servconf.c revision 262566 
1
2/* $OpenBSD: servconf.c,v 1.248 2013/12/06 13:39:49 markus Exp $ */
3/* $FreeBSD: stable/10/crypto/openssh/servconf.c 262566 2014-02-27 17:29:02Z des $ */
4/*
5 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 *                    All rights reserved
7 *
8 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose.  Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
13 */
14
15#include "includes.h"
16__RCSID("$FreeBSD: stable/10/crypto/openssh/servconf.c 262566 2014-02-27 17:29:02Z des $");
17
18#include <sys/types.h>
19#include <sys/socket.h>
20
21#include <netinet/in.h>
22#include <netinet/in_systm.h>
23#include <netinet/ip.h>
24
25#include <ctype.h>
26#include <netdb.h>
27#include <pwd.h>
28#include <stdio.h>
29#include <stdlib.h>
30#include <string.h>
31#include <signal.h>
32#include <unistd.h>
33#include <stdarg.h>
34#include <errno.h>
35#ifdef HAVE_UTIL_H
36#include <util.h>
37#endif
38
39#include "openbsd-compat/sys-queue.h"
40#include "xmalloc.h"
41#include "ssh.h"
42#include "log.h"
43#include "buffer.h"
44#include "servconf.h"
45#include "compat.h"
46#include "pathnames.h"
47#include "misc.h"
48#include "cipher.h"
49#include "key.h"
50#include "kex.h"
51#include "mac.h"
52#include "match.h"
53#include "channels.h"
54#include "groupaccess.h"
55#include "canohost.h"
56#include "packet.h"
57#include "hostfile.h"
58#include "auth.h"
59#include "version.h"
60
61static void add_listen_addr(ServerOptions *, char *, int);
62static void add_one_listen_addr(ServerOptions *, char *, int);
63
64/* Use of privilege separation or not */
65extern int use_privsep;
66extern Buffer cfg;
67
68/* Initializes the server options to their default values. */
69
70void
71initialize_server_options(ServerOptions *options)
72{
73	memset(options, 0, sizeof(*options));
74
75	/* Portable-specific options */
76	options->use_pam = -1;
77
78	/* Standard Options */
79	options->num_ports = 0;
80	options->ports_from_cmdline = 0;
81	options->listen_addrs = NULL;
82	options->address_family = -1;
83	options->num_host_key_files = 0;
84	options->num_host_cert_files = 0;
85	options->host_key_agent = NULL;
86	options->pid_file = NULL;
87	options->server_key_bits = -1;
88	options->login_grace_time = -1;
89	options->key_regeneration_time = -1;
90	options->permit_root_login = PERMIT_NOT_SET;
91	options->ignore_rhosts = -1;
92	options->ignore_user_known_hosts = -1;
93	options->print_motd = -1;
94	options->print_lastlog = -1;
95	options->x11_forwarding = -1;
96	options->x11_display_offset = -1;
97	options->x11_use_localhost = -1;
98	options->permit_tty = -1;
99	options->xauth_location = NULL;
100	options->strict_modes = -1;
101	options->tcp_keep_alive = -1;
102	options->log_facility = SYSLOG_FACILITY_NOT_SET;
103	options->log_level = SYSLOG_LEVEL_NOT_SET;
104	options->rhosts_rsa_authentication = -1;
105	options->hostbased_authentication = -1;
106	options->hostbased_uses_name_from_packet_only = -1;
107	options->rsa_authentication = -1;
108	options->pubkey_authentication = -1;
109	options->kerberos_authentication = -1;
110	options->kerberos_or_local_passwd = -1;
111	options->kerberos_ticket_cleanup = -1;
112	options->kerberos_get_afs_token = -1;
113	options->gss_authentication=-1;
114	options->gss_cleanup_creds = -1;
115	options->password_authentication = -1;
116	options->kbd_interactive_authentication = -1;
117	options->challenge_response_authentication = -1;
118	options->permit_empty_passwd = -1;
119	options->permit_user_env = -1;
120	options->use_login = -1;
121	options->compression = -1;
122	options->rekey_limit = -1;
123	options->rekey_interval = -1;
124	options->allow_tcp_forwarding = -1;
125	options->allow_agent_forwarding = -1;
126	options->num_allow_users = 0;
127	options->num_deny_users = 0;
128	options->num_allow_groups = 0;
129	options->num_deny_groups = 0;
130	options->ciphers = NULL;
131	options->macs = NULL;
132	options->kex_algorithms = NULL;
133	options->protocol = SSH_PROTO_UNKNOWN;
134	options->gateway_ports = -1;
135	options->num_subsystems = 0;
136	options->max_startups_begin = -1;
137	options->max_startups_rate = -1;
138	options->max_startups = -1;
139	options->max_authtries = -1;
140	options->max_sessions = -1;
141	options->banner = NULL;
142	options->use_dns = -1;
143	options->client_alive_interval = -1;
144	options->client_alive_count_max = -1;
145	options->num_authkeys_files = 0;
146	options->num_accept_env = 0;
147	options->permit_tun = -1;
148	options->num_permitted_opens = -1;
149	options->adm_forced_command = NULL;
150	options->chroot_directory = NULL;
151	options->authorized_keys_command = NULL;
152	options->authorized_keys_command_user = NULL;
153	options->zero_knowledge_password_authentication = -1;
154	options->revoked_keys_file = NULL;
155	options->trusted_user_ca_keys = NULL;
156	options->authorized_principals_file = NULL;
157	options->ip_qos_interactive = -1;
158	options->ip_qos_bulk = -1;
159	options->version_addendum = NULL;
160	options->hpn_disabled = -1;
161	options->hpn_buffer_size = -1;
162	options->tcp_rcv_buf_poll = -1;
163#ifdef	NONE_CIPHER_ENABLED
164	options->none_enabled = -1;
165#endif
166}
167
168void
169fill_default_server_options(ServerOptions *options)
170{
171	/* Portable-specific options */
172	if (options->use_pam == -1)
173		options->use_pam = 1;
174
175	/* Standard Options */
176	if (options->protocol == SSH_PROTO_UNKNOWN)
177		options->protocol = SSH_PROTO_2;
178	if (options->num_host_key_files == 0) {
179		/* fill default hostkeys for protocols */
180		if (options->protocol & SSH_PROTO_1)
181			options->host_key_files[options->num_host_key_files++] =
182			    _PATH_HOST_KEY_FILE;
183		if (options->protocol & SSH_PROTO_2) {
184			options->host_key_files[options->num_host_key_files++] =
185			    _PATH_HOST_RSA_KEY_FILE;
186			options->host_key_files[options->num_host_key_files++] =
187			    _PATH_HOST_DSA_KEY_FILE;
188#ifdef OPENSSL_HAS_ECC
189			options->host_key_files[options->num_host_key_files++] =
190			    _PATH_HOST_ECDSA_KEY_FILE;
191#endif
192			options->host_key_files[options->num_host_key_files++] =
193			    _PATH_HOST_ED25519_KEY_FILE;
194		}
195	}
196	/* No certificates by default */
197	if (options->num_ports == 0)
198		options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
199	if (options->listen_addrs == NULL)
200		add_listen_addr(options, NULL, 0);
201	if (options->pid_file == NULL)
202		options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
203	if (options->server_key_bits == -1)
204		options->server_key_bits = 1024;
205	if (options->login_grace_time == -1)
206		options->login_grace_time = 120;
207	if (options->key_regeneration_time == -1)
208		options->key_regeneration_time = 3600;
209	if (options->permit_root_login == PERMIT_NOT_SET)
210		options->permit_root_login = PERMIT_NO;
211	if (options->ignore_rhosts == -1)
212		options->ignore_rhosts = 1;
213	if (options->ignore_user_known_hosts == -1)
214		options->ignore_user_known_hosts = 0;
215	if (options->print_motd == -1)
216		options->print_motd = 1;
217	if (options->print_lastlog == -1)
218		options->print_lastlog = 1;
219	if (options->x11_forwarding == -1)
220		options->x11_forwarding = 1;
221	if (options->x11_display_offset == -1)
222		options->x11_display_offset = 10;
223	if (options->x11_use_localhost == -1)
224		options->x11_use_localhost = 1;
225	if (options->xauth_location == NULL)
226		options->xauth_location = _PATH_XAUTH;
227	if (options->permit_tty == -1)
228		options->permit_tty = 1;
229	if (options->strict_modes == -1)
230		options->strict_modes = 1;
231	if (options->tcp_keep_alive == -1)
232		options->tcp_keep_alive = 1;
233	if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
234		options->log_facility = SYSLOG_FACILITY_AUTH;
235	if (options->log_level == SYSLOG_LEVEL_NOT_SET)
236		options->log_level = SYSLOG_LEVEL_INFO;
237	if (options->rhosts_rsa_authentication == -1)
238		options->rhosts_rsa_authentication = 0;
239	if (options->hostbased_authentication == -1)
240		options->hostbased_authentication = 0;
241	if (options->hostbased_uses_name_from_packet_only == -1)
242		options->hostbased_uses_name_from_packet_only = 0;
243	if (options->rsa_authentication == -1)
244		options->rsa_authentication = 1;
245	if (options->pubkey_authentication == -1)
246		options->pubkey_authentication = 1;
247	if (options->kerberos_authentication == -1)
248		options->kerberos_authentication = 0;
249	if (options->kerberos_or_local_passwd == -1)
250		options->kerberos_or_local_passwd = 1;
251	if (options->kerberos_ticket_cleanup == -1)
252		options->kerberos_ticket_cleanup = 1;
253	if (options->kerberos_get_afs_token == -1)
254		options->kerberos_get_afs_token = 0;
255	if (options->gss_authentication == -1)
256		options->gss_authentication = 0;
257	if (options->gss_cleanup_creds == -1)
258		options->gss_cleanup_creds = 1;
259	if (options->password_authentication == -1)
260		options->password_authentication = 0;
261	if (options->kbd_interactive_authentication == -1)
262		options->kbd_interactive_authentication = 0;
263	if (options->challenge_response_authentication == -1)
264		options->challenge_response_authentication = 1;
265	if (options->permit_empty_passwd == -1)
266		options->permit_empty_passwd = 0;
267	if (options->permit_user_env == -1)
268		options->permit_user_env = 0;
269	if (options->use_login == -1)
270		options->use_login = 0;
271	if (options->compression == -1)
272		options->compression = COMP_DELAYED;
273	if (options->rekey_limit == -1)
274		options->rekey_limit = 0;
275	if (options->rekey_interval == -1)
276		options->rekey_interval = 0;
277	if (options->allow_tcp_forwarding == -1)
278		options->allow_tcp_forwarding = FORWARD_ALLOW;
279	if (options->allow_agent_forwarding == -1)
280		options->allow_agent_forwarding = 1;
281	if (options->gateway_ports == -1)
282		options->gateway_ports = 0;
283	if (options->max_startups == -1)
284		options->max_startups = 100;
285	if (options->max_startups_rate == -1)
286		options->max_startups_rate = 30;		/* 30% */
287	if (options->max_startups_begin == -1)
288		options->max_startups_begin = 10;
289	if (options->max_authtries == -1)
290		options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
291	if (options->max_sessions == -1)
292		options->max_sessions = DEFAULT_SESSIONS_MAX;
293	if (options->use_dns == -1)
294		options->use_dns = 1;
295	if (options->client_alive_interval == -1)
296		options->client_alive_interval = 0;
297	if (options->client_alive_count_max == -1)
298		options->client_alive_count_max = 3;
299	if (options->num_authkeys_files == 0) {
300		options->authorized_keys_files[options->num_authkeys_files++] =
301		    xstrdup(_PATH_SSH_USER_PERMITTED_KEYS);
302		options->authorized_keys_files[options->num_authkeys_files++] =
