermitUserRC:
1330                 intptr = &options->permit_user_rc;
1331                 goto parse_flag;
1332
1333         case sStrictModes:
1334                 intptr = &options->strict_modes;
1335                 goto parse_flag;
1336
1337         case sTCPKeepAlive:
1338                 intptr = &options->tcp_keep_alive;
1339                 goto parse_flag;
1340
1341         case sEmptyPasswd:
1342                 intptr = &options->permit_empty_passwd;
1343                 goto parse_flag;
1344
1345         case sPermitUserEnvironment:
1346                 intptr = &options->permit_user_env;
1347                 goto parse_flag;
1348
1349         case sCompression:
1350                 intptr = &options->compression;
1351                 multistate_ptr = multistate_compression;
1352                 goto parse_multistate;
1353
1354         case sRekeyLimit:
1355                 arg = strdelim(&cp);
1356                 if (!arg || *arg == '\0')
1357                         fatal("%.200s line %d: Missing argument.", filename,
1358                             linenum);
1359                 if (strcmp(arg, "default") == 0) {
1360                         val64 = 0;
1361                 } else {
1362                         if (scan_scaled(arg, &val64) == -1)
1363                                 fatal("%.200s line %d: Bad number '%s': %s",
1364                                     filename, linenum, arg, strerror(errno));
1365                         if (val64 != 0 && val64 < 16)
1366                                 fatal("%.200s line %d: RekeyLimit too small",
1367                                     filename, linenum);
1368                 }
1369                 if (*activep && options->rekey_limit == -1)
1370                         options->rekey_limit = val64;
1371                 if (cp != NULL) { /* optional rekey interval present */
1372                         if (strcmp(cp, "none") == 0) {
1373                                 (void)strdelim(&cp);    /* discard */
1374                                 break;
1375                         }
1376                         intptr = &options->rekey_interval;
1377                         goto parse_time;
1378                 }
1379                 break;
1380
1381         case sGatewayPorts:
1382                 intptr = &options->fwd_opts.gateway_ports;
1383                 multistate_ptr = multistate_gatewayports;
1384                 goto parse_multistate;
1385
1386         case sUseDNS:
1387                 intptr = &options->use_dns;
1388                 goto parse_flag;
1389
1390         case sLogFacility:
1391                 log_facility_ptr = &options->log_facility;
1392                 arg = strdelim(&cp);
1393                 value = log_facility_number(arg);
1394                 if (value == SYSLOG_FACILITY_NOT_SET)
1395                         fatal("%.200s line %d: unsupported log facility '%s'",
1396                             filename, linenum, arg ? arg : "<NONE>");
1397                 if (*log_facility_ptr == -1)
1398                         *log_facility_ptr = (SyslogFacility) value;
1399                 break;
1400
1401         case sLogLevel:
1402                 log_level_ptr = &options->log_level;
1403                 arg = strdelim(&cp);
1404                 value = log_level_number(arg);
1405                 if (value == SYSLOG_LEVEL_NOT_SET)
1406                         fatal("%.200s line %d: unsupported log level '%s'",
1407                             filename, linenum, arg ? arg : "<NONE>");
1408                 if (*activep && *log_level_ptr == -1)
1409                         *log_level_ptr = (LogLevel) value;
1410                 break;
1411
1412         case sAllowTcpForwarding:
1413                 intptr = &options->allow_tcp_forwarding;
1414                 multistate_ptr = multistate_tcpfwd;
1415                 goto parse_multistate;
1416
1417         case sAllowStreamLocalForwarding:
1418                 intptr = &options->allow_streamlocal_forwarding;
1419                 multistate_ptr = multistate_tcpfwd;
1420                 goto parse_multistate;
1421
1422         case sAllowAgentForwarding:
1423                 intptr = &options->allow_agent_forwarding;
1424                 goto parse_flag;
1425
1426         case sDisableForwarding:
1427                 intptr = &options->disable_forwarding;
1428                 goto parse_flag;
1429
1430         case sAllowUsers:
1431                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1432                         if (options->num_allow_users >= MAX_ALLOW_USERS)
1433                                 fatal("%s line %d: too many allow users.",
1434                                     filename, linenum);
1435                         if (match_user(NULL, NULL, NULL, arg) == -1)
1436                                 fatal("%s line %d: invalid AllowUsers pattern: "
1437                                     "\"%.100s\"", filename, linenum, arg);
1438                         if (!*activep)
1439                                 continue;
1440                         options->allow_users[options->num_allow_users++] =
1441                             xstrdup(arg);
1442                 }
1443                 break;
1444
1445         case sDenyUsers:
1446                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1447                         if (options->num_deny_users >= MAX_DENY_USERS)
1448                                 fatal("%s line %d: too many deny users.",
1449                                     filename, linenum);
1450                         if (match_user(NULL, NULL, NULL, arg) == -1)
1451                                 fatal("%s line %d: invalid DenyUsers pattern: "
1452                                     "\"%.100s\"", filename, linenum, arg);
1453                         if (!*activep)
1454                                 continue;
1455                         options->deny_users[options->num_deny_users++] =
1456                             xstrdup(arg);
1457                 }
1458                 break;
1459
1460         case sAllowGroups:
1461                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1462                         if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
1463                                 fatal("%s line %d: too many allow groups.",
1464                                     filename, linenum);
1465                         if (!*activep)
1466                                 continue;
1467                         options->allow_groups[options->num_allow_groups++] =
1468                             xstrdup(arg);
1469                 }
1470                 break;
1471
1472         case sDenyGroups:
1473                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1474                         if (options->num_deny_groups >= MAX_DENY_GROUPS)
1475                                 fatal("%s line %d: too many deny groups.",
1476                                     filename, linenum);
1477                         if (!*activep)
1478                                 continue;
1479                         options->deny_groups[options->num_deny_groups++] =
1480                             xstrdup(arg);
1481                 }
1482                 break;
