crypto/openssh/servconf.c

   1
   2 /* $OpenBSD: servconf.c,v 1.234 2013/02/06 00:20:42 dtucker Exp $ */
   3 /* $FreeBSD$ */
   4 /*
   5  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   6  *                    All rights reserved
   7  *
   8  * As far as I am concerned, the code I have written for this software
   9  * can be used freely for any purpose.  Any derived versions of this
  10  * software must be clearly marked as such, and if the derived work is
  11  * incompatible with the protocol description in the RFC file, it must be
  12  * called by a name other than "ssh" or "Secure Shell".
  13  */
  14
  15 #include "includes.h"
  16 __RCSID("$FreeBSD$");
  17
  18 #include <sys/types.h>
  19 #include <sys/socket.h>
  20
  21 #include <netinet/in.h>
  22 #include <netinet/in_systm.h>
  23 #include <netinet/ip.h>
  24
  25 #include <netdb.h>
  26 #include <pwd.h>
  27 #include <stdio.h>
  28 #include <stdlib.h>
  29 #include <string.h>
  30 #include <signal.h>
  31 #include <unistd.h>
  32 #include <stdarg.h>
  33 #include <errno.h>
  34
  35 #include "openbsd-compat/sys-queue.h"
  36 #include "xmalloc.h"
  37 #include "ssh.h"
  38 #include "log.h"
  39 #include "buffer.h"
  40 #include "servconf.h"
  41 #include "compat.h"
  42 #include "pathnames.h"
  43 #include "misc.h"
  44 #include "cipher.h"
  45 #include "key.h"
  46 #include "kex.h"
  47 #include "mac.h"
  48 #include "match.h"
  49 #include "channels.h"
  50 #include "groupaccess.h"
  51 #include "canohost.h"
  52 #include "packet.h"
  53 #include "hostfile.h"
  54 #include "auth.h"
  55 #include "version.h"
  56
  57 static void add_listen_addr(ServerOptions *, char *, int);
  58 static void add_one_listen_addr(ServerOptions *, char *, int);
  59
  60 /* Use of privilege separation or not */
  61 extern int use_privsep;
  62 extern Buffer cfg;
  63
  64 /* Initializes the server options to their default values. */
  65
  66 void
  67 initialize_server_options(ServerOptions *options)
  68 {
  69         memset(options, 0, sizeof(*options));
  70
  71         /* Portable-specific options */
  72         options->use_pam = -1;
  73
  74         /* Standard Options */
  75         options->num_ports = 0;
  76         options->ports_from_cmdline = 0;
  77         options->listen_addrs = NULL;
  78         options->address_family = -1;
  79         options->num_host_key_files = 0;
  80         options->num_host_cert_files = 0;
  81         options->pid_file = NULL;
  82         options->server_key_bits = -1;
  83         options->login_grace_time = -1;
  84         options->key_regeneration_time = -1;
  85         options->permit_root_login = PERMIT_NOT_SET;
  86         options->ignore_rhosts = -1;
  87         options->ignore_user_known_hosts = -1;
  88         options->print_motd = -1;
  89         options->print_lastlog = -1;
  90         options->x11_forwarding = -1;
  91         options->x11_display_offset = -1;
  92         options->x11_use_localhost = -1;
  93         options->xauth_location = NULL;
  94         options->strict_modes = -1;
  95         options->tcp_keep_alive = -1;
  96         options->log_facility = SYSLOG_FACILITY_NOT_SET;
  97         options->log_level = SYSLOG_LEVEL_NOT_SET;
  98         options->rhosts_rsa_authentication = -1;
  99         options->hostbased_authentication = -1;
 100         options->hostbased_uses_name_from_packet_only = -1;
 101         options->rsa_authentication = -1;
 102         options->pubkey_authentication = -1;
 103         options->kerberos_authentication = -1;
 104         options->kerberos_or_local_passwd = -1;
 105         options->kerberos_ticket_cleanup = -1;
 106         options->kerberos_get_afs_token = -1;
 107         options->gss_authentication=-1;
 108         options->gss_cleanup_creds = -1;
 109         options->password_authentication = -1;
 110         options->kbd_interactive_authentication = -1;
 111         options->challenge_response_authentication = -1;
 112         options->permit_empty_passwd = -1;
 113         options->permit_user_env = -1;
 114         options->use_login = -1;
 115         options->compression = -1;
 116         options->allow_tcp_forwarding = -1;
 117         options->allow_agent_forwarding = -1;
 118         options->num_allow_users = 0;
 119         options->num_deny_users = 0;
 120         options->num_allow_groups = 0;
 121         options->num_deny_groups = 0;
 122         options->ciphers = NULL;
 123         options->macs = NULL;
 124         options->kex_algorithms = NULL;
 125         options->protocol = SSH_PROTO_UNKNOWN;
 126         options->gateway_ports = -1;
 127         options->num_subsystems = 0;
 128         options->max_startups_begin = -1;
 129         options->max_startups_rate = -1;
 130         options->max_startups = -1;
 131         options->max_authtries = -1;
 132         options->max_sessions = -1;
 133         options->banner = NULL;
 134         options->use_dns = -1;
 135         options->client_alive_interval = -1;
 136         options->client_alive_count_max = -1;
 137         options->num_authkeys_files = 0;
 138         options->num_accept_env = 0;
 139         options->permit_tun = -1;
 140         options->num_permitted_opens = -1;
 141         options->adm_forced_command = NULL;
 142         options->chroot_directory = NULL;
 143         options->authorized_keys_command = NULL;
 144         options->authorized_keys_command_user = NULL;
 145         options->zero_knowledge_password_authentication = -1;
 146         options->revoked_keys_file = NULL;
 147         options->trusted_user_ca_keys = NULL;
 148         options->authorized_principals_file = NULL;
 149         options->ip_qos_interactive = -1;
 150         options->ip_qos_bulk = -1;
 151         options->version_addendum = NULL;
 152         options->hpn_disabled = -1;
 153         options->hpn_buffer_size = -1;
 154         options->tcp_rcv_buf_poll = -1;
 155 #ifdef  NONE_CIPHER_ENABLED
 156         options->none_enabled = -1;
 157 #endif
 158 }
 159
 160 void
 161 fill_default_server_options(ServerOptions *options)
 162 {
 163         /* Portable-specific options */
 164         if (options->use_pam == -1)
 165                 options->use_pam = 1;
 166
 167         /* Standard Options */
 168         if (options->protocol == SSH_PROTO_UNKNOWN)
 169                 options->protocol = SSH_PROTO_2;
 170         if (options->num_host_key_files == 0) {
 171                 /* fill default hostkeys for protocols */
 172                 if (options->protocol & SSH_PROTO_1)
 173                         options->host_key_files[options->num_host_key_files++] =
 174                             _PATH_HOST_KEY_FILE;
 175                 if (options->protocol & SSH_PROTO_2) {
 176                         options->host_key_files[options->num_host_key_files++] =
 177                             _PATH_HOST_RSA_KEY_FILE;
 178                         options->host_key_files[options->num_host_key_files++] =
 179                             _PATH_HOST_DSA_KEY_FILE;
 180 #ifdef OPENSSL_HAS_ECC
 181                         options->host_key_files[options->num_host_key_files++] =
 182                             _PATH_HOST_ECDSA_KEY_FILE;
 183 #endif
 184                 }
 185         }
 186         /* No certificates by default */
 187         if (options->num_ports == 0)
 188                 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
 189         if (options->listen_addrs == NULL)
 190                 add_listen_addr(options, NULL, 0);
 191         if (options->pid_file == NULL)
 192                 options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
 193         if (options->server_key_bits == -1)
 194                 options->server_key_bits = 1024;
 195         if (options->login_grace_time == -1)
 196                 options->login_grace_time = 120;
 197         if (options->key_regeneration_time == -1)
 198                 options->key_regeneration_time = 3600;
 199         if (options->permit_root_login == PERMIT_NOT_SET)
 200                 options->permit_root_login = PERMIT_NO;
 201         if (options->ignore_rhosts == -1)
 202                 options->ignore_rhosts = 1;
 203         if (options->ignore_user_known_hosts == -1)
 204                 options->ignore_user_known_hosts = 0;
 205         if (options->print_motd == -1)
 206                 options->print_motd = 1;
 207         if (options->print_lastlog == -1)
 208                 options->print_lastlog = 1;
 209         if (options->x11_forwarding == -1)
 210                 options->x11_forwarding = 1;
 211         if (options->x11_display_offset == -1)
 212                 options->x11_display_offset = 10;
 213         if (options->x11_use_localhost == -1)
 214                 options->x11_use_localhost = 1;
 215         if (options->xauth_location == NULL)
 216                 options->xauth_location = _PATH_XAUTH;
 217         if (options->strict_modes == -1)
 218                 options->strict_modes = 1;
 219         if (options->tcp_keep_alive == -1)
 220                 options->tcp_keep_alive = 1;
 221         if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
 222                 options->log_facility = SYSLOG_FACILITY_AUTH;
 223         if (options->log_level == SYSLOG_LEVEL_NOT_SET)
 224                 options->log_level = SYSLOG_LEVEL_INFO;
 225         if (options->rhosts_rsa_authentication == -1)
 226                 options->rhosts_rsa_authentication = 0;
 227         if (options->hostbased_authentication == -1)
 228                 options->hostbased_authentication = 0;
 229         if (options->hostbased_uses_name_from_packet_only == -1)
 230                 options->hostbased_uses_name_from_packet_only = 0;
 231         if (options->rsa_authentication == -1)
 232                 options->rsa_authentication = 1;
 233         if (options->pubkey_authentication == -1)
 234                 options->pubkey_authentication = 1;
 235         if (options->kerberos_authentication == -1)
 236                 options->kerberos_authentication = 0;
 237         if (options->kerberos_or_local_passwd == -1)
 238                 options->kerberos_or_local_passwd = 1;
 239         if (options->kerberos_ticket_cleanup == -1)
 240                 options->kerberos_ticket_cleanup = 1;
 241         if (options->kerberos_get_afs_token == -1)
 242                 options->kerberos_get_afs_token = 0;
 243         if (options->gss_authentication == -1)
 244                 options->gss_authentication = 0;
 245         if (options->gss_cleanup_creds == -1)
 246                 options->gss_cleanup_creds = 1;
 247         if (options->password_authentication == -1)
 248                 options->password_authentication = 0;
 249         if (options->kbd_interactive_authentication == -1)
 250                 options->kbd_interactive_authentication = 0;
 251         if (options->challenge_response_authentication == -1)
 252                 options->challenge_response_authentication = 1;
 253         if (options->permit_empty_passwd == -1)
 254                 options->permit_empty_passwd = 0;
 255         if (options->permit_user_env == -1)
 256                 options->permit_user_env = 0;
 257         if (options->use_login == -1)
 258                 options->use_login = 0;
 259         if (options->compression == -1)
 260                 options->compression = COMP_DELAYED;
 261         if (options->allow_tcp_forwarding == -1)
 262                 options->allow_tcp_forwarding = FORWARD_ALLOW;
 263         if (options->allow_agent_forwarding == -1)
 264                 options->allow_agent_forwarding = 1;
 265         if (options->gateway_ports == -1)
 266                 options->gateway_ports = 0;
 267         if (options->max_startups == -1)
 268                 options->max_startups = 100;
 269         if (options->max_startups_rate == -1)
 270                 options->max_startups_rate = 30;                /* 30% */
 271         if (options->max_startups_begin == -1)
 272                 options->max_startups_begin = 10;
 273         if (options->max_authtries == -1)
 274                 options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
 275         if (options->max_sessions == -1)
 276                 options->max_sessions = DEFAULT_SESSIONS_MAX;
 277         if (options->use_dns == -1)
 278                 options->use_dns = 1;
 279         if (options->client_alive_interval == -1)
 280                 options->client_alive_interval = 0;
 281         if (options->client_alive_count_max == -1)
 282                 options->client_alive_count_max = 3;
 283         if (options->num_authkeys_files == 0) {
 284                 options->authorized_keys_files[options->num_authkeys_files++] =
 285                     xstrdup(_PATH_SSH_USER_PERMITTED_KEYS);
 286                 options->authorized_keys_files[options->num_authkeys_files++] =
