crypto/openssh/servconf.c

   1
   2 /* $OpenBSD: servconf.c,v 1.292 2016/06/23 05:17:51 djm Exp $ */
   3 /*
   4  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   5  *                    All rights reserved
   6  *
   7  * As far as I am concerned, the code I have written for this software
   8  * can be used freely for any purpose.  Any derived versions of this
   9  * software must be clearly marked as such, and if the derived work is
  10  * incompatible with the protocol description in the RFC file, it must be
  11  * called by a name other than "ssh" or "Secure Shell".
  12  */
  13
  14 #include "includes.h"
  15 __RCSID("$FreeBSD$");
  16
  17 #include <sys/types.h>
  18 #include <sys/socket.h>
  19
  20 #include <netinet/in.h>
  21 #include <netinet/in_systm.h>
  22 #include <netinet/ip.h>
  23
  24 #include <ctype.h>
  25 #include <netdb.h>
  26 #include <pwd.h>
  27 #include <stdio.h>
  28 #include <stdlib.h>
  29 #include <string.h>
  30 #include <signal.h>
  31 #include <unistd.h>
  32 #include <limits.h>
  33 #include <stdarg.h>
  34 #include <errno.h>
  35 #ifdef HAVE_UTIL_H
  36 #include <util.h>
  37 #endif
  38
  39 #include "openbsd-compat/sys-queue.h"
  40 #include "xmalloc.h"
  41 #include "ssh.h"
  42 #include "log.h"
  43 #include "buffer.h"
  44 #include "misc.h"
  45 #include "servconf.h"
  46 #include "compat.h"
  47 #include "pathnames.h"
  48 #include "cipher.h"
  49 #include "key.h"
  50 #include "kex.h"
  51 #include "mac.h"
  52 #include "match.h"
  53 #include "channels.h"
  54 #include "groupaccess.h"
  55 #include "canohost.h"
  56 #include "packet.h"
  57 #include "hostfile.h"
  58 #include "auth.h"
  59 #include "myproposal.h"
  60 #include "digest.h"
  61 #include "version.h"
  62
  63 static void add_listen_addr(ServerOptions *, char *, int);
  64 static void add_one_listen_addr(ServerOptions *, char *, int);
  65
  66 /* Use of privilege separation or not */
  67 extern int use_privsep;
  68 extern Buffer cfg;
  69
  70 /* Initializes the server options to their default values. */
  71
  72 void
  73 initialize_server_options(ServerOptions *options)
  74 {
  75         memset(options, 0, sizeof(*options));
  76
  77         /* Portable-specific options */
  78         options->use_pam = -1;
  79
  80         /* Standard Options */
  81         options->num_ports = 0;
  82         options->ports_from_cmdline = 0;
  83         options->queued_listen_addrs = NULL;
  84         options->num_queued_listens = 0;
  85         options->listen_addrs = NULL;
  86         options->address_family = -1;
  87         options->num_host_key_files = 0;
  88         options->num_host_cert_files = 0;
  89         options->host_key_agent = NULL;
  90         options->pid_file = NULL;
  91         options->server_key_bits = -1;
  92         options->login_grace_time = -1;
  93         options->key_regeneration_time = -1;
  94         options->permit_root_login = PERMIT_NOT_SET;
  95         options->ignore_rhosts = -1;
  96         options->ignore_user_known_hosts = -1;
  97         options->print_motd = -1;
  98         options->print_lastlog = -1;
  99         options->x11_forwarding = -1;
 100         options->x11_display_offset = -1;
 101         options->x11_use_localhost = -1;
 102         options->permit_tty = -1;
 103         options->permit_user_rc = -1;
 104         options->xauth_location = NULL;
 105         options->strict_modes = -1;
 106         options->tcp_keep_alive = -1;
 107         options->log_facility = SYSLOG_FACILITY_NOT_SET;
 108         options->log_level = SYSLOG_LEVEL_NOT_SET;
 109         options->rhosts_rsa_authentication = -1;
 110         options->hostbased_authentication = -1;
 111         options->hostbased_uses_name_from_packet_only = -1;
 112         options->hostbased_key_types = NULL;
 113         options->hostkeyalgorithms = NULL;
 114         options->rsa_authentication = -1;
 115         options->pubkey_authentication = -1;
 116         options->pubkey_key_types = NULL;
 117         options->kerberos_authentication = -1;
 118         options->kerberos_or_local_passwd = -1;
 119         options->kerberos_ticket_cleanup = -1;
 120         options->kerberos_get_afs_token = -1;
 121         options->gss_authentication=-1;
 122         options->gss_cleanup_creds = -1;
 123         options->gss_strict_acceptor = -1;
 124         options->password_authentication = -1;
 125         options->kbd_interactive_authentication = -1;
 126         options->challenge_response_authentication = -1;
 127         options->permit_empty_passwd = -1;
 128         options->permit_user_env = -1;
 129         options->use_login = -1;
 130         options->compression = -1;
 131         options->rekey_limit = -1;
 132         options->rekey_interval = -1;
 133         options->allow_tcp_forwarding = -1;
 134         options->allow_streamlocal_forwarding = -1;
 135         options->allow_agent_forwarding = -1;
 136         options->num_allow_users = 0;
 137         options->num_deny_users = 0;
 138         options->num_allow_groups = 0;
 139         options->num_deny_groups = 0;
 140         options->ciphers = NULL;
 141         options->macs = NULL;
 142         options->kex_algorithms = NULL;
 143         options->protocol = SSH_PROTO_UNKNOWN;
 144         options->fwd_opts.gateway_ports = -1;
 145         options->fwd_opts.streamlocal_bind_mask = (mode_t)-1;
 146         options->fwd_opts.streamlocal_bind_unlink = -1;
 147         options->num_subsystems = 0;
 148         options->max_startups_begin = -1;
 149         options->max_startups_rate = -1;
 150         options->max_startups = -1;
 151         options->max_authtries = -1;
 152         options->max_sessions = -1;
 153         options->banner = NULL;
 154         options->use_dns = -1;
 155         options->client_alive_interval = -1;
 156         options->client_alive_count_max = -1;
 157         options->num_authkeys_files = 0;
 158         options->num_accept_env = 0;
 159         options->permit_tun = -1;
 160         options->num_permitted_opens = -1;
 161         options->adm_forced_command = NULL;
 162         options->chroot_directory = NULL;
 163         options->authorized_keys_command = NULL;
 164         options->authorized_keys_command_user = NULL;
 165         options->revoked_keys_file = NULL;
 166         options->trusted_user_ca_keys = NULL;
 167         options->authorized_principals_file = NULL;
 168         options->authorized_principals_command = NULL;
 169         options->authorized_principals_command_user = NULL;
 170         options->ip_qos_interactive = -1;
 171         options->ip_qos_bulk = -1;
 172         options->version_addendum = NULL;
 173         options->fingerprint_hash = -1;
 174 }
 175
 176 /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
 177 static int
 178 option_clear_or_none(const char *o)
 179 {
 180         return o == NULL || strcasecmp(o, "none") == 0;
 181 }
 182
 183 static void
 184 assemble_algorithms(ServerOptions *o)
 185 {
 186         if (kex_assemble_names(KEX_SERVER_ENCRYPT, &o->ciphers) != 0 ||
 187             kex_assemble_names(KEX_SERVER_MAC, &o->macs) != 0 ||
 188             kex_assemble_names(KEX_SERVER_KEX, &o->kex_algorithms) != 0 ||
 189             kex_assemble_names(KEX_DEFAULT_PK_ALG,
 190             &o->hostkeyalgorithms) != 0 ||
 191             kex_assemble_names(KEX_DEFAULT_PK_ALG,
 192             &o->hostbased_key_types) != 0 ||
 193             kex_assemble_names(KEX_DEFAULT_PK_ALG, &o->pubkey_key_types) != 0)
 194                 fatal("kex_assemble_names failed");
 195 }
 196
 197 void
 198 fill_default_server_options(ServerOptions *options)
 199 {
 200         int i;
 201
 202         /* Portable-specific options */
 203         if (options->use_pam == -1)
 204                 options->use_pam = 1;
 205
 206         /* Standard Options */
 207         if (options->protocol == SSH_PROTO_UNKNOWN)
 208                 options->protocol = SSH_PROTO_2;
 209         if (options->protocol & SSH_PROTO_1)
 210                 error("WARNING: SSH protocol version 1 enabled");
 211         if (options->num_host_key_files == 0) {
 212                 /* fill default hostkeys for protocols */
 213                 if (options->protocol & SSH_PROTO_1)
 214                         options->host_key_files[options->num_host_key_files++] =
 215                             _PATH_HOST_KEY_FILE;
 216                 if (options->protocol & SSH_PROTO_2) {
 217                         options->host_key_files[options->num_host_key_files++] =
 218                             _PATH_HOST_RSA_KEY_FILE;
 219                         options->host_key_files[options->num_host_key_files++] =
 220                             _PATH_HOST_DSA_KEY_FILE;
 221 #ifdef OPENSSL_HAS_ECC
 222                         options->host_key_files[options->num_host_key_files++] =
 223                             _PATH_HOST_ECDSA_KEY_FILE;
 224 #endif
 225                         options->host_key_files[options->num_host_key_files++] =
 226                             _PATH_HOST_ED25519_KEY_FILE;
 227                 }
 228         }
 229         /* No certificates by default */
 230         if (options->num_ports == 0)
 231                 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
 232         if (options->address_family == -1)
 233                 options->address_family = AF_UNSPEC;
 234         if (options->listen_addrs == NULL)
 235                 add_listen_addr(options, NULL, 0);
 236         if (options->pid_file == NULL)
 237                 options->pid_file = xstrdup(_PATH_SSH_DAEMON_PID_FILE);
 238         if (options->server_key_bits == -1)
 239                 options->server_key_bits = 1024;
 240         if (options->login_grace_time == -1)
 241                 options->login_grace_time = 120;
 242         if (options->key_regeneration_time == -1)
 243                 options->key_regeneration_time = 3600;
 244         if (options->permit_root_login == PERMIT_NOT_SET)
 245                 options->permit_root_login = PERMIT_NO;
 246         if (options->ignore_rhosts == -1)
 247                 options->ignore_rhosts = 1;
 248         if (options->ignore_user_known_hosts == -1)
 249                 options->ignore_user_known_hosts = 0;
 250         if (options->print_motd == -1)
 251                 options->print_motd = 1;
 252         if (options->print_lastlog == -1)
 253                 options->print_lastlog = 1;
 254         if (options->x11_forwarding == -1)
 255                 options->x11_forwarding = 1;
 256         if (options->x11_display_offset == -1)
 257                 options->x11_display_offset = 10;
 258         if (options->x11_use_localhost == -1)
 259                 options->x11_use_localhost = 1;
 260         if (options->xauth_location == NULL)
 261                 options->xauth_location = xstrdup(_PATH_XAUTH);
 262         if (options->permit_tty == -1)
 263                 options->permit_tty = 1;
 264         if (options->permit_user_rc == -1)
 265                 options->permit_user_rc = 1;
 266         if (options->strict_modes == -1)
 267                 options->strict_modes = 1;
 268         if (options->tcp_keep_alive == -1)
 269                 options->tcp_keep_alive = 1;
 270         if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
 271                 options->log_facility = SYSLOG_FACILITY_AUTH;
 272         if (options->log_level == SYSLOG_LEVEL_NOT_SET)
 273                 options->log_level = SYSLOG_LEVEL_INFO;
 274         if (options->rhosts_rsa_authentication == -1)
 275                 options->rhosts_rsa_authentication = 0;
 276         if (options->hostbased_authentication == -1)
 277                 options->hostbased_authentication = 0;
 278         if (options->hostbased_uses_name_from_packet_only == -1)
 279                 options->hostbased_uses_name_from_packet_only = 0;
 280         if (options->rsa_authentication == -1)
 281                 options->rsa_authentication = 1;
 282         if (options->pubkey_authentication == -1)
 283                 options->pubkey_authentication = 1;
 284         if (options->kerberos_authentication == -1)
 285                 options->kerberos_authentication = 0;
 286         if (options->kerberos_or_local_passwd == -1)
 287                 options->kerberos_or_local_passwd = 1;
 288         if (options->kerberos_ticket_cleanup == -1)
 289                 options->kerberos_ticket_cleanup = 1;
 290         if (options->kerberos_get_afs_token == -1)
 291                 options->kerberos_get_afs_token = 0;
 292         if (options->gss_authentication == -1)
 293                 options->gss_authentication = 0;
 294         if (options->gss_cleanup_creds == -1)
 295                 options->gss_cleanup_creds = 1;
 296         if (options->gss_strict_acceptor == -1)
 297                 options->gss_strict_acceptor = 0;
 298         if (options->password_authentication == -1)
 299                 options->password_authentication = 0;
 300         if (options->kbd_interactive_authentication == -1)
 301                 options->kbd_interactive_authentication = 0;
 302         if (options->challenge_response_authentication == -1)
 303                 options->challenge_response_authentication = 1;
 304         if (options->permit_empty_passwd == -1)
 305                 options->permit_empty_passwd = 0;
 306         if (options->permit_user_env == -1)
 307                 options->permit_user_env = 0;
 308         if (options->use_login == -1)
 309                 options->use_login = 0;
 310         if (options->compression == -1)
 311                 options->compression = COMP_DELAYED;
 312         if (options->rekey_limit == -1)
 313                 options->rekey_limit = 0;
 314         if (options->rekey_interval == -1)
 315                 options->rekey_interval = 0;
 316         if (options->allow_tcp_forwarding == -1)
 317                 options->allow_tcp_forwarding = FORWARD_ALLOW;
 318         if (options->allow_streamlocal_forwarding == -1)
 319                 options->allow_streamlocal_forwarding = FORWARD_ALLOW;
 320         if (options->allow_agent_forwarding == -1)
 321                 options->allow_agent_forwarding = 1;
 322         if (options->fwd_opts.gateway_ports == -1)
 323                 options->fwd_opts.gateway_ports = 0;
 324         if (options->max_startups == -1)
 325                 options->max_startups = 100;
 326         if (options->max_startups_rate == -1)
 327                 options->max_startups_rate = 30;                /* 30% */
 328         if (options->max_startups_begin == -1)
 329                 options->max_startups_begin = 10;
 330         if (options->max_authtries == -1)