1483
1484         case sCiphers:
1485                 arg = strdelim(&cp);
1486                 if (!arg || *arg == '\0')
1487                         fatal("%s line %d: Missing argument.", filename, linenum);
1488                 if (*arg != '-' && !ciphers_valid(*arg == '+' ? arg + 1 : arg))
1489                         fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1490                             filename, linenum, arg ? arg : "<NONE>");
1491                 if (options->ciphers == NULL)
1492                         options->ciphers = xstrdup(arg);
1493                 break;
1494
1495         case sMacs:
1496                 arg = strdelim(&cp);
1497                 if (!arg || *arg == '\0')
1498                         fatal("%s line %d: Missing argument.", filename, linenum);
1499                 if (*arg != '-' && !mac_valid(*arg == '+' ? arg + 1 : arg))
1500                         fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1501                             filename, linenum, arg ? arg : "<NONE>");
1502                 if (options->macs == NULL)
1503                         options->macs = xstrdup(arg);
1504                 break;
1505
1506         case sKexAlgorithms:
1507                 arg = strdelim(&cp);
1508                 if (!arg || *arg == '\0')
1509                         fatal("%s line %d: Missing argument.",
1510                             filename, linenum);
1511                 if (*arg != '-' &&
1512                     !kex_names_valid(*arg == '+' ? arg + 1 : arg))
1513                         fatal("%s line %d: Bad SSH2 KexAlgorithms '%s'.",
1514                             filename, linenum, arg ? arg : "<NONE>");
1515                 if (options->kex_algorithms == NULL)
1516                         options->kex_algorithms = xstrdup(arg);
1517                 break;
1518
1519         case sSubsystem:
1520                 if (options->num_subsystems >= MAX_SUBSYSTEMS) {
1521                         fatal("%s line %d: too many subsystems defined.",
1522                             filename, linenum);
1523                 }
1524                 arg = strdelim(&cp);
1525                 if (!arg || *arg == '\0')
1526                         fatal("%s line %d: Missing subsystem name.",
1527                             filename, linenum);
1528                 if (!*activep) {
1529                         arg = strdelim(&cp);
1530                         break;
1531                 }
1532                 for (i = 0; i < options->num_subsystems; i++)
1533                         if (strcmp(arg, options->subsystem_name[i]) == 0)
1534                                 fatal("%s line %d: Subsystem '%s' already defined.",
1535                                     filename, linenum, arg);
1536                 options->subsystem_name[options->num_subsystems] = xstrdup(arg);
1537                 arg = strdelim(&cp);
1538                 if (!arg || *arg == '\0')
1539                         fatal("%s line %d: Missing subsystem command.",
1540                             filename, linenum);
1541                 options->subsystem_command[options->num_subsystems] = xstrdup(arg);
1542
1543                 /* Collect arguments (separate to executable) */
1544                 p = xstrdup(arg);
1545                 len = strlen(p) + 1;
1546                 while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
1547                         len += 1 + strlen(arg);
1548                         p = xreallocarray(p, 1, len);
1549                         strlcat(p, " ", len);
1550                         strlcat(p, arg, len);
1551                 }
1552                 options->subsystem_args[options->num_subsystems] = p;
1553                 options->num_subsystems++;
1554                 break;
1555
1556         case sMaxStartups:
1557                 arg = strdelim(&cp);
1558                 if (!arg || *arg == '\0')
1559                         fatal("%s line %d: Missing MaxStartups spec.",
1560                             filename, linenum);
1561                 if ((n = sscanf(arg, "%d:%d:%d",
1562                     &options->max_startups_begin,
1563                     &options->max_startups_rate,
1564                     &options->max_startups)) == 3) {
1565                         if (options->max_startups_begin >
1566                             options->max_startups ||
1567                             options->max_startups_rate > 100 ||
1568                             options->max_startups_rate < 1)
1569                                 fatal("%s line %d: Illegal MaxStartups spec.",
1570                                     filename, linenum);
1571                 } else if (n != 1)
1572                         fatal("%s line %d: Illegal MaxStartups spec.",
1573                             filename, linenum);
1574                 else
1575                         options->max_startups = options->max_startups_begin;
1576                 break;
1577
1578         case sMaxAuthTries:
1579                 intptr = &options->max_authtries;
1580                 goto parse_int;
1581
1582         case sMaxSessions:
1583                 intptr = &options->max_sessions;
1584                 goto parse_int;
1585
1586         case sBanner:
1587                 charptr = &options->banner;
1588                 goto parse_filename;
1589
1590         /*
1591          * These options can contain %X options expanded at
1592          * connect time, so that you can specify paths like:
1593          *
1594          * AuthorizedKeysFile   /etc/ssh_keys/%u
1595          */
1596         case sAuthorizedKeysFile:
1597                 if (*activep && options->num_authkeys_files == 0) {
1598                         while ((arg = strdelim(&cp)) && *arg != '\0') {
1599                                 if (options->num_authkeys_files >=
1600                                     MAX_AUTHKEYS_FILES)
1601                                         fatal("%s line %d: "
1602                                             "too many authorized keys files.",
1603                                             filename, linenum);
1604                                 options->authorized_keys_files[
1605                                     options->num_authkeys_files++] =
1606                                     tilde_expand_filename(arg, getuid());
1607                         }
1608                 }
1609                 return 0;
1610
1611         case sAuthorizedPrincipalsFile:
1612                 charptr = &options->authorized_principals_file;
1613                 arg = strdelim(&cp);
1614                 if (!arg || *arg == '\0')
1615                         fatal("%s line %d: missing file name.",
1616                             filename, linenum);
1617                 if (*activep && *charptr == NULL) {
1618                         *charptr = tilde_expand_filename(arg, getuid());
1619                         /* increase optional counter */
1620                         if (intptr != NULL)
1621                                 *intptr = *intptr + 1;
1622                 }
1623                 break;
1624
1625         case sClientAliveInterval:
1626                 intptr = &options->client_alive_interval;
1627                 goto parse_time;
