servconf.c revision 264377 
1
2/* $OpenBSD: servconf.c,v 1.249 2014/01/29 06:18:35 djm Exp $ */
3/* $FreeBSD: stable/10/crypto/openssh/servconf.c 264377 2014-04-12 20:22:59Z des $ */
4/*
5 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 *                    All rights reserved
7 *
8 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose.  Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
13 */
14
15#include "includes.h"
16__RCSID("$FreeBSD: stable/10/crypto/openssh/servconf.c 264377 2014-04-12 20:22:59Z des $");
17
18#include <sys/types.h>
19#include <sys/socket.h>
20
21#include <netinet/in.h>
22#include <netinet/in_systm.h>
23#include <netinet/ip.h>
24
25#include <ctype.h>
26#include <netdb.h>
27#include <pwd.h>
28#include <stdio.h>
29#include <stdlib.h>
30#include <string.h>
31#include <signal.h>
32#include <unistd.h>
33#include <stdarg.h>
34#include <errno.h>
35#ifdef HAVE_UTIL_H
36#include <util.h>
37#endif
38
39#include "openbsd-compat/sys-queue.h"
40#include "xmalloc.h"
41#include "ssh.h"
42#include "log.h"
43#include "buffer.h"
44#include "servconf.h"
45#include "compat.h"
46#include "pathnames.h"
47#include "misc.h"
48#include "cipher.h"
49#include "key.h"
50#include "kex.h"
51#include "mac.h"
52#include "match.h"
53#include "channels.h"
54#include "groupaccess.h"
55#include "canohost.h"
56#include "packet.h"
57#include "hostfile.h"
58#include "auth.h"
59#include "version.h"
60
61static void add_listen_addr(ServerOptions *, char *, int);
62static void add_one_listen_addr(ServerOptions *, char *, int);
63
64/* Use of privilege separation or not */
65extern int use_privsep;
66extern Buffer cfg;
67
68/* Initializes the server options to their default values. */
69
70void
71initialize_server_options(ServerOptions *options)
72{
73	memset(options, 0, sizeof(*options));
74
75	/* Portable-specific options */
76	options->use_pam = -1;
77
78	/* Standard Options */
79	options->num_ports = 0;
80	options->ports_from_cmdline = 0;
81	options->listen_addrs = NULL;
82	options->address_family = -1;
83	options->num_host_key_files = 0;
84	options->num_host_cert_files = 0;
85	options->host_key_agent = NULL;
86	options->pid_file = NULL;
87	options->server_key_bits = -1;
88	options->login_grace_time = -1;
89	options->key_regeneration_time = -1;
90	options->permit_root_login = PERMIT_NOT_SET;
91	options->ignore_rhosts = -1;
92	options->ignore_user_known_hosts = -1;
93	options->print_motd = -1;
94	options->print_lastlog = -1;
95	options->x11_forwarding = -1;
96	options->x11_display_offset = -1;
97	options->x11_use_localhost = -1;
98	options->permit_tty = -1;
99	options->xauth_location = NULL;
100	options->strict_modes = -1;
101	options->tcp_keep_alive = -1;
102	options->log_facility = SYSLOG_FACILITY_NOT_SET;
103	options->log_level = SYSLOG_LEVEL_NOT_SET;
104	options->rhosts_rsa_authentication = -1;
105	options->hostbased_authentication = -1;
106	options->hostbased_uses_name_from_packet_only = -1;
107	options->rsa_authentication = -1;
108	options->pubkey_authentication = -1;
109	options->kerberos_authentication = -1;
110	options->kerberos_or_local_passwd = -1;
111	options->kerberos_ticket_cleanup = -1;
112	options->kerberos_get_afs_token = -1;
113	options->gss_authentication=-1;
114	options->gss_cleanup_creds = -1;
115	options->password_authentication = -1;
116	options->kbd_interactive_authentication = -1;
117	options->challenge_response_authentication = -1;
118	options->permit_empty_passwd = -1;
119	options->permit_user_env = -1;
120	options->use_login = -1;
121	options->compression = -1;
122	options->rekey_limit = -1;
123	options->rekey_interval = -1;
124	options->allow_tcp_forwarding = -1;
125	options->allow_agent_forwarding = -1;
126	options->num_allow_users = 0;
127	options->num_deny_users = 0;
128	options->num_allow_groups = 0;
129	options->num_deny_groups = 0;
130	options->ciphers = NULL;
131	options->macs = NULL;
132	options->kex_algorithms = NULL;
133	options->protocol = SSH_PROTO_UNKNOWN;
134	options->gateway_ports = -1;
135	options->num_subsystems = 0;