 287                     xstrdup(_PATH_SSH_USER_PERMITTED_KEYS2);
 288         }
 289         if (options->permit_tun == -1)
 290                 options->permit_tun = SSH_TUNMODE_NO;
 291         if (options->zero_knowledge_password_authentication == -1)
 292                 options->zero_knowledge_password_authentication = 0;
 293         if (options->ip_qos_interactive == -1)
 294                 options->ip_qos_interactive = IPTOS_LOWDELAY;
 295         if (options->ip_qos_bulk == -1)
 296                 options->ip_qos_bulk = IPTOS_THROUGHPUT;
 297         if (options->version_addendum == NULL)
 298                 options->version_addendum = xstrdup(SSH_VERSION_FREEBSD);
 299         /* Turn privilege separation on by default */
 300         if (use_privsep == -1)
 301                 use_privsep = PRIVSEP_NOSANDBOX;
 302
 303 #ifndef HAVE_MMAP
 304         if (use_privsep && options->compression == 1) {
 305                 error("This platform does not support both privilege "
 306                     "separation and compression");
 307                 error("Compression disabled");
 308                 options->compression = 0;
 309         }
 310 #endif
 311
 312         if (options->hpn_disabled == -1)
 313                 options->hpn_disabled = 0;
 314         if (options->hpn_buffer_size == -1) {
 315                 /*
 316                  * HPN buffer size option not explicitly set.  Try to figure
 317                  * out what value to use or resort to default.
 318                  */
 319                 options->hpn_buffer_size = CHAN_SES_WINDOW_DEFAULT;
 320                 if (!options->hpn_disabled) {
 321                         sock_get_rcvbuf(&options->hpn_buffer_size, 0);
 322                         debug ("HPN Buffer Size: %d", options->hpn_buffer_size);
 323                 }
 324         } else {
 325                 /*
 326                  * In the case that the user sets both values in a
 327                  * contradictory manner hpn_disabled overrrides hpn_buffer_size.
 328                  */
 329                 if (options->hpn_disabled <= 0) {
 330                         u_int maxlen;
 331
 332                         maxlen = buffer_get_max_len();
 333                         if (options->hpn_buffer_size == 0)
 334                                 options->hpn_buffer_size = 1;
 335                         /* Limit the maximum buffer to BUFFER_MAX_LEN. */
 336                         if (options->hpn_buffer_size > maxlen / 1024)
 337                                 options->hpn_buffer_size = maxlen;
 338                         else
 339                                 options->hpn_buffer_size *= 1024;
 340                 } else {
 341                         options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT;
 342                 }
 343         }
 344 }
 345
 346 /* Keyword tokens. */
 347 typedef enum {
 348         sBadOption,             /* == unknown option */
 349         /* Portable-specific options */
 350         sUsePAM,
 351         /* Standard Options */
 352         sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
 353         sPermitRootLogin, sLogFacility, sLogLevel,
 354         sRhostsRSAAuthentication, sRSAAuthentication,
 355         sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
 356         sKerberosGetAFSToken,
 357         sKerberosTgtPassing, sChallengeResponseAuthentication,
 358         sPasswordAuthentication, sKbdInteractiveAuthentication,
 359         sListenAddress, sAddressFamily,
 360         sPrintMotd, sPrintLastLog, sIgnoreRhosts,
 361         sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
 362         sStrictModes, sEmptyPasswd, sTCPKeepAlive,
 363         sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
 364         sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
 365         sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
 366         sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
 367         sMaxStartups, sMaxAuthTries, sMaxSessions,
 368         sBanner, sUseDNS, sHostbasedAuthentication,
 369         sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
 370         sClientAliveCountMax, sAuthorizedKeysFile,
 371         sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
 372         sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
 373         sUsePrivilegeSeparation, sAllowAgentForwarding,
 374         sZeroKnowledgePasswordAuthentication, sHostCertificate,
 375         sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
 376         sKexAlgorithms, sIPQoS, sVersionAddendum,
 377         sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
 378         sAuthenticationMethods,
 379         sHPNDisabled, sHPNBufferSize, sTcpRcvBufPoll,
 380 #ifdef NONE_CIPHER_ENABLED
 381         sNoneEnabled,
 382 #endif
 383         sDeprecated, sUnsupported
 384 } ServerOpCodes;
 385
 386 #define SSHCFG_GLOBAL   0x01    /* allowed in main section of sshd_config */
 387 #define SSHCFG_MATCH    0x02    /* allowed inside a Match section */
 388 #define SSHCFG_ALL      (SSHCFG_GLOBAL|SSHCFG_MATCH)
 389
 390 /* Textual representation of the tokens. */
 391 static struct {
 392         const char *name;
 393         ServerOpCodes opcode;
 394         u_int flags;
 395 } keywords[] = {
 396         /* Portable-specific options */
 397 #ifdef USE_PAM
 398         { "usepam", sUsePAM, SSHCFG_GLOBAL },
 399 #else
 400         { "usepam", sUnsupported, SSHCFG_GLOBAL },
 401 #endif
 402         { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
 403         /* Standard Options */
 404         { "port", sPort, SSHCFG_GLOBAL },
 405         { "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
 406         { "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL },          /* alias */
 407         { "pidfile", sPidFile, SSHCFG_GLOBAL },
 408         { "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL },
 409         { "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
 410         { "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL },
 411         { "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
 412         { "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
 413         { "loglevel", sLogLevel, SSHCFG_GLOBAL },
 414         { "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL },
 415         { "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
 416         { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
 417         { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_ALL },
 418         { "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
 419         { "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
 420         { "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
 421 #ifdef KRB5
 422         { "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
 423         { "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
 424         { "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
 425 #ifdef USE_AFS
 426         { "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL },
 427 #else
 428         { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
 429 #endif
 430 #else
 431         { "kerberosauthentication", sUnsupported, SSHCFG_ALL },
 432         { "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
 433         { "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
 434         { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
 435 #endif
 436         { "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
 437         { "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
 438 #ifdef GSSAPI
 439         { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
 440         { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
 441 #else
 442         { "gssapiauthentication", sUnsupported, SSHCFG_ALL },
 443         { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
 444 #endif
 445         { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
 446         { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
 447         { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
 448         { "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
 449 #ifdef JPAKE
 450         { "zeroknowledgepasswordauthentication", sZeroKnowledgePasswordAuthentication, SSHCFG_ALL },
 451 #else
 452         { "zeroknowledgepasswordauthentication", sUnsupported, SSHCFG_ALL },
 453 #endif
 454         { "checkmail", sDeprecated, SSHCFG_GLOBAL },
 455         { "listenaddress", sListenAddress, SSHCFG_GLOBAL },
 456         { "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
 457         { "printmotd", sPrintMotd, SSHCFG_GLOBAL },
 458         { "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
 459         { "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
 460         { "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
 461         { "x11forwarding", sX11Forwarding, SSHCFG_ALL },
 462         { "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
 463         { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
 464         { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
 465         { "strictmodes", sStrictModes, SSHCFG_GLOBAL },
 466         { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
 467         { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
 468         { "uselogin", sUseLogin, SSHCFG_GLOBAL },
 469         { "compression", sCompression, SSHCFG_GLOBAL },
 470         { "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL },
 471         { "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL },  /* obsolete alias */
 472         { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
 473         { "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL },
 474         { "allowusers", sAllowUsers, SSHCFG_ALL },
 475         { "denyusers", sDenyUsers, SSHCFG_ALL },
 476         { "allowgroups", sAllowGroups, SSHCFG_ALL },
 477         { "denygroups", sDenyGroups, SSHCFG_ALL },
 478         { "ciphers", sCiphers, SSHCFG_GLOBAL },
 479         { "macs", sMacs, SSHCFG_GLOBAL },
 480         { "protocol", sProtocol, SSHCFG_GLOBAL },
 481         { "gatewayports", sGatewayPorts, SSHCFG_ALL },
 482         { "subsystem", sSubsystem, SSHCFG_GLOBAL },
 483         { "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
 484         { "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
 485         { "maxsessions", sMaxSessions, SSHCFG_ALL },
 486         { "banner", sBanner, SSHCFG_ALL },
 487         { "usedns", sUseDNS, SSHCFG_GLOBAL },
 488         { "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
 489         { "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
 490         { "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL },
 491         { "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
 492         { "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_ALL },
 493         { "authorizedkeysfile2", sDeprecated, SSHCFG_ALL },
 494         { "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL},
 495         { "acceptenv", sAcceptEnv, SSHCFG_ALL },
 496         { "permittunnel", sPermitTunnel, SSHCFG_ALL },
 497         { "match", sMatch, SSHCFG_ALL },
 498         { "permitopen", sPermitOpen, SSHCFG_ALL },
 499         { "forcecommand", sForceCommand, SSHCFG_ALL },
 500         { "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
 501         { "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
 502         { "revokedkeys", sRevokedKeys, SSHCFG_ALL },
 503         { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
 504         { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
 505         { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
 506         { "ipqos", sIPQoS, SSHCFG_ALL },
 507         { "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL },
 508         { "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL },
 509         { "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL },
 510         { "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL },
 511         { "hpndisabled", sHPNDisabled, SSHCFG_ALL },
 512         { "hpnbuffersize", sHPNBufferSize, SSHCFG_ALL },
 513         { "tcprcvbufpoll", sTcpRcvBufPoll, SSHCFG_ALL },
 514 #ifdef NONE_CIPHER_ENABLED
 515         { "noneenabled", sNoneEnabled, SSHCFG_ALL },
 516 #endif
 517         { NULL, sBadOption, 0 }
 518 };
 519
 520 static struct {
 521         int val;
 522         char *text;
 523 } tunmode_desc[] = {
 524         { SSH_TUNMODE_NO, "no" },
 525         { SSH_TUNMODE_POINTOPOINT, "point-to-point" },
 526         { SSH_TUNMODE_ETHERNET, "ethernet" },
 527         { SSH_TUNMODE_YES, "yes" },
 528         { -1, NULL }
 529 };
 530
 531 /*
 532  * Returns the number of the token pointed to by cp or sBadOption.