1628
1629         case sClientAliveCountMax:
1630                 intptr = &options->client_alive_count_max;
1631                 goto parse_int;
1632
1633         case sAcceptEnv:
1634                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1635                         if (strchr(arg, '=') != NULL)
1636                                 fatal("%s line %d: Invalid environment name.",
1637                                     filename, linenum);
1638                         if (options->num_accept_env >= MAX_ACCEPT_ENV)
1639                                 fatal("%s line %d: too many allow env.",
1640                                     filename, linenum);
1641                         if (!*activep)
1642                                 continue;
1643                         options->accept_env[options->num_accept_env++] =
1644                             xstrdup(arg);
1645                 }
1646                 break;
1647
1648         case sPermitTunnel:
1649                 intptr = &options->permit_tun;
1650                 arg = strdelim(&cp);
1651                 if (!arg || *arg == '\0')
1652                         fatal("%s line %d: Missing yes/point-to-point/"
1653                             "ethernet/no argument.", filename, linenum);
1654                 value = -1;
1655                 for (i = 0; tunmode_desc[i].val != -1; i++)
1656                         if (strcmp(tunmode_desc[i].text, arg) == 0) {
1657                                 value = tunmode_desc[i].val;
1658                                 break;
1659                         }
1660                 if (value == -1)
1661                         fatal("%s line %d: Bad yes/point-to-point/ethernet/"
1662                             "no argument: %s", filename, linenum, arg);
1663                 if (*activep && *intptr == -1)
1664                         *intptr = value;
1665                 break;
1666
1667         case sMatch:
1668                 if (cmdline)
1669                         fatal("Match directive not supported as a command-line "
1670                            "option");
1671                 value = match_cfg_line(&cp, linenum, connectinfo);
1672                 if (value < 0)
1673                         fatal("%s line %d: Bad Match condition", filename,
1674                             linenum);
1675                 *activep = value;
1676                 break;
1677
1678         case sPermitOpen:
1679                 arg = strdelim(&cp);
1680                 if (!arg || *arg == '\0')
1681                         fatal("%s line %d: missing PermitOpen specification",
1682                             filename, linenum);
1683                 i = options->num_permitted_opens;       /* modified later */
1684                 if (strcmp(arg, "any") == 0 || strcmp(arg, "none") == 0) {
1685                         if (*activep && i == 0) {
1686                                 options->num_permitted_opens = 1;
1687                                 options->permitted_opens = xcalloc(1,
1688                                     sizeof(*options->permitted_opens));
1689                                 options->permitted_opens[0] = xstrdup(arg);
1690                         }
1691                         break;
1692                 }
1693                 for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) {
1694                         arg2 = xstrdup(arg);
1695                         p = hpdelim(&arg);
1696                         if (p == NULL)
1697                                 fatal("%s line %d: missing host in PermitOpen",
1698                                     filename, linenum);
1699                         p = cleanhostname(p);
1700                         if (arg == NULL || ((port = permitopen_port(arg)) < 0))
1701                                 fatal("%s line %d: bad port number in "
1702                                     "PermitOpen", filename, linenum);
1703                         if (*activep && i == 0) {
1704                                 options->permitted_opens = xrecallocarray(
1705                                     options->permitted_opens,
1706                                     options->num_permitted_opens,
1707                                     options->num_permitted_opens + 1,
1708                                     sizeof(*options->permitted_opens));
1709                                 i = options->num_permitted_opens++;
1710                                 options->permitted_opens[i] = arg2;
1711                         } else
1712                                 free(arg2);
1713                 }
1714                 break;
1715
1716         case sForceCommand:
1717                 if (cp == NULL || *cp == '\0')
1718                         fatal("%.200s line %d: Missing argument.", filename,
1719                             linenum);
1720                 len = strspn(cp, WHITESPACE);
1721                 if (*activep && options->adm_forced_command == NULL)
1722                         options->adm_forced_command = xstrdup(cp + len);
1723                 return 0;
1724
1725         case sChrootDirectory:
1726                 charptr = &options->chroot_directory;
1727
1728                 arg = strdelim(&cp);
1729                 if (!arg || *arg == '\0')
1730                         fatal("%s line %d: missing file name.",
1731                             filename, linenum);
1732                 if (*activep && *charptr == NULL)
1733                         *charptr = xstrdup(arg);
1734                 break;
1735
1736         case sTrustedUserCAKeys:
1737                 charptr = &options->trusted_user_ca_keys;
1738                 goto parse_filename;
1739
1740         case sRevokedKeys:
1741                 charptr = &options->revoked_keys_file;
1742                 goto parse_filename;
1743
1744         case sIPQoS:
1745                 arg = strdelim(&cp);
1746                 if ((value = parse_ipqos(arg)) == -1)
1747                         fatal("%s line %d: Bad IPQoS value: %s",
1748                             filename, linenum, arg);
1749                 arg = strdelim(&cp);
1750                 if (arg == NULL)
1751                         value2 = value;
1752                 else if ((value2 = parse_ipqos(arg)) == -1)
1753                         fatal("%s line %d: Bad IPQoS value: %s",
1754                             filename, linenum, arg);
1755                 if (*activep) {
1756                         options->ip_qos_interactive = value;
1757                         options->ip_qos_bulk = value2;
1758                 }
1759                 break;
1760
1761         case sVersionAddendum:
1762                 if (cp == NULL || *cp == '\0')
1763                         fatal("%.200s line %d: Missing argument.", filename,
1764                             linenum);
1765                 len = strspn(cp, WHITESPACE);
1766                 if (*activep && options->version_addendum == NULL) {
1767                         if (strcasecmp(cp + len, "none") == 0)
1768                                 options->version_addendum = xstrdup("");
1769                         else if (strchr(cp + len, '\r') != NULL)
1770                                 fatal("%.200s line %d: Invalid argument",