136	options->max_startups_begin = -1;
137	options->max_startups_rate = -1;
138	options->max_startups = -1;
139	options->max_authtries = -1;
140	options->max_sessions = -1;
141	options->banner = NULL;
142	options->use_dns = -1;
143	options->client_alive_interval = -1;
144	options->client_alive_count_max = -1;
145	options->num_authkeys_files = 0;
146	options->num_accept_env = 0;
147	options->permit_tun = -1;
148	options->num_permitted_opens = -1;
149	options->adm_forced_command = NULL;
150	options->chroot_directory = NULL;
151	options->authorized_keys_command = NULL;
152	options->authorized_keys_command_user = NULL;
153	options->revoked_keys_file = NULL;
154	options->trusted_user_ca_keys = NULL;
155	options->authorized_principals_file = NULL;
156	options->ip_qos_interactive = -1;
157	options->ip_qos_bulk = -1;
158	options->version_addendum = NULL;
159	options->hpn_disabled = -1;
160	options->hpn_buffer_size = -1;
161	options->tcp_rcv_buf_poll = -1;
162#ifdef	NONE_CIPHER_ENABLED
163	options->none_enabled = -1;
164#endif
165}
166
167void
168fill_default_server_options(ServerOptions *options)
169{
170	/* Portable-specific options */
171	if (options->use_pam == -1)
172		options->use_pam = 1;
173
174	/* Standard Options */
175	if (options->protocol == SSH_PROTO_UNKNOWN)
176		options->protocol = SSH_PROTO_2;
177	if (options->num_host_key_files == 0) {
178		/* fill default hostkeys for protocols */
179		if (options->protocol & SSH_PROTO_1)
180			options->host_key_files[options->num_host_key_files++] =
181			    _PATH_HOST_KEY_FILE;
182		if (options->protocol & SSH_PROTO_2) {
183			options->host_key_files[options->num_host_key_files++] =
184			    _PATH_HOST_RSA_KEY_FILE;
185			options->host_key_files[options->num_host_key_files++] =
186			    _PATH_HOST_DSA_KEY_FILE;
187#ifdef OPENSSL_HAS_ECC
188			options->host_key_files[options->num_host_key_files++] =
189			    _PATH_HOST_ECDSA_KEY_FILE;
190#endif
191			options->host_key_files[options->num_host_key_files++] =
192			    _PATH_HOST_ED25519_KEY_FILE;
193		}
194	}
195	/* No certificates by default */
196	if (options->num_ports == 0)
197		options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
198	if (options->listen_addrs == NULL)
199		add_listen_addr(options, NULL, 0);
200	if (options->pid_file == NULL)
201		options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
202	if (options->server_key_bits == -1)
203		options->server_key_bits = 1024;
204	if (options->login_grace_time == -1)
205		options->login_grace_time = 120;
206	if (options->key_regeneration_time == -1)
207		options->key_regeneration_time = 3600;
208	if (options->permit_root_login == PERMIT_NOT_SET)
209		options->permit_root_login = PERMIT_NO;
210	if (options->ignore_rhosts == -1)
211		options->ignore_rhosts = 1;
212	if (options->ignore_user_known_hosts == -1)
213		options->ignore_user_known_hosts = 0;
214	if (options->print_motd == -1)
215		options->print_motd = 1;
216	if (options->print_lastlog == -1)
217		options->print_lastlog = 1;
218	if (options->x11_forwarding == -1)
219		options->x11_forwarding = 1;
220	if (options->x11_display_offset == -1)
221		options->x11_display_offset = 10;
222	if (options->x11_use_localhost == -1)
223		options->x11_use_localhost = 1;
224	if (options->xauth_location == NULL)
225		options->xauth_location = _PATH_XAUTH;
226	if (options->permit_tty == -1)
227		options->permit_tty = 1;
228	if (options->strict_modes == -1)
229		options->strict_modes = 1;
230	if (options->tcp_keep_alive == -1)
231		options->tcp_keep_alive = 1;
232	if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
233		options->log_facility = SYSLOG_FACILITY_AUTH;
234	if (options->log_level == SYSLOG_LEVEL_NOT_SET)
235		options->log_level = SYSLOG_LEVEL_INFO;
236	if (options->rhosts_rsa_authentication == -1)
237		options->rhosts_rsa_authentication = 0;
238	if (options->hostbased_authentication == -1)
239		options->hostbased_authentication = 0;
240	if (options->hostbased_uses_name_from_packet_only == -1)
