crypto/openssh/servconf.c

   1
   2 /* $OpenBSD: servconf.c,v 1.249 2014/01/29 06:18:35 djm Exp $ */
   3 /* $FreeBSD$ */
   4 /*
   5  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   6  *                    All rights reserved
   7  *
   8  * As far as I am concerned, the code I have written for this software
   9  * can be used freely for any purpose.  Any derived versions of this
  10  * software must be clearly marked as such, and if the derived work is
  11  * incompatible with the protocol description in the RFC file, it must be
  12  * called by a name other than "ssh" or "Secure Shell".
  13  */
  14
  15 #include "includes.h"
  16 __RCSID("$FreeBSD$");
  17
  18 #include <sys/types.h>
  19 #include <sys/socket.h>
  20
  21 #include <netinet/in.h>
  22 #include <netinet/in_systm.h>
  23 #include <netinet/ip.h>
  24
  25 #include <ctype.h>
  26 #include <netdb.h>
  27 #include <pwd.h>
  28 #include <stdio.h>
  29 #include <stdlib.h>
  30 #include <string.h>
  31 #include <signal.h>
  32 #include <unistd.h>
  33 #include <stdarg.h>
  34 #include <errno.h>
  35 #ifdef HAVE_UTIL_H
  36 #include <util.h>
  37 #endif
  38
  39 #include "openbsd-compat/sys-queue.h"
  40 #include "xmalloc.h"
  41 #include "ssh.h"
  42 #include "log.h"
  43 #include "buffer.h"
  44 #include "servconf.h"
  45 #include "compat.h"
  46 #include "pathnames.h"
  47 #include "misc.h"
  48 #include "cipher.h"
  49 #include "key.h"
  50 #include "kex.h"
  51 #include "mac.h"
  52 #include "match.h"
  53 #include "channels.h"
  54 #include "groupaccess.h"
  55 #include "canohost.h"
  56 #include "packet.h"
  57 #include "hostfile.h"
  58 #include "auth.h"
  59 #include "version.h"
  60
  61 static void add_listen_addr(ServerOptions *, char *, int);
  62 static void add_one_listen_addr(ServerOptions *, char *, int);
  63
  64 /* Use of privilege separation or not */
  65 extern int use_privsep;
  66 extern Buffer cfg;
  67
  68 /* Initializes the server options to their default values. */
  69
  70 void
  71 initialize_server_options(ServerOptions *options)
  72 {
  73         memset(options, 0, sizeof(*options));
  74
  75         /* Portable-specific options */
  76         options->use_pam = -1;
  77
  78         /* Standard Options */
  79         options->num_ports = 0;
  80         options->ports_from_cmdline = 0;
  81         options->listen_addrs = NULL;
  82         options->address_family = -1;
  83         options->num_host_key_files = 0;
  84         options->num_host_cert_files = 0;
  85         options->host_key_agent = NULL;
  86         options->pid_file = NULL;
  87         options->server_key_bits = -1;
  88         options->login_grace_time = -1;
  89         options->key_regeneration_time = -1;
  90         options->permit_root_login = PERMIT_NOT_SET;
  91         options->ignore_rhosts = -1;
  92         options->ignore_user_known_hosts = -1;
  93         options->print_motd = -1;
  94         options->print_lastlog = -1;
  95         options->x11_forwarding = -1;
  96         options->x11_display_offset = -1;
  97         options->x11_use_localhost = -1;
  98         options->permit_tty = -1;
  99         options->xauth_location = NULL;
 100         options->strict_modes = -1;
 101         options->tcp_keep_alive = -1;
 102         options->log_facility = SYSLOG_FACILITY_NOT_SET;
 103         options->log_level = SYSLOG_LEVEL_NOT_SET;
 104         options->rhosts_rsa_authentication = -1;
 105         options->hostbased_authentication = -1;
 106         options->hostbased_uses_name_from_packet_only = -1;
 107         options->rsa_authentication = -1;
 108         options->pubkey_authentication = -1;
 109         options->kerberos_authentication = -1;
 110         options->kerberos_or_local_passwd = -1;
 111         options->kerberos_ticket_cleanup = -1;
 112         options->kerberos_get_afs_token = -1;
 113         options->gss_authentication=-1;
 114         options->gss_cleanup_creds = -1;
 115         options->password_authentication = -1;
 116         options->kbd_interactive_authentication = -1;
 117         options->challenge_response_authentication = -1;
 118         options->permit_empty_passwd = -1;
 119         options->permit_user_env = -1;
 120         options->use_login = -1;
 121         options->compression = -1;
 122         options->rekey_limit = -1;
 123         options->rekey_interval = -1;
 124         options->allow_tcp_forwarding = -1;
 125         options->allow_agent_forwarding = -1;
 126         options->num_allow_users = 0;
 127         options->num_deny_users = 0;
 128         options->num_allow_groups = 0;
 129         options->num_deny_groups = 0;
 130         options->ciphers = NULL;
 131         options->macs = NULL;
 132         options->kex_algorithms = NULL;
 133         options->protocol = SSH_PROTO_UNKNOWN;
 134         options->gateway_ports = -1;
 135         options->num_subsystems = 0;
 136         options->max_startups_begin = -1;
 137         options->max_startups_rate = -1;
 138         options->max_startups = -1;
 139         options->max_authtries = -1;
 140         options->max_sessions = -1;
 141         options->banner = NULL;
 142         options->use_dns = -1;
 143         options->client_alive_interval = -1;
 144         options->client_alive_count_max = -1;
 145         options->num_authkeys_files = 0;
 146         options->num_accept_env = 0;
 147         options->permit_tun = -1;
 148         options->num_permitted_opens = -1;
 149         options->adm_forced_command = NULL;
 150         options->chroot_directory = NULL;
 151         options->authorized_keys_command = NULL;
 152         options->authorized_keys_command_user = NULL;
 153         options->revoked_keys_file = NULL;
 154         options->trusted_user_ca_keys = NULL;
 155         options->authorized_principals_file = NULL;
 156         options->ip_qos_interactive = -1;
 157         options->ip_qos_bulk = -1;
 158         options->version_addendum = NULL;
 159         options->hpn_disabled = -1;
 160         options->hpn_buffer_size = -1;
 161         options->tcp_rcv_buf_poll = -1;
 162 #ifdef  NONE_CIPHER_ENABLED
 163         options->none_enabled = -1;
 164 #endif
 165 }
 166
 167 void
 168 fill_default_server_options(ServerOptions *options)
 169 {
 170         /* Portable-specific options */
 171         if (options->use_pam == -1)
 172                 options->use_pam = 1;
 173
 174         /* Standard Options */
 175         if (options->protocol == SSH_PROTO_UNKNOWN)
 176                 options->protocol = SSH_PROTO_2;
 177         if (options->num_host_key_files == 0) {
 178                 /* fill default hostkeys for protocols */
 179                 if (options->protocol & SSH_PROTO_1)
 180                         options->host_key_files[options->num_host_key_files++] =
 181                             _PATH_HOST_KEY_FILE;
 182                 if (options->protocol & SSH_PROTO_2) {
 183                         options->host_key_files[options->num_host_key_files++] =
 184                             _PATH_HOST_RSA_KEY_FILE;
 185                         options->host_key_files[options->num_host_key_files++] =
 186                             _PATH_HOST_DSA_KEY_FILE;
 187 #ifdef OPENSSL_HAS_ECC
 188                         options->host_key_files[options->num_host_key_files++] =
 189                             _PATH_HOST_ECDSA_KEY_FILE;
 190 #endif
 191                         options->host_key_files[options->num_host_key_files++] =
 192                             _PATH_HOST_ED25519_KEY_FILE;
 193                 }
 194         }
 195         /* No certificates by default */
 196         if (options->num_ports == 0)
 197                 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
 198         if (options->listen_addrs == NULL)
 199                 add_listen_addr(options, NULL, 0);
 200         if (options->pid_file == NULL)
 201                 options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
 202         if (options->server_key_bits == -1)
 203                 options->server_key_bits = 1024;
 204         if (options->login_grace_time == -1)
 205                 options->login_grace_time = 120;
 206         if (options->key_regeneration_time == -1)
 207                 options->key_regeneration_time = 3600;
 208         if (options->permit_root_login == PERMIT_NOT_SET)
 209                 options->permit_root_login = PERMIT_NO;
 210         if (options->ignore_rhosts == -1)
 211                 options->ignore_rhosts = 1;
 212         if (options->ignore_user_known_hosts == -1)
 213                 options->ignore_user_known_hosts = 0;
 214         if (options->print_motd == -1)
 215                 options->print_motd = 1;
 216         if (options->print_lastlog == -1)
 217                 options->print_lastlog = 1;
 218         if (options->x11_forwarding == -1)
 219                 options->x11_forwarding = 1;
 220         if (options->x11_display_offset == -1)
 221                 options->x11_display_offset = 10;
 222         if (options->x11_use_localhost == -1)
 223                 options->x11_use_localhost = 1;
 224         if (options->xauth_location == NULL)
 225                 options->xauth_location = _PATH_XAUTH;
 226         if (options->permit_tty == -1)
 227                 options->permit_tty = 1;
 228         if (options->strict_modes == -1)
 229                 options->strict_modes = 1;
 230         if (options->tcp_keep_alive == -1)
 231                 options->tcp_keep_alive = 1;
 232         if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
 233                 options->log_facility = SYSLOG_FACILITY_AUTH;
 234         if (options->log_level == SYSLOG_LEVEL_NOT_SET)
 235                 options->log_level = SYSLOG_LEVEL_INFO;
 236         if (options->rhosts_rsa_authentication == -1)
 237                 options->rhosts_rsa_authentication = 0;
 238         if (options->hostbased_authentication == -1)
 239                 options->hostbased_authentication = 0;
 240         if (options->hostbased_uses_name_from_packet_only == -1)
 241                 options->hostbased_uses_name_from_packet_only = 0;
 242         if (options->rsa_authentication == -1)
 243                 options->rsa_authentication = 1;
 244         if (options->pubkey_authentication == -1)
 245                 options->pubkey_authentication = 1;
 246         if (options->kerberos_authentication == -1)
 247                 options->kerberos_authentication = 0;
 248         if (options->kerberos_or_local_passwd == -1)
 249                 options->kerberos_or_local_passwd = 1;
 250         if (options->kerberos_ticket_cleanup == -1)
 251                 options->kerberos_ticket_cleanup = 1;
 252         if (options->kerberos_get_afs_token == -1)
 253                 options->kerberos_get_afs_token = 0;
 254         if (options->gss_authentication == -1)
 255                 options->gss_authentication = 0;
 256         if (options->gss_cleanup_creds == -1)
 257                 options->gss_cleanup_creds = 1;
 258         if (options->password_authentication == -1)
 259                 options->password_authentication = 0;
 260         if (options->kbd_interactive_authentication == -1)
 261                 options->kbd_interactive_authentication = 0;
 262         if (options->challenge_response_authentication == -1)
 263                 options->challenge_response_authentication = 1;
 264         if (options->permit_empty_passwd == -1)
 265                 options->permit_empty_passwd = 0;
 266         if (options->permit_user_env == -1)
 267                 options->permit_user_env = 0;
 268         if (options->use_login == -1)
 269                 options->use_login = 0;
 270         if (options->compression == -1)
 271                 options->compression = COMP_DELAYED;
 272         if (options->rekey_limit == -1)
 273                 options->rekey_limit = 0;
 274         if (options->rekey_interval == -1)
 275                 options->rekey_interval = 0;
 276         if (options->allow_tcp_forwarding == -1)
 277                 options->allow_tcp_forwarding = FORWARD_ALLOW;
 278         if (options->allow_agent_forwarding == -1)
 279                 options->allow_agent_forwarding = 1;
 280         if (options->gateway_ports == -1)
 281                 options->gateway_ports = 0;
 282         if (options->max_startups == -1)
 283                 options->max_startups = 100;
 284         if (options->max_startups_rate == -1)
 285                 options->max_startups_rate = 30;                /* 30% */
 286         if (options->max_startups_begin == -1)
 287                 options->max_startups_begin = 10;
 288         if (options->max_authtries == -1)
 289                 options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
 290         if (options->max_sessions == -1)
 291                 options->max_sessions = DEFAULT_SESSIONS_MAX;
 292         if (options->use_dns == -1)
 293                 options->use_dns = 1;
 294         if (options->client_alive_interval == -1)