1771                                     filename, linenum);
1772                         else
1773                                 options->version_addendum = xstrdup(cp + len);
1774                 }
1775                 return 0;
1776
1777         case sAuthorizedKeysCommand:
1778                 if (cp == NULL)
1779                         fatal("%.200s line %d: Missing argument.", filename,
1780                             linenum);
1781                 len = strspn(cp, WHITESPACE);
1782                 if (*activep && options->authorized_keys_command == NULL) {
1783                         if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0)
1784                                 fatal("%.200s line %d: AuthorizedKeysCommand "
1785                                     "must be an absolute path",
1786                                     filename, linenum);
1787                         options->authorized_keys_command = xstrdup(cp + len);
1788                 }
1789                 return 0;
1790
1791         case sAuthorizedKeysCommandUser:
1792                 charptr = &options->authorized_keys_command_user;
1793
1794                 arg = strdelim(&cp);
1795                 if (!arg || *arg == '\0')
1796                         fatal("%s line %d: missing AuthorizedKeysCommandUser "
1797                             "argument.", filename, linenum);
1798                 if (*activep && *charptr == NULL)
1799                         *charptr = xstrdup(arg);
1800                 break;
1801
1802         case sAuthorizedPrincipalsCommand:
1803                 if (cp == NULL)
1804                         fatal("%.200s line %d: Missing argument.", filename,
1805                             linenum);
1806                 len = strspn(cp, WHITESPACE);
1807                 if (*activep &&
1808                     options->authorized_principals_command == NULL) {
1809                         if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0)
1810                                 fatal("%.200s line %d: "
1811                                     "AuthorizedPrincipalsCommand must be "
1812                                     "an absolute path", filename, linenum);
1813                         options->authorized_principals_command =
1814                             xstrdup(cp + len);
1815                 }
1816                 return 0;
1817
1818         case sAuthorizedPrincipalsCommandUser:
1819                 charptr = &options->authorized_principals_command_user;
1820
1821                 arg = strdelim(&cp);
1822                 if (!arg || *arg == '\0')
1823                         fatal("%s line %d: missing "
1824                             "AuthorizedPrincipalsCommandUser argument.",
1825                             filename, linenum);
1826                 if (*activep && *charptr == NULL)
1827                         *charptr = xstrdup(arg);
1828                 break;
1829
1830         case sAuthenticationMethods:
1831                 if (options->num_auth_methods == 0) {
1832                         value = 0; /* seen "any" pseudo-method */
1833                         value2 = 0; /* sucessfully parsed any method */
1834                         while ((arg = strdelim(&cp)) && *arg != '\0') {
1835                                 if (options->num_auth_methods >=
1836                                     MAX_AUTH_METHODS)
1837                                         fatal("%s line %d: "
1838                                             "too many authentication methods.",
1839                                             filename, linenum);
1840                                 if (strcmp(arg, "any") == 0) {
1841                                         if (options->num_auth_methods > 0) {
1842                                                 fatal("%s line %d: \"any\" "
1843                                                     "must appear alone in "
1844                                                     "AuthenticationMethods",
1845                                                     filename, linenum);
1846                                         }
1847                                         value = 1;
1848                                 } else if (value) {
1849                                         fatal("%s line %d: \"any\" must appear "
1850                                             "alone in AuthenticationMethods",
1851                                             filename, linenum);
1852                                 } else if (auth2_methods_valid(arg, 0) != 0) {
1853                                         fatal("%s line %d: invalid "
1854                                             "authentication method list.",
1855                                             filename, linenum);
1856                                 }
1857                                 value2 = 1;
1858                                 if (!*activep)
1859                                         continue;
1860                                 options->auth_methods[
1861                                     options->num_auth_methods++] = xstrdup(arg);
1862                         }
1863                         if (value2 == 0) {
1864                                 fatal("%s line %d: no AuthenticationMethods "
1865                                     "specified", filename, linenum);
1866                         }
1867                 }
1868                 return 0;
1869
1870         case sStreamLocalBindMask:
1871                 arg = strdelim(&cp);
1872                 if (!arg || *arg == '\0')
1873                         fatal("%s line %d: missing StreamLocalBindMask "
1874                             "argument.", filename, linenum);
1875                 /* Parse mode in octal format */
1876                 value = strtol(arg, &p, 8);
1877                 if (arg == p || value < 0 || value > 0777)
1878                         fatal("%s line %d: Bad mask.", filename, linenum);
1879                 if (*activep)
1880                         options->fwd_opts.streamlocal_bind_mask = (mode_t)value;
1881                 break;
1882
1883         case sStreamLocalBindUnlink:
1884                 intptr = &options->fwd_opts.streamlocal_bind_unlink;
1885                 goto parse_flag;
1886
1887         case sFingerprintHash:
1888                 arg = strdelim(&cp);
1889                 if (!arg || *arg == '\0')
1890                         fatal("%.200s line %d: Missing argument.",
1891                             filename, linenum);
1892                 if ((value = ssh_digest_alg_by_name(arg)) == -1)
1893                         fatal("%.200s line %d: Invalid hash algorithm \"%s\".",
1894                             filename, linenum, arg);
1895                 if (*activep)
1896                         options->fingerprint_hash = value;
1897                 break;
1898
1899         case sExposeAuthInfo:
1900                 intptr = &options->expose_userauth_info;
1901                 goto parse_flag;
1902
1903         case sUseBlacklist:
1904                 intptr = &options->use_blacklist;
1905                 goto parse_flag;
1906
1907         case sDeprecated:
1908         case sIgnore:
1909         case sUnsupported:
1910                 do_log2(opcode == sIgnore ?