303		    xstrdup(_PATH_SSH_USER_PERMITTED_KEYS2);
304	}
305	if (options->permit_tun == -1)
306		options->permit_tun = SSH_TUNMODE_NO;
307	if (options->zero_knowledge_password_authentication == -1)
308		options->zero_knowledge_password_authentication = 0;
309	if (options->ip_qos_interactive == -1)
310		options->ip_qos_interactive = IPTOS_LOWDELAY;
311	if (options->ip_qos_bulk == -1)
312		options->ip_qos_bulk = IPTOS_THROUGHPUT;
313	if (options->version_addendum == NULL)
314		options->version_addendum = xstrdup(SSH_VERSION_FREEBSD);
315	/* Turn privilege separation on by default */
316	if (use_privsep == -1)
317		use_privsep = PRIVSEP_ON;
318
319#ifndef HAVE_MMAP
320	if (use_privsep && options->compression == 1) {
321		error("This platform does not support both privilege "
322		    "separation and compression");
323		error("Compression disabled");
324		options->compression = 0;
325	}
326#endif
327
328	if (options->hpn_disabled == -1)
329		options->hpn_disabled = 0;
330	if (options->hpn_buffer_size == -1) {
331		/*
332		 * HPN buffer size option not explicitly set.  Try to figure
333		 * out what value to use or resort to default.
334		 */
335		options->hpn_buffer_size = CHAN_SES_WINDOW_DEFAULT;
336		if (!options->hpn_disabled) {
337			sock_get_rcvbuf(&options->hpn_buffer_size, 0);
338			debug ("HPN Buffer Size: %d", options->hpn_buffer_size);
339		}
340	} else {
341		/*
342		 * In the case that the user sets both values in a
343		 * contradictory manner hpn_disabled overrrides hpn_buffer_size.
344		 */
345		if (options->hpn_disabled <= 0) {
346			u_int maxlen;
347
348			maxlen = buffer_get_max_len();
349			if (options->hpn_buffer_size == 0)
350				options->hpn_buffer_size = 1;
351			/* Limit the maximum buffer to BUFFER_MAX_LEN. */
352			if (options->hpn_buffer_size > maxlen / 1024)
353				options->hpn_buffer_size = maxlen;
354			else
355				options->hpn_buffer_size *= 1024;
356		} else {
357			options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT;
358		}
359	}
360}
361
362/* Keyword tokens. */
363typedef enum {
364	sBadOption,		/* == unknown option */
365	/* Portable-specific options */
366	sUsePAM,
367	/* Standard Options */
368	sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
369	sPermitRootLogin, sLogFacility, sLogLevel,
370	sRhostsRSAAuthentication, sRSAAuthentication,
371	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
372	sKerberosGetAFSToken,
373	sKerberosTgtPassing, sChallengeResponseAuthentication,
374	sPasswordAuthentication, sKbdInteractiveAuthentication,
375	sListenAddress, sAddressFamily,
376	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
377	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
378	sPermitTTY, sStrictModes, sEmptyPasswd, sTCPKeepAlive,
379	sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
380	sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
381	sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
382	sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
383	sMaxStartups, sMaxAuthTries, sMaxSessions,
384	sBanner, sUseDNS, sHostbasedAuthentication,
385	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
386	sClientAliveCountMax, sAuthorizedKeysFile,
387	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
388	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
389	sUsePrivilegeSeparation, sAllowAgentForwarding,
390	sZeroKnowledgePasswordAuthentication, sHostCertificate,
391	sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
392	sKexAlgorithms, sIPQoS, sVersionAddendum,
393	sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
394	sAuthenticationMethods, sHostKeyAgent,
395	sHPNDisabled, sHPNBufferSize, sTcpRcvBufPoll,
396#ifdef NONE_CIPHER_ENABLED
397	sNoneEnabled,
398#endif
399	sDeprecated, sUnsupported
400} ServerOpCodes;
401
402#define SSHCFG_GLOBAL	0x01	/* allowed in main section of sshd_config */
403#define SSHCFG_MATCH	0x02	/* allowed inside a Match section */
404#define SSHCFG_ALL	(SSHCFG_GLOBAL|SSHCFG_MATCH)
405
406/* Textual representation of the tokens. */
407static struct {
408	const char *name;
409	ServerOpCodes opcode;
410	u_int flags;
411} keywords[] = {
412	/* Portable-specific options */
413#ifdef USE_PAM
414	{ "usepam", sUsePAM, SSHCFG_GLOBAL },
415#else
416	{ "usepam", sUnsupported, SSHCFG_GLOBAL },
417#endif
418	{ "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
419	/* Standard Options */
420	{ "port", sPort, SSHCFG_GLOBAL },
421	{ "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
422	{ "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL },		/* alias */
423	{ "hostkeyagent", sHostKeyAgent, SSHCFG_GLOBAL },
424	{ "pidfile", sPidFile, SSHCFG_GLOBAL },
425	{ "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL },
426	{ "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
427	{ "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL },
428	{ "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
429	{ "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
430	{ "loglevel", sLogLevel, SSHCFG_GLOBAL },
431	{ "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL },
432	{ "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
433	{ "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
434	{ "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_ALL },
435	{ "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
436	{ "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
437	{ "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
438#ifdef KRB5
439	{ "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
440	{ "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
441	{ "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
442#ifdef USE_AFS
443	{ "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL },
444#else
445	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
446#endif
447#else
448	{ "kerberosauthentication", sUnsupported, SSHCFG_ALL },
449	{ "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
450	{ "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
451	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
452#endif
453	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
454	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
455#ifdef GSSAPI
456	{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
457	{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
458#else
459	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
460	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
461#endif
462	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
463	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
464	{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
465	{ "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
466#ifdef JPAKE
467	{ "zeroknowledgepasswordauthentication", sZeroKnowledgePasswordAuthentication, SSHCFG_ALL },
468#else
469	{ "zeroknowledgepasswordauthentication", sUnsupported, SSHCFG_ALL },
470#endif
471	{ "checkmail", sDeprecated, SSHCFG_GLOBAL },
472	{ "listenaddress", sListenAddress, SSHCFG_GLOBAL },
473	{ "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
474	{ "printmotd", sPrintMotd, SSHCFG_GLOBAL },
475	{ "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
476	{ "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
477	{ "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
478	{ "x11forwarding", sX11Forwarding, SSHCFG_ALL },
479	{ "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
480	{ "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
481	{ "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
482	{ "strictmodes", sStrictModes, SSHCFG_GLOBAL },
483	{ "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
484	{ "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
485	{ "uselogin", sUseLogin, SSHCFG_GLOBAL },
486	{ "compression", sCompression, SSHCFG_GLOBAL },
487	{ "rekeylimit", sRekeyLimit, SSHCFG_ALL },
488	{ "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL },
489	{ "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL },	/* obsolete alias */
490	{ "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
491	{ "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL },
492	{ "allowusers", sAllowUsers, SSHCFG_ALL },
493	{ "denyusers", sDenyUsers, SSHCFG_ALL },
494	{ "allowgroups", sAllowGroups, SSHCFG_ALL },
495	{ "denygroups", sDenyGroups, SSHCFG_ALL },
496	{ "ciphers", sCiphers, SSHCFG_GLOBAL },
497	{ "macs", sMacs, SSHCFG_GLOBAL },
498	{ "protocol", sProtocol, SSHCFG_GLOBAL },
499	{ "gatewayports", sGatewayPorts, SSHCFG_ALL },
500	{ "subsystem", sSubsystem, SSHCFG_GLOBAL },
501	{ "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
502	{ "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
503	{ "maxsessions", sMaxSessions, SSHCFG_ALL },
504	{ "banner", sBanner, SSHCFG_ALL },
505	{ "usedns", sUseDNS, SSHCFG_GLOBAL },
506	{ "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
507	{ "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
508	{ "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL },
509	{ "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
510	{ "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_ALL },
511	{ "authorizedkeysfile2", sDeprecated, SSHCFG_ALL },
512	{ "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL},
513	{ "acceptenv", sAcceptEnv, SSHCFG_ALL },
514	{ "permittunnel", sPermitTunnel, SSHCFG_ALL },
515	{ "permittty", sPermitTTY, SSHCFG_ALL },
516	{ "match", sMatch, SSHCFG_ALL },
517	{ "permitopen", sPermitOpen, SSHCFG_ALL },
518	{ "forcecommand", sForceCommand, SSHCFG_ALL },
519	{ "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
520	{ "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
521	{ "revokedkeys", sRevokedKeys, SSHCFG_ALL },
522	{ "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
523	{ "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
524	{ "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
525	{ "ipqos", sIPQoS, SSHCFG_ALL },
526	{ "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL },
527	{ "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL },
528	{ "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL },
529	{ "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL },
530	{ "hpndisabled", sHPNDisabled, SSHCFG_ALL },
531	{ "hpnbuffersize", sHPNBufferSize, SSHCFG_ALL },
532	{ "tcprcvbufpoll", sTcpRcvBufPoll, SSHCFG_ALL },
533#ifdef NONE_CIPHER_ENABLED
534	{ "noneenabled", sNoneEnabled, SSHCFG_ALL },
535#endif
536	{ NULL, sBadOption, 0 }
537};
538
539static struct {
540	int val;
541	char *text;
542} tunmode_desc[] = {
543	{ SSH_TUNMODE_NO, "no" },
544	{ SSH_TUNMODE_POINTOPOINT, "point-to-point" },
545	{ SSH_TUNMODE_ETHERNET, "ethernet" },
546	{ SSH_TUNMODE_YES, "yes" },
547	{ -1, NULL }
548};
549
550/*
551 * Returns the number of the token pointed to by cp or sBadOption.