 331                 options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
 332         if (options->max_sessions == -1)
 333                 options->max_sessions = DEFAULT_SESSIONS_MAX;
 334         if (options->use_dns == -1)
 335                 options->use_dns = 1;
 336         if (options->client_alive_interval == -1)
 337                 options->client_alive_interval = 0;
 338         if (options->client_alive_count_max == -1)
 339                 options->client_alive_count_max = 3;
 340         if (options->num_authkeys_files == 0) {
 341                 options->authorized_keys_files[options->num_authkeys_files++] =
 342                     xstrdup(_PATH_SSH_USER_PERMITTED_KEYS);
 343                 options->authorized_keys_files[options->num_authkeys_files++] =
 344                     xstrdup(_PATH_SSH_USER_PERMITTED_KEYS2);
 345         }
 346         if (options->permit_tun == -1)
 347                 options->permit_tun = SSH_TUNMODE_NO;
 348         if (options->ip_qos_interactive == -1)
 349                 options->ip_qos_interactive = IPTOS_LOWDELAY;
 350         if (options->ip_qos_bulk == -1)
 351                 options->ip_qos_bulk = IPTOS_THROUGHPUT;
 352         if (options->version_addendum == NULL)
 353                 options->version_addendum = xstrdup(SSH_VERSION_FREEBSD);
 354         if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
 355                 options->fwd_opts.streamlocal_bind_mask = 0177;
 356         if (options->fwd_opts.streamlocal_bind_unlink == -1)
 357                 options->fwd_opts.streamlocal_bind_unlink = 0;
 358         if (options->fingerprint_hash == -1)
 359                 options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
 360
 361         assemble_algorithms(options);
 362
 363         /* Turn privilege separation and sandboxing on by default */
 364         if (use_privsep == -1)
 365                 use_privsep = PRIVSEP_ON;
 366
 367 #define CLEAR_ON_NONE(v) \
 368         do { \
 369                 if (option_clear_or_none(v)) { \
 370                         free(v); \
 371                         v = NULL; \
 372                 } \
 373         } while(0)
 374         CLEAR_ON_NONE(options->pid_file);
 375         CLEAR_ON_NONE(options->xauth_location);
 376         CLEAR_ON_NONE(options->banner);
 377         CLEAR_ON_NONE(options->trusted_user_ca_keys);
 378         CLEAR_ON_NONE(options->revoked_keys_file);
 379         CLEAR_ON_NONE(options->authorized_principals_file);
 380         CLEAR_ON_NONE(options->adm_forced_command);
 381         CLEAR_ON_NONE(options->chroot_directory);
 382         for (i = 0; i < options->num_host_key_files; i++)
 383                 CLEAR_ON_NONE(options->host_key_files[i]);
 384         for (i = 0; i < options->num_host_cert_files; i++)
 385                 CLEAR_ON_NONE(options->host_cert_files[i]);
 386 #undef CLEAR_ON_NONE
 387
 388         /* Similar handling for AuthenticationMethods=any */
 389         if (options->num_auth_methods == 1 &&
 390             strcmp(options->auth_methods[0], "any") == 0) {
 391                 free(options->auth_methods[0]);
 392                 options->auth_methods[0] = NULL;
 393                 options->num_auth_methods = 0;
 394         }
 395
 396 #ifndef HAVE_MMAP
 397         if (use_privsep && options->compression == 1) {
 398                 error("This platform does not support both privilege "
 399                     "separation and compression");
 400                 error("Compression disabled");
 401                 options->compression = 0;
 402         }
 403 #endif
 404
 405 }
 406
 407 /* Keyword tokens. */
 408 typedef enum {
 409         sBadOption,             /* == unknown option */
 410         /* Portable-specific options */
 411         sUsePAM,
 412         /* Standard Options */
 413         sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime,
 414         sKeyRegenerationTime, sPermitRootLogin, sLogFacility, sLogLevel,
 415         sRhostsRSAAuthentication, sRSAAuthentication,
 416         sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
 417         sKerberosGetAFSToken,
 418         sKerberosTgtPassing, sChallengeResponseAuthentication,
 419         sPasswordAuthentication, sKbdInteractiveAuthentication,
 420         sListenAddress, sAddressFamily,
 421         sPrintMotd, sPrintLastLog, sIgnoreRhosts,
 422         sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
 423         sPermitTTY, sStrictModes, sEmptyPasswd, sTCPKeepAlive,
 424         sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
 425         sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
 426         sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
 427         sGatewayPorts, sPubkeyAuthentication, sPubkeyAcceptedKeyTypes,
 428         sXAuthLocation, sSubsystem, sMaxStartups, sMaxAuthTries, sMaxSessions,
 429         sBanner, sUseDNS, sHostbasedAuthentication,
 430         sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedKeyTypes,
 431         sHostKeyAlgorithms,
 432         sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
 433         sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
 434         sAcceptEnv, sPermitTunnel,
 435         sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
 436         sUsePrivilegeSeparation, sAllowAgentForwarding,
 437         sHostCertificate,
 438         sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
 439         sAuthorizedPrincipalsCommand, sAuthorizedPrincipalsCommandUser,
 440         sKexAlgorithms, sIPQoS, sVersionAddendum,
 441         sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
 442         sAuthenticationMethods, sHostKeyAgent, sPermitUserRC,
 443         sStreamLocalBindMask, sStreamLocalBindUnlink,
 444         sAllowStreamLocalForwarding, sFingerprintHash,
 445         sDeprecated, sUnsupported
 446 } ServerOpCodes;
 447
 448 #define SSHCFG_GLOBAL   0x01    /* allowed in main section of sshd_config */
 449 #define SSHCFG_MATCH    0x02    /* allowed inside a Match section */
 450 #define SSHCFG_ALL      (SSHCFG_GLOBAL|SSHCFG_MATCH)
 451
 452 /* Textual representation of the tokens. */
 453 static struct {
 454         const char *name;
 455         ServerOpCodes opcode;
 456         u_int flags;
 457 } keywords[] = {
 458         /* Portable-specific options */
 459 #ifdef USE_PAM
 460         { "usepam", sUsePAM, SSHCFG_GLOBAL },
 461 #else
 462         { "usepam", sUnsupported, SSHCFG_GLOBAL },
 463 #endif
 464         { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
 465         /* Standard Options */
 466         { "port", sPort, SSHCFG_GLOBAL },
 467         { "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
 468         { "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL },          /* alias */
 469         { "hostkeyagent", sHostKeyAgent, SSHCFG_GLOBAL },
 470         { "pidfile", sPidFile, SSHCFG_GLOBAL },
 471         { "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL },
 472         { "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
 473         { "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL },
 474         { "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
 475         { "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
 476         { "loglevel", sLogLevel, SSHCFG_GLOBAL },
 477         { "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL },
 478         { "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
 479         { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
 480         { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_ALL },
 481         { "hostbasedacceptedkeytypes", sHostbasedAcceptedKeyTypes, SSHCFG_ALL },
 482         { "hostkeyalgorithms", sHostKeyAlgorithms, SSHCFG_GLOBAL },
 483         { "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
 484         { "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
 485         { "pubkeyacceptedkeytypes", sPubkeyAcceptedKeyTypes, SSHCFG_ALL },
 486         { "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
 487 #ifdef KRB5
 488         { "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
 489         { "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
 490         { "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
 491 #ifdef USE_AFS
 492         { "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL },
 493 #else
 494         { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
 495 #endif
 496 #else
 497         { "kerberosauthentication", sUnsupported, SSHCFG_ALL },
 498         { "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
 499         { "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
 500         { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
 501 #endif
 502         { "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
 503         { "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
 504 #ifdef GSSAPI
 505         { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
 506         { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
 507         { "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
 508 #else
 509         { "gssapiauthentication", sUnsupported, SSHCFG_ALL },
 510         { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
 511         { "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
 512 #endif
 513         { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
 514         { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
 515         { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
 516         { "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
 517         { "checkmail", sDeprecated, SSHCFG_GLOBAL },
 518         { "listenaddress", sListenAddress, SSHCFG_GLOBAL },
 519         { "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
 520         { "printmotd", sPrintMotd, SSHCFG_GLOBAL },
 521 #ifdef DISABLE_LASTLOG
 522         { "printlastlog", sUnsupported, SSHCFG_GLOBAL },
 523 #else
 524         { "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
 525 #endif
 526         { "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
 527         { "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
 528         { "x11forwarding", sX11Forwarding, SSHCFG_ALL },
 529         { "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
 530         { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
 531         { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
 532         { "strictmodes", sStrictModes, SSHCFG_GLOBAL },
 533         { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
 534         { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
 535         { "uselogin", sUseLogin, SSHCFG_GLOBAL },
 536         { "compression", sCompression, SSHCFG_GLOBAL },
 537         { "rekeylimit", sRekeyLimit, SSHCFG_ALL },
 538         { "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL },
 539         { "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL },  /* obsolete alias */
 540         { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
 541         { "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL },
 542         { "allowusers", sAllowUsers, SSHCFG_ALL },
 543         { "denyusers", sDenyUsers, SSHCFG_ALL },
 544         { "allowgroups", sAllowGroups, SSHCFG_ALL },
 545         { "denygroups", sDenyGroups, SSHCFG_ALL },
 546         { "ciphers", sCiphers, SSHCFG_GLOBAL },
 547         { "macs", sMacs, SSHCFG_GLOBAL },
 548         { "protocol", sProtocol, SSHCFG_GLOBAL },
 549         { "gatewayports", sGatewayPorts, SSHCFG_ALL },
 550         { "subsystem", sSubsystem, SSHCFG_GLOBAL },
 551         { "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
 552         { "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
 553         { "maxsessions", sMaxSessions, SSHCFG_ALL },
 554         { "banner", sBanner, SSHCFG_ALL },
 555         { "usedns", sUseDNS, SSHCFG_GLOBAL },
 556         { "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
 557         { "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
 558         { "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL },
 559         { "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
 560         { "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_ALL },
 561         { "authorizedkeysfile2", sDeprecated, SSHCFG_ALL },
 562         { "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL},
 563         { "acceptenv", sAcceptEnv, SSHCFG_ALL },
 564         { "permittunnel", sPermitTunnel, SSHCFG_ALL },
 565         { "permittty", sPermitTTY, SSHCFG_ALL },
 566         { "permituserrc", sPermitUserRC, SSHCFG_ALL },
 567         { "match", sMatch, SSHCFG_ALL },
 568         { "permitopen", sPermitOpen, SSHCFG_ALL },
 569         { "forcecommand", sForceCommand, SSHCFG_ALL },
 570         { "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
 571         { "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
 572         { "revokedkeys", sRevokedKeys, SSHCFG_ALL },
 573         { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
 574         { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
 575         { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
 576         { "ipqos", sIPQoS, SSHCFG_ALL },
 577         { "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL },
 578         { "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL },
 579         { "authorizedprincipalscommand", sAuthorizedPrincipalsCommand, SSHCFG_ALL },
 580         { "authorizedprincipalscommanduser", sAuthorizedPrincipalsCommandUser, SSHCFG_ALL },
 581         { "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL },
 582         { "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL },
 583         { "streamlocalbindmask", sStreamLocalBindMask, SSHCFG_ALL },
 584         { "streamlocalbindunlink", sStreamLocalBindUnlink, SSHCFG_ALL },
 585         { "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL },
 586         { "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL },
 587         { "noneenabled", sUnsupported, SSHCFG_ALL },
 588         { "hpndisabled", sDeprecated, SSHCFG_ALL },
 589         { "hpnbuffersize", sDeprecated, SSHCFG_ALL },
 590         { "tcprcvbufpoll", sDeprecated, SSHCFG_ALL },
 591         { NULL, sBadOption, 0 }
 592 };
 593
 594 static struct {
 595         int val;
 596         char *text;
 597 } tunmode_desc[] = {
 598         { SSH_TUNMODE_NO, "no" },
 599         { SSH_TUNMODE_POINTOPOINT, "point-to-point" },
 600         { SSH_TUNMODE_ETHERNET, "ethernet" },
 601         { SSH_TUNMODE_YES, "yes" },
 602         { -1, NULL }
 603 };
 604
 605 /*
 606  * Returns the number of the token pointed to by cp or sBadOption.