1911                     SYSLOG_LEVEL_DEBUG2 : SYSLOG_LEVEL_INFO,
1912                     "%s line %d: %s option %s", filename, linenum,
1913                     opcode == sUnsupported ? "Unsupported" : "Deprecated", arg);
1914                 while (arg)
1915                     arg = strdelim(&cp);
1916                 break;
1917
1918         default:
1919                 fatal("%s line %d: Missing handler for opcode %s (%d)",
1920                     filename, linenum, arg, opcode);
1921         }
1922         if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
1923                 fatal("%s line %d: garbage at end of line; \"%.200s\".",
1924                     filename, linenum, arg);
1925         return 0;
1926 }
1927
1928 /* Reads the server configuration file. */
1929
1930 void
1931 load_server_config(const char *filename, Buffer *conf)
1932 {
1933         char line[4096], *cp;
1934         FILE *f;
1935         int lineno = 0;
1936
1937         debug2("%s: filename %s", __func__, filename);
1938         if ((f = fopen(filename, "r")) == NULL) {
1939                 perror(filename);
1940                 exit(1);
1941         }
1942         buffer_clear(conf);
1943         while (fgets(line, sizeof(line), f)) {
1944                 lineno++;
1945                 if (strlen(line) == sizeof(line) - 1)
1946                         fatal("%s line %d too long", filename, lineno);
1947                 /*
1948                  * Trim out comments and strip whitespace
1949                  * NB - preserve newlines, they are needed to reproduce
1950                  * line numbers later for error messages
1951                  */
1952                 if ((cp = strchr(line, '#')) != NULL)
1953                         memcpy(cp, "\n", 2);
1954                 cp = line + strspn(line, " \t\r");
1955
1956                 buffer_append(conf, cp, strlen(cp));
1957         }
1958         buffer_append(conf, "\0", 1);
1959         fclose(f);
1960         debug2("%s: done config len = %d", __func__, buffer_len(conf));
1961 }
1962
1963 void
1964 parse_server_match_config(ServerOptions *options,
1965    struct connection_info *connectinfo)
1966 {
1967         ServerOptions mo;
1968
1969         initialize_server_options(&mo);
1970         parse_server_config(&mo, "reprocess config", &cfg, connectinfo);
1971         copy_set_server_options(options, &mo, 0);
1972 }
1973
1974 int parse_server_match_testspec(struct connection_info *ci, char *spec)
1975 {
1976         char *p;
1977
1978         while ((p = strsep(&spec, ",")) && *p != '\0') {
1979                 if (strncmp(p, "addr=", 5) == 0) {
1980                         ci->address = xstrdup(p + 5);
1981                 } else if (strncmp(p, "host=", 5) == 0) {
1982                         ci->host = xstrdup(p + 5);
1983                 } else if (strncmp(p, "user=", 5) == 0) {
1984                         ci->user = xstrdup(p + 5);
1985                 } else if (strncmp(p, "laddr=", 6) == 0) {
1986                         ci->laddress = xstrdup(p + 6);
1987                 } else if (strncmp(p, "lport=", 6) == 0) {
1988                         ci->lport = a2port(p + 6);
1989                         if (ci->lport == -1) {
1990                                 fprintf(stderr, "Invalid port '%s' in test mode"
1991                                    " specification %s\n", p+6, p);
1992                                 return -1;
1993                         }
1994                 } else {
1995                         fprintf(stderr, "Invalid test mode specification %s\n",
1996                            p);
1997                         return -1;
1998                 }
1999         }
2000         return 0;
2001 }
2002
2003 /*
2004  * returns 1 for a complete spec, 0 for partial spec and -1 for an
2005  * empty spec.
2006  */
2007 int server_match_spec_complete(struct connection_info *ci)
2008 {
2009         if (ci->user && ci->host && ci->address)
2010                 return 1;       /* complete */
2011         if (!ci->user && !ci->host && !ci->address)
2012                 return -1;      /* empty */
2013         return 0;       /* partial */
2014 }
2015
2016 /*
2017  * Copy any supported values that are set.
2018  *
2019  * If the preauth flag is set, we do not bother copying the string or
2020  * array values that are not used pre-authentication, because any that we
2021  * do use must be explictly sent in mm_getpwnamallow().