 533  */
 534
 535 static ServerOpCodes
 536 parse_token(const char *cp, const char *filename,
 537             int linenum, u_int *flags)
 538 {
 539         u_int i;
 540
 541         for (i = 0; keywords[i].name; i++)
 542                 if (strcasecmp(cp, keywords[i].name) == 0) {
 543                         *flags = keywords[i].flags;
 544                         return keywords[i].opcode;
 545                 }
 546
 547         error("%s: line %d: Bad configuration option: %s",
 548             filename, linenum, cp);
 549         return sBadOption;
 550 }
 551
 552 char *
 553 derelativise_path(const char *path)
 554 {
 555         char *expanded, *ret, cwd[MAXPATHLEN];
 556
 557         expanded = tilde_expand_filename(path, getuid());
 558         if (*expanded == '/')
 559                 return expanded;
 560         if (getcwd(cwd, sizeof(cwd)) == NULL)
 561                 fatal("%s: getcwd: %s", __func__, strerror(errno));
 562         xasprintf(&ret, "%s/%s", cwd, expanded);
 563         xfree(expanded);
 564         return ret;
 565 }
 566
 567 static void
 568 add_listen_addr(ServerOptions *options, char *addr, int port)
 569 {
 570         u_int i;
 571
 572         if (options->num_ports == 0)
 573                 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
 574         if (options->address_family == -1)
 575                 options->address_family = AF_UNSPEC;
 576         if (port == 0)
 577                 for (i = 0; i < options->num_ports; i++)
 578                         add_one_listen_addr(options, addr, options->ports[i]);
 579         else
 580                 add_one_listen_addr(options, addr, port);
 581 }
 582
 583 static void
 584 add_one_listen_addr(ServerOptions *options, char *addr, int port)
 585 {
 586         struct addrinfo hints, *ai, *aitop;
 587         char strport[NI_MAXSERV];
 588         int gaierr;
 589
 590         memset(&hints, 0, sizeof(hints));
 591         hints.ai_family = options->address_family;
 592         hints.ai_socktype = SOCK_STREAM;
 593         hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
 594         snprintf(strport, sizeof strport, "%d", port);
 595         if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
 596                 fatal("bad addr or host: %s (%s)",
 597                     addr ? addr : "<NULL>",
 598                     ssh_gai_strerror(gaierr));
 599         for (ai = aitop; ai->ai_next; ai = ai->ai_next)
 600                 ;
 601         ai->ai_next = options->listen_addrs;
 602         options->listen_addrs = aitop;
 603 }
 604
 605 struct connection_info *
 606 get_connection_info(int populate, int use_dns)
 607 {
 608         static struct connection_info ci;
 609
 610         if (!populate)
 611                 return &ci;
 612         ci.host = get_canonical_hostname(use_dns);
 613         ci.address = get_remote_ipaddr();
 614         ci.laddress = get_local_ipaddr(packet_get_connection_in());
 615         ci.lport = get_local_port();
 616         return &ci;
 617 }
 618
 619 /*
 620  * The strategy for the Match blocks is that the config file is parsed twice.
 621  *
 622  * The first time is at startup.  activep is initialized to 1 and the
 623  * directives in the global context are processed and acted on.  Hitting a
 624  * Match directive unsets activep and the directives inside the block are
 625  * checked for syntax only.
 626  *
 627  * The second time is after a connection has been established but before
 628  * authentication.  activep is initialized to 2 and global config directives
 629  * are ignored since they have already been processed.  If the criteria in a
 630  * Match block is met, activep is set and the subsequent directives
 631  * processed and actioned until EOF or another Match block unsets it.  Any
 632  * options set are copied into the main server config.
 633  *
 634  * Potential additions/improvements:
 635  *  - Add Match support for pre-kex directives, eg Protocol, Ciphers.
 636  *
 637  *  - Add a Tag directive (idea from David Leonard) ala pf, eg:
 638  *      Match Address 192.168.0.*
 639  *              Tag trusted
 640  *      Match Group wheel
 641  *              Tag trusted
 642  *      Match Tag trusted
 643  *              AllowTcpForwarding yes
 644  *              GatewayPorts clientspecified
 645  *              [...]
 646  *
 647  *  - Add a PermittedChannelRequests directive
 648  *      Match Group shell
 649  *              PermittedChannelRequests session,forwarded-tcpip
 650  */
 651
 652 static int
 653 match_cfg_line_group(const char *grps, int line, const char *user)
 654 {
 655         int result = 0;
 656         struct passwd *pw;
 657
 658         if (user == NULL)
 659                 goto out;
 660
 661         if ((pw = getpwnam(user)) == NULL) {
 662                 debug("Can't match group at line %d because user %.100s does "
 663                     "not exist", line, user);
 664         } else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
 665                 debug("Can't Match group because user %.100s not in any group "
 666                     "at line %d", user, line);
 667         } else if (ga_match_pattern_list(grps) != 1) {
 668                 debug("user %.100s does not match group list %.100s at line %d",
 669                     user, grps, line);
 670         } else {
 671                 debug("user %.100s matched group list %.100s at line %d", user,
 672                     grps, line);
 673                 result = 1;
 674         }
 675 out:
 676         ga_free();
 677         return result;
 678 }
 679
 680 /*
 681  * All of the attributes on a single Match line are ANDed together, so we need
 682  * to check every * attribute and set the result to zero if any attribute does
 683  * not match.