 607  */
 608
 609 static ServerOpCodes
 610 parse_token(const char *cp, const char *filename,
 611             int linenum, u_int *flags)
 612 {
 613         u_int i;
 614
 615         for (i = 0; keywords[i].name; i++)
 616                 if (strcasecmp(cp, keywords[i].name) == 0) {
 617                         *flags = keywords[i].flags;
 618                         return keywords[i].opcode;
 619                 }
 620
 621         error("%s: line %d: Bad configuration option: %s",
 622             filename, linenum, cp);
 623         return sBadOption;
 624 }
 625
 626 char *
 627 derelativise_path(const char *path)
 628 {
 629         char *expanded, *ret, cwd[PATH_MAX];
 630
 631         if (strcasecmp(path, "none") == 0)
 632                 return xstrdup("none");
 633         expanded = tilde_expand_filename(path, getuid());
 634         if (*expanded == '/')
 635                 return expanded;
 636         if (getcwd(cwd, sizeof(cwd)) == NULL)
 637                 fatal("%s: getcwd: %s", __func__, strerror(errno));
 638         xasprintf(&ret, "%s/%s", cwd, expanded);
 639         free(expanded);
 640         return ret;
 641 }
 642
 643 static void
 644 add_listen_addr(ServerOptions *options, char *addr, int port)
 645 {
 646         u_int i;
 647
 648         if (port == 0)
 649                 for (i = 0; i < options->num_ports; i++)
 650                         add_one_listen_addr(options, addr, options->ports[i]);
 651         else
 652                 add_one_listen_addr(options, addr, port);
 653 }
 654
 655 static void
 656 add_one_listen_addr(ServerOptions *options, char *addr, int port)
 657 {
 658         struct addrinfo hints, *ai, *aitop;
 659         char strport[NI_MAXSERV];
 660         int gaierr;
 661
 662         memset(&hints, 0, sizeof(hints));
 663         hints.ai_family = options->address_family;
 664         hints.ai_socktype = SOCK_STREAM;
 665         hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
 666         snprintf(strport, sizeof strport, "%d", port);
 667         if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
 668                 fatal("bad addr or host: %s (%s)",
 669                     addr ? addr : "<NULL>",
 670                     ssh_gai_strerror(gaierr));
 671         for (ai = aitop; ai->ai_next; ai = ai->ai_next)
 672                 ;
 673         ai->ai_next = options->listen_addrs;
 674         options->listen_addrs = aitop;
 675 }
 676
 677 /*
 678  * Queue a ListenAddress to be processed once we have all of the Ports
 679  * and AddressFamily options.
 680  */
 681 static void
 682 queue_listen_addr(ServerOptions *options, char *addr, int port)
 683 {
 684         options->queued_listen_addrs = xreallocarray(
 685             options->queued_listen_addrs, options->num_queued_listens + 1,
 686             sizeof(addr));
 687         options->queued_listen_ports = xreallocarray(
 688             options->queued_listen_ports, options->num_queued_listens + 1,
 689             sizeof(port));
 690         options->queued_listen_addrs[options->num_queued_listens] =
 691             xstrdup(addr);
 692         options->queued_listen_ports[options->num_queued_listens] = port;
 693         options->num_queued_listens++;
 694 }
 695
 696 /*
 697  * Process queued (text) ListenAddress entries.
 698  */
 699 static void
 700 process_queued_listen_addrs(ServerOptions *options)
 701 {
 702         u_int i;
 703
 704         if (options->num_ports == 0)
 705                 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
 706         if (options->address_family == -1)
 707                 options->address_family = AF_UNSPEC;
 708
 709         for (i = 0; i < options->num_queued_listens; i++) {
 710                 add_listen_addr(options, options->queued_listen_addrs[i],
 711                     options->queued_listen_ports[i]);
 712                 free(options->queued_listen_addrs[i]);
 713                 options->queued_listen_addrs[i] = NULL;
 714         }
 715         free(options->queued_listen_addrs);
 716         options->queued_listen_addrs = NULL;
 717         free(options->queued_listen_ports);
 718         options->queued_listen_ports = NULL;
 719         options->num_queued_listens = 0;
 720 }
 721
 722 struct connection_info *
 723 get_connection_info(int populate, int use_dns)
 724 {
 725         struct ssh *ssh = active_state; /* XXX */
 726         static struct connection_info ci;
 727
 728         if (!populate)
 729                 return &ci;
 730         ci.host = auth_get_canonical_hostname(ssh, use_dns);
 731         ci.address = ssh_remote_ipaddr(ssh);
 732         ci.laddress = ssh_local_ipaddr(ssh);
 733         ci.lport = ssh_local_port(ssh);
 734         return &ci;
 735 }
 736
 737 /*
 738  * The strategy for the Match blocks is that the config file is parsed twice.
 739  *
 740  * The first time is at startup.  activep is initialized to 1 and the
 741  * directives in the global context are processed and acted on.  Hitting a
 742  * Match directive unsets activep and the directives inside the block are
 743  * checked for syntax only.
 744  *
 745  * The second time is after a connection has been established but before
 746  * authentication.  activep is initialized to 2 and global config directives
 747  * are ignored since they have already been processed.  If the criteria in a
 748  * Match block is met, activep is set and the subsequent directives
 749  * processed and actioned until EOF or another Match block unsets it.  Any
 750  * options set are copied into the main server config.
 751  *
 752  * Potential additions/improvements:
 753  *  - Add Match support for pre-kex directives, eg Protocol, Ciphers.
 754  *
 755  *  - Add a Tag directive (idea from David Leonard) ala pf, eg:
 756  *      Match Address 192.168.0.*
 757  *              Tag trusted
 758  *      Match Group wheel
 759  *              Tag trusted
 760  *      Match Tag trusted
 761  *              AllowTcpForwarding yes
 762  *              GatewayPorts clientspecified
 763  *              [...]
 764  *
 765  *  - Add a PermittedChannelRequests directive
 766  *      Match Group shell
 767  *              PermittedChannelRequests session,forwarded-tcpip
 768  */
 769
 770 static int
 771 match_cfg_line_group(const char *grps, int line, const char *user)
 772 {
 773         int result = 0;
 774         struct passwd *pw;
 775
 776         if (user == NULL)
 777                 goto out;
 778
 779         if ((pw = getpwnam(user)) == NULL) {
 780                 debug("Can't match group at line %d because user %.100s does "
 781                     "not exist", line, user);
 782         } else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
 783                 debug("Can't Match group because user %.100s not in any group "
 784                     "at line %d", user, line);
 785         } else if (ga_match_pattern_list(grps) != 1) {
 786                 debug("user %.100s does not match group list %.100s at line %d",
 787                     user, grps, line);
 788         } else {
 789                 debug("user %.100s matched group list %.100s at line %d", user,
 790                     grps, line);
 791                 result = 1;
 792         }
 793 out:
 794         ga_free();
 795         return result;
 796 }
 797
 798 /*
 799  * All of the attributes on a single Match line are ANDed together, so we need
 800  * to check every attribute and set the result to zero if any attribute does
 801  * not match.