552 */
553
554static ServerOpCodes
555parse_token(const char *cp, const char *filename,
556	    int linenum, u_int *flags)
557{
558	u_int i;
559
560	for (i = 0; keywords[i].name; i++)
561		if (strcasecmp(cp, keywords[i].name) == 0) {
562			*flags = keywords[i].flags;
563			return keywords[i].opcode;
564		}
565
566	error("%s: line %d: Bad configuration option: %s",
567	    filename, linenum, cp);
568	return sBadOption;
569}
570
571char *
572derelativise_path(const char *path)
573{
574	char *expanded, *ret, cwd[MAXPATHLEN];
575
576	expanded = tilde_expand_filename(path, getuid());
577	if (*expanded == '/')
578		return expanded;
579	if (getcwd(cwd, sizeof(cwd)) == NULL)
580		fatal("%s: getcwd: %s", __func__, strerror(errno));
581	xasprintf(&ret, "%s/%s", cwd, expanded);
582	free(expanded);
583	return ret;
584}
585
586static void
587add_listen_addr(ServerOptions *options, char *addr, int port)
588{
589	u_int i;
590
591	if (options->num_ports == 0)
592		options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
593	if (options->address_family == -1)
594		options->address_family = AF_UNSPEC;
595	if (port == 0)
596		for (i = 0; i < options->num_ports; i++)
597			add_one_listen_addr(options, addr, options->ports[i]);
598	else
599		add_one_listen_addr(options, addr, port);
600}
601
602static void
603add_one_listen_addr(ServerOptions *options, char *addr, int port)
604{
605	struct addrinfo hints, *ai, *aitop;
606	char strport[NI_MAXSERV];
607	int gaierr;
608
609	memset(&hints, 0, sizeof(hints));
610	hints.ai_family = options->address_family;
611	hints.ai_socktype = SOCK_STREAM;
612	hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
613	snprintf(strport, sizeof strport, "%d", port);
614	if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
615		fatal("bad addr or host: %s (%s)",
616		    addr ? addr : "<NULL>",
617		    ssh_gai_strerror(gaierr));
618	for (ai = aitop; ai->ai_next; ai = ai->ai_next)
619		;
620	ai->ai_next = options->listen_addrs;
621	options->listen_addrs = aitop;
622}
623
624struct connection_info *
625get_connection_info(int populate, int use_dns)
626{
627	static struct connection_info ci;
628
629	if (!populate)
630		return &ci;
631	ci.host = get_canonical_hostname(use_dns);
632	ci.address = get_remote_ipaddr();
633	ci.laddress = get_local_ipaddr(packet_get_connection_in());
634	ci.lport = get_local_port();
635	return &ci;
636}
637
638/*
639 * The strategy for the Match blocks is that the config file is parsed twice.
640 *
641 * The first time is at startup.  activep is initialized to 1 and the
642 * directives in the global context are processed and acted on.  Hitting a
643 * Match directive unsets activep and the directives inside the block are
644 * checked for syntax only.
645 *
646 * The second time is after a connection has been established but before
647 * authentication.  activep is initialized to 2 and global config directives
648 * are ignored since they have already been processed.  If the criteria in a
649 * Match block is met, activep is set and the subsequent directives
650 * processed and actioned until EOF or another Match block unsets it.  Any
651 * options set are copied into the main server config.
652 *
653 * Potential additions/improvements:
654 *  - Add Match support for pre-kex directives, eg Protocol, Ciphers.
655 *
656 *  - Add a Tag directive (idea from David Leonard) ala pf, eg:
657 *	Match Address 192.168.0.*
658 *		Tag trusted
659 *	Match Group wheel
660 *		Tag trusted
661 *	Match Tag trusted
662 *		AllowTcpForwarding yes
663 *		GatewayPorts clientspecified
664 *		[...]
665 *
666 *  - Add a PermittedChannelRequests directive
667 *	Match Group shell
668 *		PermittedChannelRequests session,forwarded-tcpip
669 */
670
671static int
672match_cfg_line_group(const char *grps, int line, const char *user)
673{
674	int result = 0;
675	struct passwd *pw;
676
677	if (user == NULL)
678		goto out;
679
680	if ((pw = getpwnam(user)) == NULL) {
681		debug("Can't match group at line %d because user %.100s does "
682		    "not exist", line, user);
683	} else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
684		debug("Can't Match group because user %.100s not in any group "
685		    "at line %d", user, line);
686	} else if (ga_match_pattern_list(grps) != 1) {
687		debug("user %.100s does not match group list %.100s at line %d",
688		    user, grps, line);
689	} else {
690		debug("user %.100s matched group list %.100s at line %d", user,
691		    grps, line);
692		result = 1;
693	}
694out:
695	ga_free();
696	return result;
697}
698
699/*
700 * All of the attributes on a single Match line are ANDed together, so we need
701 * to check every attribute and set the result to zero if any attribute does
702 * not match.
703 */
704static int
705match_cfg_line(char **condition, int line, struct connection_info *ci)
706{
707	int result = 1, attributes = 0, port;
708	char *arg, *attrib, *cp = *condition;
709	size_t len;
710
711	if (ci == NULL)
712		debug3("checking syntax for 'Match %s'", cp);
713	else
714		debug3("checking match for '%s' user %s host %s addr %s "
715		    "laddr %s lport %d", cp, ci->user ? ci->user : "(null)",
716		    ci->host ? ci->host : "(null)",
717		    ci->address ? ci->address : "(null)",
718		    ci->laddress ? ci->laddress : "(null)", ci->lport);
719
720	while ((attrib = strdelim(&cp)) && *attrib != '\0') {
721		attributes++;
722		if (strcasecmp(attrib, "all") == 0) {
723			if (attributes != 1 ||
724			    ((arg = strdelim(&cp)) != NULL && *arg != '\0')) {
725				error("'all' cannot be combined with other "
726				    "Match attributes");
727				return -1;
728			}
729			*condition = cp;
730			return 1;
731		}
732		if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
733			error("Missing Match criteria for %s", attrib);
734			return -1;
735		}
736		len = strlen(arg);
737		if (strcasecmp(attrib, "user") == 0) {
738			if (ci == NULL || ci->user == NULL) {
739				result = 0;
740				continue;
741			}
742			if (match_pattern_list(ci->user, arg, len, 0) != 1)
743				result = 0;
744			else
745				debug("user %.100s matched 'User %.100s' at "
746				    "line %d", ci->user, arg, line);
747		} else if (strcasecmp(attrib, "group") == 0) {
748			if (ci == NULL || ci->user == NULL) {
749				result = 0;
750				continue;
751			}
752			switch (match_cfg_line_group(arg, line, ci->user)) {
753			case -1:
754				return -1;
755			case 0:
756				result = 0;
757			}
758		} else if (strcasecmp(attrib, "host") == 0) {
759			if (ci == NULL || ci->host == NULL) {
760				result = 0;
761				continue;
762			}
763			if (match_hostname(ci->host, arg, len) != 1)
764				result = 0;
765			else
766				debug("connection from %.100s matched 'Host "
767				    "%.100s' at line %d", ci->host, arg, line);
768		} else if (strcasecmp(attrib, "address") == 0) {
769			if (ci == NULL || ci->address == NULL) {
770				result = 0;
771				continue;
772			}
773			switch (addr_match_list(ci->address, arg)) {
774			case 1:
775				debug("connection from %.100s matched 'Address "
776				    "%.100s' at line %d", ci->address, arg, line);
777				break;
778			case 0:
779			case -1:
780				result = 0;
781				break;
782			case -2:
783				return -1;
784			}
785		} else if (strcasecmp(attrib, "localaddress") == 0){
786			if (ci == NULL || ci->laddress == NULL) {
787				result = 0;
788				continue;
789			}
790			switch (addr_match_list(ci->laddress, arg)) {
791			case 1:
792				debug("connection from %.100s matched "
793				    "'LocalAddress %.100s' at line %d",
794				    ci->laddress, arg, line);
795				break;
796			case 0:
797			case -1:
798				result = 0;
799				break;
800			case -2:
801				return -1;
802			}
803		} else if (strcasecmp(attrib, "localport") == 0) {
804			if ((port = a2port(arg)) == -1) {