 684  */
 685 static int
 686 match_cfg_line(char **condition, int line, struct connection_info *ci)
 687 {
 688         int result = 1, port;
 689         char *arg, *attrib, *cp = *condition;
 690         size_t len;
 691
 692         if (ci == NULL)
 693                 debug3("checking syntax for 'Match %s'", cp);
 694         else
 695                 debug3("checking match for '%s' user %s host %s addr %s "
 696                     "laddr %s lport %d", cp, ci->user ? ci->user : "(null)",
 697                     ci->host ? ci->host : "(null)",
 698                     ci->address ? ci->address : "(null)",
 699                     ci->laddress ? ci->laddress : "(null)", ci->lport);
 700
 701         while ((attrib = strdelim(&cp)) && *attrib != '\0') {
 702                 if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
 703                         error("Missing Match criteria for %s", attrib);
 704                         return -1;
 705                 }
 706                 len = strlen(arg);
 707                 if (strcasecmp(attrib, "user") == 0) {
 708                         if (ci == NULL || ci->user == NULL) {
 709                                 result = 0;
 710                                 continue;
 711                         }
 712                         if (match_pattern_list(ci->user, arg, len, 0) != 1)
 713                                 result = 0;
 714                         else
 715                                 debug("user %.100s matched 'User %.100s' at "
 716                                     "line %d", ci->user, arg, line);
 717                 } else if (strcasecmp(attrib, "group") == 0) {
 718                         if (ci == NULL || ci->user == NULL) {
 719                                 result = 0;
 720                                 continue;
 721                         }
 722                         switch (match_cfg_line_group(arg, line, ci->user)) {
 723                         case -1:
 724                                 return -1;
 725                         case 0:
 726                                 result = 0;
 727                         }
 728                 } else if (strcasecmp(attrib, "host") == 0) {
 729                         if (ci == NULL || ci->host == NULL) {
 730                                 result = 0;
 731                                 continue;
 732                         }
 733                         if (match_hostname(ci->host, arg, len) != 1)
 734                                 result = 0;
 735                         else
 736                                 debug("connection from %.100s matched 'Host "
 737                                     "%.100s' at line %d", ci->host, arg, line);
 738                 } else if (strcasecmp(attrib, "address") == 0) {
 739                         if (ci == NULL || ci->address == NULL) {
 740                                 result = 0;
 741                                 continue;
 742                         }
 743                         switch (addr_match_list(ci->address, arg)) {
 744                         case 1:
 745                                 debug("connection from %.100s matched 'Address "
 746                                     "%.100s' at line %d", ci->address, arg, line);
 747                                 break;
 748                         case 0:
 749                         case -1:
 750                                 result = 0;
 751                                 break;
 752                         case -2:
 753                                 return -1;
 754                         }
 755                 } else if (strcasecmp(attrib, "localaddress") == 0){
 756                         if (ci == NULL || ci->laddress == NULL) {
 757                                 result = 0;
 758                                 continue;
 759                         }
 760                         switch (addr_match_list(ci->laddress, arg)) {
 761                         case 1:
 762                                 debug("connection from %.100s matched "
 763                                     "'LocalAddress %.100s' at line %d",
 764                                     ci->laddress, arg, line);
 765                                 break;
 766                         case 0:
 767                         case -1:
 768                                 result = 0;
 769                                 break;
 770                         case -2:
 771                                 return -1;
 772                         }
 773                 } else if (strcasecmp(attrib, "localport") == 0) {
 774                         if ((port = a2port(arg)) == -1) {
 775                                 error("Invalid LocalPort '%s' on Match line",
 776                                     arg);
 777                                 return -1;
 778                         }
 779                         if (ci == NULL || ci->lport == 0) {
 780                                 result = 0;
 781                                 continue;
 782                         }
 783                         /* TODO support port lists */
 784                         if (port == ci->lport)
 785                                 debug("connection from %.100s matched "
 786                                     "'LocalPort %d' at line %d",
 787                                     ci->laddress, port, line);
 788                         else
 789                                 result = 0;
 790                 } else {
 791                         error("Unsupported Match attribute %s", attrib);
 792                         return -1;
 793                 }
 794         }
 795         if (ci != NULL)
 796                 debug3("match %sfound", result ? "" : "not ");
 797         *condition = cp;
 798         return result;
 799 }
 800
 801 #define WHITESPACE " \t\r\n"
 802
 803 /* Multistate option parsing */
 804 struct multistate {
 805         char *key;
 806         int value;
 807 };
 808 static const struct multistate multistate_addressfamily[] = {
 809         { "inet",                       AF_INET },
 810         { "inet6",                      AF_INET6 },
 811         { "any",                        AF_UNSPEC },
 812         { NULL, -1 }
 813 };
 814 static const struct multistate multistate_permitrootlogin[] = {
 815         { "without-password",           PERMIT_NO_PASSWD },
 816         { "forced-commands-only",       PERMIT_FORCED_ONLY },
 817         { "yes",                        PERMIT_YES },
 818         { "no",                         PERMIT_NO },
 819         { NULL, -1 }
 820 };
 821 static const struct multistate multistate_compression[] = {
 822         { "delayed",                    COMP_DELAYED },
 823         { "yes",                        COMP_ZLIB },
 824         { "no",                         COMP_NONE },
 825         { NULL, -1 }
 826 };
 827 static const struct multistate multistate_gatewayports[] = {
 828         { "clientspecified",            2 },
 829         { "yes",                        1 },
 830         { "no",                         0 },
 831         { NULL, -1 }
 832 };
 833 static const struct multistate multistate_privsep[] = {
 834         { "yes",                        PRIVSEP_NOSANDBOX },
 835         { "sandbox",                    PRIVSEP_ON },
 836         { "nosandbox",                  PRIVSEP_NOSANDBOX },
 837         { "no",                         PRIVSEP_OFF },
 838         { NULL, -1 }
 839 };
 840 static const struct multistate multistate_tcpfwd[] = {
 841         { "yes",                        FORWARD_ALLOW },
 842         { "all",                        FORWARD_ALLOW },
 843         { "no",                         FORWARD_DENY },
 844         { "remote",                     FORWARD_REMOTE },
 845         { "local",                      FORWARD_LOCAL },
 846         { NULL, -1 }
 847 };
 848
 849 int
 850 process_server_config_line(ServerOptions *options, char *line,
 851     const char *filename, int linenum, int *activep,
 852     struct connection_info *connectinfo)
 853 {
 854         char *cp, **charptr, *arg, *p;
 855         int cmdline = 0, *intptr, value, value2, n;
 856         SyslogFacility *log_facility_ptr;
 857         LogLevel *log_level_ptr;
 858         ServerOpCodes opcode;
 859         int port;
 860         u_int i, flags = 0;
 861         size_t len;
 862         const struct multistate *multistate_ptr;
 863
 864         cp = line;
 865         if ((arg = strdelim(&cp)) == NULL)
 866                 return 0;
 867         /* Ignore leading whitespace */
 868         if (*arg == '\0')
 869                 arg = strdelim(&cp);
 870         if (!arg || !*arg || *arg == '#')
 871                 return 0;
 872         intptr = NULL;
 873         charptr = NULL;
 874         opcode = parse_token(arg, filename, linenum, &flags);
 875
 876         if (activep == NULL) { /* We are processing a command line directive */
 877                 cmdline = 1;
 878                 activep = &cmdline;
 879         }
 880         if (*activep && opcode != sMatch)
 881                 debug3("%s:%d setting %s %s", filename, linenum, arg, cp);
 882         if (*activep == 0 && !(flags & SSHCFG_MATCH)) {
 883                 if (connectinfo == NULL) {
 884                         fatal("%s line %d: Directive '%s' is not allowed "
 885                             "within a Match block", filename, linenum, arg);
 886                 } else { /* this is a directive we have already processed */
 887                         while (arg)
 888                                 arg = strdelim(&cp);
 889                         return 0;
 890                 }
 891         }
 892
 893         switch (opcode) {
 894         /* Portable-specific options */
 895         case sUsePAM:
 896                 intptr = &options->use_pam;
 897                 goto parse_flag;
 898
 899         /* Standard Options */
 900         case sBadOption:
 901                 return -1;
 902         case sPort:
 903                 /* ignore ports from configfile if cmdline specifies ports */
 904                 if (options->ports_from_cmdline)
 905                         return 0;
 906                 if (options->listen_addrs != NULL)
 907                         fatal("%s line %d: ports must be specified before "
 908                             "ListenAddress.", filename, linenum);
 909                 if (options->num_ports >= MAX_PORTS)
 910                         fatal("%s line %d: too many ports.",
 911                             filename, linenum);
 912                 arg = strdelim(&cp);
 913                 if (!arg || *arg == '\0')
 914                         fatal("%s line %d: missing port number.",
 915                             filename, linenum);
 916                 options->ports[options->num_ports++] = a2port(arg);
 917                 if (options->ports[options->num_ports-1] <= 0)
 918                         fatal("%s line %d: Badly formatted port number.",
 919                             filename, linenum);
 920                 break;
 921
 922         case sServerKeyBits:
 923                 intptr = &options->server_key_bits;
 924  parse_int:
 925                 arg = strdelim(&cp);
 926                 if (!arg || *arg == '\0')
 927                         fatal("%s line %d: missing integer value.",
 928                             filename, linenum);
 929                 value = atoi(arg);
 930                 if (*activep && *intptr == -1)
 931                         *intptr = value;
 932                 break;
 933
 934         case sLoginGraceTime:
 935                 intptr = &options->login_grace_time;
 936  parse_time:
 937                 arg = strdelim(&cp);
 938                 if (!arg || *arg == '\0')
 939                         fatal("%s line %d: missing time value.",
 940                             filename, linenum);
 941                 if ((value = convtime(arg)) == -1)
 942                         fatal("%s line %d: invalid time value.",
 943                             filename, linenum);
 944                 if (*intptr == -1)
 945                         *intptr = value;
 946                 break;
 947
 948         case sKeyRegenerationTime:
 949                 intptr = &options->key_regeneration_time;
 950                 goto parse_time;
 951
 952         case sListenAddress:
 953                 arg = strdelim(&cp);
 954                 if (arg == NULL || *arg == '\0')
 955                         fatal("%s line %d: missing address",