 802  */
 803 static int
 804 match_cfg_line(char **condition, int line, struct connection_info *ci)
 805 {
 806         int result = 1, attributes = 0, port;
 807         char *arg, *attrib, *cp = *condition;
 808
 809         if (ci == NULL)
 810                 debug3("checking syntax for 'Match %s'", cp);
 811         else
 812                 debug3("checking match for '%s' user %s host %s addr %s "
 813                     "laddr %s lport %d", cp, ci->user ? ci->user : "(null)",
 814                     ci->host ? ci->host : "(null)",
 815                     ci->address ? ci->address : "(null)",
 816                     ci->laddress ? ci->laddress : "(null)", ci->lport);
 817
 818         while ((attrib = strdelim(&cp)) && *attrib != '\0') {
 819                 attributes++;
 820                 if (strcasecmp(attrib, "all") == 0) {
 821                         if (attributes != 1 ||
 822                             ((arg = strdelim(&cp)) != NULL && *arg != '\0')) {
 823                                 error("'all' cannot be combined with other "
 824                                     "Match attributes");
 825                                 return -1;
 826                         }
 827                         *condition = cp;
 828                         return 1;
 829                 }
 830                 if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
 831                         error("Missing Match criteria for %s", attrib);
 832                         return -1;
 833                 }
 834                 if (strcasecmp(attrib, "user") == 0) {
 835                         if (ci == NULL || ci->user == NULL) {
 836                                 result = 0;
 837                                 continue;
 838                         }
 839                         if (match_pattern_list(ci->user, arg, 0) != 1)
 840                                 result = 0;
 841                         else
 842                                 debug("user %.100s matched 'User %.100s' at "
 843                                     "line %d", ci->user, arg, line);
 844                 } else if (strcasecmp(attrib, "group") == 0) {
 845                         if (ci == NULL || ci->user == NULL) {
 846                                 result = 0;
 847                                 continue;
 848                         }
 849                         switch (match_cfg_line_group(arg, line, ci->user)) {
 850                         case -1:
 851                                 return -1;
 852                         case 0:
 853                                 result = 0;
 854                         }
 855                 } else if (strcasecmp(attrib, "host") == 0) {
 856                         if (ci == NULL || ci->host == NULL) {
 857                                 result = 0;
 858                                 continue;
 859                         }
 860                         if (match_hostname(ci->host, arg) != 1)
 861                                 result = 0;
 862                         else
 863                                 debug("connection from %.100s matched 'Host "
 864                                     "%.100s' at line %d", ci->host, arg, line);
 865                 } else if (strcasecmp(attrib, "address") == 0) {
 866                         if (ci == NULL || ci->address == NULL) {
 867                                 result = 0;
 868                                 continue;
 869                         }
 870                         switch (addr_match_list(ci->address, arg)) {
 871                         case 1:
 872                                 debug("connection from %.100s matched 'Address "
 873                                     "%.100s' at line %d", ci->address, arg, line);
 874                                 break;
 875                         case 0:
 876                         case -1:
 877                                 result = 0;
 878                                 break;
 879                         case -2:
 880                                 return -1;
 881                         }
 882                 } else if (strcasecmp(attrib, "localaddress") == 0){
 883                         if (ci == NULL || ci->laddress == NULL) {
 884                                 result = 0;
 885                                 continue;
 886                         }
 887                         switch (addr_match_list(ci->laddress, arg)) {
 888                         case 1:
 889                                 debug("connection from %.100s matched "
 890                                     "'LocalAddress %.100s' at line %d",
 891                                     ci->laddress, arg, line);
 892                                 break;
 893                         case 0:
 894                         case -1:
 895                                 result = 0;
 896                                 break;
 897                         case -2:
 898                                 return -1;
 899                         }
 900                 } else if (strcasecmp(attrib, "localport") == 0) {
 901                         if ((port = a2port(arg)) == -1) {
 902                                 error("Invalid LocalPort '%s' on Match line",
 903                                     arg);
 904                                 return -1;
 905                         }
 906                         if (ci == NULL || ci->lport == 0) {
 907                                 result = 0;
 908                                 continue;
 909                         }
 910                         /* TODO support port lists */
 911                         if (port == ci->lport)
 912                                 debug("connection from %.100s matched "
 913                                     "'LocalPort %d' at line %d",
 914                                     ci->laddress, port, line);
 915                         else
 916                                 result = 0;
 917                 } else {
 918                         error("Unsupported Match attribute %s", attrib);
 919                         return -1;
 920                 }
 921         }
 922         if (attributes == 0) {
 923                 error("One or more attributes required for Match");
 924                 return -1;
 925         }
 926         if (ci != NULL)
 927                 debug3("match %sfound", result ? "" : "not ");
 928         *condition = cp;
 929         return result;
 930 }
 931
 932 #define WHITESPACE " \t\r\n"
 933
 934 /* Multistate option parsing */
 935 struct multistate {
 936         char *key;
 937         int value;
 938 };
 939 static const struct multistate multistate_addressfamily[] = {
 940         { "inet",                       AF_INET },
 941         { "inet6",                      AF_INET6 },
 942         { "any",                        AF_UNSPEC },
 943         { NULL, -1 }
 944 };
 945 static const struct multistate multistate_permitrootlogin[] = {
 946         { "without-password",           PERMIT_NO_PASSWD },
 947         { "prohibit-password",          PERMIT_NO_PASSWD },
 948         { "forced-commands-only",       PERMIT_FORCED_ONLY },
 949         { "yes",                        PERMIT_YES },
 950         { "no",                         PERMIT_NO },
 951         { NULL, -1 }
 952 };
 953 static const struct multistate multistate_compression[] = {
 954         { "delayed",                    COMP_DELAYED },
 955         { "yes",                        COMP_ZLIB },
 956         { "no",                         COMP_NONE },
 957         { NULL, -1 }
 958 };
 959 static const struct multistate multistate_gatewayports[] = {
 960         { "clientspecified",            2 },
 961         { "yes",                        1 },
 962         { "no",                         0 },
 963         { NULL, -1 }
 964 };
 965 static const struct multistate multistate_privsep[] = {
 966         { "yes",                        PRIVSEP_NOSANDBOX },
 967         { "sandbox",                    PRIVSEP_ON },
 968         { "nosandbox",                  PRIVSEP_NOSANDBOX },
 969         { "no",                         PRIVSEP_OFF },
 970         { NULL, -1 }
 971 };
 972 static const struct multistate multistate_tcpfwd[] = {
 973         { "yes",                        FORWARD_ALLOW },
 974         { "all",                        FORWARD_ALLOW },
 975         { "no",                         FORWARD_DENY },
 976         { "remote",                     FORWARD_REMOTE },
 977         { "local",                      FORWARD_LOCAL },
 978         { NULL, -1 }
 979 };
 980
 981 int
 982 process_server_config_line(ServerOptions *options, char *line,
 983     const char *filename, int linenum, int *activep,
 984     struct connection_info *connectinfo)
 985 {
 986         char *cp, **charptr, *arg, *p;
 987         int cmdline = 0, *intptr, value, value2, n, port;
 988         SyslogFacility *log_facility_ptr;
 989         LogLevel *log_level_ptr;
 990         ServerOpCodes opcode;
 991         u_int i, flags = 0;
 992         size_t len;
 993         long long val64;
 994         const struct multistate *multistate_ptr;
 995
 996         cp = line;
 997         if ((arg = strdelim(&cp)) == NULL)
 998                 return 0;
 999         /* Ignore leading whitespace */
1000         if (*arg == '\0')
1001                 arg = strdelim(&cp);
1002         if (!arg || !*arg || *arg == '#')
1003                 return 0;
1004         intptr = NULL;
1005         charptr = NULL;
1006         opcode = parse_token(arg, filename, linenum, &flags);
1007
1008         if (activep == NULL) { /* We are processing a command line directive */
1009                 cmdline = 1;
1010                 activep = &cmdline;
1011         }
1012         if (*activep && opcode != sMatch)
1013                 debug3("%s:%d setting %s %s", filename, linenum, arg, cp);
1014         if (*activep == 0 && !(flags & SSHCFG_MATCH)) {
1015                 if (connectinfo == NULL) {
1016                         fatal("%s line %d: Directive '%s' is not allowed "
1017                             "within a Match block", filename, linenum, arg);
1018                 } else { /* this is a directive we have already processed */
1019                         while (arg)
1020                                 arg = strdelim(&cp);
1021                         return 0;
1022                 }
1023         }
1024
1025         switch (opcode) {
1026         /* Portable-specific options */
1027         case sUsePAM:
1028                 intptr = &options->use_pam;
1029                 goto parse_flag;
1030
1031         /* Standard Options */
1032         case sBadOption:
1033                 return -1;
1034         case sPort:
1035                 /* ignore ports from configfile if cmdline specifies ports */
1036                 if (options->ports_from_cmdline)
1037                         return 0;
1038                 if (options->num_ports >= MAX_PORTS)
1039                         fatal("%s line %d: too many ports.",
1040                             filename, linenum);
1041                 arg = strdelim(&cp);
1042                 if (!arg || *arg == '\0')
1043                         fatal("%s line %d: missing port number.",
1044                             filename, linenum);
1045                 options->ports[options->num_ports++] = a2port(arg);
1046                 if (options->ports[options->num_ports-1] <= 0)
1047                         fatal("%s line %d: Badly formatted port number.",
1048                             filename, linenum);
1049                 break;
1050
1051         case sServerKeyBits:
1052                 intptr = &options->server_key_bits;
1053  parse_int:
1054                 arg = strdelim(&cp);
1055                 if (!arg || *arg == '\0')
1056                         fatal("%s line %d: missing integer value.",
1057                             filename, linenum);
1058                 value = atoi(arg);
1059                 if (*activep && *intptr == -1)
1060                         *intptr = value;
1061                 break;
1062
1063         case sLoginGraceTime:
1064                 intptr = &options->login_grace_time;
1065  parse_time:
1066                 arg = strdelim(&cp);
1067                 if (!arg || *arg == '\0')
1068                         fatal("%s line %d: missing time value.",
1069                             filename, linenum);
1070                 if ((value = convtime(arg)) == -1)
1071                         fatal("%s line %d: invalid time value.",
1072                             filename, linenum);
1073                 if (*activep && *intptr == -1)
1074                         *intptr = value;
1075                 break;
1076
1077         case sKeyRegenerationTime:
1078                 intptr = &options->key_regeneration_time;
1079                 goto parse_time;
1080
1081         case sListenAddress:
1082                 arg = strdelim(&cp);
1083                 if (arg == NULL || *arg == '\0')
1084                         fatal("%s line %d: missing address",
1085                             filename, linenum);
1086                 /* check for bare IPv6 address: no "[]" and 2 or more ":" */
1087                 if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL
1088                     && strchr(p+1, ':') != NULL) {
1089                         queue_listen_addr(options, arg, 0);
1090                         break;
1091                 }
1092                 p = hpdelim(&arg);
1093                 if (p == NULL)
1094                         fatal("%s line %d: bad address:port usage",
1095                             filename, linenum);
1096                 p = cleanhostname(p);
1097                 if (arg == NULL)
1098                         port = 0;
1099                 else if ((port = a2port(arg)) <= 0)
1100                         fatal("%s line %d: bad port number", filename, linenum);
1101
1102                 queue_listen_addr(options, p, port);
1103
1104                 break;
1105
1106         case sAddressFamily:
1107                 intptr = &options->address_family;
1108                 multistate_ptr = multistate_addressfamily;
1109  parse_multistate:
1110                 arg = strdelim(&cp);
1111                 if (!arg || *arg == '\0')
1112                         fatal("%s line %d: missing argument.",
1113                             filename, linenum);
1114                 value = -1;
1115                 for (i = 0; multistate_ptr[i].key != NULL; i++) {
1116                         if (strcasecmp(arg, multistate_ptr[i].key) == 0) {
1117                                 value = multistate_ptr[i].value;
1118                                 break;
1119                         }
1120                 }
1121                 if (value == -1)
1122                         fatal("%s line %d: unsupported option \"%s\".",
1123                             filename, linenum, arg);
1124                 if (*activep && *intptr == -1)
1125                         *intptr = value;
1126                 break;
1127
1128         case sHostKeyFile:
1129                 intptr = &options->num_host_key_files;
1130                 if (*intptr >= MAX_HOSTKEYS)
1131                         fatal("%s line %d: too many host keys specified (max %d).",
1132                             filename, linenum, MAX_HOSTKEYS);
1133                 charptr = &options->host_key_files[*intptr];
1134  parse_filename:
1135                 arg = strdelim(&cp);
1136                 if (!arg || *arg == '\0')
1137                         fatal("%s line %d: missing file name.",
1138                             filename, linenum);
1139                 if (*activep && *charptr == NULL) {
1140                         *charptr = derelativise_path(arg);
1141                         /* increase optional counter */
1142                         if (intptr != NULL)
1143                                 *intptr = *intptr + 1;
1144                 }
1145                 break;
1146
1147         case sHostKeyAgent:
1148                 charptr = &options->host_key_agent;
1149                 arg = strdelim(&cp);
1150                 if (!arg || *arg == '\0')
1151                         fatal("%s line %d: missing socket name.",
1152                             filename, linenum);
1153                 if (*activep && *charptr == NULL)
1154                         *charptr = !strcmp(arg, SSH_AUTHSOCKET_ENV_NAME) ?