805				error("Invalid LocalPort '%s' on Match line",
806				    arg);
807				return -1;
808			}
809			if (ci == NULL || ci->lport == 0) {
810				result = 0;
811				continue;
812			}
813			/* TODO support port lists */
814			if (port == ci->lport)
815				debug("connection from %.100s matched "
816				    "'LocalPort %d' at line %d",
817				    ci->laddress, port, line);
818			else
819				result = 0;
820		} else {
821			error("Unsupported Match attribute %s", attrib);
822			return -1;
823		}
824	}
825	if (attributes == 0) {
826		error("One or more attributes required for Match");
827		return -1;
828	}
829	if (ci != NULL)
830		debug3("match %sfound", result ? "" : "not ");
831	*condition = cp;
832	return result;
833}
834
835#define WHITESPACE " \t\r\n"
836
837/* Multistate option parsing */
838struct multistate {
839	char *key;
840	int value;
841};
842static const struct multistate multistate_addressfamily[] = {
843	{ "inet",			AF_INET },
844	{ "inet6",			AF_INET6 },
845	{ "any",			AF_UNSPEC },
846	{ NULL, -1 }
847};
848static const struct multistate multistate_permitrootlogin[] = {
849	{ "without-password",		PERMIT_NO_PASSWD },
850	{ "forced-commands-only",	PERMIT_FORCED_ONLY },
851	{ "yes",			PERMIT_YES },
852	{ "no",				PERMIT_NO },
853	{ NULL, -1 }
854};
855static const struct multistate multistate_compression[] = {
856	{ "delayed",			COMP_DELAYED },
857	{ "yes",			COMP_ZLIB },
858	{ "no",				COMP_NONE },
859	{ NULL, -1 }
860};
861static const struct multistate multistate_gatewayports[] = {
862	{ "clientspecified",		2 },
863	{ "yes",			1 },
864	{ "no",				0 },
865	{ NULL, -1 }
866};
867static const struct multistate multistate_privsep[] = {
868	{ "yes",			PRIVSEP_NOSANDBOX },
869	{ "sandbox",			PRIVSEP_ON },
870	{ "nosandbox",			PRIVSEP_NOSANDBOX },
871	{ "no",				PRIVSEP_OFF },
872	{ NULL, -1 }
873};
874static const struct multistate multistate_tcpfwd[] = {
875	{ "yes",			FORWARD_ALLOW },
876	{ "all",			FORWARD_ALLOW },
877	{ "no",				FORWARD_DENY },
878	{ "remote",			FORWARD_REMOTE },
879	{ "local",			FORWARD_LOCAL },
880	{ NULL, -1 }
881};
882
883int
884process_server_config_line(ServerOptions *options, char *line,
885    const char *filename, int linenum, int *activep,
886    struct connection_info *connectinfo)
887{
888	char *cp, **charptr, *arg, *p;
889	int cmdline = 0, *intptr, value, value2, n, port;
890	SyslogFacility *log_facility_ptr;
891	LogLevel *log_level_ptr;
892	ServerOpCodes opcode;
893	u_int i, flags = 0;
894	size_t len;
895	long long val64;
896	const struct multistate *multistate_ptr;
897
898	cp = line;
899	if ((arg = strdelim(&cp)) == NULL)
900		return 0;
901	/* Ignore leading whitespace */
902	if (*arg == '\0')
903		arg = strdelim(&cp);
904	if (!arg || !*arg || *arg == '#')
905		return 0;
906	intptr = NULL;
907	charptr = NULL;
908	opcode = parse_token(arg, filename, linenum, &flags);
909
910	if (activep == NULL) { /* We are processing a command line directive */
911		cmdline = 1;
912		activep = &cmdline;
913	}
914	if (*activep && opcode != sMatch)
915		debug3("%s:%d setting %s %s", filename, linenum, arg, cp);
916	if (*activep == 0 && !(flags & SSHCFG_MATCH)) {
917		if (connectinfo == NULL) {
918			fatal("%s line %d: Directive '%s' is not allowed "
919			    "within a Match block", filename, linenum, arg);
920		} else { /* this is a directive we have already processed */
921			while (arg)
922				arg = strdelim(&cp);
923			return 0;
924		}
925	}
926
927	switch (opcode) {
928	/* Portable-specific options */
929	case sUsePAM:
930		intptr = &options->use_pam;
931		goto parse_flag;
932
933	/* Standard Options */
934	case sBadOption:
935		return -1;
936	case sPort:
937		/* ignore ports from configfile if cmdline specifies ports */
938		if (options->ports_from_cmdline)
939			return 0;
940		if (options->listen_addrs != NULL)
941			fatal("%s line %d: ports must be specified before "
942			    "ListenAddress.", filename, linenum);
943		if (options->num_ports >= MAX_PORTS)
944			fatal("%s line %d: too many ports.",
945			    filename, linenum);
946		arg = strdelim(&cp);
947		if (!arg || *arg == '\0')
948			fatal("%s line %d: missing port number.",
949			    filename, linenum);
950		options->ports[options->num_ports++] = a2port(arg);
951		if (options->ports[options->num_ports-1] <= 0)
952			fatal("%s line %d: Badly formatted port number.",
953			    filename, linenum);
954		break;
955
956	case sServerKeyBits:
957		intptr = &options->server_key_bits;
958 parse_int:
959		arg = strdelim(&cp);
960		if (!arg || *arg == '\0')
961			fatal("%s line %d: missing integer value.",
962			    filename, linenum);
963		value = atoi(arg);
964		if (*activep && *intptr == -1)
965			*intptr = value;
966		break;
967
968	case sLoginGraceTime:
969		intptr = &options->login_grace_time;
970 parse_time:
971		arg = strdelim(&cp);
972		if (!arg || *arg == '\0')
973			fatal("%s line %d: missing time value.",
974			    filename, linenum);
975		if ((value = convtime(arg)) == -1)
976			fatal("%s line %d: invalid time value.",
977			    filename, linenum);
978		if (*intptr == -1)
979			*intptr = value;
980		break;
981
982	case sKeyRegenerationTime:
983		intptr = &options->key_regeneration_time;
984		goto parse_time;
985
986	case sListenAddress:
987		arg = strdelim(&cp);
988		if (arg == NULL || *arg == '\0')
989			fatal("%s line %d: missing address",
990			    filename, linenum);
991		/* check for bare IPv6 address: no "[]" and 2 or more ":" */
992		if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL
993		    && strchr(p+1, ':') != NULL) {
994			add_listen_addr(options, arg, 0);
995			break;
996		}
997		p = hpdelim(&arg);
998		if (p == NULL)
999			fatal("%s line %d: bad address:port usage",
1000			    filename, linenum);
1001		p = cleanhostname(p);
1002		if (arg == NULL)
1003			port = 0;
1004		else if ((port = a2port(arg)) <= 0)
1005			fatal("%s line %d: bad port number", filename, linenum);
1006
1007		add_listen_addr(options, p, port);
1008
1009		break;
1010
1011	case sAddressFamily:
1012		intptr = &options->address_family;
1013		multistate_ptr = multistate_addressfamily;
1014		if (options->listen_addrs != NULL)
1015			fatal("%s line %d: address family must be specified "
1016			    "before ListenAddress.", filename, linenum);
1017 parse_multistate:
1018		arg = strdelim(&cp);
1019		if (!arg || *arg == '\0')
1020			fatal("%s line %d: missing argument.",
1021			    filename, linenum);
1022		value = -1;
1023		for (i = 0; multistate_ptr[i].key != NULL; i++) {
1024			if (strcasecmp(arg, multistate_ptr[i].key) == 0) {
1025				value = multistate_ptr[i].value;
1026				break;
1027			}
1028		}
1029		if (value == -1)
1030			fatal("%s line %d: unsupported option \"%s\".",
1031			    filename, linenum, arg);
1032		if (*activep && *intptr == -1)
1033			*intptr = value;
1034		break;
1035
1036	case sHostKeyFile:
1037		intptr = &options->num_host_key_files;
1038		if (*intptr >= MAX_HOSTKEYS)
1039			fatal("%s line %d: too many host keys specified (max %d).",
1040			    filename, linenum, MAX_HOSTKEYS);
1041		charptr = &options->host_key_files[*intptr];
1042 parse_filename:
1043		arg = strdelim(&cp);
1044		if (!arg || *arg == '\0')
1045			fatal("%s line %d: missing file name.",
1046			    filename, linenum);
1047		if (*activep && *charptr == NULL) {
1048			*charptr = derelativise_path(arg);
1049			/* increase optional counter */
1050			if (intptr != NULL)
1051				*intptr = *intptr + 1;
1052		}
1053		break;
1054
1055	case sHostKeyAgent:
1056		charptr = &options->host_key_agent;
1057		arg = strdelim(&cp);
1058		if (!arg || *arg == '\0')
1059			fatal("%s line %d: missing socket name.",
1060			    filename, linenum);
1061		if (*activep && *charptr == NULL)
1062			*charptr = !strcmp(arg, SSH_AUTHSOCKET_ENV_NAME) ?