 295                 options->client_alive_interval = 0;
 296         if (options->client_alive_count_max == -1)
 297                 options->client_alive_count_max = 3;
 298         if (options->num_authkeys_files == 0) {
 299                 options->authorized_keys_files[options->num_authkeys_files++] =
 300                     xstrdup(_PATH_SSH_USER_PERMITTED_KEYS);
 301                 options->authorized_keys_files[options->num_authkeys_files++] =
 302                     xstrdup(_PATH_SSH_USER_PERMITTED_KEYS2);
 303         }
 304         if (options->permit_tun == -1)
 305                 options->permit_tun = SSH_TUNMODE_NO;
 306         if (options->ip_qos_interactive == -1)
 307                 options->ip_qos_interactive = IPTOS_LOWDELAY;
 308         if (options->ip_qos_bulk == -1)
 309                 options->ip_qos_bulk = IPTOS_THROUGHPUT;
 310         if (options->version_addendum == NULL)
 311                 options->version_addendum = xstrdup(SSH_VERSION_FREEBSD);
 312         /* Turn privilege separation on by default */
 313         if (use_privsep == -1)
 314                 use_privsep = PRIVSEP_ON;
 315
 316 #ifndef HAVE_MMAP
 317         if (use_privsep && options->compression == 1) {
 318                 error("This platform does not support both privilege "
 319                     "separation and compression");
 320                 error("Compression disabled");
 321                 options->compression = 0;
 322         }
 323 #endif
 324
 325         if (options->hpn_disabled == -1)
 326                 options->hpn_disabled = 0;
 327         if (options->hpn_buffer_size == -1) {
 328                 /*
 329                  * HPN buffer size option not explicitly set.  Try to figure
 330                  * out what value to use or resort to default.
 331                  */
 332                 options->hpn_buffer_size = CHAN_SES_WINDOW_DEFAULT;
 333                 if (!options->hpn_disabled) {
 334                         sock_get_rcvbuf(&options->hpn_buffer_size, 0);
 335                         debug ("HPN Buffer Size: %d", options->hpn_buffer_size);
 336                 }
 337         } else {
 338                 /*
 339                  * In the case that the user sets both values in a
 340                  * contradictory manner hpn_disabled overrrides hpn_buffer_size.
 341                  */
 342                 if (options->hpn_disabled <= 0) {
 343                         u_int maxlen;
 344
 345                         maxlen = buffer_get_max_len();
 346                         if (options->hpn_buffer_size == 0)
 347                                 options->hpn_buffer_size = 1;
 348                         /* Limit the maximum buffer to BUFFER_MAX_LEN. */
 349                         if (options->hpn_buffer_size > maxlen / 1024)
 350                                 options->hpn_buffer_size = maxlen;
 351                         else
 352                                 options->hpn_buffer_size *= 1024;
 353                 } else {
 354                         options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT;
 355                 }
 356         }
 357 }
 358
 359 /* Keyword tokens. */
 360 typedef enum {
 361         sBadOption,             /* == unknown option */
 362         /* Portable-specific options */
 363         sUsePAM,
 364         /* Standard Options */
 365         sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
 366         sPermitRootLogin, sLogFacility, sLogLevel,
 367         sRhostsRSAAuthentication, sRSAAuthentication,
 368         sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
 369         sKerberosGetAFSToken,
 370         sKerberosTgtPassing, sChallengeResponseAuthentication,
 371         sPasswordAuthentication, sKbdInteractiveAuthentication,
 372         sListenAddress, sAddressFamily,
 373         sPrintMotd, sPrintLastLog, sIgnoreRhosts,
 374         sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
 375         sPermitTTY, sStrictModes, sEmptyPasswd, sTCPKeepAlive,
 376         sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
 377         sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
 378         sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
 379         sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
 380         sMaxStartups, sMaxAuthTries, sMaxSessions,
 381         sBanner, sUseDNS, sHostbasedAuthentication,
 382         sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
 383         sClientAliveCountMax, sAuthorizedKeysFile,
 384         sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
 385         sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
 386         sUsePrivilegeSeparation, sAllowAgentForwarding,
 387         sHostCertificate,
 388         sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
 389         sKexAlgorithms, sIPQoS, sVersionAddendum,
 390         sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
 391         sAuthenticationMethods, sHostKeyAgent,
 392         sHPNDisabled, sHPNBufferSize, sTcpRcvBufPoll,
 393 #ifdef NONE_CIPHER_ENABLED
 394         sNoneEnabled,
 395 #endif
 396         sDeprecated, sUnsupported
 397 } ServerOpCodes;
 398
 399 #define SSHCFG_GLOBAL   0x01    /* allowed in main section of sshd_config */
 400 #define SSHCFG_MATCH    0x02    /* allowed inside a Match section */
 401 #define SSHCFG_ALL      (SSHCFG_GLOBAL|SSHCFG_MATCH)
 402
 403 /* Textual representation of the tokens. */
 404 static struct {
 405         const char *name;
 406         ServerOpCodes opcode;
 407         u_int flags;
 408 } keywords[] = {
 409         /* Portable-specific options */
 410 #ifdef USE_PAM
 411         { "usepam", sUsePAM, SSHCFG_GLOBAL },
 412 #else
 413         { "usepam", sUnsupported, SSHCFG_GLOBAL },
 414 #endif
 415         { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
 416         /* Standard Options */
 417         { "port", sPort, SSHCFG_GLOBAL },
 418         { "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
 419         { "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL },          /* alias */
 420         { "hostkeyagent", sHostKeyAgent, SSHCFG_GLOBAL },
 421         { "pidfile", sPidFile, SSHCFG_GLOBAL },
 422         { "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL },
 423         { "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
 424         { "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL },
 425         { "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
 426         { "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
 427         { "loglevel", sLogLevel, SSHCFG_GLOBAL },
 428         { "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL },
 429         { "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
 430         { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
 431         { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_ALL },
 432         { "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
 433         { "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
 434         { "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
 435 #ifdef KRB5
 436         { "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
 437         { "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
 438         { "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
 439 #ifdef USE_AFS
 440         { "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL },
 441 #else
 442         { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
 443 #endif
 444 #else
 445         { "kerberosauthentication", sUnsupported, SSHCFG_ALL },
 446         { "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
 447         { "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
 448         { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
 449 #endif
 450         { "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
 451         { "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
 452 #ifdef GSSAPI
 453         { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
 454         { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
 455 #else
 456         { "gssapiauthentication", sUnsupported, SSHCFG_ALL },
 457         { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
 458 #endif
 459         { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
 460         { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
 461         { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
 462         { "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
 463         { "checkmail", sDeprecated, SSHCFG_GLOBAL },
 464         { "listenaddress", sListenAddress, SSHCFG_GLOBAL },
 465         { "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
 466         { "printmotd", sPrintMotd, SSHCFG_GLOBAL },
 467         { "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
 468         { "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
 469         { "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
 470         { "x11forwarding", sX11Forwarding, SSHCFG_ALL },
 471         { "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
 472         { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
 473         { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
 474         { "strictmodes", sStrictModes, SSHCFG_GLOBAL },
 475         { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
 476         { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
 477         { "uselogin", sUseLogin, SSHCFG_GLOBAL },
 478         { "compression", sCompression, SSHCFG_GLOBAL },
 479         { "rekeylimit", sRekeyLimit, SSHCFG_ALL },
 480         { "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL },
 481         { "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL },  /* obsolete alias */
 482         { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
 483         { "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL },
 484         { "allowusers", sAllowUsers, SSHCFG_ALL },
 485         { "denyusers", sDenyUsers, SSHCFG_ALL },
 486         { "allowgroups", sAllowGroups, SSHCFG_ALL },
 487         { "denygroups", sDenyGroups, SSHCFG_ALL },
 488         { "ciphers", sCiphers, SSHCFG_GLOBAL },
 489         { "macs", sMacs, SSHCFG_GLOBAL },
 490         { "protocol", sProtocol, SSHCFG_GLOBAL },
 491         { "gatewayports", sGatewayPorts, SSHCFG_ALL },
 492         { "subsystem", sSubsystem, SSHCFG_GLOBAL },
 493         { "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
 494         { "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
 495         { "maxsessions", sMaxSessions, SSHCFG_ALL },
 496         { "banner", sBanner, SSHCFG_ALL },
 497         { "usedns", sUseDNS, SSHCFG_GLOBAL },
 498         { "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
 499         { "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
 500         { "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL },
 501         { "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
 502         { "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_ALL },
 503         { "authorizedkeysfile2", sDeprecated, SSHCFG_ALL },
 504         { "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL},
 505         { "acceptenv", sAcceptEnv, SSHCFG_ALL },
 506         { "permittunnel", sPermitTunnel, SSHCFG_ALL },
 507         { "permittty", sPermitTTY, SSHCFG_ALL },
 508         { "match", sMatch, SSHCFG_ALL },
 509         { "permitopen", sPermitOpen, SSHCFG_ALL },
 510         { "forcecommand", sForceCommand, SSHCFG_ALL },
 511         { "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
 512         { "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
 513         { "revokedkeys", sRevokedKeys, SSHCFG_ALL },
 514         { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
 515         { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
 516         { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
 517         { "ipqos", sIPQoS, SSHCFG_ALL },
 518         { "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL },
 519         { "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL },
 520         { "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL },
 521         { "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL },
 522         { "hpndisabled", sHPNDisabled, SSHCFG_ALL },
 523         { "hpnbuffersize", sHPNBufferSize, SSHCFG_ALL },
 524         { "tcprcvbufpoll", sTcpRcvBufPoll, SSHCFG_ALL },
 525 #ifdef NONE_CIPHER_ENABLED
 526         { "noneenabled", sNoneEnabled, SSHCFG_ALL },
 527 #endif
 528         { NULL, sBadOption, 0 }
 529 };
 530
 531 static struct {
 532         int val;
 533         char *text;
 534 } tunmode_desc[] = {
 535         { SSH_TUNMODE_NO, "no" },
 536         { SSH_TUNMODE_POINTOPOINT, "point-to-point" },
 537         { SSH_TUNMODE_ETHERNET, "ethernet" },
 538         { SSH_TUNMODE_YES, "yes" },
 539         { -1, NULL }
 540 };
 541
 542 /*
 543  * Returns the number of the token pointed to by cp or sBadOption.