241		options->hostbased_uses_name_from_packet_only = 0;
242	if (options->rsa_authentication == -1)
243		options->rsa_authentication = 1;
244	if (options->pubkey_authentication == -1)
245		options->pubkey_authentication = 1;
246	if (options->kerberos_authentication == -1)
247		options->kerberos_authentication = 0;
248	if (options->kerberos_or_local_passwd == -1)
249		options->kerberos_or_local_passwd = 1;
250	if (options->kerberos_ticket_cleanup == -1)
251		options->kerberos_ticket_cleanup = 1;
252	if (options->kerberos_get_afs_token == -1)
253		options->kerberos_get_afs_token = 0;
254	if (options->gss_authentication == -1)
255		options->gss_authentication = 0;
256	if (options->gss_cleanup_creds == -1)
257		options->gss_cleanup_creds = 1;
258	if (options->password_authentication == -1)
259		options->password_authentication = 0;
260	if (options->kbd_interactive_authentication == -1)
261		options->kbd_interactive_authentication = 0;
262	if (options->challenge_response_authentication == -1)
263		options->challenge_response_authentication = 1;
264	if (options->permit_empty_passwd == -1)
265		options->permit_empty_passwd = 0;
266	if (options->permit_user_env == -1)
267		options->permit_user_env = 0;
268	if (options->use_login == -1)
269		options->use_login = 0;
270	if (options->compression == -1)
271		options->compression = COMP_DELAYED;
272	if (options->rekey_limit == -1)
273		options->rekey_limit = 0;
274	if (options->rekey_interval == -1)
275		options->rekey_interval = 0;
276	if (options->allow_tcp_forwarding == -1)
277		options->allow_tcp_forwarding = FORWARD_ALLOW;
278	if (options->allow_agent_forwarding == -1)
279		options->allow_agent_forwarding = 1;
280	if (options->gateway_ports == -1)
281		options->gateway_ports = 0;
282	if (options->max_startups == -1)
283		options->max_startups = 100;
284	if (options->max_startups_rate == -1)
285		options->max_startups_rate = 30;		/* 30% */
286	if (options->max_startups_begin == -1)
287		options->max_startups_begin = 10;
288	if (options->max_authtries == -1)
289		options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
290	if (options->max_sessions == -1)
291		options->max_sessions = DEFAULT_SESSIONS_MAX;
292	if (options->use_dns == -1)
293		options->use_dns = 1;
294	if (options->client_alive_interval == -1)
295		options->client_alive_interval = 0;
296	if (options->client_alive_count_max == -1)
297		options->client_alive_count_max = 3;
298	if (options->num_authkeys_files == 0) {
299		options->authorized_keys_files[options->num_authkeys_files++] =
300		    xstrdup(_PATH_SSH_USER_PERMITTED_KEYS);
301		options->authorized_keys_files[options->num_authkeys_files++] =
302		    xstrdup(_PATH_SSH_USER_PERMITTED_KEYS2);
303	}
304	if (options->permit_tun == -1)
305		options->permit_tun = SSH_TUNMODE_NO;
306	if (options->ip_qos_interactive == -1)
307		options->ip_qos_interactive = IPTOS_LOWDELAY;
308	if (options->ip_qos_bulk == -1)
309		options->ip_qos_bulk = IPTOS_THROUGHPUT;
310	if (options->version_addendum == NULL)
311		options->version_addendum = xstrdup(SSH_VERSION_FREEBSD);
312	/* Turn privilege separation on by default */
313	if (use_privsep == -1)
314		use_privsep = PRIVSEP_ON;
315
316#ifndef HAVE_MMAP
317	if (use_privsep && options->compression == 1) {
318		error("This platform does not support both privilege "
319		    "separation and compression");
320		error("Compression disabled");
321		options->compression = 0;
322	}
323#endif
324
325	if (options->hpn_disabled == -1)
326		options->hpn_disabled = 0;
327	if (options->hpn_buffer_size == -1) {
328		/*
329		 * HPN buffer size option not explicitly set.  Try to figure
330		 * out what value to use or resort to default.
331		 */
332		options->hpn_buffer_size = CHAN_SES_WINDOW_DEFAULT;
333		if (!options->hpn_disabled) {
334			sock_get_rcvbuf(&options->hpn_buffer_size, 0);
335			debug ("HPN Buffer Size: %d", options->hpn_buffer_size);
336		}
337	} else {
338		/*
339		 * In the case that the user sets both values in a
340		 * contradictory manner hpn_disabled overrrides hpn_buffer_size.