1063			    xstrdup(arg) : derelativise_path(arg);
1064		break;
1065
1066	case sHostCertificate:
1067		intptr = &options->num_host_cert_files;
1068		if (*intptr >= MAX_HOSTKEYS)
1069			fatal("%s line %d: too many host certificates "
1070			    "specified (max %d).", filename, linenum,
1071			    MAX_HOSTCERTS);
1072		charptr = &options->host_cert_files[*intptr];
1073		goto parse_filename;
1074		break;
1075
1076	case sPidFile:
1077		charptr = &options->pid_file;
1078		goto parse_filename;
1079
1080	case sPermitRootLogin:
1081		intptr = &options->permit_root_login;
1082		multistate_ptr = multistate_permitrootlogin;
1083		goto parse_multistate;
1084
1085	case sIgnoreRhosts:
1086		intptr = &options->ignore_rhosts;
1087 parse_flag:
1088		arg = strdelim(&cp);
1089		if (!arg || *arg == '\0')
1090			fatal("%s line %d: missing yes/no argument.",
1091			    filename, linenum);
1092		value = 0;	/* silence compiler */
1093		if (strcmp(arg, "yes") == 0)
1094			value = 1;
1095		else if (strcmp(arg, "no") == 0)
1096			value = 0;
1097		else
1098			fatal("%s line %d: Bad yes/no argument: %s",
1099				filename, linenum, arg);
1100		if (*activep && *intptr == -1)
1101			*intptr = value;
1102		break;
1103
1104	case sIgnoreUserKnownHosts:
1105		intptr = &options->ignore_user_known_hosts;
1106		goto parse_flag;
1107
1108	case sRhostsRSAAuthentication:
1109		intptr = &options->rhosts_rsa_authentication;
1110		goto parse_flag;
1111
1112	case sHostbasedAuthentication:
1113		intptr = &options->hostbased_authentication;
1114		goto parse_flag;
1115
1116	case sHostbasedUsesNameFromPacketOnly:
1117		intptr = &options->hostbased_uses_name_from_packet_only;
1118		goto parse_flag;
1119
1120	case sRSAAuthentication:
1121		intptr = &options->rsa_authentication;
1122		goto parse_flag;
1123
1124	case sPubkeyAuthentication:
1125		intptr = &options->pubkey_authentication;
1126		goto parse_flag;
1127
1128	case sKerberosAuthentication:
1129		intptr = &options->kerberos_authentication;
1130		goto parse_flag;
1131
1132	case sKerberosOrLocalPasswd:
1133		intptr = &options->kerberos_or_local_passwd;
1134		goto parse_flag;
1135
1136	case sKerberosTicketCleanup:
1137		intptr = &options->kerberos_ticket_cleanup;
1138		goto parse_flag;
1139
1140	case sKerberosGetAFSToken:
1141		intptr = &options->kerberos_get_afs_token;
1142		goto parse_flag;
1143
1144	case sGssAuthentication:
1145		intptr = &options->gss_authentication;
1146		goto parse_flag;
1147
1148	case sGssCleanupCreds:
1149		intptr = &options->gss_cleanup_creds;
1150		goto parse_flag;
1151
1152	case sPasswordAuthentication:
1153		intptr = &options->password_authentication;
1154		goto parse_flag;
1155
1156	case sZeroKnowledgePasswordAuthentication:
1157		intptr = &options->zero_knowledge_password_authentication;
1158		goto parse_flag;
1159
1160	case sKbdInteractiveAuthentication:
1161		intptr = &options->kbd_interactive_authentication;
1162		goto parse_flag;
1163
1164	case sChallengeResponseAuthentication:
1165		intptr = &options->challenge_response_authentication;
1166		goto parse_flag;
1167
1168	case sPrintMotd:
1169		intptr = &options->print_motd;
1170		goto parse_flag;
1171
1172	case sPrintLastLog:
1173		intptr = &options->print_lastlog;
1174		goto parse_flag;
1175
1176	case sX11Forwarding:
1177		intptr = &options->x11_forwarding;
1178		goto parse_flag;
1179
1180	case sX11DisplayOffset:
1181		intptr = &options->x11_display_offset;
1182		goto parse_int;
1183
1184	case sX11UseLocalhost:
1185		intptr = &options->x11_use_localhost;
1186		goto parse_flag;
1187
1188	case sXAuthLocation:
1189		charptr = &options->xauth_location;
1190		goto parse_filename;
1191
1192	case sPermitTTY:
1193		intptr = &options->permit_tty;
1194		goto parse_flag;
1195
1196	case sStrictModes:
1197		intptr = &options->strict_modes;
1198		goto parse_flag;
1199
1200	case sTCPKeepAlive:
1201		intptr = &options->tcp_keep_alive;
1202		goto parse_flag;
1203
1204	case sEmptyPasswd:
1205		intptr = &options->permit_empty_passwd;
1206		goto parse_flag;
1207
1208	case sPermitUserEnvironment:
1209		intptr = &options->permit_user_env;
1210		goto parse_flag;
1211
1212	case sUseLogin:
1213		intptr = &options->use_login;
1214		goto parse_flag;
1215
1216	case sCompression:
1217		intptr = &options->compression;
1218		multistate_ptr = multistate_compression;
1219		goto parse_multistate;
1220
1221	case sRekeyLimit:
1222		arg = strdelim(&cp);
1223		if (!arg || *arg == '\0')
1224			fatal("%.200s line %d: Missing argument.", filename,
1225			    linenum);
1226		if (strcmp(arg, "default") == 0) {
1227			val64 = 0;
1228		} else {
1229			if (scan_scaled(arg, &val64) == -1)
1230				fatal("%.200s line %d: Bad number '%s': %s",
1231				    filename, linenum, arg, strerror(errno));
1232			/* check for too-large or too-small limits */
1233			if (val64 > UINT_MAX)
1234				fatal("%.200s line %d: RekeyLimit too large",
1235				    filename, linenum);
1236			if (val64 != 0 && val64 < 16)
1237				fatal("%.200s line %d: RekeyLimit too small",
1238				    filename, linenum);
1239		}
1240		if (*activep && options->rekey_limit == -1)
1241			options->rekey_limit = (u_int32_t)val64;
1242		if (cp != NULL) { /* optional rekey interval present */
1243			if (strcmp(cp, "none") == 0) {
1244				(void)strdelim(&cp);	/* discard */
1245				break;
1246			}
1247			intptr = &options->rekey_interval;
1248			goto parse_time;
1249		}
1250		break;
1251
1252	case sGatewayPorts:
1253		intptr = &options->gateway_ports;
1254		multistate_ptr = multistate_gatewayports;
1255		goto parse_multistate;
1256
1257	case sUseDNS:
1258		intptr = &options->use_dns;
1259		goto parse_flag;
1260
1261	case sLogFacility:
1262		log_facility_ptr = &options->log_facility;
1263		arg = strdelim(&cp);
1264		value = log_facility_number(arg);
1265		if (value == SYSLOG_FACILITY_NOT_SET)
1266			fatal("%.200s line %d: unsupported log facility '%s'",
1267			    filename, linenum, arg ? arg : "<NONE>");
1268		if (*log_facility_ptr == -1)
1269			*log_facility_ptr = (SyslogFacility) value;
1270		break;
1271
1272	case sLogLevel:
1273		log_level_ptr = &options->log_level;
1274		arg = strdelim(&cp);
1275		value = log_level_number(arg);
1276		if (value == SYSLOG_LEVEL_NOT_SET)
1277			fatal("%.200s line %d: unsupported log level '%s'",
1278			    filename, linenum, arg ? arg : "<NONE>");
1279		if (*log_level_ptr == -1)
1280			*log_level_ptr = (LogLevel) value;
1281		break;
1282
1283	case sAllowTcpForwarding:
1284		intptr = &options->allow_tcp_forwarding;
1285		multistate_ptr = multistate_tcpfwd;
1286		goto parse_multistate;
1287
1288	case sAllowAgentForwarding:
1289		intptr = &options->allow_agent_forwarding;
1290		goto parse_flag;
1291
1292	case sUsePrivilegeSeparation:
1293		intptr = &use_privsep;
1294		multistate_ptr = multistate_privsep;
1295		goto parse_multistate;
1296
1297	case sAllowUsers:
1298		while ((arg = strdelim(&cp)) && *arg != '\0') {
1299			if (options->num_allow_users >= MAX_ALLOW_USERS)
1300				fatal("%s line %d: too many allow users.",
1301				    filename, linenum);
1302			if (!*activep)
1303				continue;
1304			options->allow_users[options->num_allow_users++] =
1305			    xstrdup(arg);
1306		}
1307		break;
1308
1309	case sDenyUsers:
1310		while ((arg = strdelim(&cp)) && *arg != '\0') {
1311			if (options->num_deny_users >= MAX_DENY_USERS)
1312				fatal("%s line %d: too many deny users.",
1313				    filename, linenum);
1314			if (!*activep)
1315				continue;
1316			options->deny_users[options->num_deny_users++] =
1317			    xstrdup(arg);
1318		}
1319		break;
1320
1321	case sAllowGroups:
1322		while ((arg = strdelim(&cp)) && *arg != '\0') {
1323			if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
1324				fatal("%s line %d: too many allow groups.",
1325				    filename, linenum);
1326			if (!*activep)
1327				continue;
1328			options->allow_groups[options->num_allow_groups++] =
1329			    xstrdup(arg);
1330		}
1331		break;
1332
1333	case sDenyGroups:
1334		while ((arg = strdelim(&cp)) && *arg != '\0') {
1335			if (options->num_deny_groups >= MAX_DENY_GROUPS)
1336				fatal("%s line %d: too many deny groups.",
1337				    filename, linenum);
1338			if (!*activep)
1339				continue;
1340			options->deny_groups[options->num_deny_groups++] =
1341			    xstrdup(arg);
1342		}
1343		break;
1344
1345	case sCiphers:
1346		arg = strdelim(&cp);
1347		if (!arg || *arg == '\0')