 544  */
 545
 546 static ServerOpCodes
 547 parse_token(const char *cp, const char *filename,
 548             int linenum, u_int *flags)
 549 {
 550         u_int i;
 551
 552         for (i = 0; keywords[i].name; i++)
 553                 if (strcasecmp(cp, keywords[i].name) == 0) {
 554                         *flags = keywords[i].flags;
 555                         return keywords[i].opcode;
 556                 }
 557
 558         error("%s: line %d: Bad configuration option: %s",
 559             filename, linenum, cp);
 560         return sBadOption;
 561 }
 562
 563 char *
 564 derelativise_path(const char *path)
 565 {
 566         char *expanded, *ret, cwd[MAXPATHLEN];
 567
 568         expanded = tilde_expand_filename(path, getuid());
 569         if (*expanded == '/')
 570                 return expanded;
 571         if (getcwd(cwd, sizeof(cwd)) == NULL)
 572                 fatal("%s: getcwd: %s", __func__, strerror(errno));
 573         xasprintf(&ret, "%s/%s", cwd, expanded);
 574         free(expanded);
 575         return ret;
 576 }
 577
 578 static void
 579 add_listen_addr(ServerOptions *options, char *addr, int port)
 580 {
 581         u_int i;
 582
 583         if (options->num_ports == 0)
 584                 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
 585         if (options->address_family == -1)
 586                 options->address_family = AF_UNSPEC;
 587         if (port == 0)
 588                 for (i = 0; i < options->num_ports; i++)
 589                         add_one_listen_addr(options, addr, options->ports[i]);
 590         else
 591                 add_one_listen_addr(options, addr, port);
 592 }
 593
 594 static void
 595 add_one_listen_addr(ServerOptions *options, char *addr, int port)
 596 {
 597         struct addrinfo hints, *ai, *aitop;
 598         char strport[NI_MAXSERV];
 599         int gaierr;
 600
 601         memset(&hints, 0, sizeof(hints));
 602         hints.ai_family = options->address_family;
 603         hints.ai_socktype = SOCK_STREAM;
 604         hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
 605         snprintf(strport, sizeof strport, "%d", port);
 606         if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
 607                 fatal("bad addr or host: %s (%s)",
 608                     addr ? addr : "<NULL>",
 609                     ssh_gai_strerror(gaierr));
 610         for (ai = aitop; ai->ai_next; ai = ai->ai_next)
 611                 ;
 612         ai->ai_next = options->listen_addrs;
 613         options->listen_addrs = aitop;
 614 }
 615
 616 struct connection_info *
 617 get_connection_info(int populate, int use_dns)
 618 {
 619         static struct connection_info ci;
 620
 621         if (!populate)
 622                 return &ci;
 623         ci.host = get_canonical_hostname(use_dns);
 624         ci.address = get_remote_ipaddr();
 625         ci.laddress = get_local_ipaddr(packet_get_connection_in());
 626         ci.lport = get_local_port();
 627         return &ci;
 628 }
 629
 630 /*
 631  * The strategy for the Match blocks is that the config file is parsed twice.
 632  *
 633  * The first time is at startup.  activep is initialized to 1 and the
 634  * directives in the global context are processed and acted on.  Hitting a
 635  * Match directive unsets activep and the directives inside the block are
 636  * checked for syntax only.
 637  *
 638  * The second time is after a connection has been established but before
 639  * authentication.  activep is initialized to 2 and global config directives
 640  * are ignored since they have already been processed.  If the criteria in a
 641  * Match block is met, activep is set and the subsequent directives
 642  * processed and actioned until EOF or another Match block unsets it.  Any
 643  * options set are copied into the main server config.
 644  *
 645  * Potential additions/improvements:
 646  *  - Add Match support for pre-kex directives, eg Protocol, Ciphers.
 647  *
 648  *  - Add a Tag directive (idea from David Leonard) ala pf, eg:
 649  *      Match Address 192.168.0.*
 650  *              Tag trusted
 651  *      Match Group wheel
 652  *              Tag trusted
 653  *      Match Tag trusted
 654  *              AllowTcpForwarding yes
 655  *              GatewayPorts clientspecified
 656  *              [...]
 657  *
 658  *  - Add a PermittedChannelRequests directive
 659  *      Match Group shell
 660  *              PermittedChannelRequests session,forwarded-tcpip
 661  */
 662
 663 static int
 664 match_cfg_line_group(const char *grps, int line, const char *user)
 665 {
 666         int result = 0;
 667         struct passwd *pw;
 668
 669         if (user == NULL)
 670                 goto out;
 671
 672         if ((pw = getpwnam(user)) == NULL) {
 673                 debug("Can't match group at line %d because user %.100s does "
 674                     "not exist", line, user);
 675         } else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
 676                 debug("Can't Match group because user %.100s not in any group "
 677                     "at line %d", user, line);
 678         } else if (ga_match_pattern_list(grps) != 1) {
 679                 debug("user %.100s does not match group list %.100s at line %d",
 680                     user, grps, line);
 681         } else {
 682                 debug("user %.100s matched group list %.100s at line %d", user,
 683                     grps, line);
 684                 result = 1;
 685         }
 686 out:
 687         ga_free();
 688         return result;
 689 }
 690
 691 /*
 692  * All of the attributes on a single Match line are ANDed together, so we need
 693  * to check every attribute and set the result to zero if any attribute does
 694  * not match.
 695  */
 696 static int
 697 match_cfg_line(char **condition, int line, struct connection_info *ci)
 698 {
 699         int result = 1, attributes = 0, port;
 700         char *arg, *attrib, *cp = *condition;
 701         size_t len;
 702
 703         if (ci == NULL)
 704                 debug3("checking syntax for 'Match %s'", cp);
 705         else
 706                 debug3("checking match for '%s' user %s host %s addr %s "
 707                     "laddr %s lport %d", cp, ci->user ? ci->user : "(null)",
 708                     ci->host ? ci->host : "(null)",
 709                     ci->address ? ci->address : "(null)",
 710                     ci->laddress ? ci->laddress : "(null)", ci->lport);
 711
 712         while ((attrib = strdelim(&cp)) && *attrib != '\0') {
 713                 attributes++;
 714                 if (strcasecmp(attrib, "all") == 0) {
 715                         if (attributes != 1 ||
 716                             ((arg = strdelim(&cp)) != NULL && *arg != '\0')) {
 717                                 error("'all' cannot be combined with other "
 718                                     "Match attributes");
 719                                 return -1;
 720                         }
 721                         *condition = cp;
 722                         return 1;
 723                 }
 724                 if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
 725                         error("Missing Match criteria for %s", attrib);
 726                         return -1;
 727                 }
 728                 len = strlen(arg);
 729                 if (strcasecmp(attrib, "user") == 0) {
 730                         if (ci == NULL || ci->user == NULL) {
 731                                 result = 0;
 732                                 continue;
 733                         }
 734                         if (match_pattern_list(ci->user, arg, len, 0) != 1)
 735                                 result = 0;
 736                         else
 737                                 debug("user %.100s matched 'User %.100s' at "
 738                                     "line %d", ci->user, arg, line);
 739                 } else if (strcasecmp(attrib, "group") == 0) {
 740                         if (ci == NULL || ci->user == NULL) {
 741                                 result = 0;
 742                                 continue;
 743                         }
 744                         switch (match_cfg_line_group(arg, line, ci->user)) {
 745                         case -1:
 746                                 return -1;
 747                         case 0:
 748                                 result = 0;
 749                         }
 750                 } else if (strcasecmp(attrib, "host") == 0) {
 751                         if (ci == NULL || ci->host == NULL) {
 752                                 result = 0;
 753                                 continue;
 754                         }
 755                         if (match_hostname(ci->host, arg, len) != 1)
 756                                 result = 0;
 757                         else
 758                                 debug("connection from %.100s matched 'Host "
 759                                     "%.100s' at line %d", ci->host, arg, line);
 760                 } else if (strcasecmp(attrib, "address") == 0) {
 761                         if (ci == NULL || ci->address == NULL) {
 762                                 result = 0;
 763                                 continue;
 764                         }
 765                         switch (addr_match_list(ci->address, arg)) {
 766                         case 1:
 767                                 debug("connection from %.100s matched 'Address "
 768                                     "%.100s' at line %d", ci->address, arg, line);
 769                                 break;
 770                         case 0:
 771                         case -1:
 772                                 result = 0;
 773                                 break;
 774                         case -2:
 775                                 return -1;
 776                         }
 777                 } else if (strcasecmp(attrib, "localaddress") == 0){
 778                         if (ci == NULL || ci->laddress == NULL) {
 779                                 result = 0;
 780                                 continue;
 781                         }
 782                         switch (addr_match_list(ci->laddress, arg)) {
 783                         case 1:
 784                                 debug("connection from %.100s matched "
 785                                     "'LocalAddress %.100s' at line %d",
 786                                     ci->laddress, arg, line);
 787                                 break;
 788                         case 0:
 789                         case -1:
 790                                 result = 0;
 791                                 break;
 792                         case -2:
 793                                 return -1;
 794                         }
 795                 } else if (strcasecmp(attrib, "localport") == 0) {
 796                         if ((port = a2port(arg)) == -1) {
 797                                 error("Invalid LocalPort '%s' on Match line",
 798                                     arg);
 799                                 return -1;
 800                         }
 801                         if (ci == NULL || ci->lport == 0) {