 956                             filename, linenum);
 957                 /* check for bare IPv6 address: no "[]" and 2 or more ":" */
 958                 if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL
 959                     && strchr(p+1, ':') != NULL) {
 960                         add_listen_addr(options, arg, 0);
 961                         break;
 962                 }
 963                 p = hpdelim(&arg);
 964                 if (p == NULL)
 965                         fatal("%s line %d: bad address:port usage",
 966                             filename, linenum);
 967                 p = cleanhostname(p);
 968                 if (arg == NULL)
 969                         port = 0;
 970                 else if ((port = a2port(arg)) <= 0)
 971                         fatal("%s line %d: bad port number", filename, linenum);
 972
 973                 add_listen_addr(options, p, port);
 974
 975                 break;
 976
 977         case sAddressFamily:
 978                 intptr = &options->address_family;
 979                 multistate_ptr = multistate_addressfamily;
 980                 if (options->listen_addrs != NULL)
 981                         fatal("%s line %d: address family must be specified "
 982                             "before ListenAddress.", filename, linenum);
 983  parse_multistate:
 984                 arg = strdelim(&cp);
 985                 if (!arg || *arg == '\0')
 986                         fatal("%s line %d: missing argument.",
 987                             filename, linenum);
 988                 value = -1;
 989                 for (i = 0; multistate_ptr[i].key != NULL; i++) {
 990                         if (strcasecmp(arg, multistate_ptr[i].key) == 0) {
 991                                 value = multistate_ptr[i].value;
 992                                 break;
 993                         }
 994                 }
 995                 if (value == -1)
 996                         fatal("%s line %d: unsupported option \"%s\".",
 997                             filename, linenum, arg);
 998                 if (*activep && *intptr == -1)
 999                         *intptr = value;
1000                 break;
1001
1002         case sHostKeyFile:
1003                 intptr = &options->num_host_key_files;
1004                 if (*intptr >= MAX_HOSTKEYS)
1005                         fatal("%s line %d: too many host keys specified (max %d).",
1006                             filename, linenum, MAX_HOSTKEYS);
1007                 charptr = &options->host_key_files[*intptr];
1008  parse_filename:
1009                 arg = strdelim(&cp);
1010                 if (!arg || *arg == '\0')
1011                         fatal("%s line %d: missing file name.",
1012                             filename, linenum);
1013                 if (*activep && *charptr == NULL) {
1014                         *charptr = derelativise_path(arg);
1015                         /* increase optional counter */
1016                         if (intptr != NULL)
1017                                 *intptr = *intptr + 1;
1018                 }
1019                 break;
1020
1021         case sHostCertificate:
1022                 intptr = &options->num_host_cert_files;
1023                 if (*intptr >= MAX_HOSTKEYS)
1024                         fatal("%s line %d: too many host certificates "
1025                             "specified (max %d).", filename, linenum,
1026                             MAX_HOSTCERTS);
1027                 charptr = &options->host_cert_files[*intptr];
1028                 goto parse_filename;
1029                 break;
1030
1031         case sPidFile:
1032                 charptr = &options->pid_file;
1033                 goto parse_filename;
1034
1035         case sPermitRootLogin:
1036                 intptr = &options->permit_root_login;
1037                 multistate_ptr = multistate_permitrootlogin;
1038                 goto parse_multistate;
1039
1040         case sIgnoreRhosts:
1041                 intptr = &options->ignore_rhosts;
1042  parse_flag:
1043                 arg = strdelim(&cp);
1044                 if (!arg || *arg == '\0')
1045                         fatal("%s line %d: missing yes/no argument.",
1046                             filename, linenum);
1047                 value = 0;      /* silence compiler */
1048                 if (strcmp(arg, "yes") == 0)
1049                         value = 1;
1050                 else if (strcmp(arg, "no") == 0)
1051                         value = 0;
1052                 else
1053                         fatal("%s line %d: Bad yes/no argument: %s",
1054                                 filename, linenum, arg);
1055                 if (*activep && *intptr == -1)
1056                         *intptr = value;
1057                 break;
1058
1059         case sIgnoreUserKnownHosts:
1060                 intptr = &options->ignore_user_known_hosts;
1061                 goto parse_flag;
1062
1063         case sRhostsRSAAuthentication:
1064                 intptr = &options->rhosts_rsa_authentication;
1065                 goto parse_flag;
1066
1067         case sHostbasedAuthentication:
1068                 intptr = &options->hostbased_authentication;
1069                 goto parse_flag;
1070
1071         case sHostbasedUsesNameFromPacketOnly:
1072                 intptr = &options->hostbased_uses_name_from_packet_only;
1073                 goto parse_flag;
1074
1075         case sRSAAuthentication:
1076                 intptr = &options->rsa_authentication;
1077                 goto parse_flag;
1078
1079         case sPubkeyAuthentication:
1080                 intptr = &options->pubkey_authentication;
1081                 goto parse_flag;
1082
1083         case sKerberosAuthentication:
1084                 intptr = &options->kerberos_authentication;
1085                 goto parse_flag;
1086
1087         case sKerberosOrLocalPasswd:
1088                 intptr = &options->kerberos_or_local_passwd;
1089                 goto parse_flag;
1090
1091         case sKerberosTicketCleanup:
1092                 intptr = &options->kerberos_ticket_cleanup;
1093                 goto parse_flag;
1094
1095         case sKerberosGetAFSToken:
1096                 intptr = &options->kerberos_get_afs_token;
1097                 goto parse_flag;
1098
1099         case sGssAuthentication:
1100                 intptr = &options->gss_authentication;
1101                 goto parse_flag;
1102
1103         case sGssCleanupCreds:
1104                 intptr = &options->gss_cleanup_creds;
1105                 goto parse_flag;
1106
1107         case sPasswordAuthentication:
1108                 intptr = &options->password_authentication;
1109                 goto parse_flag;
1110
1111         case sZeroKnowledgePasswordAuthentication:
1112                 intptr = &options->zero_knowledge_password_authentication;
1113                 goto parse_flag;
1114
1115         case sKbdInteractiveAuthentication:
1116                 intptr = &options->kbd_interactive_authentication;
1117                 goto parse_flag;
1118
1119         case sChallengeResponseAuthentication:
1120                 intptr = &options->challenge_response_authentication;
1121                 goto parse_flag;
1122
1123         case sPrintMotd:
1124                 intptr = &options->print_motd;
1125                 goto parse_flag;
1126
1127         case sPrintLastLog:
1128                 intptr = &options->print_lastlog;
1129                 goto parse_flag;
1130
1131         case sX11Forwarding:
1132                 intptr = &options->x11_forwarding;
1133                 goto parse_flag;
1134
1135         case sX11DisplayOffset:
1136                 intptr = &options->x11_display_offset;
1137                 goto parse_int;
1138
1139         case sX11UseLocalhost:
1140                 intptr = &options->x11_use_localhost;
1141                 goto parse_flag;
1142
1143         case sXAuthLocation:
1144                 charptr = &options->xauth_location;
1145                 goto parse_filename;
1146
1147         case sStrictModes:
1148                 intptr = &options->strict_modes;
1149                 goto parse_flag;
1150
1151         case sTCPKeepAlive:
1152                 intptr = &options->tcp_keep_alive;
1153                 goto parse_flag;
1154
1155         case sEmptyPasswd:
1156                 intptr = &options->permit_empty_passwd;
1157                 goto parse_flag;
1158
1159         case sPermitUserEnvironment:
1160                 intptr = &options->permit_user_env;
1161                 goto parse_flag;
1162
1163         case sUseLogin:
1164                 intptr = &options->use_login;
1165                 goto parse_flag;
1166
1167         case sCompression:
1168                 intptr = &options->compression;
1169                 multistate_ptr = multistate_compression;
1170                 goto parse_multistate;
1171
1172         case sGatewayPorts:
1173                 intptr = &options->gateway_ports;
1174                 multistate_ptr = multistate_gatewayports;
1175                 goto parse_multistate;
1176
1177         case sUseDNS:
1178                 intptr = &options->use_dns;
1179                 goto parse_flag;
1180
1181         case sLogFacility:
1182                 log_facility_ptr = &options->log_facility;
1183                 arg = strdelim(&cp);
1184                 value = log_facility_number(arg);
1185                 if (value == SYSLOG_FACILITY_NOT_SET)
1186                         fatal("%.200s line %d: unsupported log facility '%s'",
1187                             filename, linenum, arg ? arg : "<NONE>");
1188                 if (*log_facility_ptr == -1)
1189                         *log_facility_ptr = (SyslogFacility) value;
1190                 break;
1191
1192         case sLogLevel:
1193                 log_level_ptr = &options->log_level;
1194                 arg = strdelim(&cp);
1195                 value = log_level_number(arg);
1196                 if (value == SYSLOG_LEVEL_NOT_SET)
1197                         fatal("%.200s line %d: unsupported log level '%s'",
1198                             filename, linenum, arg ? arg : "<NONE>");
1199                 if (*log_level_ptr == -1)
1200                         *log_level_ptr = (LogLevel) value;
1201                 break;
1202
1203         case sAllowTcpForwarding:
1204                 intptr = &options->allow_tcp_forwarding;
1205                 multistate_ptr = multistate_tcpfwd;
1206                 goto parse_multistate;
1207
1208         case sAllowAgentForwarding:
1209                 intptr = &options->allow_agent_forwarding;
1210                 goto parse_flag;
1211
1212         case sUsePrivilegeSeparation:
1213                 intptr = &use_privsep;
1214                 multistate_ptr = multistate_privsep;
1215                 goto parse_multistate;
1216
1217         case sAllowUsers:
1218                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1219                         if (options->num_allow_users >= MAX_ALLOW_USERS)
1220                                 fatal("%s line %d: too many allow users.",
1221                                     filename, linenum);
1222                         if (!*activep)
1223                                 continue;
1224                         options->allow_users[options->num_allow_users++] =
1225                             xstrdup(arg);
1226                 }
1227                 break;
1228
1229         case sDenyUsers:
1230                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1231                         if (options->num_deny_users >= MAX_DENY_USERS)
1232                                 fatal("%s line %d: too many deny users.",
1233                                     filename, linenum);
1234                         if (!*activep)
1235                                 continue;
1236                         options->deny_users[options->num_deny_users++] =
1237                             xstrdup(arg);
1238                 }
1239                 break;
1240
1241         case sAllowGroups:
1242                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1243                         if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
1244                                 fatal("%s line %d: too many allow groups.",
1245                                     filename, linenum);
1246                         if (!*activep)
1247                                 continue;