1155                             xstrdup(arg) : derelativise_path(arg);
1156                 break;
1157
1158         case sHostCertificate:
1159                 intptr = &options->num_host_cert_files;
1160                 if (*intptr >= MAX_HOSTKEYS)
1161                         fatal("%s line %d: too many host certificates "
1162                             "specified (max %d).", filename, linenum,
1163                             MAX_HOSTCERTS);
1164                 charptr = &options->host_cert_files[*intptr];
1165                 goto parse_filename;
1166                 break;
1167
1168         case sPidFile:
1169                 charptr = &options->pid_file;
1170                 goto parse_filename;
1171
1172         case sPermitRootLogin:
1173                 intptr = &options->permit_root_login;
1174                 multistate_ptr = multistate_permitrootlogin;
1175                 goto parse_multistate;
1176
1177         case sIgnoreRhosts:
1178                 intptr = &options->ignore_rhosts;
1179  parse_flag:
1180                 arg = strdelim(&cp);
1181                 if (!arg || *arg == '\0')
1182                         fatal("%s line %d: missing yes/no argument.",
1183                             filename, linenum);
1184                 value = 0;      /* silence compiler */
1185                 if (strcmp(arg, "yes") == 0)
1186                         value = 1;
1187                 else if (strcmp(arg, "no") == 0)
1188                         value = 0;
1189                 else
1190                         fatal("%s line %d: Bad yes/no argument: %s",
1191                                 filename, linenum, arg);
1192                 if (*activep && *intptr == -1)
1193                         *intptr = value;
1194                 break;
1195
1196         case sIgnoreUserKnownHosts:
1197                 intptr = &options->ignore_user_known_hosts;
1198                 goto parse_flag;
1199
1200         case sRhostsRSAAuthentication:
1201                 intptr = &options->rhosts_rsa_authentication;
1202                 goto parse_flag;
1203
1204         case sHostbasedAuthentication:
1205                 intptr = &options->hostbased_authentication;
1206                 goto parse_flag;
1207
1208         case sHostbasedUsesNameFromPacketOnly:
1209                 intptr = &options->hostbased_uses_name_from_packet_only;
1210                 goto parse_flag;
1211
1212         case sHostbasedAcceptedKeyTypes:
1213                 charptr = &options->hostbased_key_types;
1214  parse_keytypes:
1215                 arg = strdelim(&cp);
1216                 if (!arg || *arg == '\0')
1217                         fatal("%s line %d: Missing argument.",
1218                             filename, linenum);
1219                 if (!sshkey_names_valid2(*arg == '+' ? arg + 1 : arg, 1))
1220                         fatal("%s line %d: Bad key types '%s'.",
1221                             filename, linenum, arg ? arg : "<NONE>");
1222                 if (*activep && *charptr == NULL)
1223                         *charptr = xstrdup(arg);
1224                 break;
1225
1226         case sHostKeyAlgorithms:
1227                 charptr = &options->hostkeyalgorithms;
1228                 goto parse_keytypes;
1229
1230         case sRSAAuthentication:
1231                 intptr = &options->rsa_authentication;
1232                 goto parse_flag;
1233
1234         case sPubkeyAuthentication:
1235                 intptr = &options->pubkey_authentication;
1236                 goto parse_flag;
1237
1238         case sPubkeyAcceptedKeyTypes:
1239                 charptr = &options->pubkey_key_types;
1240                 goto parse_keytypes;
1241
1242         case sKerberosAuthentication:
1243                 intptr = &options->kerberos_authentication;
1244                 goto parse_flag;
1245
1246         case sKerberosOrLocalPasswd:
1247                 intptr = &options->kerberos_or_local_passwd;
1248                 goto parse_flag;
1249
1250         case sKerberosTicketCleanup:
1251                 intptr = &options->kerberos_ticket_cleanup;
1252                 goto parse_flag;
1253
1254         case sKerberosGetAFSToken:
1255                 intptr = &options->kerberos_get_afs_token;
1256                 goto parse_flag;
1257
1258         case sGssAuthentication:
1259                 intptr = &options->gss_authentication;
1260                 goto parse_flag;
1261
1262         case sGssCleanupCreds:
1263                 intptr = &options->gss_cleanup_creds;
1264                 goto parse_flag;
1265
1266         case sGssStrictAcceptor:
1267                 intptr = &options->gss_strict_acceptor;
1268                 goto parse_flag;
1269
1270         case sPasswordAuthentication:
1271                 intptr = &options->password_authentication;
1272                 goto parse_flag;
1273
1274         case sKbdInteractiveAuthentication:
1275                 intptr = &options->kbd_interactive_authentication;
1276                 goto parse_flag;
1277
1278         case sChallengeResponseAuthentication:
1279                 intptr = &options->challenge_response_authentication;
1280                 goto parse_flag;
1281
1282         case sPrintMotd:
1283                 intptr = &options->print_motd;
1284                 goto parse_flag;
1285
1286         case sPrintLastLog:
1287                 intptr = &options->print_lastlog;
1288                 goto parse_flag;
1289
1290         case sX11Forwarding:
1291                 intptr = &options->x11_forwarding;
1292                 goto parse_flag;
1293
1294         case sX11DisplayOffset:
1295                 intptr = &options->x11_display_offset;
1296                 goto parse_int;
1297
1298         case sX11UseLocalhost:
1299                 intptr = &options->x11_use_localhost;
1300                 goto parse_flag;
1301
1302         case sXAuthLocation:
1303                 charptr = &options->xauth_location;
1304                 goto parse_filename;
1305
1306         case sPermitTTY:
1307                 intptr = &options->permit_tty;
1308                 goto parse_flag;
1309
1310         case sPermitUserRC:
1311                 intptr = &options->permit_user_rc;
1312                 goto parse_flag;
1313
1314         case sStrictModes:
1315                 intptr = &options->strict_modes;
1316                 goto parse_flag;
1317
1318         case sTCPKeepAlive:
1319                 intptr = &options->tcp_keep_alive;
1320                 goto parse_flag;
1321
1322         case sEmptyPasswd:
1323                 intptr = &options->permit_empty_passwd;
1324                 goto parse_flag;
1325
1326         case sPermitUserEnvironment:
1327                 intptr = &options->permit_user_env;
1328                 goto parse_flag;
1329
1330         case sUseLogin:
1331                 intptr = &options->use_login;
1332                 goto parse_flag;
1333
1334         case sCompression:
1335                 intptr = &options->compression;
1336                 multistate_ptr = multistate_compression;
1337                 goto parse_multistate;
1338
1339         case sRekeyLimit:
1340                 arg = strdelim(&cp);
1341                 if (!arg || *arg == '\0')
1342                         fatal("%.200s line %d: Missing argument.", filename,
1343                             linenum);
1344                 if (strcmp(arg, "default") == 0) {
1345                         val64 = 0;
1346                 } else {
1347                         if (scan_scaled(arg, &val64) == -1)
1348                                 fatal("%.200s line %d: Bad number '%s': %s",
1349                                     filename, linenum, arg, strerror(errno));
1350                         if (val64 != 0 && val64 < 16)
1351                                 fatal("%.200s line %d: RekeyLimit too small",
1352                                     filename, linenum);
1353                 }
1354                 if (*activep && options->rekey_limit == -1)
1355                         options->rekey_limit = val64;
1356                 if (cp != NULL) { /* optional rekey interval present */
1357                         if (strcmp(cp, "none") == 0) {
1358                                 (void)strdelim(&cp);    /* discard */
1359                                 break;
1360                         }
1361                         intptr = &options->rekey_interval;
1362                         goto parse_time;
1363                 }
1364                 break;
1365
1366         case sGatewayPorts:
1367                 intptr = &options->fwd_opts.gateway_ports;
1368                 multistate_ptr = multistate_gatewayports;
1369                 goto parse_multistate;
1370
1371         case sUseDNS:
1372                 intptr = &options->use_dns;
1373                 goto parse_flag;
1374
1375         case sLogFacility:
1376                 log_facility_ptr = &options->log_facility;
1377                 arg = strdelim(&cp);
1378                 value = log_facility_number(arg);
1379                 if (value == SYSLOG_FACILITY_NOT_SET)
1380                         fatal("%.200s line %d: unsupported log facility '%s'",
1381                             filename, linenum, arg ? arg : "<NONE>");
1382                 if (*log_facility_ptr == -1)
1383                         *log_facility_ptr = (SyslogFacility) value;
1384                 break;
1385
1386         case sLogLevel:
1387                 log_level_ptr = &options->log_level;
1388                 arg = strdelim(&cp);
1389                 value = log_level_number(arg);
1390                 if (value == SYSLOG_LEVEL_NOT_SET)
1391                         fatal("%.200s line %d: unsupported log level '%s'",
1392                             filename, linenum, arg ? arg : "<NONE>");
1393                 if (*log_level_ptr == -1)
1394                         *log_level_ptr = (LogLevel) value;
1395                 break;
1396
1397         case sAllowTcpForwarding:
1398                 intptr = &options->allow_tcp_forwarding;
1399                 multistate_ptr = multistate_tcpfwd;
1400                 goto parse_multistate;
1401
1402         case sAllowStreamLocalForwarding:
1403                 intptr = &options->allow_streamlocal_forwarding;
1404                 multistate_ptr = multistate_tcpfwd;
1405                 goto parse_multistate;
1406
1407         case sAllowAgentForwarding:
1408                 intptr = &options->allow_agent_forwarding;
1409                 goto parse_flag;
1410
1411         case sUsePrivilegeSeparation:
1412                 intptr = &use_privsep;
1413                 multistate_ptr = multistate_privsep;
1414                 goto parse_multistate;
1415
1416         case sAllowUsers:
1417                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1418                         if (options->num_allow_users >= MAX_ALLOW_USERS)
1419                                 fatal("%s line %d: too many allow users.",
1420                                     filename, linenum);
1421                         if (!*activep)
1422                                 continue;
1423                         options->allow_users[options->num_allow_users++] =
1424                             xstrdup(arg);
1425                 }
1426                 break;
1427
1428         case sDenyUsers:
1429                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1430                         if (options->num_deny_users >= MAX_DENY_USERS)
1431                                 fatal("%s line %d: too many deny users.",
1432                                     filename, linenum);
1433                         if (!*activep)
1434                                 continue;
1435                         options->deny_users[options->num_deny_users++] =
1436                             xstrdup(arg);
1437                 }
1438                 break;
1439
1440         case sAllowGroups:
1441                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1442                         if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
1443                                 fatal("%s line %d: too many allow groups.",
1444                                     filename, linenum);
1445                         if (!*activep)
1446                                 continue;
1447                         options->allow_groups[options->num_allow_groups++] =
1448                             xstrdup(arg);
1449                 }
1450                 break;
1451
1452         case sDenyGroups:
1453                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1454                         if (options->num_deny_groups >= MAX_DENY_GROUPS)
1455                                 fatal("%s line %d: too many deny groups.",
1456                                     filename, linenum);
1457                         if (!*activep)
1458                                 continue;
1459                         options->deny_groups[options->num_deny_groups++] =
1460                             xstrdup(arg);
1461                 }
1462                 break;
1463
1464         case sCiphers:
1465                 arg = strdelim(&cp);
1466                 if (!arg || *arg == '\0')
1467                         fatal("%s line %d: Missing argument.", filename, linenum);
1468                 if (!ciphers_valid(*arg == '+' ? arg + 1 : arg))
1469                         fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1470                             filename, linenum, arg ? arg : "<NONE>");
1471                 if (options->ciphers == NULL)
1472                         options->ciphers = xstrdup(arg);
1473                 break;
1474
1475         case sMacs:
1476                 arg = strdelim(&cp);
1477                 if (!arg || *arg == '\0')
1478                         fatal("%s line %d: Missing argument.", filename, linenum);
1479                 if (!mac_valid(*arg == '+' ? arg + 1 : arg))
1480                         fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1481                             filename, linenum, arg ? arg : "<NONE>");