1348			fatal("%s line %d: Missing argument.", filename, linenum);
1349		if (!ciphers_valid(arg))
1350			fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1351			    filename, linenum, arg ? arg : "<NONE>");
1352		if (options->ciphers == NULL)
1353			options->ciphers = xstrdup(arg);
1354		break;
1355
1356	case sMacs:
1357		arg = strdelim(&cp);
1358		if (!arg || *arg == '\0')
1359			fatal("%s line %d: Missing argument.", filename, linenum);
1360		if (!mac_valid(arg))
1361			fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1362			    filename, linenum, arg ? arg : "<NONE>");
1363		if (options->macs == NULL)
1364			options->macs = xstrdup(arg);
1365		break;
1366
1367	case sKexAlgorithms:
1368		arg = strdelim(&cp);
1369		if (!arg || *arg == '\0')
1370			fatal("%s line %d: Missing argument.",
1371			    filename, linenum);
1372		if (!kex_names_valid(arg))
1373			fatal("%s line %d: Bad SSH2 KexAlgorithms '%s'.",
1374			    filename, linenum, arg ? arg : "<NONE>");
1375		if (options->kex_algorithms == NULL)
1376			options->kex_algorithms = xstrdup(arg);
1377		break;
1378
1379	case sProtocol:
1380		intptr = &options->protocol;
1381		arg = strdelim(&cp);
1382		if (!arg || *arg == '\0')
1383			fatal("%s line %d: Missing argument.", filename, linenum);
1384		value = proto_spec(arg);
1385		if (value == SSH_PROTO_UNKNOWN)
1386			fatal("%s line %d: Bad protocol spec '%s'.",
1387			    filename, linenum, arg ? arg : "<NONE>");
1388		if (*intptr == SSH_PROTO_UNKNOWN)
1389			*intptr = value;
1390		break;
1391
1392	case sSubsystem:
1393		if (options->num_subsystems >= MAX_SUBSYSTEMS) {
1394			fatal("%s line %d: too many subsystems defined.",
1395			    filename, linenum);
1396		}
1397		arg = strdelim(&cp);
1398		if (!arg || *arg == '\0')
1399			fatal("%s line %d: Missing subsystem name.",
1400			    filename, linenum);
1401		if (!*activep) {
1402			arg = strdelim(&cp);
1403			break;
1404		}
1405		for (i = 0; i < options->num_subsystems; i++)
1406			if (strcmp(arg, options->subsystem_name[i]) == 0)
1407				fatal("%s line %d: Subsystem '%s' already defined.",
1408				    filename, linenum, arg);
1409		options->subsystem_name[options->num_subsystems] = xstrdup(arg);
1410		arg = strdelim(&cp);
1411		if (!arg || *arg == '\0')
1412			fatal("%s line %d: Missing subsystem command.",
1413			    filename, linenum);
1414		options->subsystem_command[options->num_subsystems] = xstrdup(arg);
1415
1416		/* Collect arguments (separate to executable) */
1417		p = xstrdup(arg);
1418		len = strlen(p) + 1;
1419		while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
1420			len += 1 + strlen(arg);
1421			p = xrealloc(p, 1, len);
1422			strlcat(p, " ", len);
1423			strlcat(p, arg, len);
1424		}
1425		options->subsystem_args[options->num_subsystems] = p;
1426		options->num_subsystems++;
1427		break;
1428
1429	case sMaxStartups:
1430		arg = strdelim(&cp);
1431		if (!arg || *arg == '\0')
1432			fatal("%s line %d: Missing MaxStartups spec.",
1433			    filename, linenum);
1434		if ((n = sscanf(arg, "%d:%d:%d",
1435		    &options->max_startups_begin,
1436		    &options->max_startups_rate,
1437		    &options->max_startups)) == 3) {
1438			if (options->max_startups_begin >
1439			    options->max_startups ||
1440			    options->max_startups_rate > 100 ||
1441			    options->max_startups_rate < 1)
1442				fatal("%s line %d: Illegal MaxStartups spec.",
1443				    filename, linenum);
1444		} else if (n != 1)
1445			fatal("%s line %d: Illegal MaxStartups spec.",
1446			    filename, linenum);
1447		else
1448			options->max_startups = options->max_startups_begin;
1449		break;
1450
1451	case sMaxAuthTries:
1452		intptr = &options->max_authtries;
1453		goto parse_int;
1454
1455	case sMaxSessions:
1456		intptr = &options->max_sessions;
1457		goto parse_int;
1458
1459	case sBanner:
1460		charptr = &options->banner;
1461		goto parse_filename;
1462
1463	/*
1464	 * These options can contain %X options expanded at
1465	 * connect time, so that you can specify paths like:
1466	 *
1467	 * AuthorizedKeysFile	/etc/ssh_keys/%u
1468	 */
1469	case sAuthorizedKeysFile:
1470		if (*activep && options->num_authkeys_files == 0) {
1471			while ((arg = strdelim(&cp)) && *arg != '\0') {
1472				if (options->num_authkeys_files >=
1473				    MAX_AUTHKEYS_FILES)
1474					fatal("%s line %d: "
1475					    "too many authorized keys files.",
1476					    filename, linenum);
1477				options->authorized_keys_files[
1478				    options->num_authkeys_files++] =
1479				    tilde_expand_filename(arg, getuid());
1480			}
1481		}
1482		return 0;
1483
1484	case sAuthorizedPrincipalsFile:
1485		charptr = &options->authorized_principals_file;
1486		arg = strdelim(&cp);
1487		if (!arg || *arg == '\0')
1488			fatal("%s line %d: missing file name.",
1489			    filename, linenum);
1490		if (*activep && *charptr == NULL) {
1491			*charptr = tilde_expand_filename(arg, getuid());
1492			/* increase optional counter */
1493			if (intptr != NULL)
1494				*intptr = *intptr + 1;
1495		}
1496		break;
1497
1498	case sClientAliveInterval:
1499		intptr = &options->client_alive_interval;
1500		goto parse_time;
1501
1502	case sClientAliveCountMax:
1503		intptr = &options->client_alive_count_max;
1504		goto parse_int;
1505
1506	case sAcceptEnv:
1507		while ((arg = strdelim(&cp)) && *arg != '\0') {
1508			if (strchr(arg, '=') != NULL)
1509				fatal("%s line %d: Invalid environment name.",
1510				    filename, linenum);
1511			if (options->num_accept_env >= MAX_ACCEPT_ENV)
1512				fatal("%s line %d: too many allow env.",
1513				    filename, linenum);
1514			if (!*activep)
1515				continue;
1516			options->accept_env[options->num_accept_env++] =
1517			    xstrdup(arg);
1518		}
1519		break;
1520
1521	case sPermitTunnel:
1522		intptr = &options->permit_tun;
1523		arg = strdelim(&cp);
1524		if (!arg || *arg == '\0')
1525			fatal("%s line %d: Missing yes/point-to-point/"
1526			    "ethernet/no argument.", filename, linenum);
1527		value = -1;
1528		for (i = 0; tunmode_desc[i].val != -1; i++)
1529			if (strcmp(tunmode_desc[i].text, arg) == 0) {
1530				value = tunmode_desc[i].val;
1531				break;
1532			}
1533		if (value == -1)
1534			fatal("%s line %d: Bad yes/point-to-point/ethernet/"
1535			    "no argument: %s", filename, linenum, arg);
1536		if (*intptr == -1)
1537			*intptr = value;
1538		break;
1539
1540	case sMatch:
1541		if (cmdline)
1542			fatal("Match directive not supported as a command-line "
1543			   "option");
1544		value = match_cfg_line(&cp, linenum, connectinfo);
1545		if (value < 0)
1546			fatal("%s line %d: Bad Match condition", filename,
1547			    linenum);
1548		*activep = value;
1549		break;
1550
1551	case sPermitOpen:
1552		arg = strdelim(&cp);
1553		if (!arg || *arg == '\0')
1554			fatal("%s line %d: missing PermitOpen specification",
1555			    filename, linenum);
1556		n = options->num_permitted_opens;	/* modified later */
1557		if (strcmp(arg, "any") == 0) {
1558			if (*activep && n == -1) {
1559				channel_clear_adm_permitted_opens();
1560				options->num_permitted_opens = 0;
1561			}
1562			break;
1563		}
1564		if (strcmp(arg, "none") == 0) {
1565			if (*activep && n == -1) {
1566				options->num_permitted_opens = 1;
1567				channel_disable_adm_local_opens();
1568			}
1569			break;
1570		}
1571		if (*activep && n == -1)
1572			channel_clear_adm_permitted_opens();
1573		for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) {
1574			p = hpdelim(&arg);
1575			if (p == NULL)
1576				fatal("%s line %d: missing host in PermitOpen",
1577				    filename, linenum);
1578			p = cleanhostname(p);
1579			if (arg == NULL || ((port = permitopen_port(arg)) < 0))
1580				fatal("%s line %d: bad port number in "
1581				    "PermitOpen", filename, linenum);
1582			if (*activep && n == -1)
1583				options->num_permitted_opens =
1584				    channel_add_adm_permitted_opens(p, port);
1585		}
1586		break;
1587
1588	case sForceCommand:
1589		if (cp == NULL)
1590			fatal("%.200s line %d: Missing argument.", filename,
1591			    linenum);
1592		len = strspn(cp, WHITESPACE);
1593		if (*activep && options->adm_forced_command == NULL)
1594			options->adm_forced_command = xstrdup(cp + len);
1595		return 0;
1596
1597	case sChrootDirectory:
1598		charptr = &options->chroot_directory;
1599
1600		arg = strdelim(&cp);
1601		if (!arg || *arg == '\0')
1602			fatal("%s line %d: missing file name.",