341		 */
342		if (options->hpn_disabled <= 0) {
343			u_int maxlen;
344
345			maxlen = buffer_get_max_len();
346			if (options->hpn_buffer_size == 0)
347				options->hpn_buffer_size = 1;
348			/* Limit the maximum buffer to BUFFER_MAX_LEN. */
349			if (options->hpn_buffer_size > maxlen / 1024)
350				options->hpn_buffer_size = maxlen;
351			else
352				options->hpn_buffer_size *= 1024;
353		} else {
354			options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT;
355		}
356	}
357}
358
359/* Keyword tokens. */
360typedef enum {
361	sBadOption,		/* == unknown option */
362	/* Portable-specific options */
363	sUsePAM,
364	/* Standard Options */
365	sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
366	sPermitRootLogin, sLogFacility, sLogLevel,
367	sRhostsRSAAuthentication, sRSAAuthentication,
368	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
369	sKerberosGetAFSToken,
370	sKerberosTgtPassing, sChallengeResponseAuthentication,
371	sPasswordAuthentication, sKbdInteractiveAuthentication,
372	sListenAddress, sAddressFamily,
373	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
374	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
375	sPermitTTY, sStrictModes, sEmptyPasswd, sTCPKeepAlive,
376	sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
377	sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
378	sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
379	sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
380	sMaxStartups, sMaxAuthTries, sMaxSessions,
381	sBanner, sUseDNS, sHostbasedAuthentication,
382	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
383	sClientAliveCountMax, sAuthorizedKeysFile,
384	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
385	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
386	sUsePrivilegeSeparation, sAllowAgentForwarding,
387	sHostCertificate,
388	sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
389	sKexAlgorithms, sIPQoS, sVersionAddendum,
390	sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
391	sAuthenticationMethods, sHostKeyAgent,
392	sHPNDisabled, sHPNBufferSize, sTcpRcvBufPoll,
393#ifdef NONE_CIPHER_ENABLED
394	sNoneEnabled,
395#endif
396	sDeprecated, sUnsupported
397} ServerOpCodes;
398
399#define SSHCFG_GLOBAL	0x01	/* allowed in main section of sshd_config */
400#define SSHCFG_MATCH	0x02	/* allowed inside a Match section */
401#define SSHCFG_ALL	(SSHCFG_GLOBAL|SSHCFG_MATCH)
402
403/* Textual representation of the tokens. */
404static struct {
405	const char *name;
406	ServerOpCodes opcode;
407	u_int flags;
408} keywords[] = {
409	/* Portable-specific options */
410#ifdef USE_PAM
411	{ "usepam", sUsePAM, SSHCFG_GLOBAL },
412#else
413	{ "usepam", sUnsupported, SSHCFG_GLOBAL },
414#endif
415	{ "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
416	/* Standard Options */
417	{ "port", sPort, SSHCFG_GLOBAL },
418	{ "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
419	{ "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL },		/* alias */
420	{ "hostkeyagent", sHostKeyAgent, SSHCFG_GLOBAL },
421	{ "pidfile", sPidFile, SSHCFG_GLOBAL },
422	{ "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL },
423	{ "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
424	{ "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL },
425	{ "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
426	{ "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
427	{ "loglevel", sLogLevel, SSHCFG_GLOBAL },
428	{ "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL },
429	{ "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
430	{ "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
431	{ "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_ALL },
432	{ "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
433	{ "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
434	{ "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
435#ifdef KRB5
436	{ "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
437	{ "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
438	{ "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
439#ifdef USE_AFS
440	{ "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL },
441#else
442	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
443#endif
444#else
445	{ "kerberosauthentication", sUnsupported, SSHCFG_ALL },
446	{ "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
447	{ "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
448	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
449#endif
450	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
451	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
452#ifdef GSSAPI
453	{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
454	{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
455#else
456	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
457	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
458#endif
459	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
460	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