 802                                 result = 0;
 803                                 continue;
 804                         }
 805                         /* TODO support port lists */
 806                         if (port == ci->lport)
 807                                 debug("connection from %.100s matched "
 808                                     "'LocalPort %d' at line %d",
 809                                     ci->laddress, port, line);
 810                         else
 811                                 result = 0;
 812                 } else {
 813                         error("Unsupported Match attribute %s", attrib);
 814                         return -1;
 815                 }
 816         }
 817         if (attributes == 0) {
 818                 error("One or more attributes required for Match");
 819                 return -1;
 820         }
 821         if (ci != NULL)
 822                 debug3("match %sfound", result ? "" : "not ");
 823         *condition = cp;
 824         return result;
 825 }
 826
 827 #define WHITESPACE " \t\r\n"
 828
 829 /* Multistate option parsing */
 830 struct multistate {
 831         char *key;
 832         int value;
 833 };
 834 static const struct multistate multistate_addressfamily[] = {
 835         { "inet",                       AF_INET },
 836         { "inet6",                      AF_INET6 },
 837         { "any",                        AF_UNSPEC },
 838         { NULL, -1 }
 839 };
 840 static const struct multistate multistate_permitrootlogin[] = {
 841         { "without-password",           PERMIT_NO_PASSWD },
 842         { "forced-commands-only",       PERMIT_FORCED_ONLY },
 843         { "yes",                        PERMIT_YES },
 844         { "no",                         PERMIT_NO },
 845         { NULL, -1 }
 846 };
 847 static const struct multistate multistate_compression[] = {
 848         { "delayed",                    COMP_DELAYED },
 849         { "yes",                        COMP_ZLIB },
 850         { "no",                         COMP_NONE },
 851         { NULL, -1 }
 852 };
 853 static const struct multistate multistate_gatewayports[] = {
 854         { "clientspecified",            2 },
 855         { "yes",                        1 },
 856         { "no",                         0 },
 857         { NULL, -1 }
 858 };
 859 static const struct multistate multistate_privsep[] = {
 860         { "yes",                        PRIVSEP_NOSANDBOX },
 861         { "sandbox",                    PRIVSEP_ON },
 862         { "nosandbox",                  PRIVSEP_NOSANDBOX },
 863         { "no",                         PRIVSEP_OFF },
 864         { NULL, -1 }
 865 };
 866 static const struct multistate multistate_tcpfwd[] = {
 867         { "yes",                        FORWARD_ALLOW },
 868         { "all",                        FORWARD_ALLOW },
 869         { "no",                         FORWARD_DENY },
 870         { "remote",                     FORWARD_REMOTE },
 871         { "local",                      FORWARD_LOCAL },
 872         { NULL, -1 }
 873 };
 874
 875 int
 876 process_server_config_line(ServerOptions *options, char *line,
 877     const char *filename, int linenum, int *activep,
 878     struct connection_info *connectinfo)
 879 {
 880         char *cp, **charptr, *arg, *p;
 881         int cmdline = 0, *intptr, value, value2, n, port;
 882         SyslogFacility *log_facility_ptr;
 883         LogLevel *log_level_ptr;
 884         ServerOpCodes opcode;
 885         u_int i, flags = 0;
 886         size_t len;
 887         long long val64;
 888         const struct multistate *multistate_ptr;
 889
 890         cp = line;
 891         if ((arg = strdelim(&cp)) == NULL)
 892                 return 0;
 893         /* Ignore leading whitespace */
 894         if (*arg == '\0')
 895                 arg = strdelim(&cp);
 896         if (!arg || !*arg || *arg == '#')
 897                 return 0;
 898         intptr = NULL;
 899         charptr = NULL;
 900         opcode = parse_token(arg, filename, linenum, &flags);
 901
 902         if (activep == NULL) { /* We are processing a command line directive */
 903                 cmdline = 1;
 904                 activep = &cmdline;
 905         }
 906         if (*activep && opcode != sMatch)
 907                 debug3("%s:%d setting %s %s", filename, linenum, arg, cp);
 908         if (*activep == 0 && !(flags & SSHCFG_MATCH)) {
 909                 if (connectinfo == NULL) {
 910                         fatal("%s line %d: Directive '%s' is not allowed "
 911                             "within a Match block", filename, linenum, arg);
 912                 } else { /* this is a directive we have already processed */
 913                         while (arg)
 914                                 arg = strdelim(&cp);
 915                         return 0;
 916                 }
 917         }
 918
 919         switch (opcode) {
 920         /* Portable-specific options */
 921         case sUsePAM:
 922                 intptr = &options->use_pam;
 923                 goto parse_flag;
 924
 925         /* Standard Options */
 926         case sBadOption:
 927                 return -1;
 928         case sPort:
 929                 /* ignore ports from configfile if cmdline specifies ports */
 930                 if (options->ports_from_cmdline)
 931                         return 0;
 932                 if (options->listen_addrs != NULL)
 933                         fatal("%s line %d: ports must be specified before "
 934                             "ListenAddress.", filename, linenum);
 935                 if (options->num_ports >= MAX_PORTS)
 936                         fatal("%s line %d: too many ports.",
 937                             filename, linenum);
 938                 arg = strdelim(&cp);
 939                 if (!arg || *arg == '\0')
 940                         fatal("%s line %d: missing port number.",
 941                             filename, linenum);
 942                 options->ports[options->num_ports++] = a2port(arg);
 943                 if (options->ports[options->num_ports-1] <= 0)
 944                         fatal("%s line %d: Badly formatted port number.",
 945                             filename, linenum);
 946                 break;
 947
 948         case sServerKeyBits:
 949                 intptr = &options->server_key_bits;
 950  parse_int:
 951                 arg = strdelim(&cp);
 952                 if (!arg || *arg == '\0')
 953                         fatal("%s line %d: missing integer value.",
 954                             filename, linenum);
 955                 value = atoi(arg);
 956                 if (*activep && *intptr == -1)
 957                         *intptr = value;
 958                 break;
 959
 960         case sLoginGraceTime:
 961                 intptr = &options->login_grace_time;
 962  parse_time:
 963                 arg = strdelim(&cp);
 964                 if (!arg || *arg == '\0')
 965                         fatal("%s line %d: missing time value.",
 966                             filename, linenum);
 967                 if ((value = convtime(arg)) == -1)
 968                         fatal("%s line %d: invalid time value.",
 969                             filename, linenum);
 970                 if (*intptr == -1)
 971                         *intptr = value;
 972                 break;
 973
 974         case sKeyRegenerationTime:
 975                 intptr = &options->key_regeneration_time;
 976                 goto parse_time;
 977
 978         case sListenAddress:
 979                 arg = strdelim(&cp);
 980                 if (arg == NULL || *arg == '\0')
 981                         fatal("%s line %d: missing address",
 982                             filename, linenum);
 983                 /* check for bare IPv6 address: no "[]" and 2 or more ":" */
 984                 if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL
 985                     && strchr(p+1, ':') != NULL) {
 986                         add_listen_addr(options, arg, 0);
 987                         break;
 988                 }
 989                 p = hpdelim(&arg);
 990                 if (p == NULL)
 991                         fatal("%s line %d: bad address:port usage",
 992                             filename, linenum);
 993                 p = cleanhostname(p);
 994                 if (arg == NULL)
 995                         port = 0;
 996                 else if ((port = a2port(arg)) <= 0)
 997                         fatal("%s line %d: bad port number", filename, linenum);
 998
 999                 add_listen_addr(options, p, port);
1000
1001                 break;
1002
1003         case sAddressFamily:
1004                 intptr = &options->address_family;
1005                 multistate_ptr = multistate_addressfamily;
1006                 if (options->listen_addrs != NULL)
1007                         fatal("%s line %d: address family must be specified "
1008                             "before ListenAddress.", filename, linenum);
1009  parse_multistate:
1010                 arg = strdelim(&cp);
1011                 if (!arg || *arg == '\0')
1012                         fatal("%s line %d: missing argument.",
1013                             filename, linenum);
1014                 value = -1;
1015                 for (i = 0; multistate_ptr[i].key != NULL; i++) {
1016                         if (strcasecmp(arg, multistate_ptr[i].key) == 0) {
1017                                 value = multistate_ptr[i].value;
1018                                 break;
1019                         }
1020                 }
1021                 if (value == -1)
1022                         fatal("%s line %d: unsupported option \"%s\".",
1023                             filename, linenum, arg);
1024                 if (*activep && *intptr == -1)
1025                         *intptr = value;
1026                 break;
1027
1028         case sHostKeyFile:
1029                 intptr = &options->num_host_key_files;
1030                 if (*intptr >= MAX_HOSTKEYS)
1031                         fatal("%s line %d: too many host keys specified (max %d).",
1032                             filename, linenum, MAX_HOSTKEYS);
1033                 charptr = &options->host_key_files[*intptr];
1034  parse_filename:
1035                 arg = strdelim(&cp);
1036                 if (!arg || *arg == '\0')
1037                         fatal("%s line %d: missing file name.",
1038                             filename, linenum);
1039                 if (*activep && *charptr == NULL) {
1040                         *charptr = derelativise_path(arg);
1041                         /* increase optional counter */
1042                         if (intptr != NULL)
1043                                 *intptr = *intptr + 1;
1044                 }
1045                 break;
1046
1047         case sHostKeyAgent:
1048                 charptr = &options->host_key_agent;
1049                 arg = strdelim(&cp);
1050                 if (!arg || *arg == '\0')
1051                         fatal("%s line %d: missing socket name.",
1052                             filename, linenum);
1053                 if (*activep && *charptr == NULL)
1054                         *charptr = !strcmp(arg, SSH_AUTHSOCKET_ENV_NAME) ?