1603			    filename, linenum);
1604		if (*activep && *charptr == NULL)
1605			*charptr = xstrdup(arg);
1606		break;
1607
1608	case sTrustedUserCAKeys:
1609		charptr = &options->trusted_user_ca_keys;
1610		goto parse_filename;
1611
1612	case sRevokedKeys:
1613		charptr = &options->revoked_keys_file;
1614		goto parse_filename;
1615
1616	case sIPQoS:
1617		arg = strdelim(&cp);
1618		if ((value = parse_ipqos(arg)) == -1)
1619			fatal("%s line %d: Bad IPQoS value: %s",
1620			    filename, linenum, arg);
1621		arg = strdelim(&cp);
1622		if (arg == NULL)
1623			value2 = value;
1624		else if ((value2 = parse_ipqos(arg)) == -1)
1625			fatal("%s line %d: Bad IPQoS value: %s",
1626			    filename, linenum, arg);
1627		if (*activep) {
1628			options->ip_qos_interactive = value;
1629			options->ip_qos_bulk = value2;
1630		}
1631		break;
1632
1633	case sVersionAddendum:
1634		if (cp == NULL)
1635			fatal("%.200s line %d: Missing argument.", filename,
1636			    linenum);
1637		len = strspn(cp, WHITESPACE);
1638		if (*activep && options->version_addendum == NULL) {
1639			if (strcasecmp(cp + len, "none") == 0)
1640				options->version_addendum = xstrdup("");
1641			else if (strchr(cp + len, '\r') != NULL)
1642				fatal("%.200s line %d: Invalid argument",
1643				    filename, linenum);
1644			else
1645				options->version_addendum = xstrdup(cp + len);
1646		}
1647		return 0;
1648
1649	case sAuthorizedKeysCommand:
1650		len = strspn(cp, WHITESPACE);
1651		if (*activep && options->authorized_keys_command == NULL) {
1652			if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0)
1653				fatal("%.200s line %d: AuthorizedKeysCommand "
1654				    "must be an absolute path",
1655				    filename, linenum);
1656			options->authorized_keys_command = xstrdup(cp + len);
1657		}
1658		return 0;
1659
1660	case sAuthorizedKeysCommandUser:
1661		charptr = &options->authorized_keys_command_user;
1662
1663		arg = strdelim(&cp);
1664		if (*activep && *charptr == NULL)
1665			*charptr = xstrdup(arg);
1666		break;
1667
1668	case sAuthenticationMethods:
1669		if (*activep && options->num_auth_methods == 0) {
1670			while ((arg = strdelim(&cp)) && *arg != '\0') {
1671				if (options->num_auth_methods >=
1672				    MAX_AUTH_METHODS)
1673					fatal("%s line %d: "
1674					    "too many authentication methods.",
1675					    filename, linenum);
1676				if (auth2_methods_valid(arg, 0) != 0)
1677					fatal("%s line %d: invalid "
1678					    "authentication method list.",
1679					    filename, linenum);
1680				options->auth_methods[
1681				    options->num_auth_methods++] = xstrdup(arg);
1682			}
1683		}
1684		return 0;
1685
1686	case sHPNDisabled:
1687		intptr = &options->hpn_disabled;
1688		goto parse_flag;
1689
1690	case sHPNBufferSize:
1691		intptr = &options->hpn_buffer_size;
1692		goto parse_int;
1693
1694	case sTcpRcvBufPoll:
1695		intptr = &options->tcp_rcv_buf_poll;
1696		goto parse_flag;
1697
1698#ifdef	NONE_CIPHER_ENABLED
1699	case sNoneEnabled:
1700		intptr = &options->none_enabled;
1701		goto parse_flag;
1702#endif
1703
1704	case sDeprecated:
1705		logit("%s line %d: Deprecated option %s",
1706		    filename, linenum, arg);
1707		while (arg)
1708		    arg = strdelim(&cp);
1709		break;
1710
1711	case sUnsupported:
1712		logit("%s line %d: Unsupported option %s",
1713		    filename, linenum, arg);
1714		while (arg)
1715		    arg = strdelim(&cp);
1716		break;
1717
1718	default:
1719		fatal("%s line %d: Missing handler for opcode %s (%d)",
1720		    filename, linenum, arg, opcode);
1721	}
1722	if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
1723		fatal("%s line %d: garbage at end of line; \"%.200s\".",
1724		    filename, linenum, arg);
1725	return 0;
1726}
1727
1728/* Reads the server configuration file. */
1729
1730void
1731load_server_config(const char *filename, Buffer *conf)
1732{
1733	char line[4096], *cp;
1734	FILE *f;
1735	int lineno = 0;
1736
1737	debug2("%s: filename %s", __func__, filename);
1738	if ((f = fopen(filename, "r")) == NULL) {
1739		perror(filename);
1740		exit(1);
1741	}
1742	buffer_clear(conf);
1743	while (fgets(line, sizeof(line), f)) {
1744		lineno++;
1745		if (strlen(line) == sizeof(line) - 1)
1746			fatal("%s line %d too long", filename, lineno);
1747		/*
1748		 * Trim out comments and strip whitespace
1749		 * NB - preserve newlines, they are needed to reproduce
1750		 * line numbers later for error messages
1751		 */
1752		if ((cp = strchr(line, '#')) != NULL)
1753			memcpy(cp, "\n", 2);
1754		cp = line + strspn(line, " \t\r");
1755
1756		buffer_append(conf, cp, strlen(cp));
1757	}
1758	buffer_append(conf, "\0", 1);
1759	fclose(f);
1760	debug2("%s: done config len = %d", __func__, buffer_len(conf));
1761}
1762
1763void
1764parse_server_match_config(ServerOptions *options,
1765   struct connection_info *connectinfo)
1766{
1767	ServerOptions mo;
1768
1769	initialize_server_options(&mo);
1770	parse_server_config(&mo, "reprocess config", &cfg, connectinfo);
1771	copy_set_server_options(options, &mo, 0);
1772}
1773
1774int parse_server_match_testspec(struct connection_info *ci, char *spec)
1775{
1776	char *p;
1777
1778	while ((p = strsep(&spec, ",")) && *p != '\0') {
1779		if (strncmp(p, "addr=", 5) == 0) {
1780			ci->address = xstrdup(p + 5);
1781		} else if (strncmp(p, "host=", 5) == 0) {
1782			ci->host = xstrdup(p + 5);
1783		} else if (strncmp(p, "user=", 5) == 0) {
1784			ci->user = xstrdup(p + 5);
1785		} else if (strncmp(p, "laddr=", 6) == 0) {
1786			ci->laddress = xstrdup(p + 6);
1787		} else if (strncmp(p, "lport=", 6) == 0) {
1788			ci->lport = a2port(p + 6);
1789			if (ci->lport == -1) {
1790				fprintf(stderr, "Invalid port '%s' in test mode"
1791				   " specification %s\n", p+6, p);
1792				return -1;
1793			}
1794		} else {
1795			fprintf(stderr, "Invalid test mode specification %s\n",
1796			   p);
1797			return -1;
1798		}
1799	}
1800	return 0;
1801}
1802
1803/*
1804 * returns 1 for a complete spec, 0 for partial spec and -1 for an
1805 * empty spec.
1806 */
1807int server_match_spec_complete(struct connection_info *ci)
1808{
1809	if (ci->user && ci->host && ci->address)
1810		return 1;	/* complete */
1811	if (!ci->user && !ci->host && !ci->address)
1812		return -1;	/* empty */
1813	return 0;	/* partial */
1814}
1815
1816/*
1817 * Copy any supported values that are set.
1818 *
1819 * If the preauth flag is set, we do not bother copying the string or
1820 * array values that are not used pre-authentication, because any that we
1821 * do use must be explictly sent in mm_getpwnamallow().
1822 */
1823void
1824copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
1825{
1826#define M_CP_INTOPT(n) do {\
1827	if (src->n != -1) \
1828		dst->n = src->n; \
1829} while (0)
1830
1831	M_CP_INTOPT(password_authentication);
1832	M_CP_INTOPT(gss_authentication);
1833	M_CP_INTOPT(rsa_authentication);
1834	M_CP_INTOPT(pubkey_authentication);
1835	M_CP_INTOPT(kerberos_authentication);
1836	M_CP_INTOPT(hostbased_authentication);
1837	M_CP_INTOPT(hostbased_uses_name_from_packet_only);
1838	M_CP_INTOPT(kbd_interactive_authentication);
1839	M_CP_INTOPT(zero_knowledge_password_authentication);
1840	M_CP_INTOPT(permit_root_login);
1841	M_CP_INTOPT(permit_empty_passwd);
1842
1843	M_CP_INTOPT(allow_tcp_forwarding);
1844	M_CP_INTOPT(allow_agent_forwarding);
1845	M_CP_INTOPT(permit_tun);
1846	M_CP_INTOPT(gateway_ports);
1847	M_CP_INTOPT(x11_display_offset);
1848	M_CP_INTOPT(x11_forwarding);
1849	M_CP_INTOPT(x11_use_localhost);
1850	M_CP_INTOPT(permit_tty);
1851	M_CP_INTOPT(max_sessions);
1852	M_CP_INTOPT(max_authtries);
1853	M_CP_INTOPT(ip_qos_interactive);
1854	M_CP_INTOPT(ip_qos_bulk);
1855	M_CP_INTOPT(rekey_limit);
1856	M_CP_INTOPT(rekey_interval);
1857
1858	/* M_CP_STROPT and M_CP_STRARRAYOPT should not appear before here */
1859#define M_CP_STROPT(n) do {\
1860	if (src->n != NULL && dst->n != src->n) { \
1861		free(dst->n); \
1862		dst->n = src->n; \
1863	} \
1864} while(0)
1865#define M_CP_STRARRAYOPT(n, num_n) do {\
1866	if (src->num_n != 0) { \
1867		for (dst->num_n = 0; dst->num_n < src->num_n; dst->num_n++) \
1868			dst->n[dst->num_n] = xstrdup(src->n[dst->num_n]); \
1869	} \
1870} while(0)
1871
1872	/* See comment in servconf.h */
1873	COPY_MATCH_STRING_OPTS();
1874
1875	/*
1876	 * The only things that should be below this point are string options
1877	 * which are only used after authentication.