1248                         options->allow_groups[options->num_allow_groups++] =
1249                             xstrdup(arg);
1250                 }
1251                 break;
1252
1253         case sDenyGroups:
1254                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1255                         if (options->num_deny_groups >= MAX_DENY_GROUPS)
1256                                 fatal("%s line %d: too many deny groups.",
1257                                     filename, linenum);
1258                         if (!*activep)
1259                                 continue;
1260                         options->deny_groups[options->num_deny_groups++] =
1261                             xstrdup(arg);
1262                 }
1263                 break;
1264
1265         case sCiphers:
1266                 arg = strdelim(&cp);
1267                 if (!arg || *arg == '\0')
1268                         fatal("%s line %d: Missing argument.", filename, linenum);
1269                 if (!ciphers_valid(arg))
1270                         fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1271                             filename, linenum, arg ? arg : "<NONE>");
1272                 if (options->ciphers == NULL)
1273                         options->ciphers = xstrdup(arg);
1274                 break;
1275
1276         case sMacs:
1277                 arg = strdelim(&cp);
1278                 if (!arg || *arg == '\0')
1279                         fatal("%s line %d: Missing argument.", filename, linenum);
1280                 if (!mac_valid(arg))
1281                         fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1282                             filename, linenum, arg ? arg : "<NONE>");
1283                 if (options->macs == NULL)
1284                         options->macs = xstrdup(arg);
1285                 break;
1286
1287         case sKexAlgorithms:
1288                 arg = strdelim(&cp);
1289                 if (!arg || *arg == '\0')
1290                         fatal("%s line %d: Missing argument.",
1291                             filename, linenum);
1292                 if (!kex_names_valid(arg))
1293                         fatal("%s line %d: Bad SSH2 KexAlgorithms '%s'.",
1294                             filename, linenum, arg ? arg : "<NONE>");
1295                 if (options->kex_algorithms == NULL)
1296                         options->kex_algorithms = xstrdup(arg);
1297                 break;
1298
1299         case sProtocol:
1300                 intptr = &options->protocol;
1301                 arg = strdelim(&cp);
1302                 if (!arg || *arg == '\0')
1303                         fatal("%s line %d: Missing argument.", filename, linenum);
1304                 value = proto_spec(arg);
1305                 if (value == SSH_PROTO_UNKNOWN)
1306                         fatal("%s line %d: Bad protocol spec '%s'.",
1307                             filename, linenum, arg ? arg : "<NONE>");
1308                 if (*intptr == SSH_PROTO_UNKNOWN)
1309                         *intptr = value;
1310                 break;
1311
1312         case sSubsystem:
1313                 if (options->num_subsystems >= MAX_SUBSYSTEMS) {
1314                         fatal("%s line %d: too many subsystems defined.",
1315                             filename, linenum);
1316                 }
1317                 arg = strdelim(&cp);
1318                 if (!arg || *arg == '\0')
1319                         fatal("%s line %d: Missing subsystem name.",
1320                             filename, linenum);
1321                 if (!*activep) {
1322                         arg = strdelim(&cp);
1323                         break;
1324                 }
1325                 for (i = 0; i < options->num_subsystems; i++)
1326                         if (strcmp(arg, options->subsystem_name[i]) == 0)
1327                                 fatal("%s line %d: Subsystem '%s' already defined.",
1328                                     filename, linenum, arg);
1329                 options->subsystem_name[options->num_subsystems] = xstrdup(arg);
1330                 arg = strdelim(&cp);
1331                 if (!arg || *arg == '\0')
1332                         fatal("%s line %d: Missing subsystem command.",
1333                             filename, linenum);
1334                 options->subsystem_command[options->num_subsystems] = xstrdup(arg);
1335
1336                 /* Collect arguments (separate to executable) */
1337                 p = xstrdup(arg);
1338                 len = strlen(p) + 1;
1339                 while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
1340                         len += 1 + strlen(arg);
1341                         p = xrealloc(p, 1, len);
1342                         strlcat(p, " ", len);
1343                         strlcat(p, arg, len);
1344                 }
1345                 options->subsystem_args[options->num_subsystems] = p;
1346                 options->num_subsystems++;
1347                 break;
1348
1349         case sMaxStartups:
1350                 arg = strdelim(&cp);
1351                 if (!arg || *arg == '\0')
1352                         fatal("%s line %d: Missing MaxStartups spec.",
1353                             filename, linenum);
1354                 if ((n = sscanf(arg, "%d:%d:%d",
1355                     &options->max_startups_begin,
1356                     &options->max_startups_rate,
1357                     &options->max_startups)) == 3) {
1358                         if (options->max_startups_begin >
1359                             options->max_startups ||
1360                             options->max_startups_rate > 100 ||
1361                             options->max_startups_rate < 1)
1362                                 fatal("%s line %d: Illegal MaxStartups spec.",
1363                                     filename, linenum);
1364                 } else if (n != 1)
1365                         fatal("%s line %d: Illegal MaxStartups spec.",
1366                             filename, linenum);
1367                 else
1368                         options->max_startups = options->max_startups_begin;
1369                 break;
1370
1371         case sMaxAuthTries:
1372                 intptr = &options->max_authtries;
1373                 goto parse_int;
1374
1375         case sMaxSessions:
1376                 intptr = &options->max_sessions;
1377                 goto parse_int;
1378
1379         case sBanner:
1380                 charptr = &options->banner;
1381                 goto parse_filename;
1382
1383         /*
1384          * These options can contain %X options expanded at
1385          * connect time, so that you can specify paths like:
1386          *
1387          * AuthorizedKeysFile   /etc/ssh_keys/%u
1388          */
1389         case sAuthorizedKeysFile:
1390                 if (*activep && options->num_authkeys_files == 0) {
1391                         while ((arg = strdelim(&cp)) && *arg != '\0') {
1392                                 if (options->num_authkeys_files >=
1393                                     MAX_AUTHKEYS_FILES)
1394                                         fatal("%s line %d: "
1395                                             "too many authorized keys files.",
1396                                             filename, linenum);
1397                                 options->authorized_keys_files[
1398                                     options->num_authkeys_files++] =
1399                                     tilde_expand_filename(arg, getuid());
1400                         }
1401                 }
1402                 return 0;
1403
1404         case sAuthorizedPrincipalsFile:
1405                 charptr = &options->authorized_principals_file;
1406                 arg = strdelim(&cp);
1407                 if (!arg || *arg == '\0')
1408                         fatal("%s line %d: missing file name.",
1409                             filename, linenum);
1410                 if (*activep && *charptr == NULL) {
1411                         *charptr = tilde_expand_filename(arg, getuid());
1412                         /* increase optional counter */
1413                         if (intptr != NULL)
1414                                 *intptr = *intptr + 1;
1415                 }
1416                 break;
1417
1418         case sClientAliveInterval:
1419                 intptr = &options->client_alive_interval;
1420                 goto parse_time;
1421
1422         case sClientAliveCountMax:
1423                 intptr = &options->client_alive_count_max;
1424                 goto parse_int;
1425
1426         case sAcceptEnv:
1427                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1428                         if (strchr(arg, '=') != NULL)
1429                                 fatal("%s line %d: Invalid environment name.",
1430                                     filename, linenum);
1431                         if (options->num_accept_env >= MAX_ACCEPT_ENV)
1432                                 fatal("%s line %d: too many allow env.",
1433                                     filename, linenum);
1434                         if (!*activep)
1435                                 continue;
1436                         options->accept_env[options->num_accept_env++] =
1437                             xstrdup(arg);
1438                 }
1439                 break;
1440
1441         case sPermitTunnel:
1442                 intptr = &options->permit_tun;
1443                 arg = strdelim(&cp);
1444                 if (!arg || *arg == '\0')
1445                         fatal("%s line %d: Missing yes/point-to-point/"
1446                             "ethernet/no argument.", filename, linenum);
1447                 value = -1;
1448                 for (i = 0; tunmode_desc[i].val != -1; i++)
1449                         if (strcmp(tunmode_desc[i].text, arg) == 0) {
1450                                 value = tunmode_desc[i].val;
1451                                 break;
1452                         }
1453                 if (value == -1)
1454                         fatal("%s line %d: Bad yes/point-to-point/ethernet/"
1455                             "no argument: %s", filename, linenum, arg);
1456                 if (*intptr == -1)
1457                         *intptr = value;
1458                 break;
1459
1460         case sMatch:
1461                 if (cmdline)
1462                         fatal("Match directive not supported as a command-line "
1463                            "option");
1464                 value = match_cfg_line(&cp, linenum, connectinfo);
1465                 if (value < 0)
1466                         fatal("%s line %d: Bad Match condition", filename,
1467                             linenum);
1468                 *activep = value;
1469                 break;
1470
1471         case sPermitOpen:
1472                 arg = strdelim(&cp);
1473                 if (!arg || *arg == '\0')
1474                         fatal("%s line %d: missing PermitOpen specification",
1475                             filename, linenum);
1476                 n = options->num_permitted_opens;       /* modified later */
1477                 if (strcmp(arg, "any") == 0) {
1478                         if (*activep && n == -1) {
1479                                 channel_clear_adm_permitted_opens();
1480                                 options->num_permitted_opens = 0;
1481                         }
1482                         break;
1483                 }
1484                 if (strcmp(arg, "none") == 0) {
1485                         if (*activep && n == -1) {
1486                                 options->num_permitted_opens = 1;
1487                                 channel_disable_adm_local_opens();
1488                         }
1489                         break;
1490                 }
1491                 if (*activep && n == -1)
1492                         channel_clear_adm_permitted_opens();
1493                 for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) {
1494                         p = hpdelim(&arg);
1495                         if (p == NULL)
1496                                 fatal("%s line %d: missing host in PermitOpen",
1497                                     filename, linenum);
1498                         p = cleanhostname(p);
1499                         if (arg == NULL || ((port = permitopen_port(arg)) < 0))
1500                                 fatal("%s line %d: bad port number in "