2022  */
2023 void
2024 copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
2025 {
2026 #define M_CP_INTOPT(n) do {\
2027         if (src->n != -1) \
2028                 dst->n = src->n; \
2029 } while (0)
2030
2031         M_CP_INTOPT(password_authentication);
2032         M_CP_INTOPT(gss_authentication);
2033         M_CP_INTOPT(pubkey_authentication);
2034         M_CP_INTOPT(kerberos_authentication);
2035         M_CP_INTOPT(hostbased_authentication);
2036         M_CP_INTOPT(hostbased_uses_name_from_packet_only);
2037         M_CP_INTOPT(kbd_interactive_authentication);
2038         M_CP_INTOPT(permit_root_login);
2039         M_CP_INTOPT(permit_empty_passwd);
2040
2041         M_CP_INTOPT(allow_tcp_forwarding);
2042         M_CP_INTOPT(allow_streamlocal_forwarding);
2043         M_CP_INTOPT(allow_agent_forwarding);
2044         M_CP_INTOPT(disable_forwarding);
2045         M_CP_INTOPT(expose_userauth_info);
2046         M_CP_INTOPT(permit_tun);
2047         M_CP_INTOPT(fwd_opts.gateway_ports);
2048         M_CP_INTOPT(fwd_opts.streamlocal_bind_unlink);
2049         M_CP_INTOPT(x11_display_offset);
2050         M_CP_INTOPT(x11_forwarding);
2051         M_CP_INTOPT(x11_use_localhost);
2052         M_CP_INTOPT(permit_tty);
2053         M_CP_INTOPT(permit_user_rc);
2054         M_CP_INTOPT(max_sessions);
2055         M_CP_INTOPT(max_authtries);
2056         M_CP_INTOPT(client_alive_count_max);
2057         M_CP_INTOPT(client_alive_interval);
2058         M_CP_INTOPT(ip_qos_interactive);
2059         M_CP_INTOPT(ip_qos_bulk);
2060         M_CP_INTOPT(rekey_limit);
2061         M_CP_INTOPT(rekey_interval);
2062         M_CP_INTOPT(log_level);
2063
2064         /*
2065          * The bind_mask is a mode_t that may be unsigned, so we can't use
2066          * M_CP_INTOPT - it does a signed comparison that causes compiler
2067          * warnings.
2068          */
2069         if (src->fwd_opts.streamlocal_bind_mask != (mode_t)-1) {
2070                 dst->fwd_opts.streamlocal_bind_mask =
2071                     src->fwd_opts.streamlocal_bind_mask;
2072         }
2073
2074         /* M_CP_STROPT and M_CP_STRARRAYOPT should not appear before here */
2075 #define M_CP_STROPT(n) do {\
2076         if (src->n != NULL && dst->n != src->n) { \
2077                 free(dst->n); \
2078                 dst->n = src->n; \
2079         } \
2080 } while(0)
2081 #define M_CP_STRARRAYOPT(n, num_n) do {\
2082         if (src->num_n != 0) { \
2083                 for (dst->num_n = 0; dst->num_n < src->num_n; dst->num_n++) \
2084                         dst->n[dst->num_n] = xstrdup(src->n[dst->num_n]); \
2085         } \
2086 } while(0)
2087 #define M_CP_STRARRAYOPT_ALLOC(n, num_n) do { \
2088         if (src->num_n != 0) { \
2089                 dst->n = xcalloc(src->num_n, sizeof(*dst->n)); \
2090                 M_CP_STRARRAYOPT(n, num_n); \
2091                 dst->num_n = src->num_n; \
2092         } \
2093 } while(0)
2094
2095         /* See comment in servconf.h */
2096         COPY_MATCH_STRING_OPTS();
2097
2098         /* Arguments that accept '+...' need to be expanded */
2099         assemble_algorithms(dst);
2100
2101         /*
2102          * The only things that should be below this point are string options
2103          * which are only used after authentication.
2104          */
2105         if (preauth)
2106                 return;
2107
2108         /* These options may be "none" to clear a global setting */
2109         M_CP_STROPT(adm_forced_command);
2110         if (option_clear_or_none(dst->adm_forced_command)) {
2111                 free(dst->adm_forced_command);
2112                 dst->adm_forced_command = NULL;
2113         }
2114         M_CP_STROPT(chroot_directory);
2115         if (option_clear_or_none(dst->chroot_directory)) {
2116                 free(dst->chroot_directory);
2117                 dst->chroot_directory = NULL;
2118         }
2119 }
2120
2121 #undef M_CP_INTOPT
2122 #undef M_CP_STROPT
2123 #undef M_CP_STRARRAYOPT
2124 #undef M_CP_STRARRAYOPT_ALLOC
2125
2126 void
2127 parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
2128     struct connection_info *connectinfo)
2129 {
2130         int active, linenum, bad_options = 0;
2131         char *cp, *obuf, *cbuf;
2132
2133         debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
2134
2135         if ((obuf = cbuf = sshbuf_dup_string(conf)) == NULL)
2136                 fatal("%s: sshbuf_dup_string failed", __func__);
2137         active = connectinfo ? 0 : 1;
2138         linenum = 1;
2139         while ((cp = strsep(&cbuf, "\n")) != NULL) {
2140                 if (process_server_config_line(options, cp, filename,
2141                     linenum++, &active, connectinfo) != 0)
2142                         bad_options++;
2143         }
2144         free(obuf);
2145         if (bad_options > 0)
2146                 fatal("%s: terminating, %d bad configuration options",
2147                     filename, bad_options);
2148         process_queued_listen_addrs(options);
2149 }
2150
2151 static const char *
2152 fmt_multistate_int(int val, const struct multistate *m)
2153 {
2154         u_int i;
2155
2156         for (i = 0; m[i].key != NULL; i++) {
2157                 if (m[i].value == val)
2158                         return m[i].key;
2159         }
2160         return "UNKNOWN";
2161 }
2162
2163 static const char *
2164 fmt_intarg(ServerOpCodes code, int val)
2165 {
2166         if (val == -1)
2167                 return "unset";
2168         switch (code) {
2169         case sAddressFamily:
2170                 return fmt_multistate_int(val, multistate_addressfamily);
2171         case sPermitRootLogin:
2172                 return fmt_multistate_int(val, multistate_permitrootlogin);
2173         case sGatewayPorts:
2174                 return fmt_multistate_int(val, multistate_gatewayports);