1878	 */
1879	if (preauth)
1880		return;
1881
1882	M_CP_STROPT(adm_forced_command);
1883	M_CP_STROPT(chroot_directory);
1884}
1885
1886#undef M_CP_INTOPT
1887#undef M_CP_STROPT
1888#undef M_CP_STRARRAYOPT
1889
1890void
1891parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
1892    struct connection_info *connectinfo)
1893{
1894	int active, linenum, bad_options = 0;
1895	char *cp, *obuf, *cbuf;
1896
1897	debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
1898
1899	obuf = cbuf = xstrdup(buffer_ptr(conf));
1900	active = connectinfo ? 0 : 1;
1901	linenum = 1;
1902	while ((cp = strsep(&cbuf, "\n")) != NULL) {
1903		if (process_server_config_line(options, cp, filename,
1904		    linenum++, &active, connectinfo) != 0)
1905			bad_options++;
1906	}
1907	free(obuf);
1908	if (bad_options > 0)
1909		fatal("%s: terminating, %d bad configuration options",
1910		    filename, bad_options);
1911}
1912
1913static const char *
1914fmt_multistate_int(int val, const struct multistate *m)
1915{
1916	u_int i;
1917
1918	for (i = 0; m[i].key != NULL; i++) {
1919		if (m[i].value == val)
1920			return m[i].key;
1921	}
1922	return "UNKNOWN";
1923}
1924
1925static const char *
1926fmt_intarg(ServerOpCodes code, int val)
1927{
1928	if (val == -1)
1929		return "unset";
1930	switch (code) {
1931	case sAddressFamily:
1932		return fmt_multistate_int(val, multistate_addressfamily);
1933	case sPermitRootLogin:
1934		return fmt_multistate_int(val, multistate_permitrootlogin);
1935	case sGatewayPorts:
1936		return fmt_multistate_int(val, multistate_gatewayports);
1937	case sCompression:
1938		return fmt_multistate_int(val, multistate_compression);
1939	case sUsePrivilegeSeparation:
1940		return fmt_multistate_int(val, multistate_privsep);
1941	case sAllowTcpForwarding:
1942		return fmt_multistate_int(val, multistate_tcpfwd);
1943	case sProtocol:
1944		switch (val) {
1945		case SSH_PROTO_1:
1946			return "1";
1947		case SSH_PROTO_2:
1948			return "2";
1949		case (SSH_PROTO_1|SSH_PROTO_2):
1950			return "2,1";
1951		default:
1952			return "UNKNOWN";
1953		}
1954	default:
1955		switch (val) {
1956		case 0:
1957			return "no";
1958		case 1:
1959			return "yes";
1960		default:
1961			return "UNKNOWN";
1962		}
1963	}
1964}
1965
1966static const char *
1967lookup_opcode_name(ServerOpCodes code)
1968{
1969	u_int i;
1970
1971	for (i = 0; keywords[i].name != NULL; i++)
1972		if (keywords[i].opcode == code)
1973			return(keywords[i].name);
1974	return "UNKNOWN";
1975}
1976
1977static void
1978dump_cfg_int(ServerOpCodes code, int val)
1979{
1980	printf("%s %d\n", lookup_opcode_name(code), val);
1981}
1982
1983static void
1984dump_cfg_fmtint(ServerOpCodes code, int val)
1985{
1986	printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
1987}
1988
1989static void
1990dump_cfg_string(ServerOpCodes code, const char *val)
1991{
1992	if (val == NULL)
1993		return;
1994	printf("%s %s\n", lookup_opcode_name(code), val);
1995}
1996
1997static void
1998dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals)
1999{
2000	u_int i;
2001
2002	for (i = 0; i < count; i++)
2003		printf("%s %s\n", lookup_opcode_name(code), vals[i]);
2004}
2005
2006static void
2007dump_cfg_strarray_oneline(ServerOpCodes code, u_int count, char **vals)
2008{
2009	u_int i;
2010
2011	printf("%s", lookup_opcode_name(code));
2012	for (i = 0; i < count; i++)
2013		printf(" %s",  vals[i]);
2014	printf("\n");
2015}
2016
2017void
2018dump_config(ServerOptions *o)
2019{
2020	u_int i;
2021	int ret;
2022	struct addrinfo *ai;
2023	char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL;
2024
2025	/* these are usually at the top of the config */
2026	for (i = 0; i < o->num_ports; i++)
2027		printf("port %d\n", o->ports[i]);
2028	dump_cfg_fmtint(sProtocol, o->protocol);
2029	dump_cfg_fmtint(sAddressFamily, o->address_family);
2030
2031	/* ListenAddress must be after Port */
2032	for (ai = o->listen_addrs; ai; ai = ai->ai_next) {
2033		if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr,
2034		    sizeof(addr), port, sizeof(port),
2035		    NI_NUMERICHOST|NI_NUMERICSERV)) != 0) {
2036			error("getnameinfo failed: %.100s",
2037			    (ret != EAI_SYSTEM) ? gai_strerror(ret) :
2038			    strerror(errno));
2039		} else {
2040			if (ai->ai_family == AF_INET6)
2041				printf("listenaddress [%s]:%s\n", addr, port);
2042			else
2043				printf("listenaddress %s:%s\n", addr, port);
2044		}
2045	}
2046
2047	/* integer arguments */
2048#ifdef USE_PAM
2049	dump_cfg_int(sUsePAM, o->use_pam);
2050#endif
2051	dump_cfg_int(sServerKeyBits, o->server_key_bits);
2052	dump_cfg_int(sLoginGraceTime, o->login_grace_time);
2053	dump_cfg_int(sKeyRegenerationTime, o->key_regeneration_time);
2054	dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
2055	dump_cfg_int(sMaxAuthTries, o->max_authtries);
2056	dump_cfg_int(sMaxSessions, o->max_sessions);
2057	dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
2058	dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max);
2059
2060	/* formatted integer arguments */
2061	dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login);
2062	dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts);
2063	dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts);
2064	dump_cfg_fmtint(sRhostsRSAAuthentication, o->rhosts_rsa_authentication);
2065	dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication);
2066	dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly,
2067	    o->hostbased_uses_name_from_packet_only);
2068	dump_cfg_fmtint(sRSAAuthentication, o->rsa_authentication);
2069	dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication);
2070#ifdef KRB5
2071	dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication);
2072	dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd);
2073	dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup);
2074# ifdef USE_AFS
2075	dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
2076# endif
2077#endif
2078#ifdef GSSAPI
2079	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
2080	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
2081#endif
2082#ifdef JPAKE
2083	dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication,
2084	    o->zero_knowledge_password_authentication);
2085#endif
2086	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
2087	dump_cfg_fmtint(sKbdInteractiveAuthentication,
2088	    o->kbd_interactive_authentication);
2089	dump_cfg_fmtint(sChallengeResponseAuthentication,
2090	    o->challenge_response_authentication);
2091	dump_cfg_fmtint(sPrintMotd, o->print_motd);
2092	dump_cfg_fmtint(sPrintLastLog, o->print_lastlog);
2093	dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding);
2094	dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
2095	dump_cfg_fmtint(sPermitTTY, o->permit_tty);
2096	dump_cfg_fmtint(sStrictModes, o->strict_modes);
2097	dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
2098	dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
2099	dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
2100	dump_cfg_fmtint(sUseLogin, o->use_login);
2101	dump_cfg_fmtint(sCompression, o->compression);
2102	dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
2103	dump_cfg_fmtint(sUseDNS, o->use_dns);
2104	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
2105	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
2106
2107	/* string arguments */
2108	dump_cfg_string(sPidFile, o->pid_file);
2109	dump_cfg_string(sXAuthLocation, o->xauth_location);
2110	dump_cfg_string(sCiphers, o->ciphers ? o->ciphers :
2111	    cipher_alg_list(',', 0));
2112	dump_cfg_string(sMacs, o->macs ? o->macs : mac_alg_list(','));
2113	dump_cfg_string(sBanner, o->banner);
2114	dump_cfg_string(sForceCommand, o->adm_forced_command);
2115	dump_cfg_string(sChrootDirectory, o->chroot_directory);
2116	dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
2117	dump_cfg_string(sRevokedKeys, o->revoked_keys_file);
2118	dump_cfg_string(sAuthorizedPrincipalsFile,
2119	    o->authorized_principals_file);
2120	dump_cfg_string(sVersionAddendum, o->version_addendum);
2121	dump_cfg_string(sAuthorizedKeysCommand, o->authorized_keys_command);
2122	dump_cfg_string(sAuthorizedKeysCommandUser, o->authorized_keys_command_user);
2123	dump_cfg_string(sHostKeyAgent, o->host_key_agent);
2124	dump_cfg_string(sKexAlgorithms, o->kex_algorithms ? o->kex_algorithms :
2125	    kex_alg_list(','));
2126
2127	/* string arguments requiring a lookup */
2128	dump_cfg_string(sLogLevel, log_level_name(o->log_level));
2129	dump_cfg_string(sLogFacility, log_facility_name(o->log_facility));
2130
2131	/* string array arguments */
2132	dump_cfg_strarray_oneline(sAuthorizedKeysFile, o->num_authkeys_files,
2133	    o->authorized_keys_files);
2134	dump_cfg_strarray(sHostKeyFile, o->num_host_key_files,
2135	     o->host_key_files);
2136	dump_cfg_strarray(sHostKeyFile, o->num_host_cert_files,
2137	     o->host_cert_files);
2138	dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users);
2139	dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users);
2140	dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups);
2141	dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups);
2142	dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env);
2143	dump_cfg_strarray_oneline(sAuthenticationMethods,
2144	    o->num_auth_methods, o->auth_methods);
2145
2146	/* other arguments */
2147	for (i = 0; i < o->num_subsystems; i++)
2148		printf("subsystem %s %s\n", o->subsystem_name[i],
2149		    o->subsystem_args[i]);
2150
2151	printf("maxstartups %d:%d:%d\n", o->max_startups_begin,
2152	    o->max_startups_rate, o->max_startups);
2153
2154	for (i = 0; tunmode_desc[i].val != -1; i++)
2155		if (tunmode_desc[i].val == o->permit_tun) {
2156			s = tunmode_desc[i].text;
2157			break;
2158		}
2159	dump_cfg_string(sPermitTunnel, s);
2160
2161	printf("ipqos %s ", iptos2str(o->ip_qos_interactive));
2162	printf("%s\n", iptos2str(o->ip_qos_bulk));
2163
2164	printf("rekeylimit %lld %d\n", (long long)o->rekey_limit,
2165	    o->rekey_interval);
2166
2167	channel_print_adm_permitted_opens();
2168}
2169