1501                                     "PermitOpen", filename, linenum);
1502                         if (*activep && n == -1)
1503                                 options->num_permitted_opens =
1504                                     channel_add_adm_permitted_opens(p, port);
1505                 }
1506                 break;
1507
1508         case sForceCommand:
1509                 if (cp == NULL)
1510                         fatal("%.200s line %d: Missing argument.", filename,
1511                             linenum);
1512                 len = strspn(cp, WHITESPACE);
1513                 if (*activep && options->adm_forced_command == NULL)
1514                         options->adm_forced_command = xstrdup(cp + len);
1515                 return 0;
1516
1517         case sChrootDirectory:
1518                 charptr = &options->chroot_directory;
1519
1520                 arg = strdelim(&cp);
1521                 if (!arg || *arg == '\0')
1522                         fatal("%s line %d: missing file name.",
1523                             filename, linenum);
1524                 if (*activep && *charptr == NULL)
1525                         *charptr = xstrdup(arg);
1526                 break;
1527
1528         case sTrustedUserCAKeys:
1529                 charptr = &options->trusted_user_ca_keys;
1530                 goto parse_filename;
1531
1532         case sRevokedKeys:
1533                 charptr = &options->revoked_keys_file;
1534                 goto parse_filename;
1535
1536         case sIPQoS:
1537                 arg = strdelim(&cp);
1538                 if ((value = parse_ipqos(arg)) == -1)
1539                         fatal("%s line %d: Bad IPQoS value: %s",
1540                             filename, linenum, arg);
1541                 arg = strdelim(&cp);
1542                 if (arg == NULL)
1543                         value2 = value;
1544                 else if ((value2 = parse_ipqos(arg)) == -1)
1545                         fatal("%s line %d: Bad IPQoS value: %s",
1546                             filename, linenum, arg);
1547                 if (*activep) {
1548                         options->ip_qos_interactive = value;
1549                         options->ip_qos_bulk = value2;
1550                 }
1551                 break;
1552
1553         case sVersionAddendum:
1554                 if (cp == NULL)
1555                         fatal("%.200s line %d: Missing argument.", filename,
1556                             linenum);
1557                 len = strspn(cp, WHITESPACE);
1558                 if (*activep && options->version_addendum == NULL) {
1559                         if (strcasecmp(cp + len, "none") == 0)
1560                                 options->version_addendum = xstrdup("");
1561                         else if (strchr(cp + len, '\r') != NULL)
1562                                 fatal("%.200s line %d: Invalid argument",
1563                                     filename, linenum);
1564                         else
1565                                 options->version_addendum = xstrdup(cp + len);
1566                 }
1567                 return 0;
1568
1569         case sAuthorizedKeysCommand:
1570                 len = strspn(cp, WHITESPACE);
1571                 if (*activep && options->authorized_keys_command == NULL) {
1572                         if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0)
1573                                 fatal("%.200s line %d: AuthorizedKeysCommand "
1574                                     "must be an absolute path",
1575                                     filename, linenum);
1576                         options->authorized_keys_command = xstrdup(cp + len);
1577                 }
1578                 return 0;
1579
1580         case sAuthorizedKeysCommandUser:
1581                 charptr = &options->authorized_keys_command_user;
1582
1583                 arg = strdelim(&cp);
1584                 if (*activep && *charptr == NULL)
1585                         *charptr = xstrdup(arg);
1586                 break;
1587
1588         case sAuthenticationMethods:
1589                 if (*activep && options->num_auth_methods == 0) {
1590                         while ((arg = strdelim(&cp)) && *arg != '\0') {
1591                                 if (options->num_auth_methods >=
1592                                     MAX_AUTH_METHODS)
1593                                         fatal("%s line %d: "
1594                                             "too many authentication methods.",
1595                                             filename, linenum);
1596                                 if (auth2_methods_valid(arg, 0) != 0)
1597                                         fatal("%s line %d: invalid "
1598                                             "authentication method list.",
1599                                             filename, linenum);
1600                                 options->auth_methods[
1601                                     options->num_auth_methods++] = xstrdup(arg);
1602                         }
1603                 }
1604                 return 0;
1605
1606         case sHPNDisabled:
1607                 intptr = &options->hpn_disabled;
1608                 goto parse_flag;
1609
1610         case sHPNBufferSize:
1611                 intptr = &options->hpn_buffer_size;
1612                 goto parse_int;
1613
1614         case sTcpRcvBufPoll:
1615                 intptr = &options->tcp_rcv_buf_poll;
1616                 goto parse_flag;
1617
1618 #ifdef  NONE_CIPHER_ENABLED
1619         case sNoneEnabled:
1620                 intptr = &options->none_enabled;
1621                 goto parse_flag;
1622 #endif
1623
1624         case sDeprecated:
1625                 logit("%s line %d: Deprecated option %s",
1626                     filename, linenum, arg);
1627                 while (arg)
1628                     arg = strdelim(&cp);
1629                 break;
1630
1631         case sUnsupported:
1632                 logit("%s line %d: Unsupported option %s",
1633                     filename, linenum, arg);
1634                 while (arg)
1635                     arg = strdelim(&cp);
1636                 break;
1637
1638         default:
1639                 fatal("%s line %d: Missing handler for opcode %s (%d)",
1640                     filename, linenum, arg, opcode);
1641         }
1642         if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
1643                 fatal("%s line %d: garbage at end of line; \"%.200s\".",
1644                     filename, linenum, arg);
1645         return 0;
1646 }
1647
1648 /* Reads the server configuration file. */
1649
1650 void
1651 load_server_config(const char *filename, Buffer *conf)
1652 {
1653         char line[4096], *cp;
1654         FILE *f;
1655         int lineno = 0;
1656
1657         debug2("%s: filename %s", __func__, filename);
1658         if ((f = fopen(filename, "r")) == NULL) {
1659                 perror(filename);
1660                 exit(1);
1661         }
1662         buffer_clear(conf);
1663         while (fgets(line, sizeof(line), f)) {
1664                 lineno++;
1665                 if (strlen(line) == sizeof(line) - 1)
1666                         fatal("%s line %d too long", filename, lineno);
1667                 /*
1668                  * Trim out comments and strip whitespace
1669                  * NB - preserve newlines, they are needed to reproduce
1670                  * line numbers later for error messages
1671                  */
1672                 if ((cp = strchr(line, '#')) != NULL)
1673                         memcpy(cp, "\n", 2);
1674                 cp = line + strspn(line, " \t\r");
1675
1676                 buffer_append(conf, cp, strlen(cp));
1677         }
1678         buffer_append(conf, "\0", 1);
1679         fclose(f);
1680         debug2("%s: done config len = %d", __func__, buffer_len(conf));
1681 }
1682
1683 void
1684 parse_server_match_config(ServerOptions *options,
1685    struct connection_info *connectinfo)
1686 {
1687         ServerOptions mo;
1688
1689         initialize_server_options(&mo);
1690         parse_server_config(&mo, "reprocess config", &cfg, connectinfo);
1691         copy_set_server_options(options, &mo, 0);
1692 }
1693
1694 int parse_server_match_testspec(struct connection_info *ci, char *spec)
1695 {
1696         char *p;
1697
1698         while ((p = strsep(&spec, ",")) && *p != '\0') {
1699                 if (strncmp(p, "addr=", 5) == 0) {
1700                         ci->address = xstrdup(p + 5);
1701                 } else if (strncmp(p, "host=", 5) == 0) {
1702                         ci->host = xstrdup(p + 5);
1703                 } else if (strncmp(p, "user=", 5) == 0) {
1704                         ci->user = xstrdup(p + 5);
1705                 } else if (strncmp(p, "laddr=", 6) == 0) {
1706                         ci->laddress = xstrdup(p + 6);
1707                 } else if (strncmp(p, "lport=", 6) == 0) {
1708                         ci->lport = a2port(p + 6);
1709                         if (ci->lport == -1) {
1710                                 fprintf(stderr, "Invalid port '%s' in test mode"
1711                                    " specification %s\n", p+6, p);
1712                                 return -1;
1713                         }
1714                 } else {
1715                         fprintf(stderr, "Invalid test mode specification %s\n",
1716                            p);
1717                         return -1;
1718                 }
1719         }
1720         return 0;
1721 }
1722
1723 /*
1724  * returns 1 for a complete spec, 0 for partial spec and -1 for an
1725  * empty spec.
1726  */
1727 int server_match_spec_complete(struct connection_info *ci)
1728 {
1729         if (ci->user && ci->host && ci->address)
1730                 return 1;       /* complete */
1731         if (!ci->user && !ci->host && !ci->address)
1732                 return -1;      /* empty */
1733         return 0;       /* partial */
1734 }
1735
1736 /* Helper macros */
1737 #define M_CP_INTOPT(n) do {\
1738         if (src->n != -1) \
1739                 dst->n = src->n; \
1740 } while (0)
1741 #define M_CP_STROPT(n) do {\
1742         if (src->n != NULL) { \
1743                 if (dst->n != NULL) \
1744                         xfree(dst->n); \
1745                 dst->n = src->n; \
1746         } \
1747 } while(0)
1748 #define M_CP_STRARRAYOPT(n, num_n) do {\
1749         if (src->num_n != 0) { \
1750                 for (dst->num_n = 0; dst->num_n < src->num_n; dst->num_n++) \
1751                         dst->n[dst->num_n] = xstrdup(src->n[dst->num_n]); \
1752         } \
1753 } while(0)
1754
1755 /*
1756  * Copy any supported values that are set.
1757  *
1758  * If the preauth flag is set, we do not bother copying the string or
1759  * array values that are not used pre-authentication, because any that we
1760  * do use must be explictly sent in mm_getpwnamallow().
1761  */
1762 void
1763 copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
1764 {
1765         M_CP_INTOPT(password_authentication);
1766         M_CP_INTOPT(gss_authentication);
1767         M_CP_INTOPT(rsa_authentication);
1768         M_CP_INTOPT(pubkey_authentication);
1769         M_CP_INTOPT(kerberos_authentication);
1770         M_CP_INTOPT(hostbased_authentication);
1771         M_CP_INTOPT(hostbased_uses_name_from_packet_only);
1772         M_CP_INTOPT(kbd_interactive_authentication);
1773         M_CP_INTOPT(zero_knowledge_password_authentication);
1774         M_CP_STROPT(authorized_keys_command);
1775         M_CP_STROPT(authorized_keys_command_user);
1776         M_CP_INTOPT(permit_root_login);
1777         M_CP_INTOPT(permit_empty_passwd);
1778
1779         M_CP_INTOPT(allow_tcp_forwarding);
1780         M_CP_INTOPT(allow_agent_forwarding);
1781         M_CP_INTOPT(permit_tun);
1782         M_CP_INTOPT(gateway_ports);
1783         M_CP_INTOPT(x11_display_offset);
1784         M_CP_INTOPT(x11_forwarding);
1785         M_CP_INTOPT(x11_use_localhost);
1786         M_CP_INTOPT(max_sessions);
1787         M_CP_INTOPT(max_authtries);
1788         M_CP_INTOPT(ip_qos_interactive);
1789         M_CP_INTOPT(ip_qos_bulk);
1790
1791         /* See comment in servconf.h */
1792         COPY_MATCH_STRING_OPTS();
1793
1794         /*
1795          * The only things that should be below this point are string options
1796          * which are only used after authentication.