2175         case sCompression:
2176                 return fmt_multistate_int(val, multistate_compression);
2177         case sAllowTcpForwarding:
2178                 return fmt_multistate_int(val, multistate_tcpfwd);
2179         case sAllowStreamLocalForwarding:
2180                 return fmt_multistate_int(val, multistate_tcpfwd);
2181         case sFingerprintHash:
2182                 return ssh_digest_alg_name(val);
2183         default:
2184                 switch (val) {
2185                 case 0:
2186                         return "no";
2187                 case 1:
2188                         return "yes";
2189                 default:
2190                         return "UNKNOWN";
2191                 }
2192         }
2193 }
2194
2195 static const char *
2196 lookup_opcode_name(ServerOpCodes code)
2197 {
2198         u_int i;
2199
2200         for (i = 0; keywords[i].name != NULL; i++)
2201                 if (keywords[i].opcode == code)
2202                         return(keywords[i].name);
2203         return "UNKNOWN";
2204 }
2205
2206 static void
2207 dump_cfg_int(ServerOpCodes code, int val)
2208 {
2209         printf("%s %d\n", lookup_opcode_name(code), val);
2210 }
2211
2212 static void
2213 dump_cfg_oct(ServerOpCodes code, int val)
2214 {
2215         printf("%s 0%o\n", lookup_opcode_name(code), val);
2216 }
2217
2218 static void
2219 dump_cfg_fmtint(ServerOpCodes code, int val)
2220 {
2221         printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
2222 }
2223
2224 static void
2225 dump_cfg_string(ServerOpCodes code, const char *val)
2226 {
2227         printf("%s %s\n", lookup_opcode_name(code),
2228             val == NULL ? "none" : val);
2229 }
2230
2231 static void
2232 dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals)
2233 {
2234         u_int i;
2235
2236         for (i = 0; i < count; i++)
2237                 printf("%s %s\n", lookup_opcode_name(code), vals[i]);
2238 }
2239
2240 static void
2241 dump_cfg_strarray_oneline(ServerOpCodes code, u_int count, char **vals)
2242 {
2243         u_int i;
2244
2245         if (count <= 0 && code != sAuthenticationMethods)
2246                 return;
2247         printf("%s", lookup_opcode_name(code));
2248         for (i = 0; i < count; i++)
2249                 printf(" %s",  vals[i]);
2250         if (code == sAuthenticationMethods && count == 0)
2251                 printf(" any");
2252         printf("\n");
2253 }
2254
2255 void
2256 dump_config(ServerOptions *o)
2257 {
2258         u_int i;
2259         int ret;
2260         struct addrinfo *ai;
2261         char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL;
2262         char *laddr1 = xstrdup(""), *laddr2 = NULL;
2263
2264         /* these are usually at the top of the config */
2265         for (i = 0; i < o->num_ports; i++)
2266                 printf("port %d\n", o->ports[i]);
2267         dump_cfg_fmtint(sAddressFamily, o->address_family);
2268
2269         /*
2270          * ListenAddress must be after Port.  add_one_listen_addr pushes
2271          * addresses onto a stack, so to maintain ordering we need to
2272          * print these in reverse order.
2273          */
2274         for (ai = o->listen_addrs; ai; ai = ai->ai_next) {
2275                 if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr,
2276                     sizeof(addr), port, sizeof(port),
2277                     NI_NUMERICHOST|NI_NUMERICSERV)) != 0) {
2278                         error("getnameinfo failed: %.100s",
2279                             (ret != EAI_SYSTEM) ? gai_strerror(ret) :
2280                             strerror(errno));
2281                 } else {
2282                         laddr2 = laddr1;
2283                         if (ai->ai_family == AF_INET6)
2284                                 xasprintf(&laddr1, "listenaddress [%s]:%s\n%s",
2285                                     addr, port, laddr2);
2286                         else
2287                                 xasprintf(&laddr1, "listenaddress %s:%s\n%s",
2288                                     addr, port, laddr2);
2289                         free(laddr2);
2290                 }
2291         }
2292         printf("%s", laddr1);
2293         free(laddr1);
2294
2295         /* integer arguments */
2296 #ifdef USE_PAM
2297         dump_cfg_fmtint(sUsePAM, o->use_pam);
2298 #endif
2299         dump_cfg_int(sLoginGraceTime, o->login_grace_time);
2300         dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
2301         dump_cfg_int(sMaxAuthTries, o->max_authtries);
2302         dump_cfg_int(sMaxSessions, o->max_sessions);
2303         dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
2304         dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max);
2305         dump_cfg_oct(sStreamLocalBindMask, o->fwd_opts.streamlocal_bind_mask);
2306
2307         /* formatted integer arguments */
2308         dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login);
2309         dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts);
2310         dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts);
2311         dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication);
2312         dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly,
2313             o->hostbased_uses_name_from_packet_only);
2314         dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication);
2315 #ifdef KRB5
2316         dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication);
2317         dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd);
2318         dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup);
2319 # ifdef USE_AFS
2320         dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
2321 # endif
2322 #endif
2323 #ifdef GSSAPI
2324         dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
2325         dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
2326 #endif