1482                 if (options->macs == NULL)
1483                         options->macs = xstrdup(arg);
1484                 break;
1485
1486         case sKexAlgorithms:
1487                 arg = strdelim(&cp);
1488                 if (!arg || *arg == '\0')
1489                         fatal("%s line %d: Missing argument.",
1490                             filename, linenum);
1491                 if (!kex_names_valid(*arg == '+' ? arg + 1 : arg))
1492                         fatal("%s line %d: Bad SSH2 KexAlgorithms '%s'.",
1493                             filename, linenum, arg ? arg : "<NONE>");
1494                 if (options->kex_algorithms == NULL)
1495                         options->kex_algorithms = xstrdup(arg);
1496                 break;
1497
1498         case sProtocol:
1499                 intptr = &options->protocol;
1500                 arg = strdelim(&cp);
1501                 if (!arg || *arg == '\0')
1502                         fatal("%s line %d: Missing argument.", filename, linenum);
1503                 value = proto_spec(arg);
1504                 if (value == SSH_PROTO_UNKNOWN)
1505                         fatal("%s line %d: Bad protocol spec '%s'.",
1506                             filename, linenum, arg ? arg : "<NONE>");
1507                 if (*intptr == SSH_PROTO_UNKNOWN)
1508                         *intptr = value;
1509                 break;
1510
1511         case sSubsystem:
1512                 if (options->num_subsystems >= MAX_SUBSYSTEMS) {
1513                         fatal("%s line %d: too many subsystems defined.",
1514                             filename, linenum);
1515                 }
1516                 arg = strdelim(&cp);
1517                 if (!arg || *arg == '\0')
1518                         fatal("%s line %d: Missing subsystem name.",
1519                             filename, linenum);
1520                 if (!*activep) {
1521                         arg = strdelim(&cp);
1522                         break;
1523                 }
1524                 for (i = 0; i < options->num_subsystems; i++)
1525                         if (strcmp(arg, options->subsystem_name[i]) == 0)
1526                                 fatal("%s line %d: Subsystem '%s' already defined.",
1527                                     filename, linenum, arg);
1528                 options->subsystem_name[options->num_subsystems] = xstrdup(arg);
1529                 arg = strdelim(&cp);
1530                 if (!arg || *arg == '\0')
1531                         fatal("%s line %d: Missing subsystem command.",
1532                             filename, linenum);
1533                 options->subsystem_command[options->num_subsystems] = xstrdup(arg);
1534
1535                 /* Collect arguments (separate to executable) */
1536                 p = xstrdup(arg);
1537                 len = strlen(p) + 1;
1538                 while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
1539                         len += 1 + strlen(arg);
1540                         p = xreallocarray(p, 1, len);
1541                         strlcat(p, " ", len);
1542                         strlcat(p, arg, len);
1543                 }
1544                 options->subsystem_args[options->num_subsystems] = p;
1545                 options->num_subsystems++;
1546                 break;
1547
1548         case sMaxStartups:
1549                 arg = strdelim(&cp);
1550                 if (!arg || *arg == '\0')
1551                         fatal("%s line %d: Missing MaxStartups spec.",
1552                             filename, linenum);
1553                 if ((n = sscanf(arg, "%d:%d:%d",
1554                     &options->max_startups_begin,
1555                     &options->max_startups_rate,
1556                     &options->max_startups)) == 3) {
1557                         if (options->max_startups_begin >
1558                             options->max_startups ||
1559                             options->max_startups_rate > 100 ||
1560                             options->max_startups_rate < 1)
1561                                 fatal("%s line %d: Illegal MaxStartups spec.",
1562                                     filename, linenum);
1563                 } else if (n != 1)
1564                         fatal("%s line %d: Illegal MaxStartups spec.",
1565                             filename, linenum);
1566                 else
1567                         options->max_startups = options->max_startups_begin;
1568                 break;
1569
1570         case sMaxAuthTries:
1571                 intptr = &options->max_authtries;
1572                 goto parse_int;
1573
1574         case sMaxSessions:
1575                 intptr = &options->max_sessions;
1576                 goto parse_int;
1577
1578         case sBanner:
1579                 charptr = &options->banner;
1580                 goto parse_filename;
1581
1582         /*
1583          * These options can contain %X options expanded at
1584          * connect time, so that you can specify paths like:
1585          *
1586          * AuthorizedKeysFile   /etc/ssh_keys/%u
1587          */
1588         case sAuthorizedKeysFile:
1589                 if (*activep && options->num_authkeys_files == 0) {
1590                         while ((arg = strdelim(&cp)) && *arg != '\0') {
1591                                 if (options->num_authkeys_files >=
1592                                     MAX_AUTHKEYS_FILES)
1593                                         fatal("%s line %d: "
1594                                             "too many authorized keys files.",
1595                                             filename, linenum);
1596                                 options->authorized_keys_files[
1597                                     options->num_authkeys_files++] =
1598                                     tilde_expand_filename(arg, getuid());
1599                         }
1600                 }
1601                 return 0;
1602
1603         case sAuthorizedPrincipalsFile:
1604                 charptr = &options->authorized_principals_file;
1605                 arg = strdelim(&cp);
1606                 if (!arg || *arg == '\0')
1607                         fatal("%s line %d: missing file name.",
1608                             filename, linenum);
1609                 if (*activep && *charptr == NULL) {
1610                         *charptr = tilde_expand_filename(arg, getuid());
1611                         /* increase optional counter */
1612                         if (intptr != NULL)
1613                                 *intptr = *intptr + 1;
1614                 }
1615                 break;
1616
1617         case sClientAliveInterval:
1618                 intptr = &options->client_alive_interval;
1619                 goto parse_time;
1620
1621         case sClientAliveCountMax:
1622                 intptr = &options->client_alive_count_max;
1623                 goto parse_int;
1624
1625         case sAcceptEnv:
1626                 while ((arg = strdelim(&cp)) && *arg != '\0') {
1627                         if (strchr(arg, '=') != NULL)
1628                                 fatal("%s line %d: Invalid environment name.",
1629                                     filename, linenum);
1630                         if (options->num_accept_env >= MAX_ACCEPT_ENV)
1631                                 fatal("%s line %d: too many allow env.",
1632                                     filename, linenum);
1633                         if (!*activep)
1634                                 continue;
1635                         options->accept_env[options->num_accept_env++] =
1636                             xstrdup(arg);
1637                 }
1638                 break;
1639
1640         case sPermitTunnel:
1641                 intptr = &options->permit_tun;
1642                 arg = strdelim(&cp);
1643                 if (!arg || *arg == '\0')
1644                         fatal("%s line %d: Missing yes/point-to-point/"
1645                             "ethernet/no argument.", filename, linenum);
1646                 value = -1;
1647                 for (i = 0; tunmode_desc[i].val != -1; i++)
1648                         if (strcmp(tunmode_desc[i].text, arg) == 0) {
1649                                 value = tunmode_desc[i].val;
1650                                 break;
1651                         }
1652                 if (value == -1)
1653                         fatal("%s line %d: Bad yes/point-to-point/ethernet/"
1654                             "no argument: %s", filename, linenum, arg);
1655                 if (*activep && *intptr == -1)
1656                         *intptr = value;
1657                 break;
1658
1659         case sMatch:
1660                 if (cmdline)
1661                         fatal("Match directive not supported as a command-line "
1662                            "option");
1663                 value = match_cfg_line(&cp, linenum, connectinfo);
1664                 if (value < 0)
1665                         fatal("%s line %d: Bad Match condition", filename,
1666                             linenum);
1667                 *activep = value;
1668                 break;
1669
1670         case sPermitOpen:
1671                 arg = strdelim(&cp);
1672                 if (!arg || *arg == '\0')
1673                         fatal("%s line %d: missing PermitOpen specification",
1674                             filename, linenum);
1675                 n = options->num_permitted_opens;       /* modified later */
1676                 if (strcmp(arg, "any") == 0) {
1677                         if (*activep && n == -1) {
1678                                 channel_clear_adm_permitted_opens();
1679                                 options->num_permitted_opens = 0;
1680                         }
1681                         break;
1682                 }
1683                 if (strcmp(arg, "none") == 0) {
1684                         if (*activep && n == -1) {
1685                                 options->num_permitted_opens = 1;
1686                                 channel_disable_adm_local_opens();
1687                         }
1688                         break;
1689                 }
1690                 if (*activep && n == -1)
1691                         channel_clear_adm_permitted_opens();
1692                 for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) {
1693                         p = hpdelim(&arg);
1694                         if (p == NULL)
1695                                 fatal("%s line %d: missing host in PermitOpen",
1696                                     filename, linenum);
1697                         p = cleanhostname(p);
1698                         if (arg == NULL || ((port = permitopen_port(arg)) < 0))
1699                                 fatal("%s line %d: bad port number in "
1700                                     "PermitOpen", filename, linenum);
1701                         if (*activep && n == -1)
1702                                 options->num_permitted_opens =
1703                                     channel_add_adm_permitted_opens(p, port);
1704                 }
1705                 break;
1706
1707         case sForceCommand:
1708                 if (cp == NULL || *cp == '\0')
1709                         fatal("%.200s line %d: Missing argument.", filename,
1710                             linenum);
1711                 len = strspn(cp, WHITESPACE);
1712                 if (*activep && options->adm_forced_command == NULL)
1713                         options->adm_forced_command = xstrdup(cp + len);
1714                 return 0;
1715
1716         case sChrootDirectory:
1717                 charptr = &options->chroot_directory;
1718
1719                 arg = strdelim(&cp);
1720                 if (!arg || *arg == '\0')
1721                         fatal("%s line %d: missing file name.",
1722                             filename, linenum);
1723                 if (*activep && *charptr == NULL)
1724                         *charptr = xstrdup(arg);
1725                 break;
1726
1727         case sTrustedUserCAKeys:
1728                 charptr = &options->trusted_user_ca_keys;
1729                 goto parse_filename;
1730
1731         case sRevokedKeys:
1732                 charptr = &options->revoked_keys_file;
1733                 goto parse_filename;
1734
1735         case sIPQoS:
1736                 arg = strdelim(&cp);
1737                 if ((value = parse_ipqos(arg)) == -1)
1738                         fatal("%s line %d: Bad IPQoS value: %s",
1739                             filename, linenum, arg);
1740                 arg = strdelim(&cp);
1741                 if (arg == NULL)
1742                         value2 = value;
1743                 else if ((value2 = parse_ipqos(arg)) == -1)
1744                         fatal("%s line %d: Bad IPQoS value: %s",
1745                             filename, linenum, arg);
1746                 if (*activep) {
1747                         options->ip_qos_interactive = value;
1748                         options->ip_qos_bulk = value2;
1749                 }
1750                 break;
1751
1752         case sVersionAddendum:
1753                 if (cp == NULL || *cp == '\0')
1754                         fatal("%.200s line %d: Missing argument.", filename,
1755                             linenum);
1756                 len = strspn(cp, WHITESPACE);
1757                 if (*activep && options->version_addendum == NULL) {
1758                         if (strcasecmp(cp + len, "none") == 0)
1759                                 options->version_addendum = xstrdup("");
1760                         else if (strchr(cp + len, '\r') != NULL)
1761                                 fatal("%.200s line %d: Invalid argument",
1762                                     filename, linenum);
1763                         else
1764                                 options->version_addendum = xstrdup(cp + len);
1765                 }
1766                 return 0;
1767