1055                             xstrdup(arg) : derelativise_path(arg);
1056                 break;
1057
1058         case sHostCertificate:
1059                 intptr = &options->num_host_cert_files;
1060                 if (*intptr >= MAX_HOSTKEYS)
1061                         fatal("%s line %d: too many host certificates "
1062                             "specified (max %d).", filename, linenum,
1063                             MAX_HOSTCERTS);
1064                 charptr = &options->host_cert_files[*intptr];
1065                 goto parse_filename;
1066                 break;
1067
1068         case sPidFile:
1069                 charptr = &options->pid_file;
1070                 goto parse_filename;
1071
1072         case sPermitRootLogin:
1073                 intptr = &options->permit_root_login;
1074                 multistate_ptr = multistate_permitrootlogin;
1075                 goto parse_multistate;
1076
1077         case sIgnoreRhosts:
1078                 intptr = &options->ignore_rhosts;
1079  parse_flag:
1080                 arg = strdelim(&cp);
1081                 if (!arg || *arg == '\0')
1082                         fatal("%s line %d: missing yes/no argument.",
1083                             filename, linenum);
1084                 value = 0;      /* silence compiler */
1085                 if (strcmp(arg, "yes") == 0)
1086                         value = 1;
1087                 else if (strcmp(arg, "no") == 0)
1088                         value = 0;
1089                 else
1090                         fatal("%s line %d: Bad yes/no argument: %s",
1091                                 filename, linenum, arg);
1092                 if (*activep && *intptr == -1)
1093                         *intptr = value;
1094                 break;
1095
1096         case sIgnoreUserKnownHosts:
1097                 intptr = &options->ignore_user_known_hosts;
1098                 goto parse_flag;
1099
1100         case sRhostsRSAAuthentication:
1101                 intptr = &options->rhosts_rsa_authentication;
1102                 goto parse_flag;
1103
1104         case sHostbasedAuthentication:
1105                 intptr = &options->hostbased_authentication;
1106                 goto parse_flag;
1107
1108         case sHostbasedUsesNameFromPacketOnly:
1109                 intptr = &options->hostbased_uses_name_from_packet_only;
1110                 goto parse_flag;
1111
1112         case sRSAAuthentication:
1113                 intptr = &options->rsa_authentication;
1114                 goto parse_flag;
1115
1116         case sPubkeyAuthentication:
1117                 intptr = &options->pubkey_authentication;
1118                 goto parse_flag;
1119
1120         case sKerberosAuthentication:
1121                 intptr = &options->kerberos_authentication;
1122                 goto parse_flag;
1123
1124         case sKerberosOrLocalPasswd:
1125                 intptr = &options->kerberos_or_local_passwd;
1126                 goto parse_flag;
1127
1128         case sKerberosTicketCleanup:
1129                 intptr = &options->kerberos_ticket_cleanup;
1130                 goto parse_flag;
1131
1132         case sKerberosGetAFSToken:
1133                 intptr = &options->kerberos_get_afs_token;
1134                 goto parse_flag;
1135
1136         case sGssAuthentication:
1137                 intptr = &options->gss_authentication;
1138                 goto parse_flag;
1139
1140         case sGssCleanupCreds:
1141                 intptr = &options->gss_cleanup_creds;
1142                 goto parse_flag;
1143
1144         case sPasswordAuthentication:
1145                 intptr = &options->password_authentication;
1146                 goto parse_flag;
1147
1148         case sKbdInteractiveAuthentication:
1149                 intptr = &options->kbd_interactive_authentication;
1150                 goto parse_flag;
1151
1152         case sChallengeResponseAuthentication:
1153                 intptr = &options->challenge_response_authentication;
1154                 goto parse_flag;
1155
1156         case sPrintMotd:
1157                 intptr = &options->print_motd;
1158                 goto parse_flag;
1159
1160         case sPrintLastLog:
1161                 intptr = &options->print_lastlog;
1162                 goto parse_flag;
1163
1164         case sX11Forwarding:
1165                 intptr = &options->x11_forwarding;
1166                 goto parse_flag;
1167
1168         case sX11DisplayOffset:
1169                 intptr = &options->x11_display_offset;
1170                 goto parse_int;
1171
1172         case sX11UseLocalhost:
1173                 intptr = &options->x11_use_localhost;
1174                 goto parse_flag;
1175
1176         case sXAuthLocation:
1177                 charptr = &options->xauth_location;
1178                 goto parse_filename;
1179
1180         case sPermitTTY:
1181                 intptr = &options->permit_tty;
1182                 goto parse_flag;
1183
1184         case sStrictModes:
1185                 intptr = &options->strict_modes;
1186                 goto parse_flag;
1187
1188         case sTCPKeepAlive:
1189                 intptr = &options->tcp_keep_alive;
1190                 goto parse_flag;
1191
1192         case sEmptyPasswd:
1193                 intptr = &options->permit_empty_passwd;
1194                 goto parse_flag;
1195
1196         case sPermitUserEnvironment:
1197                 intptr = &options->permit_user_env;
1198                 goto parse_flag;
1199
1200         case sUseLogin:
1201                 intptr = &options->use_login;
1202                 goto parse_flag;
1203
1204         case sCompression:
1205                 intptr = &options->compression;
1206                 multistate_ptr = multistate_compression;
1207                 goto parse_multistate;
1208
1209         case sRekeyLimit:
1210                 arg = strdelim(&cp);
1211                 if (!arg || *arg == '\0')
1212                         fatal("%.200s line %d: Missing argument.", filename,
1213                             linenum);
1214                 if (strcmp(arg, "default") == 0) {
1215                         val64 = 0;
1216                 } else {
1217                         if (scan_scaled(arg, &val64) == -1)
1218                                 fatal("%.200s line %d: Bad number '%s': %s",
1219                                     filename, linenum, arg, strerror(errno));
1220                         /* check for too-large or too-small limits */
1221                         if (val64 > UINT_MAX)
1222                                 fatal("%.200s line %d: RekeyLimit too large",
1223                                     filename, linenum);
1224                         if (val64 != 0 && val64 < 16)
1225                                 fatal("%.200s line %d: RekeyLimit too small",
1226                                     filename, linenum);
1227                 }
1228                 if (*activep && options->rekey_limit == -1)
1229                         options->rekey_limit = (u_int32_t)val64;
1230                 if (cp != NULL) { /* optional rekey interval present */
1231                         if (strcmp(cp, "none") == 0) {
1232                                 (void)strdelim(&cp);    /* discard */
1233                                 break;
1234                         }
1235                         intptr = &options->rekey_interval;
1236                         goto parse_time;
1237                 }
1238                 break;
1239
1240         case sGatewayPorts:
1241                 intptr = &options->gateway_ports;
1242                 multistate_ptr = multistate_gatewayports;
1243                 goto parse_multistate;
1244
1245         case sUseDNS:
1246                 intptr = &options->use_dns;
1247                 goto parse_flag;
1248
1249         case sLogFacility:
1250                 log_facility_ptr = &options->log_facility;
1251                 arg = strdelim(&cp);
1252                 value = log_facility_number(arg);
1253                 if (value == SYSLOG_FACILITY_NOT_SET)
1254                         fatal("%.200s line %d: unsupported log facility '%s'",
1255                             filename, linenum, arg ? arg : "<NONE>");
1256                 if (*log_facility_ptr == -1)
1257                         *log_facility_ptr = (SyslogFacility) value;
1258                 break;
1259
1260         case sLogLevel:
1261                 log_level_ptr = &options->log_level;
1262                 arg = strdelim(&cp);
1263                 value = log_level_number(arg);
1264                 if (value == SYSLOG_LEVEL_NOT_SET)
1265                         fatal("%.200s line %d: unsupported log level '%s'",
1266                             filename, linenum, arg ? arg : "<NONE>");
1267                 if (*log_level_ptr == -1)
1268                         *log_level_ptr = (LogLevel) value;
1269                 break;
1270
1271         case sAllowTcpForwarding:
1272                 intptr = &options->allow_tcp_forwarding;
1273                 multistate_ptr = multistate_tcpfwd;
1274                 goto parse_multistate;
1275
1276         case sAllowAgentForwarding:
1277                 intptr = &options->allow_agent_forwarding;
1278                 goto parse_flag;
1279
1280         case sUsePrivilegeSeparation:
1281                 intptr = &use_privsep;
1282                 multistate_ptr = multistate_privsep;
1283                 goto parse_multistate;
1284
1285         case sAllowUsers:
1286                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1287                         if (options->num_allow_users >= MAX_ALLOW_USERS)
1288                                 fatal("%s line %d: too many allow users.",
1289                                     filename, linenum);
1290                         if (!*activep)
1291                                 continue;
1292                         options->allow_users[options->num_allow_users++] =
1293                             xstrdup(arg);
1294                 }
1295                 break;
1296
1297         case sDenyUsers:
1298                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1299                         if (options->num_deny_users >= MAX_DENY_USERS)
1300                                 fatal("%s line %d: too many deny users.",
1301                                     filename, linenum);
1302                         if (!*activep)
1303                                 continue;
1304                         options->deny_users[options->num_deny_users++] =
1305                             xstrdup(arg);
1306                 }
1307                 break;
1308
1309         case sAllowGroups:
1310                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1311                         if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
1312                                 fatal("%s line %d: too many allow groups.",
1313                                     filename, linenum);
1314                         if (!*activep)
1315                                 continue;
1316                         options->allow_groups[options->num_allow_groups++] =
1317                             xstrdup(arg);
1318                 }
1319                 break;
1320
1321         case sDenyGroups:
1322                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1323                         if (options->num_deny_groups >= MAX_DENY_GROUPS)
1324                                 fatal("%s line %d: too many deny groups.",
1325                                     filename, linenum);
1326                         if (!*activep)
1327                                 continue;
1328                         options->deny_groups[options->num_deny_groups++] =
1329                             xstrdup(arg);
1330                 }
1331                 break;
1332
1333         case sCiphers:
1334                 arg = strdelim(&cp);
1335                 if (!arg || *arg == '\0')
1336                         fatal("%s line %d: Missing argument.", filename, linenum);