1797          */
1798         if (preauth)
1799                 return;
1800
1801         M_CP_STROPT(adm_forced_command);
1802         M_CP_STROPT(chroot_directory);
1803 }
1804
1805 #undef M_CP_INTOPT
1806 #undef M_CP_STROPT
1807 #undef M_CP_STRARRAYOPT
1808
1809 void
1810 parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
1811     struct connection_info *connectinfo)
1812 {
1813         int active, linenum, bad_options = 0;
1814         char *cp, *obuf, *cbuf;
1815
1816         debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
1817
1818         obuf = cbuf = xstrdup(buffer_ptr(conf));
1819         active = connectinfo ? 0 : 1;
1820         linenum = 1;
1821         while ((cp = strsep(&cbuf, "\n")) != NULL) {
1822                 if (process_server_config_line(options, cp, filename,
1823                     linenum++, &active, connectinfo) != 0)
1824                         bad_options++;
1825         }
1826         xfree(obuf);
1827         if (bad_options > 0)
1828                 fatal("%s: terminating, %d bad configuration options",
1829                     filename, bad_options);
1830 }
1831
1832 static const char *
1833 fmt_multistate_int(int val, const struct multistate *m)
1834 {
1835         u_int i;
1836
1837         for (i = 0; m[i].key != NULL; i++) {
1838                 if (m[i].value == val)
1839                         return m[i].key;
1840         }
1841         return "UNKNOWN";
1842 }
1843
1844 static const char *
1845 fmt_intarg(ServerOpCodes code, int val)
1846 {
1847         if (val == -1)
1848                 return "unset";
1849         switch (code) {
1850         case sAddressFamily:
1851                 return fmt_multistate_int(val, multistate_addressfamily);
1852         case sPermitRootLogin:
1853                 return fmt_multistate_int(val, multistate_permitrootlogin);
1854         case sGatewayPorts:
1855                 return fmt_multistate_int(val, multistate_gatewayports);
1856         case sCompression:
1857                 return fmt_multistate_int(val, multistate_compression);
1858         case sUsePrivilegeSeparation:
1859                 return fmt_multistate_int(val, multistate_privsep);
1860         case sAllowTcpForwarding:
1861                 return fmt_multistate_int(val, multistate_tcpfwd);
1862         case sProtocol:
1863                 switch (val) {
1864                 case SSH_PROTO_1:
1865                         return "1";
1866                 case SSH_PROTO_2:
1867                         return "2";
1868                 case (SSH_PROTO_1|SSH_PROTO_2):
1869                         return "2,1";
1870                 default:
1871                         return "UNKNOWN";
1872                 }
1873         default:
1874                 switch (val) {
1875                 case 0:
1876                         return "no";
1877                 case 1:
1878                         return "yes";
1879                 default:
1880                         return "UNKNOWN";
1881                 }
1882         }
1883 }
1884
1885 static const char *
1886 lookup_opcode_name(ServerOpCodes code)
1887 {
1888         u_int i;
1889
1890         for (i = 0; keywords[i].name != NULL; i++)
1891                 if (keywords[i].opcode == code)
1892                         return(keywords[i].name);
1893         return "UNKNOWN";
1894 }
1895
1896 static void
1897 dump_cfg_int(ServerOpCodes code, int val)
1898 {
1899         printf("%s %d\n", lookup_opcode_name(code), val);
1900 }
1901
1902 static void
1903 dump_cfg_fmtint(ServerOpCodes code, int val)
1904 {
1905         printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
1906 }
1907
1908 static void
1909 dump_cfg_string(ServerOpCodes code, const char *val)
1910 {
1911         if (val == NULL)
1912                 return;
1913         printf("%s %s\n", lookup_opcode_name(code), val);
1914 }
1915
1916 static void
1917 dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals)
1918 {
1919         u_int i;
1920
1921         for (i = 0; i < count; i++)
1922                 printf("%s %s\n", lookup_opcode_name(code), vals[i]);
1923 }
1924
1925 static void
1926 dump_cfg_strarray_oneline(ServerOpCodes code, u_int count, char **vals)
1927 {
1928         u_int i;
1929
1930         printf("%s", lookup_opcode_name(code));
1931         for (i = 0; i < count; i++)
1932                 printf(" %s",  vals[i]);
1933         printf("\n");
1934 }
1935
1936 void
1937 dump_config(ServerOptions *o)
1938 {
1939         u_int i;
1940         int ret;
1941         struct addrinfo *ai;
1942         char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL;
1943
1944         /* these are usually at the top of the config */
1945         for (i = 0; i < o->num_ports; i++)
1946                 printf("port %d\n", o->ports[i]);
1947         dump_cfg_fmtint(sProtocol, o->protocol);
1948         dump_cfg_fmtint(sAddressFamily, o->address_family);
1949
1950         /* ListenAddress must be after Port */
1951         for (ai = o->listen_addrs; ai; ai = ai->ai_next) {
1952                 if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr,
1953                     sizeof(addr), port, sizeof(port),
1954                     NI_NUMERICHOST|NI_NUMERICSERV)) != 0) {
1955                         error("getnameinfo failed: %.100s",
1956                             (ret != EAI_SYSTEM) ? gai_strerror(ret) :
1957                             strerror(errno));
1958                 } else {
1959                         if (ai->ai_family == AF_INET6)
1960                                 printf("listenaddress [%s]:%s\n", addr, port);
1961                         else
1962                                 printf("listenaddress %s:%s\n", addr, port);
1963                 }
1964         }
1965
1966         /* integer arguments */
1967 #ifdef USE_PAM
1968         dump_cfg_int(sUsePAM, o->use_pam);
1969 #endif
1970         dump_cfg_int(sServerKeyBits, o->server_key_bits);
1971         dump_cfg_int(sLoginGraceTime, o->login_grace_time);
1972         dump_cfg_int(sKeyRegenerationTime, o->key_regeneration_time);
1973         dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
1974         dump_cfg_int(sMaxAuthTries, o->max_authtries);
1975         dump_cfg_int(sMaxSessions, o->max_sessions);
1976         dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
1977         dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max);
1978
1979         /* formatted integer arguments */
1980         dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login);
1981         dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts);
1982         dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts);
1983         dump_cfg_fmtint(sRhostsRSAAuthentication, o->rhosts_rsa_authentication);
1984         dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication);
1985         dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly,
1986             o->hostbased_uses_name_from_packet_only);
1987         dump_cfg_fmtint(sRSAAuthentication, o->rsa_authentication);
1988         dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication);
1989 #ifdef KRB5
1990         dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication);
1991         dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd);
1992         dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup);
1993 # ifdef USE_AFS
1994         dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
1995 # endif
1996 #endif
1997 #ifdef GSSAPI
1998         dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
1999         dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
2000 #endif
2001 #ifdef JPAKE
2002         dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication,
2003             o->zero_knowledge_password_authentication);
2004 #endif
2005         dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
2006         dump_cfg_fmtint(sKbdInteractiveAuthentication,
2007             o->kbd_interactive_authentication);
2008         dump_cfg_fmtint(sChallengeResponseAuthentication,
2009             o->challenge_response_authentication);
2010         dump_cfg_fmtint(sPrintMotd, o->print_motd);
2011         dump_cfg_fmtint(sPrintLastLog, o->print_lastlog);
2012         dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding);
2013         dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
2014         dump_cfg_fmtint(sStrictModes, o->strict_modes);
2015         dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
2016         dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
2017         dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
2018         dump_cfg_fmtint(sUseLogin, o->use_login);
2019         dump_cfg_fmtint(sCompression, o->compression);
2020         dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
2021         dump_cfg_fmtint(sUseDNS, o->use_dns);
2022         dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
2023         dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
2024
2025         /* string arguments */
2026         dump_cfg_string(sPidFile, o->pid_file);
2027         dump_cfg_string(sXAuthLocation, o->xauth_location);
2028         dump_cfg_string(sCiphers, o->ciphers);
2029         dump_cfg_string(sMacs, o->macs);
2030         dump_cfg_string(sBanner, o->banner);
2031         dump_cfg_string(sForceCommand, o->adm_forced_command);
2032         dump_cfg_string(sChrootDirectory, o->chroot_directory);
2033         dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
2034         dump_cfg_string(sRevokedKeys, o->revoked_keys_file);
2035         dump_cfg_string(sAuthorizedPrincipalsFile,
2036             o->authorized_principals_file);
2037         dump_cfg_string(sVersionAddendum, o->version_addendum);
2038         dump_cfg_string(sAuthorizedKeysCommand, o->authorized_keys_command);
2039         dump_cfg_string(sAuthorizedKeysCommandUser, o->authorized_keys_command_user);
2040
2041         /* string arguments requiring a lookup */
2042         dump_cfg_string(sLogLevel, log_level_name(o->log_level));
2043         dump_cfg_string(sLogFacility, log_facility_name(o->log_facility));
2044
2045         /* string array arguments */
2046         dump_cfg_strarray_oneline(sAuthorizedKeysFile, o->num_authkeys_files,
2047             o->authorized_keys_files);
2048         dump_cfg_strarray(sHostKeyFile, o->num_host_key_files,
2049              o->host_key_files);
2050         dump_cfg_strarray(sHostKeyFile, o->num_host_cert_files,
2051              o->host_cert_files);
2052         dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users);
2053         dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users);
2054         dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups);
2055         dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups);
2056         dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env);
2057         dump_cfg_strarray_oneline(sAuthenticationMethods,
2058             o->num_auth_methods, o->auth_methods);
2059
2060         /* other arguments */
2061         for (i = 0; i < o->num_subsystems; i++)
2062                 printf("subsystem %s %s\n", o->subsystem_name[i],
2063                     o->subsystem_args[i]);
2064
2065         printf("maxstartups %d:%d:%d\n", o->max_startups_begin,
2066             o->max_startups_rate, o->max_startups);
2067
2068         for (i = 0; tunmode_desc[i].val != -1; i++)
2069                 if (tunmode_desc[i].val == o->permit_tun) {
2070                         s = tunmode_desc[i].text;
2071                         break;
2072                 }
2073         dump_cfg_string(sPermitTunnel, s);
2074
2075         printf("ipqos %s ", iptos2str(o->ip_qos_interactive));
2076         printf("%s\n", iptos2str(o->ip_qos_bulk));
2077
2078         channel_print_adm_permitted_opens();
2079 }