1768         case sAuthorizedKeysCommand:
1769                 if (cp == NULL)
1770                         fatal("%.200s line %d: Missing argument.", filename,
1771                             linenum);
1772                 len = strspn(cp, WHITESPACE);
1773                 if (*activep && options->authorized_keys_command == NULL) {
1774                         if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0)
1775                                 fatal("%.200s line %d: AuthorizedKeysCommand "
1776                                     "must be an absolute path",
1777                                     filename, linenum);
1778                         options->authorized_keys_command = xstrdup(cp + len);
1779                 }
1780                 return 0;
1781
1782         case sAuthorizedKeysCommandUser:
1783                 charptr = &options->authorized_keys_command_user;
1784
1785                 arg = strdelim(&cp);
1786                 if (!arg || *arg == '\0')
1787                         fatal("%s line %d: missing AuthorizedKeysCommandUser "
1788                             "argument.", filename, linenum);
1789                 if (*activep && *charptr == NULL)
1790                         *charptr = xstrdup(arg);
1791                 break;
1792
1793         case sAuthorizedPrincipalsCommand:
1794                 if (cp == NULL)
1795                         fatal("%.200s line %d: Missing argument.", filename,
1796                             linenum);
1797                 len = strspn(cp, WHITESPACE);
1798                 if (*activep &&
1799                     options->authorized_principals_command == NULL) {
1800                         if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0)
1801                                 fatal("%.200s line %d: "
1802                                     "AuthorizedPrincipalsCommand must be "
1803                                     "an absolute path", filename, linenum);
1804                         options->authorized_principals_command =
1805                             xstrdup(cp + len);
1806                 }
1807                 return 0;
1808
1809         case sAuthorizedPrincipalsCommandUser:
1810                 charptr = &options->authorized_principals_command_user;
1811
1812                 arg = strdelim(&cp);
1813                 if (!arg || *arg == '\0')
1814                         fatal("%s line %d: missing "
1815                             "AuthorizedPrincipalsCommandUser argument.",
1816                             filename, linenum);
1817                 if (*activep && *charptr == NULL)
1818                         *charptr = xstrdup(arg);
1819                 break;
1820
1821         case sAuthenticationMethods:
1822                 if (options->num_auth_methods == 0) {
1823                         value = 0; /* seen "any" pseudo-method */
1824                         value2 = 0; /* sucessfully parsed any method */
1825                         while ((arg = strdelim(&cp)) && *arg != '\0') {
1826                                 if (options->num_auth_methods >=
1827                                     MAX_AUTH_METHODS)
1828                                         fatal("%s line %d: "
1829                                             "too many authentication methods.",
1830                                             filename, linenum);
1831                                 if (strcmp(arg, "any") == 0) {
1832                                         if (options->num_auth_methods > 0) {
1833                                                 fatal("%s line %d: \"any\" "
1834                                                     "must appear alone in "
1835                                                     "AuthenticationMethods",
1836                                                     filename, linenum);
1837                                         }
1838                                         value = 1;
1839                                 } else if (value) {
1840                                         fatal("%s line %d: \"any\" must appear "
1841                                             "alone in AuthenticationMethods",
1842                                             filename, linenum);
1843                                 } else if (auth2_methods_valid(arg, 0) != 0) {
1844                                         fatal("%s line %d: invalid "
1845                                             "authentication method list.",
1846                                             filename, linenum);
1847                                 }
1848                                 value2 = 1;
1849                                 if (!*activep)
1850                                         continue;
1851                                 options->auth_methods[
1852                                     options->num_auth_methods++] = xstrdup(arg);
1853                         }
1854                         if (value2 == 0) {
1855                                 fatal("%s line %d: no AuthenticationMethods "
1856                                     "specified", filename, linenum);
1857                         }
1858                 }
1859                 return 0;
1860
1861         case sStreamLocalBindMask:
1862                 arg = strdelim(&cp);
1863                 if (!arg || *arg == '\0')
1864                         fatal("%s line %d: missing StreamLocalBindMask "
1865                             "argument.", filename, linenum);
1866                 /* Parse mode in octal format */
1867                 value = strtol(arg, &p, 8);
1868                 if (arg == p || value < 0 || value > 0777)
1869                         fatal("%s line %d: Bad mask.", filename, linenum);
1870                 if (*activep)
1871                         options->fwd_opts.streamlocal_bind_mask = (mode_t)value;
1872                 break;
1873
1874         case sStreamLocalBindUnlink:
1875                 intptr = &options->fwd_opts.streamlocal_bind_unlink;
1876                 goto parse_flag;
1877
1878         case sFingerprintHash:
1879                 arg = strdelim(&cp);
1880                 if (!arg || *arg == '\0')
1881                         fatal("%.200s line %d: Missing argument.",
1882                             filename, linenum);
1883                 if ((value = ssh_digest_alg_by_name(arg)) == -1)
1884                         fatal("%.200s line %d: Invalid hash algorithm \"%s\".",
1885                             filename, linenum, arg);
1886                 if (*activep)
1887                         options->fingerprint_hash = value;
1888                 break;
1889
1890         case sDeprecated:
1891                 logit("%s line %d: Deprecated option %s",
1892                     filename, linenum, arg);
1893                 while (arg)
1894                     arg = strdelim(&cp);
1895                 break;
1896
1897         case sUnsupported:
1898                 logit("%s line %d: Unsupported option %s",
1899                     filename, linenum, arg);
1900                 while (arg)
1901                     arg = strdelim(&cp);
1902                 break;
1903
1904         default:
1905                 fatal("%s line %d: Missing handler for opcode %s (%d)",
1906                     filename, linenum, arg, opcode);
1907         }
1908         if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
1909                 fatal("%s line %d: garbage at end of line; \"%.200s\".",
1910                     filename, linenum, arg);
1911         return 0;
1912 }
1913
1914 /* Reads the server configuration file. */
1915
1916 void
1917 load_server_config(const char *filename, Buffer *conf)
1918 {
1919         char line[4096], *cp;
1920         FILE *f;
1921         int lineno = 0;
1922
1923         debug2("%s: filename %s", __func__, filename);
1924         if ((f = fopen(filename, "r")) == NULL) {
1925                 perror(filename);
1926                 exit(1);
1927         }
1928         buffer_clear(conf);
1929         while (fgets(line, sizeof(line), f)) {
1930                 lineno++;
1931                 if (strlen(line) == sizeof(line) - 1)
1932                         fatal("%s line %d too long", filename, lineno);
1933                 /*
1934                  * Trim out comments and strip whitespace
1935                  * NB - preserve newlines, they are needed to reproduce
1936                  * line numbers later for error messages
1937                  */
1938                 if ((cp = strchr(line, '#')) != NULL)
1939                         memcpy(cp, "\n", 2);
1940                 cp = line + strspn(line, " \t\r");
1941
1942                 buffer_append(conf, cp, strlen(cp));
1943         }
1944         buffer_append(conf, "\0", 1);
1945         fclose(f);
1946         debug2("%s: done config len = %d", __func__, buffer_len(conf));
1947 }
1948
1949 void
1950 parse_server_match_config(ServerOptions *options,
1951    struct connection_info *connectinfo)
1952 {
1953         ServerOptions mo;
1954
1955         initialize_server_options(&mo);
1956         parse_server_config(&mo, "reprocess config", &cfg, connectinfo);
1957         copy_set_server_options(options, &mo, 0);
1958 }
1959
1960 int parse_server_match_testspec(struct connection_info *ci, char *spec)
1961 {
1962         char *p;
1963
1964         while ((p = strsep(&spec, ",")) && *p != '\0') {
1965                 if (strncmp(p, "addr=", 5) == 0) {
1966                         ci->address = xstrdup(p + 5);
1967                 } else if (strncmp(p, "host=", 5) == 0) {
1968                         ci->host = xstrdup(p + 5);
1969                 } else if (strncmp(p, "user=", 5) == 0) {
1970                         ci->user = xstrdup(p + 5);
1971                 } else if (strncmp(p, "laddr=", 6) == 0) {
1972                         ci->laddress = xstrdup(p + 6);
1973                 } else if (strncmp(p, "lport=", 6) == 0) {
1974                         ci->lport = a2port(p + 6);
1975                         if (ci->lport == -1) {
1976                                 fprintf(stderr, "Invalid port '%s' in test mode"
1977                                    " specification %s\n", p+6, p);
1978                                 return -1;
1979                         }
1980                 } else {
1981                         fprintf(stderr, "Invalid test mode specification %s\n",
1982                            p);
1983                         return -1;
1984                 }
1985         }
1986         return 0;
1987 }
1988
1989 /*
1990  * returns 1 for a complete spec, 0 for partial spec and -1 for an
1991  * empty spec.
1992  */
1993 int server_match_spec_complete(struct connection_info *ci)
1994 {
1995         if (ci->user && ci->host && ci->address)
1996                 return 1;       /* complete */
1997         if (!ci->user && !ci->host && !ci->address)
1998                 return -1;      /* empty */
1999         return 0;       /* partial */
2000 }
2001
2002 /*
2003  * Copy any supported values that are set.
2004  *
2005  * If the preauth flag is set, we do not bother copying the string or
2006  * array values that are not used pre-authentication, because any that we
2007  * do use must be explictly sent in mm_getpwnamallow().
2008  */
2009 void
2010 copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
2011 {
2012 #define M_CP_INTOPT(n) do {\
2013         if (src->n != -1) \
2014                 dst->n = src->n; \
2015 } while (0)
2016
2017         M_CP_INTOPT(password_authentication);
2018         M_CP_INTOPT(gss_authentication);
2019         M_CP_INTOPT(rsa_authentication);
2020         M_CP_INTOPT(pubkey_authentication);
2021         M_CP_INTOPT(kerberos_authentication);
2022         M_CP_INTOPT(hostbased_authentication);
2023         M_CP_INTOPT(hostbased_uses_name_from_packet_only);
2024         M_CP_INTOPT(kbd_interactive_authentication);
2025         M_CP_INTOPT(permit_root_login);
2026         M_CP_INTOPT(permit_empty_passwd);
2027
2028         M_CP_INTOPT(allow_tcp_forwarding);
2029         M_CP_INTOPT(allow_streamlocal_forwarding);
2030         M_CP_INTOPT(allow_agent_forwarding);
2031         M_CP_INTOPT(permit_tun);
2032         M_CP_INTOPT(fwd_opts.gateway_ports);
2033         M_CP_INTOPT(fwd_opts.streamlocal_bind_unlink);
2034         M_CP_INTOPT(x11_display_offset);
2035         M_CP_INTOPT(x11_forwarding);
2036         M_CP_INTOPT(x11_use_localhost);
2037         M_CP_INTOPT(permit_tty);
2038         M_CP_INTOPT(permit_user_rc);
2039         M_CP_INTOPT(max_sessions);
2040         M_CP_INTOPT(max_authtries);
2041         M_CP_INTOPT(ip_qos_interactive);
2042         M_CP_INTOPT(ip_qos_bulk);
2043         M_CP_INTOPT(rekey_limit);
2044         M_CP_INTOPT(rekey_interval);
2045
2046         /*
2047          * The bind_mask is a mode_t that may be unsigned, so we can't use
2048          * M_CP_INTOPT - it does a signed comparison that causes compiler
2049          * warnings.
2050          */
2051         if (src->fwd_opts.streamlocal_bind_mask != (mode_t)-1) {
2052                 dst->fwd_opts.streamlocal_bind_mask =
2053                     src->fwd_opts.streamlocal_bind_mask;
2054         }
2055
2056         /* M_CP_STROPT and M_CP_STRARRAYOPT should not appear before here */
2057 #define M_CP_STROPT(n) do {\
2058         if (src->n != NULL && dst->n != src->n) { \
2059                 free(dst->n); \
2060                 dst->n = src->n; \
2061         } \
2062 } while(0)
2063 #define M_CP_STRARRAYOPT(n, num_n) do {\
2064         if (src->num_n != 0) { \
2065                 for (dst->num_n = 0; dst->num_n < src->num_n; dst->num_n++) \
2066                         dst->n[dst->num_n] = xstrdup(src->n[dst->num_n]); \
2067         } \
2068 } while(0)
2069
2070         /* See comment in servconf.h */
2071         COPY_MATCH_STRING_OPTS();
2072
2073         /* Arguments that accept '+...' need to be expanded */
2074         assemble_algorithms(dst);
2075
2076         /*
2077          * The only things that should be below this point are string options
2078          * which are only used after authentication.