2327         dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
2328         dump_cfg_fmtint(sKbdInteractiveAuthentication,
2329             o->kbd_interactive_authentication);
2330         dump_cfg_fmtint(sChallengeResponseAuthentication,
2331             o->challenge_response_authentication);
2332         dump_cfg_fmtint(sPrintMotd, o->print_motd);
2333 #ifndef DISABLE_LASTLOG
2334         dump_cfg_fmtint(sPrintLastLog, o->print_lastlog);
2335 #endif
2336         dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding);
2337         dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
2338         dump_cfg_fmtint(sPermitTTY, o->permit_tty);
2339         dump_cfg_fmtint(sPermitUserRC, o->permit_user_rc);
2340         dump_cfg_fmtint(sStrictModes, o->strict_modes);
2341         dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
2342         dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
2343         dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
2344         dump_cfg_fmtint(sCompression, o->compression);
2345         dump_cfg_fmtint(sGatewayPorts, o->fwd_opts.gateway_ports);
2346         dump_cfg_fmtint(sUseDNS, o->use_dns);
2347         dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
2348         dump_cfg_fmtint(sAllowAgentForwarding, o->allow_agent_forwarding);
2349         dump_cfg_fmtint(sDisableForwarding, o->disable_forwarding);
2350         dump_cfg_fmtint(sAllowStreamLocalForwarding, o->allow_streamlocal_forwarding);
2351         dump_cfg_fmtint(sStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink);
2352         dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);
2353         dump_cfg_fmtint(sExposeAuthInfo, o->expose_userauth_info);
2354         dump_cfg_fmtint(sUseBlacklist, o->use_blacklist);
2355
2356         /* string arguments */
2357         dump_cfg_string(sPidFile, o->pid_file);
2358         dump_cfg_string(sXAuthLocation, o->xauth_location);
2359         dump_cfg_string(sCiphers, o->ciphers ? o->ciphers : KEX_SERVER_ENCRYPT);
2360         dump_cfg_string(sMacs, o->macs ? o->macs : KEX_SERVER_MAC);
2361         dump_cfg_string(sBanner, o->banner);
2362         dump_cfg_string(sForceCommand, o->adm_forced_command);
2363         dump_cfg_string(sChrootDirectory, o->chroot_directory);
2364         dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
2365         dump_cfg_string(sRevokedKeys, o->revoked_keys_file);
2366         dump_cfg_string(sAuthorizedPrincipalsFile,
2367             o->authorized_principals_file);
2368         dump_cfg_string(sVersionAddendum, *o->version_addendum == '\0'
2369             ? "none" : o->version_addendum);
2370         dump_cfg_string(sAuthorizedKeysCommand, o->authorized_keys_command);
2371         dump_cfg_string(sAuthorizedKeysCommandUser, o->authorized_keys_command_user);
2372         dump_cfg_string(sAuthorizedPrincipalsCommand, o->authorized_principals_command);
2373         dump_cfg_string(sAuthorizedPrincipalsCommandUser, o->authorized_principals_command_user);
2374         dump_cfg_string(sHostKeyAgent, o->host_key_agent);
2375         dump_cfg_string(sKexAlgorithms,
2376             o->kex_algorithms ? o->kex_algorithms : KEX_SERVER_KEX);
2377         dump_cfg_string(sHostbasedAcceptedKeyTypes, o->hostbased_key_types ?
2378             o->hostbased_key_types : KEX_DEFAULT_PK_ALG);
2379         dump_cfg_string(sHostKeyAlgorithms, o->hostkeyalgorithms ?
2380             o->hostkeyalgorithms : KEX_DEFAULT_PK_ALG);
2381         dump_cfg_string(sPubkeyAcceptedKeyTypes, o->pubkey_key_types ?
2382             o->pubkey_key_types : KEX_DEFAULT_PK_ALG);
2383
2384         /* string arguments requiring a lookup */
2385         dump_cfg_string(sLogLevel, log_level_name(o->log_level));
2386         dump_cfg_string(sLogFacility, log_facility_name(o->log_facility));
2387
2388         /* string array arguments */
2389         dump_cfg_strarray_oneline(sAuthorizedKeysFile, o->num_authkeys_files,
2390             o->authorized_keys_files);
2391         dump_cfg_strarray(sHostKeyFile, o->num_host_key_files,
2392              o->host_key_files);
2393         dump_cfg_strarray(sHostCertificate, o->num_host_cert_files,
2394              o->host_cert_files);
2395         dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users);
2396         dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users);
2397         dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups);
2398         dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups);
2399         dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env);
2400         dump_cfg_strarray_oneline(sAuthenticationMethods,
2401             o->num_auth_methods, o->auth_methods);
2402
2403         /* other arguments */
2404         for (i = 0; i < o->num_subsystems; i++)
2405                 printf("subsystem %s %s\n", o->subsystem_name[i],
2406                     o->subsystem_args[i]);
2407
2408         printf("maxstartups %d:%d:%d\n", o->max_startups_begin,
2409             o->max_startups_rate, o->max_startups);
2410
2411         for (i = 0; tunmode_desc[i].val != -1; i++)
2412                 if (tunmode_desc[i].val == o->permit_tun) {
2413                         s = tunmode_desc[i].text;
2414                         break;
2415                 }
2416         dump_cfg_string(sPermitTunnel, s);
2417
2418         printf("ipqos %s ", iptos2str(o->ip_qos_interactive));
2419         printf("%s\n", iptos2str(o->ip_qos_bulk));
2420
2421         printf("rekeylimit %llu %d\n", (unsigned long long)o->rekey_limit,
2422             o->rekey_interval);
2423
2424         printf("permitopen");
2425         if (o->num_permitted_opens == 0)
2426                 printf(" any");
2427         else {
2428                 for (i = 0; i < o->num_permitted_opens; i++)
2429                         printf(" %s", o->permitted_opens[i]);
2430         }
2431         printf("\n");
2432 }