1337                 if (!ciphers_valid(arg))
1338                         fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1339                             filename, linenum, arg ? arg : "<NONE>");
1340                 if (options->ciphers == NULL)
1341                         options->ciphers = xstrdup(arg);
1342                 break;
1343
1344         case sMacs:
1345                 arg = strdelim(&cp);
1346                 if (!arg || *arg == '\0')
1347                         fatal("%s line %d: Missing argument.", filename, linenum);
1348                 if (!mac_valid(arg))
1349                         fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1350                             filename, linenum, arg ? arg : "<NONE>");
1351                 if (options->macs == NULL)
1352                         options->macs = xstrdup(arg);
1353                 break;
1354
1355         case sKexAlgorithms:
1356                 arg = strdelim(&cp);
1357                 if (!arg || *arg == '\0')
1358                         fatal("%s line %d: Missing argument.",
1359                             filename, linenum);
1360                 if (!kex_names_valid(arg))
1361                         fatal("%s line %d: Bad SSH2 KexAlgorithms '%s'.",
1362                             filename, linenum, arg ? arg : "<NONE>");
1363                 if (options->kex_algorithms == NULL)
1364                         options->kex_algorithms = xstrdup(arg);
1365                 break;
1366
1367         case sProtocol:
1368                 intptr = &options->protocol;
1369                 arg = strdelim(&cp);
1370                 if (!arg || *arg == '\0')
1371                         fatal("%s line %d: Missing argument.", filename, linenum);
1372                 value = proto_spec(arg);
1373                 if (value == SSH_PROTO_UNKNOWN)
1374                         fatal("%s line %d: Bad protocol spec '%s'.",
1375                             filename, linenum, arg ? arg : "<NONE>");
1376                 if (*intptr == SSH_PROTO_UNKNOWN)
1377                         *intptr = value;
1378                 break;
1379
1380         case sSubsystem:
1381                 if (options->num_subsystems >= MAX_SUBSYSTEMS) {
1382                         fatal("%s line %d: too many subsystems defined.",
1383                             filename, linenum);
1384                 }
1385                 arg = strdelim(&cp);
1386                 if (!arg || *arg == '\0')
1387                         fatal("%s line %d: Missing subsystem name.",
1388                             filename, linenum);
1389                 if (!*activep) {
1390                         arg = strdelim(&cp);
1391                         break;
1392                 }
1393                 for (i = 0; i < options->num_subsystems; i++)
1394                         if (strcmp(arg, options->subsystem_name[i]) == 0)
1395                                 fatal("%s line %d: Subsystem '%s' already defined.",
1396                                     filename, linenum, arg);
1397                 options->subsystem_name[options->num_subsystems] = xstrdup(arg);
1398                 arg = strdelim(&cp);
1399                 if (!arg || *arg == '\0')
1400                         fatal("%s line %d: Missing subsystem command.",
1401                             filename, linenum);
1402                 options->subsystem_command[options->num_subsystems] = xstrdup(arg);
1403
1404                 /* Collect arguments (separate to executable) */
1405                 p = xstrdup(arg);
1406                 len = strlen(p) + 1;
1407                 while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
1408                         len += 1 + strlen(arg);
1409                         p = xrealloc(p, 1, len);
1410                         strlcat(p, " ", len);
1411                         strlcat(p, arg, len);
1412                 }
1413                 options->subsystem_args[options->num_subsystems] = p;
1414                 options->num_subsystems++;
1415                 break;
1416
1417         case sMaxStartups:
1418                 arg = strdelim(&cp);
1419                 if (!arg || *arg == '\0')
1420                         fatal("%s line %d: Missing MaxStartups spec.",
1421                             filename, linenum);
1422                 if ((n = sscanf(arg, "%d:%d:%d",
1423                     &options->max_startups_begin,
1424                     &options->max_startups_rate,
1425                     &options->max_startups)) == 3) {
1426                         if (options->max_startups_begin >
1427                             options->max_startups ||
1428                             options->max_startups_rate > 100 ||
1429                             options->max_startups_rate < 1)
1430                                 fatal("%s line %d: Illegal MaxStartups spec.",
1431                                     filename, linenum);
1432                 } else if (n != 1)
1433                         fatal("%s line %d: Illegal MaxStartups spec.",
1434                             filename, linenum);
1435                 else
1436                         options->max_startups = options->max_startups_begin;
1437                 break;
1438
1439         case sMaxAuthTries:
1440                 intptr = &options->max_authtries;
1441                 goto parse_int;
1442
1443         case sMaxSessions:
1444                 intptr = &options->max_sessions;
1445                 goto parse_int;
1446
1447         case sBanner:
1448                 charptr = &options->banner;
1449                 goto parse_filename;
1450
1451         /*
1452          * These options can contain %X options expanded at
1453          * connect time, so that you can specify paths like:
1454          *
1455          * AuthorizedKeysFile   /etc/ssh_keys/%u
1456          */
1457         case sAuthorizedKeysFile:
1458                 if (*activep && options->num_authkeys_files == 0) {
1459                         while ((arg = strdelim(&cp)) && *arg != '\0') {
1460                                 if (options->num_authkeys_files >=
1461                                     MAX_AUTHKEYS_FILES)
1462                                         fatal("%s line %d: "
1463                                             "too many authorized keys files.",
1464                                             filename, linenum);
1465                                 options->authorized_keys_files[
1466                                     options->num_authkeys_files++] =
1467                                     tilde_expand_filename(arg, getuid());
1468                         }
1469                 }
1470                 return 0;
1471
1472         case sAuthorizedPrincipalsFile:
1473                 charptr = &options->authorized_principals_file;
1474                 arg = strdelim(&cp);
1475                 if (!arg || *arg == '\0')
1476                         fatal("%s line %d: missing file name.",
1477                             filename, linenum);
1478                 if (*activep && *charptr == NULL) {
1479                         *charptr = tilde_expand_filename(arg, getuid());
1480                         /* increase optional counter */
1481                         if (intptr != NULL)
1482                                 *intptr = *intptr + 1;
1483                 }
1484                 break;
1485
1486         case sClientAliveInterval:
1487                 intptr = &options->client_alive_interval;
1488                 goto parse_time;
1489
1490         case sClientAliveCountMax:
1491                 intptr = &options->client_alive_count_max;
1492                 goto parse_int;
1493
1494         case sAcceptEnv:
1495                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1496                         if (strchr(arg, '=') != NULL)
1497                                 fatal("%s line %d: Invalid environment name.",
1498                                     filename, linenum);
1499                         if (options->num_accept_env >= MAX_ACCEPT_ENV)
1500                                 fatal("%s line %d: too many allow env.",
1501                                     filename, linenum);
1502                         if (!*activep)
1503                                 continue;
1504                         options->accept_env[options->num_accept_env++] =
1505                             xstrdup(arg);
1506                 }
1507                 break;
1508
1509         case sPermitTunnel:
1510                 intptr = &options->permit_tun;
1511                 arg = strdelim(&cp);
1512                 if (!arg || *arg == '\0')
1513                         fatal("%s line %d: Missing yes/point-to-point/"
1514                             "ethernet/no argument.", filename, linenum);
1515                 value = -1;
1516                 for (i = 0; tunmode_desc[i].val != -1; i++)
1517                         if (strcmp(tunmode_desc[i].text, arg) == 0) {
1518                                 value = tunmode_desc[i].val;
1519                                 break;
1520                         }
1521                 if (value == -1)
1522                         fatal("%s line %d: Bad yes/point-to-point/ethernet/"
1523                             "no argument: %s", filename, linenum, arg);
1524                 if (*intptr == -1)
1525                         *intptr = value;
1526                 break;
1527
1528         case sMatch:
1529                 if (cmdline)
1530                         fatal("Match directive not supported as a command-line "
1531                            "option");
1532                 value = match_cfg_line(&cp, linenum, connectinfo);
1533                 if (value < 0)
1534                         fatal("%s line %d: Bad Match condition", filename,
1535                             linenum);
1536                 *activep = value;
1537                 break;
1538
1539         case sPermitOpen:
1540                 arg = strdelim(&cp);
1541                 if (!arg || *arg == '\0')
1542                         fatal("%s line %d: missing PermitOpen specification",
1543                             filename, linenum);
1544                 n = options->num_permitted_opens;       /* modified later */
1545                 if (strcmp(arg, "any") == 0) {
1546                         if (*activep && n == -1) {
1547                                 channel_clear_adm_permitted_opens();
1548                                 options->num_permitted_opens = 0;
1549                         }
1550                         break;
1551                 }
1552                 if (strcmp(arg, "none") == 0) {
1553                         if (*activep && n == -1) {
1554                                 options->num_permitted_opens = 1;
1555                                 channel_disable_adm_local_opens();
1556                         }
1557                         break;
1558                 }
1559                 if (*activep && n == -1)
1560                         channel_clear_adm_permitted_opens();
1561                 for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) {
1562                         p = hpdelim(&arg);
1563                         if (p == NULL)
1564                                 fatal("%s line %d: missing host in PermitOpen",
1565                                     filename, linenum);
1566                         p = cleanhostname(p);
1567                         if (arg == NULL || ((port = permitopen_port(arg)) < 0))
1568                                 fatal("%s line %d: bad port number in "
1569                                     "PermitOpen", filename, linenum);
1570                         if (*activep && n == -1)
1571                                 options->num_permitted_opens =
1572                                     channel_add_adm_permitted_opens(p, port);
1573                 }
1574                 break;
1575
1576         case sForceCommand:
1577                 if (cp == NULL)