2079          */
2080         if (preauth)
2081                 return;
2082
2083         /* These options may be "none" to clear a global setting */
2084         M_CP_STROPT(adm_forced_command);
2085         if (option_clear_or_none(dst->adm_forced_command)) {
2086                 free(dst->adm_forced_command);
2087                 dst->adm_forced_command = NULL;
2088         }
2089         M_CP_STROPT(chroot_directory);
2090         if (option_clear_or_none(dst->chroot_directory)) {
2091                 free(dst->chroot_directory);
2092                 dst->chroot_directory = NULL;
2093         }
2094 }
2095
2096 #undef M_CP_INTOPT
2097 #undef M_CP_STROPT
2098 #undef M_CP_STRARRAYOPT
2099
2100 void
2101 parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
2102     struct connection_info *connectinfo)
2103 {
2104         int active, linenum, bad_options = 0;
2105         char *cp, *obuf, *cbuf;
2106
2107         debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
2108
2109         if ((obuf = cbuf = sshbuf_dup_string(conf)) == NULL)
2110                 fatal("%s: sshbuf_dup_string failed", __func__);
2111         active = connectinfo ? 0 : 1;
2112         linenum = 1;
2113         while ((cp = strsep(&cbuf, "\n")) != NULL) {
2114                 if (process_server_config_line(options, cp, filename,
2115                     linenum++, &active, connectinfo) != 0)
2116                         bad_options++;
2117         }
2118         free(obuf);
2119         if (bad_options > 0)
2120                 fatal("%s: terminating, %d bad configuration options",
2121                     filename, bad_options);
2122         process_queued_listen_addrs(options);
2123 }
2124
2125 static const char *
2126 fmt_multistate_int(int val, const struct multistate *m)
2127 {
2128         u_int i;
2129
2130         for (i = 0; m[i].key != NULL; i++) {
2131                 if (m[i].value == val)
2132                         return m[i].key;
2133         }
2134         return "UNKNOWN";
2135 }
2136
2137 static const char *
2138 fmt_intarg(ServerOpCodes code, int val)
2139 {
2140         if (val == -1)
2141                 return "unset";
2142         switch (code) {
2143         case sAddressFamily:
2144                 return fmt_multistate_int(val, multistate_addressfamily);
2145         case sPermitRootLogin:
2146                 return fmt_multistate_int(val, multistate_permitrootlogin);
2147         case sGatewayPorts:
2148                 return fmt_multistate_int(val, multistate_gatewayports);
2149         case sCompression:
2150                 return fmt_multistate_int(val, multistate_compression);
2151         case sUsePrivilegeSeparation:
2152                 return fmt_multistate_int(val, multistate_privsep);
2153         case sAllowTcpForwarding:
2154                 return fmt_multistate_int(val, multistate_tcpfwd);
2155         case sAllowStreamLocalForwarding:
2156                 return fmt_multistate_int(val, multistate_tcpfwd);
2157         case sFingerprintHash:
2158                 return ssh_digest_alg_name(val);
2159         case sProtocol:
2160                 switch (val) {
2161                 case SSH_PROTO_1:
2162                         return "1";
2163                 case SSH_PROTO_2:
2164                         return "2";
2165                 case (SSH_PROTO_1|SSH_PROTO_2):
2166                         return "2,1";
2167                 default:
2168                         return "UNKNOWN";
2169                 }
2170         default:
2171                 switch (val) {
2172                 case 0:
2173                         return "no";
2174                 case 1:
2175                         return "yes";
2176                 default:
2177                         return "UNKNOWN";
2178                 }
2179         }
2180 }
2181
2182 static const char *
2183 lookup_opcode_name(ServerOpCodes code)
2184 {
2185         u_int i;
2186
2187         for (i = 0; keywords[i].name != NULL; i++)
2188                 if (keywords[i].opcode == code)
2189                         return(keywords[i].name);
2190         return "UNKNOWN";
2191 }
2192
2193 static void
2194 dump_cfg_int(ServerOpCodes code, int val)
2195 {
2196         printf("%s %d\n", lookup_opcode_name(code), val);
2197 }
2198
2199 static void
2200 dump_cfg_oct(ServerOpCodes code, int val)
2201 {
2202         printf("%s 0%o\n", lookup_opcode_name(code), val);
2203 }
2204
2205 static void
2206 dump_cfg_fmtint(ServerOpCodes code, int val)
2207 {
2208         printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
2209 }
2210
2211 static void
2212 dump_cfg_string(ServerOpCodes code, const char *val)
2213 {
2214         if (val == NULL)
2215                 return;
2216         printf("%s %s\n", lookup_opcode_name(code),
2217             val == NULL ? "none" : val);
2218 }
2219
2220 static void
2221 dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals)
2222 {
2223         u_int i;
2224
2225         for (i = 0; i < count; i++)
2226                 printf("%s %s\n", lookup_opcode_name(code), vals[i]);
2227 }
2228
2229 static void
2230 dump_cfg_strarray_oneline(ServerOpCodes code, u_int count, char **vals)
2231 {
2232         u_int i;
2233
2234         if (count <= 0 && code != sAuthenticationMethods)
2235                 return;
2236         printf("%s", lookup_opcode_name(code));
2237         for (i = 0; i < count; i++)
2238                 printf(" %s",  vals[i]);
2239         if (code == sAuthenticationMethods && count == 0)
2240                 printf(" any");
2241         printf("\n");
2242 }
2243
2244 void
2245 dump_config(ServerOptions *o)
2246 {
2247         u_int i;
2248         int ret;
2249         struct addrinfo *ai;
2250         char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL;
2251         char *laddr1 = xstrdup(""), *laddr2 = NULL;
2252
2253         /* these are usually at the top of the config */
2254         for (i = 0; i < o->num_ports; i++)
2255                 printf("port %d\n", o->ports[i]);
2256         dump_cfg_fmtint(sProtocol, o->protocol);
2257         dump_cfg_fmtint(sAddressFamily, o->address_family);
2258
2259         /*
2260          * ListenAddress must be after Port.  add_one_listen_addr pushes
2261          * addresses onto a stack, so to maintain ordering we need to
2262          * print these in reverse order.
2263          */
2264         for (ai = o->listen_addrs; ai; ai = ai->ai_next) {
2265                 if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr,
2266                     sizeof(addr), port, sizeof(port),
2267                     NI_NUMERICHOST|NI_NUMERICSERV)) != 0) {
2268                         error("getnameinfo failed: %.100s",
2269                             (ret != EAI_SYSTEM) ? gai_strerror(ret) :
2270                             strerror(errno));
2271                 } else {
2272                         laddr2 = laddr1;
2273                         if (ai->ai_family == AF_INET6)
2274                                 xasprintf(&laddr1, "listenaddress [%s]:%s\n%s",
2275                                     addr, port, laddr2);
2276                         else
2277                                 xasprintf(&laddr1, "listenaddress %s:%s\n%s",
2278                                     addr, port, laddr2);
2279                         free(laddr2);
2280                 }
2281         }
2282         printf("%s", laddr1);
2283         free(laddr1);
2284
2285         /* integer arguments */
2286 #ifdef USE_PAM
2287         dump_cfg_fmtint(sUsePAM, o->use_pam);
2288 #endif
2289         dump_cfg_int(sServerKeyBits, o->server_key_bits);
2290         dump_cfg_int(sLoginGraceTime, o->login_grace_time);
2291         dump_cfg_int(sKeyRegenerationTime, o->key_regeneration_time);
2292         dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
2293         dump_cfg_int(sMaxAuthTries, o->max_authtries);
2294         dump_cfg_int(sMaxSessions, o->max_sessions);
2295         dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
2296         dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max);
2297         dump_cfg_oct(sStreamLocalBindMask, o->fwd_opts.streamlocal_bind_mask);
2298
2299         /* formatted integer arguments */
2300         dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login);
2301         dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts);
2302         dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts);
2303         dump_cfg_fmtint(sRhostsRSAAuthentication, o->rhosts_rsa_authentication);
2304         dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication);
2305         dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly,
2306             o->hostbased_uses_name_from_packet_only);
2307         dump_cfg_fmtint(sRSAAuthentication, o->rsa_authentication);
2308         dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication);
2309 #ifdef KRB5
2310         dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication);
2311         dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd);
2312         dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup);
2313 # ifdef USE_AFS
2314         dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
2315 # endif
2316 #endif
2317 #ifdef GSSAPI
2318         dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
2319         dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
2320 #endif
2321         dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
2322         dump_cfg_fmtint(sKbdInteractiveAuthentication,
2323             o->kbd_interactive_authentication);
2324         dump_cfg_fmtint(sChallengeResponseAuthentication,
2325             o->challenge_response_authentication);
2326         dump_cfg_fmtint(sPrintMotd, o->print_motd);
2327 #ifndef DISABLE_LASTLOG
2328         dump_cfg_fmtint(sPrintLastLog, o->print_lastlog);
2329 #endif
2330         dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding);
2331         dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
2332         dump_cfg_fmtint(sPermitTTY, o->permit_tty);
2333         dump_cfg_fmtint(sPermitUserRC, o->permit_user_rc);
2334         dump_cfg_fmtint(sStrictModes, o->strict_modes);
2335         dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
2336         dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
2337         dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
2338         dump_cfg_fmtint(sUseLogin, o->use_login);
2339         dump_cfg_fmtint(sCompression, o->compression);
2340         dump_cfg_fmtint(sGatewayPorts, o->fwd_opts.gateway_ports);
2341         dump_cfg_fmtint(sUseDNS, o->use_dns);
2342         dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
2343         dump_cfg_fmtint(sAllowAgentForwarding, o->allow_agent_forwarding);
2344         dump_cfg_fmtint(sAllowStreamLocalForwarding, o->allow_streamlocal_forwarding);
2345         dump_cfg_fmtint(sStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink);
2346         dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
2347         dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);
2348
2349         /* string arguments */
2350         dump_cfg_string(sPidFile, o->pid_file);
2351         dump_cfg_string(sXAuthLocation, o->xauth_location);
2352         dump_cfg_string(sCiphers, o->ciphers ? o->ciphers : KEX_SERVER_ENCRYPT);
2353         dump_cfg_string(sMacs, o->macs ? o->macs : KEX_SERVER_MAC);
2354         dump_cfg_string(sBanner, o->banner);
2355         dump_cfg_string(sForceCommand, o->adm_forced_command);
2356         dump_cfg_string(sChrootDirectory, o->chroot_directory);
2357         dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
2358         dump_cfg_string(sRevokedKeys, o->revoked_keys_file);
2359         dump_cfg_string(sAuthorizedPrincipalsFile,
2360             o->authorized_principals_file);
2361         dump_cfg_string(sVersionAddendum, *o->version_addendum == '\0'
2362             ? "none" : o->version_addendum);
2363         dump_cfg_string(sAuthorizedKeysCommand, o->authorized_keys_command);
2364         dump_cfg_string(sAuthorizedKeysCommandUser, o->authorized_keys_command_user);
2365         dump_cfg_string(sAuthorizedPrincipalsCommand, o->authorized_principals_command);
2366         dump_cfg_string(sAuthorizedPrincipalsCommandUser, o->authorized_principals_command_user);
2367         dump_cfg_string(sHostKeyAgent, o->host_key_agent);
2368         dump_cfg_string(sKexAlgorithms,
2369             o->kex_algorithms ? o->kex_algorithms : KEX_SERVER_KEX);
2370         dump_cfg_string(sHostbasedAcceptedKeyTypes, o->hostbased_key_types ?
2371             o->hostbased_key_types : KEX_DEFAULT_PK_ALG);
2372         dump_cfg_string(sHostKeyAlgorithms, o->hostkeyalgorithms ?
2373             o->hostkeyalgorithms : KEX_DEFAULT_PK_ALG);
2374         dump_cfg_string(sPubkeyAcceptedKeyTypes, o->pubkey_key_types ?
2375             o->pubkey_key_types : KEX_DEFAULT_PK_ALG);
2376
2377         /* string arguments requiring a lookup */
2378         dump_cfg_string(sLogLevel, log_level_name(o->log_level));
2379         dump_cfg_string(sLogFacility, log_facility_name(o->log_facility));
2380
2381         /* string array arguments */
2382         dump_cfg_strarray_oneline(sAuthorizedKeysFile, o->num_authkeys_files,
2383             o->authorized_keys_files);
2384         dump_cfg_strarray(sHostKeyFile, o->num_host_key_files,
2385              o->host_key_files);
2386         dump_cfg_strarray(sHostCertificate, o->num_host_cert_files,
2387              o->host_cert_files);
2388         dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users);
2389         dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users);
2390         dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups);
2391         dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups);
2392         dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env);
2393         dump_cfg_strarray_oneline(sAuthenticationMethods,
2394             o->num_auth_methods, o->auth_methods);
2395
2396         /* other arguments */
2397         for (i = 0; i < o->num_subsystems; i++)
2398                 printf("subsystem %s %s\n", o->subsystem_name[i],
2399                     o->subsystem_args[i]);
2400
2401         printf("maxstartups %d:%d:%d\n", o->max_startups_begin,
2402             o->max_startups_rate, o->max_startups);
2403
2404         for (i = 0; tunmode_desc[i].val != -1; i++)
2405                 if (tunmode_desc[i].val == o->permit_tun) {
2406                         s = tunmode_desc[i].text;
2407                         break;
2408                 }
2409         dump_cfg_string(sPermitTunnel, s);
2410
2411         printf("ipqos %s ", iptos2str(o->ip_qos_interactive));
2412         printf("%s\n", iptos2str(o->ip_qos_bulk));
2413
2414         printf("rekeylimit %llu %d\n", (unsigned long long)o->rekey_limit,
2415             o->rekey_interval);
2416
2417         channel_print_adm_permitted_opens();
2418 }