1578                         fatal("%.200s line %d: Missing argument.", filename,
1579                             linenum);
1580                 len = strspn(cp, WHITESPACE);
1581                 if (*activep && options->adm_forced_command == NULL)
1582                         options->adm_forced_command = xstrdup(cp + len);
1583                 return 0;
1584
1585         case sChrootDirectory:
1586                 charptr = &options->chroot_directory;
1587
1588                 arg = strdelim(&cp);
1589                 if (!arg || *arg == '\0')
1590                         fatal("%s line %d: missing file name.",
1591                             filename, linenum);
1592                 if (*activep && *charptr == NULL)
1593                         *charptr = xstrdup(arg);
1594                 break;
1595
1596         case sTrustedUserCAKeys:
1597                 charptr = &options->trusted_user_ca_keys;
1598                 goto parse_filename;
1599
1600         case sRevokedKeys:
1601                 charptr = &options->revoked_keys_file;
1602                 goto parse_filename;
1603
1604         case sIPQoS:
1605                 arg = strdelim(&cp);
1606                 if ((value = parse_ipqos(arg)) == -1)
1607                         fatal("%s line %d: Bad IPQoS value: %s",
1608                             filename, linenum, arg);
1609                 arg = strdelim(&cp);
1610                 if (arg == NULL)
1611                         value2 = value;
1612                 else if ((value2 = parse_ipqos(arg)) == -1)
1613                         fatal("%s line %d: Bad IPQoS value: %s",
1614                             filename, linenum, arg);
1615                 if (*activep) {
1616                         options->ip_qos_interactive = value;
1617                         options->ip_qos_bulk = value2;
1618                 }
1619                 break;
1620
1621         case sVersionAddendum:
1622                 if (cp == NULL)
1623                         fatal("%.200s line %d: Missing argument.", filename,
1624                             linenum);
1625                 len = strspn(cp, WHITESPACE);
1626                 if (*activep && options->version_addendum == NULL) {
1627                         if (strcasecmp(cp + len, "none") == 0)
1628                                 options->version_addendum = xstrdup("");
1629                         else if (strchr(cp + len, '\r') != NULL)
1630                                 fatal("%.200s line %d: Invalid argument",
1631                                     filename, linenum);
1632                         else
1633                                 options->version_addendum = xstrdup(cp + len);
1634                 }
1635                 return 0;
1636
1637         case sAuthorizedKeysCommand:
1638                 len = strspn(cp, WHITESPACE);
1639                 if (*activep && options->authorized_keys_command == NULL) {
1640                         if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0)
1641                                 fatal("%.200s line %d: AuthorizedKeysCommand "
1642                                     "must be an absolute path",
1643                                     filename, linenum);
1644                         options->authorized_keys_command = xstrdup(cp + len);
1645                 }
1646                 return 0;
1647
1648         case sAuthorizedKeysCommandUser:
1649                 charptr = &options->authorized_keys_command_user;
1650
1651                 arg = strdelim(&cp);
1652                 if (*activep && *charptr == NULL)
1653                         *charptr = xstrdup(arg);
1654                 break;
1655
1656         case sAuthenticationMethods:
1657                 if (*activep && options->num_auth_methods == 0) {
1658                         while ((arg = strdelim(&cp)) && *arg != '\0') {
1659                                 if (options->num_auth_methods >=
1660                                     MAX_AUTH_METHODS)
1661                                         fatal("%s line %d: "
1662                                             "too many authentication methods.",
1663                                             filename, linenum);
1664                                 if (auth2_methods_valid(arg, 0) != 0)
1665                                         fatal("%s line %d: invalid "
1666                                             "authentication method list.",
1667                                             filename, linenum);
1668                                 options->auth_methods[
1669                                     options->num_auth_methods++] = xstrdup(arg);
1670                         }
1671                 }
1672                 return 0;
1673
1674         case sHPNDisabled:
1675                 intptr = &options->hpn_disabled;
1676                 goto parse_flag;
1677
1678         case sHPNBufferSize:
1679                 intptr = &options->hpn_buffer_size;
1680                 goto parse_int;
1681
1682         case sTcpRcvBufPoll:
1683                 intptr = &options->tcp_rcv_buf_poll;
1684                 goto parse_flag;
1685
1686 #ifdef  NONE_CIPHER_ENABLED
1687         case sNoneEnabled:
1688                 intptr = &options->none_enabled;
1689                 goto parse_flag;
1690 #endif
1691
1692         case sDeprecated:
1693                 logit("%s line %d: Deprecated option %s",
1694                     filename, linenum, arg);
1695                 while (arg)
1696                     arg = strdelim(&cp);
1697                 break;
1698
1699         case sUnsupported:
1700                 logit("%s line %d: Unsupported option %s",
1701                     filename, linenum, arg);
1702                 while (arg)
1703                     arg = strdelim(&cp);
1704                 break;
1705
1706         default:
1707                 fatal("%s line %d: Missing handler for opcode %s (%d)",
1708                     filename, linenum, arg, opcode);
1709         }
1710         if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
1711                 fatal("%s line %d: garbage at end of line; \"%.200s\".",
1712                     filename, linenum, arg);
1713         return 0;
1714 }
1715
1716 /* Reads the server configuration file. */
1717
1718 void
1719 load_server_config(const char *filename, Buffer *conf)
1720 {
1721         char line[4096], *cp;
1722         FILE *f;
1723         int lineno = 0;
1724
1725         debug2("%s: filename %s", __func__, filename);
1726         if ((f = fopen(filename, "r")) == NULL) {
1727                 perror(filename);
1728                 exit(1);
1729         }
1730         buffer_clear(conf);
1731         while (fgets(line, sizeof(line), f)) {
1732                 lineno++;
1733                 if (strlen(line) == sizeof(line) - 1)
1734                         fatal("%s line %d too long", filename, lineno);
1735                 /*
1736                  * Trim out comments and strip whitespace
1737                  * NB - preserve newlines, they are needed to reproduce
1738                  * line numbers later for error messages
1739                  */
1740                 if ((cp = strchr(line, '#')) != NULL)
1741                         memcpy(cp, "\n", 2);
1742                 cp = line + strspn(line, " \t\r");
1743
1744                 buffer_append(conf, cp, strlen(cp));
1745         }
1746         buffer_append(conf, "\0", 1);
1747         fclose(f);
1748         debug2("%s: done config len = %d", __func__, buffer_len(conf));
1749 }
1750
1751 void
1752 parse_server_match_config(ServerOptions *options,
1753    struct connection_info *connectinfo)
1754 {
1755         ServerOptions mo;
1756
1757         initialize_server_options(&mo);
1758         parse_server_config(&mo, "reprocess config", &cfg, connectinfo);
1759         copy_set_server_options(options, &mo, 0);
1760 }
1761
1762 int parse_server_match_testspec(struct connection_info *ci, char *spec)
1763 {
1764         char *p;
1765
1766         while ((p = strsep(&spec, ",")) && *p != '\0') {
1767                 if (strncmp(p, "addr=", 5) == 0) {
1768                         ci->address = xstrdup(p + 5);
1769                 } else if (strncmp(p, "host=", 5) == 0) {
1770                         ci->host = xstrdup(p + 5);
1771                 } else if (strncmp(p, "user=", 5) == 0) {
1772                         ci->user = xstrdup(p + 5);
1773                 } else if (strncmp(p, "laddr=", 6) == 0) {
1774                         ci->laddress = xstrdup(p + 6);
1775                 } else if (strncmp(p, "lport=", 6) == 0) {
1776                         ci->lport = a2port(p + 6);
1777                         if (ci->lport == -1) {
1778                                 fprintf(stderr, "Invalid port '%s' in test mode"
1779                                    " specification %s\n", p+6, p);
1780                                 return -1;
1781                         }
1782                 } else {
1783                         fprintf(stderr, "Invalid test mode specification %s\n",
1784                            p);
1785                         return -1;
1786                 }
1787         }
1788         return 0;
1789 }
1790
1791 /*
1792  * returns 1 for a complete spec, 0 for partial spec and -1 for an
1793  * empty spec.
1794  */
1795 int server_match_spec_complete(struct connection_info *ci)
1796 {
1797         if (ci->user && ci->host && ci->address)
1798                 return 1;       /* complete */
1799         if (!ci->user && !ci->host && !ci->address)
1800                 return -1;      /* empty */
1801         return 0;       /* partial */
1802 }
1803
1804 /*
1805  * Copy any supported values that are set.
1806  *
1807  * If the preauth flag is set, we do not bother copying the string or
1808  * array values that are not used pre-authentication, because any that we
1809  * do use must be explictly sent in mm_getpwnamallow().
1810  */
1811 void
1812 copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
1813 {
1814 #define M_CP_INTOPT(n) do {\
1815         if (src->n != -1) \
1816                 dst->n = src->n; \
1817 } while (0)
1818
1819         M_CP_INTOPT(password_authentication);
1820         M_CP_INTOPT(gss_authentication);
1821         M_CP_INTOPT(rsa_authentication);
1822         M_CP_INTOPT(pubkey_authentication);
1823         M_CP_INTOPT(kerberos_authentication);
1824         M_CP_INTOPT(hostbased_authentication);
1825         M_CP_INTOPT(hostbased_uses_name_from_packet_only);
1826         M_CP_INTOPT(kbd_interactive_authentication);
1827         M_CP_INTOPT(permit_root_login);
1828         M_CP_INTOPT(permit_empty_passwd);
1829
1830         M_CP_INTOPT(allow_tcp_forwarding);
1831         M_CP_INTOPT(allow_agent_forwarding);
1832         M_CP_INTOPT(permit_tun);
1833         M_CP_INTOPT(gateway_ports);
1834         M_CP_INTOPT(x11_display_offset);
1835         M_CP_INTOPT(x11_forwarding);
1836         M_CP_INTOPT(x11_use_localhost);
1837         M_CP_INTOPT(permit_tty);
1838         M_CP_INTOPT(max_sessions);
1839         M_CP_INTOPT(max_authtries);
1840         M_CP_INTOPT(ip_qos_interactive);
1841         M_CP_INTOPT(ip_qos_bulk);
1842         M_CP_INTOPT(rekey_limit);
1843         M_CP_INTOPT(rekey_interval);
1844
1845         /* M_CP_STROPT and M_CP_STRARRAYOPT should not appear before here */
1846 #define M_CP_STROPT(n) do {\
1847         if (src->n != NULL && dst->n != src->n) { \
1848                 free(dst->n); \
1849                 dst->n = src->n; \
1850         } \
1851 } while(0)
1852 #define M_CP_STRARRAYOPT(n, num_n) do {\
1853         if (src->num_n != 0) { \
1854                 for (dst->num_n = 0; dst->num_n < src->num_n; dst->num_n++) \
1855                         dst->n[dst->num_n] = xstrdup(src->n[dst->num_n]); \
1856         } \
1857 } while(0)
1858
1859         /* See comment in servconf.h */
1860         COPY_MATCH_STRING_OPTS();
1861
1862         /*
1863          * The only things that should be below this point are string options
1864          * which are only used after authentication.
1865          */
1866         if (preauth)
1867                 return;
1868
1869         M_CP_STROPT(adm_forced_command);
1870         M_CP_STROPT(chroot_directory);
1871 }
1872
1873 #undef M_CP_INTOPT
1874 #undef M_CP_STROPT
1875 #undef M_CP_STRARRAYOPT
1876
1877 void
1878 parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
1879     struct connection_info *connectinfo)
1880 {
1881         int active, linenum, bad_options = 0;
1882         char *cp, *obuf, *cbuf;
1883
1884         debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
1885
1886         obuf = cbuf = xstrdup(buffer_ptr(conf));
1887         active = connectinfo ? 0 : 1;
1888         linenum = 1;
1889         while ((cp = strsep(&cbuf, "\n")) != NULL) {
1890                 if (process_server_config_line(options, cp, filename,
1891                     linenum++, &active, connectinfo) != 0)
1892                         bad_options++;
1893         }
1894         free(obuf);
1895         if (bad_options > 0)
1896                 fatal("%s: terminating, %d bad configuration options",
1897                     filename, bad_options);
1898 }
1899
1900 static const char *
1901 fmt_multistate_int(int val, const struct multistate *m)
1902 {
1903         u_int i;
1904
1905         for (i = 0; m[i].key != NULL; i++) {
1906                 if (m[i].value == val)
1907                         return m[i].key;
1908         }
1909         return "UNKNOWN";
1910 }
1911
1912 static const char *
1913 fmt_intarg(ServerOpCodes code, int val)
1914 {
1915         if (val == -1)
1916                 return "unset";
1917         switch (code) {
1918         case sAddressFamily:
1919                 return fmt_multistate_int(val, multistate_addressfamily);
1920         case sPermitRootLogin:
1921                 return fmt_multistate_int(val, multistate_permitrootlogin);
1922         case sGatewayPorts:
1923                 return fmt_multistate_int(val, multistate_gatewayports);
1924         case sCompression:
1925                 return fmt_multistate_int(val, multistate_compression);
1926         case sUsePrivilegeSeparation:
1927                 return fmt_multistate_int(val, multistate_privsep);
1928         case sAllowTcpForwarding:
1929                 return fmt_multistate_int(val, multistate_tcpfwd);
1930         case sProtocol:
1931                 switch (val) {
1932                 case SSH_PROTO_1:
1933                         return "1";
1934                 case SSH_PROTO_2:
1935                         return "2";
1936                 case (SSH_PROTO_1|SSH_PROTO_2):
1937                         return "2,1";
1938                 default:
1939                         return "UNKNOWN";
1940                 }
1941         default:
1942                 switch (val) {
1943                 case 0:
1944                         return "no";
1945                 case 1:
1946                         return "yes";
1947                 default:
1948                         return "UNKNOWN";
1949                 }
1950         }
1951 }
1952
1953 static const char *
1954 lookup_opcode_name(ServerOpCodes code)
1955 {
1956         u_int i;
1957
1958         for (i = 0; keywords[i].name != NULL; i++)
1959                 if (keywords[i].opcode == code)
1960                         return(keywords[i].name);
1961         return "UNKNOWN";
1962 }
1963
1964 static void
1965 dump_cfg_int(ServerOpCodes code, int val)
1966 {
1967         printf("%s %d\n", lookup_opcode_name(code), val);
1968 }
1969
1970 static void
1971 dump_cfg_fmtint(ServerOpCodes code, int val)
1972 {
1973         printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
1974 }
1975
1976 static void
1977 dump_cfg_string(ServerOpCodes code, const char *val)
1978 {
1979         if (val == NULL)
1980                 return;
1981         printf("%s %s\n", lookup_opcode_name(code), val);
1982 }
1983
1984 static void
1985 dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals)
1986 {
1987         u_int i;
1988
1989         for (i = 0; i < count; i++)
1990                 printf("%s %s\n", lookup_opcode_name(code), vals[i]);
1991 }
1992
1993 static void
1994 dump_cfg_strarray_oneline(ServerOpCodes code, u_int count, char **vals)
1995 {
1996         u_int i;
1997
1998         printf("%s", lookup_opcode_name(code));
1999         for (i = 0; i < count; i++)
2000                 printf(" %s",  vals[i]);
2001         printf("\n");
2002 }
2003
2004 void
2005 dump_config(ServerOptions *o)
2006 {
2007         u_int i;
2008         int ret;
2009         struct addrinfo *ai;
2010         char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL;
2011
2012         /* these are usually at the top of the config */
2013         for (i = 0; i < o->num_ports; i++)
2014                 printf("port %d\n", o->ports[i]);
2015         dump_cfg_fmtint(sProtocol, o->protocol);
2016         dump_cfg_fmtint(sAddressFamily, o->address_family);
2017
2018         /* ListenAddress must be after Port */
2019         for (ai = o->listen_addrs; ai; ai = ai->ai_next) {
2020                 if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr,
2021                     sizeof(addr), port, sizeof(port),
2022                     NI_NUMERICHOST|NI_NUMERICSERV)) != 0) {
2023                         error("getnameinfo failed: %.100s",
2024                             (ret != EAI_SYSTEM) ? gai_strerror(ret) :
2025                             strerror(errno));
2026                 } else {
2027                         if (ai->ai_family == AF_INET6)
2028                                 printf("listenaddress [%s]:%s\n", addr, port);
2029                         else
2030                                 printf("listenaddress %s:%s\n", addr, port);
2031                 }
2032         }
2033
2034         /* integer arguments */
2035 #ifdef USE_PAM
2036         dump_cfg_int(sUsePAM, o->use_pam);
2037 #endif
2038         dump_cfg_int(sServerKeyBits, o->server_key_bits);
2039         dump_cfg_int(sLoginGraceTime, o->login_grace_time);
2040         dump_cfg_int(sKeyRegenerationTime, o->key_regeneration_time);
2041         dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
2042         dump_cfg_int(sMaxAuthTries, o->max_authtries);
2043         dump_cfg_int(sMaxSessions, o->max_sessions);
2044         dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
2045         dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max);
2046
2047         /* formatted integer arguments */
2048         dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login);
2049         dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts);
2050         dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts);
2051         dump_cfg_fmtint(sRhostsRSAAuthentication, o->rhosts_rsa_authentication);
2052         dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication);
2053         dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly,
2054             o->hostbased_uses_name_from_packet_only);
2055         dump_cfg_fmtint(sRSAAuthentication, o->rsa_authentication);
2056         dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication);
2057 #ifdef KRB5
2058         dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication);
2059         dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd);
2060         dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup);
2061 # ifdef USE_AFS
2062         dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
2063 # endif
2064 #endif
2065 #ifdef GSSAPI
2066         dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
2067         dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
2068 #endif
2069         dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
2070         dump_cfg_fmtint(sKbdInteractiveAuthentication,
2071             o->kbd_interactive_authentication);
2072         dump_cfg_fmtint(sChallengeResponseAuthentication,
2073             o->challenge_response_authentication);
2074         dump_cfg_fmtint(sPrintMotd, o->print_motd);
2075         dump_cfg_fmtint(sPrintLastLog, o->print_lastlog);
2076         dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding);
2077         dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
2078         dump_cfg_fmtint(sPermitTTY, o->permit_tty);
2079         dump_cfg_fmtint(sStrictModes, o->strict_modes);
2080         dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
2081         dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
2082         dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
2083         dump_cfg_fmtint(sUseLogin, o->use_login);
2084         dump_cfg_fmtint(sCompression, o->compression);
2085         dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
2086         dump_cfg_fmtint(sUseDNS, o->use_dns);
2087         dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
2088         dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
2089
2090         /* string arguments */
2091         dump_cfg_string(sPidFile, o->pid_file);
2092         dump_cfg_string(sXAuthLocation, o->xauth_location);
2093         dump_cfg_string(sCiphers, o->ciphers ? o->ciphers :
2094             cipher_alg_list(',', 0));
2095         dump_cfg_string(sMacs, o->macs ? o->macs : mac_alg_list(','));
2096         dump_cfg_string(sBanner, o->banner);
2097         dump_cfg_string(sForceCommand, o->adm_forced_command);
2098         dump_cfg_string(sChrootDirectory, o->chroot_directory);
2099         dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
2100         dump_cfg_string(sRevokedKeys, o->revoked_keys_file);
2101         dump_cfg_string(sAuthorizedPrincipalsFile,
2102             o->authorized_principals_file);
2103         dump_cfg_string(sVersionAddendum, o->version_addendum);
2104         dump_cfg_string(sAuthorizedKeysCommand, o->authorized_keys_command);
2105         dump_cfg_string(sAuthorizedKeysCommandUser, o->authorized_keys_command_user);
2106         dump_cfg_string(sHostKeyAgent, o->host_key_agent);
2107         dump_cfg_string(sKexAlgorithms, o->kex_algorithms ? o->kex_algorithms :
2108             kex_alg_list(','));
2109
2110         /* string arguments requiring a lookup */
2111         dump_cfg_string(sLogLevel, log_level_name(o->log_level));
2112         dump_cfg_string(sLogFacility, log_facility_name(o->log_facility));
2113
2114         /* string array arguments */
2115         dump_cfg_strarray_oneline(sAuthorizedKeysFile, o->num_authkeys_files,
2116             o->authorized_keys_files);
2117         dump_cfg_strarray(sHostKeyFile, o->num_host_key_files,
2118              o->host_key_files);
2119         dump_cfg_strarray(sHostKeyFile, o->num_host_cert_files,
2120              o->host_cert_files);
2121         dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users);
2122         dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users);
2123         dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups);
2124         dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups);
2125         dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env);
2126         dump_cfg_strarray_oneline(sAuthenticationMethods,
2127             o->num_auth_methods, o->auth_methods);
2128
2129         /* other arguments */
2130         for (i = 0; i < o->num_subsystems; i++)
2131                 printf("subsystem %s %s\n", o->subsystem_name[i],
2132                     o->subsystem_args[i]);
2133
2134         printf("maxstartups %d:%d:%d\n", o->max_startups_begin,
2135             o->max_startups_rate, o->max_startups);
2136
2137         for (i = 0; tunmode_desc[i].val != -1; i++)
2138                 if (tunmode_desc[i].val == o->permit_tun) {
2139                         s = tunmode_desc[i].text;
2140                         break;
2141                 }
2142         dump_cfg_string(sPermitTunnel, s);
2143
2144         printf("ipqos %s ", iptos2str(o->ip_qos_interactive));
2145         printf("%s\n", iptos2str(o->ip_qos_bulk));
2146
2147         printf("rekeylimit %lld %d\n", (long long)o->rekey_limit,
2148             o->rekey_interval);
2149
2150         channel_print_adm_permitted_opens();
2151 }