461	{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
462	{ "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
463	{ "checkmail", sDeprecated, SSHCFG_GLOBAL },
464	{ "listenaddress", sListenAddress, SSHCFG_GLOBAL },
465	{ "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
466	{ "printmotd", sPrintMotd, SSHCFG_GLOBAL },
467	{ "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
468	{ "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
469	{ "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
470	{ "x11forwarding", sX11Forwarding, SSHCFG_ALL },
471	{ "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
472	{ "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
473	{ "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
474	{ "strictmodes", sStrictModes, SSHCFG_GLOBAL },
475	{ "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
476	{ "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
477	{ "uselogin", sUseLogin, SSHCFG_GLOBAL },
478	{ "compression", sCompression, SSHCFG_GLOBAL },
479	{ "rekeylimit", sRekeyLimit, SSHCFG_ALL },
480	{ "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL },
481	{ "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL },	/* obsolete alias */
482	{ "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
483	{ "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL },
484	{ "allowusers", sAllowUsers, SSHCFG_ALL },
485	{ "denyusers", sDenyUsers, SSHCFG_ALL },
486	{ "allowgroups", sAllowGroups, SSHCFG_ALL },
487	{ "denygroups", sDenyGroups, SSHCFG_ALL },
488	{ "ciphers", sCiphers, SSHCFG_GLOBAL },
489	{ "macs", sMacs, SSHCFG_GLOBAL },
490	{ "protocol", sProtocol, SSHCFG_GLOBAL },
491	{ "gatewayports", sGatewayPorts, SSHCFG_ALL },
492	{ "subsystem", sSubsystem, SSHCFG_GLOBAL },
493	{ "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
494	{ "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
495	{ "maxsessions", sMaxSessions, SSHCFG_ALL },
496	{ "banner", sBanner, SSHCFG_ALL },
497	{ "usedns", sUseDNS, SSHCFG_GLOBAL },
498	{ "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
499	{ "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
500	{ "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL },
501	{ "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
502	{ "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_ALL },
503	{ "authorizedkeysfile2", sDeprecated, SSHCFG_ALL },
504	{ "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL},
505	{ "acceptenv", sAcceptEnv, SSHCFG_ALL },
506	{ "permittunnel", sPermitTunnel, SSHCFG_ALL },
507	{ "permittty", sPermitTTY, SSHCFG_ALL },
508	{ "match", sMatch, SSHCFG_ALL },
509	{ "permitopen", sPermitOpen, SSHCFG_ALL },
510	{ "forcecommand", sForceCommand, SSHCFG_ALL },
511	{ "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
512	{ "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
513	{ "revokedkeys", sRevokedKeys, SSHCFG_ALL },
514	{ "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
515	{ "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
516	{ "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
517	{ "ipqos", sIPQoS, SSHCFG_ALL },
518	{ "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL },
519	{ "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL },
520	{ "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL },
521	{ "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL },
522	{ "hpndisabled", sHPNDisabled, SSHCFG_ALL },
523	{ "hpnbuffersize", sHPNBufferSize, SSHCFG_ALL },
524	{ "tcprcvbufpoll", sTcpRcvBufPoll, SSHCFG_ALL },
525#ifdef NONE_CIPHER_ENABLED
526	{ "noneenabled", sNoneEnabled, SSHCFG_ALL },
527#endif
528	{ NULL, sBadOption, 0 }
529};
530
531static struct {
532	int val;
533	char *text;
534} tunmode_desc[] = {
535	{ SSH_TUNMODE_NO, "no" },
536	{ SSH_TUNMODE_POINTOPOINT, "point-to-point" },
537	{ SSH_TUNMODE_ETHERNET, "ethernet" },
538	{ SSH_TUNMODE_YES, "yes" },
539	{ -1, NULL }
540};
541
542/*
543 * Returns the number of the token pointed to by cp or sBadOption.
544 */
545
546static ServerOpCodes
547parse_token(const char *cp, const char *filename,
548	    int linenum, u_int *flags)
549{
550	u_int i;
551
552	for (i = 0; keywords[i].name; i++)
553		if (strcasecmp(cp, keywords[i].name) == 0) {
554			*flags = keywords[i].flags;
555			return keywords[i].opcode;
556		}
557
558	error("%s: line %d: Bad configuration option: %s",
559	    filename, linenum, cp);
560	return sBadOption;
561}
562
563char *
564derelativise_path(const char *path)
565{
566	char *expanded, *ret, cwd[MAXPATHLEN];
567
568	expanded = tilde_expand_filename(path, getuid());
569	if (*expanded == '/')
570		return expanded;
571	if (getcwd(cwd, sizeof(cwd)) == NULL)
572		fatal("%s: getcwd: %s", __func__, strerror(errno));
573	xasprintf(&ret, "%s/%s", cwd, expanded);
574	free(expanded);
575	return ret;
576}
577
578static void
579add_listen_addr(ServerOptions *options, char *addr, int port)
580{
581	u_int i;
582
583	if (options->num_ports == 0)
584		options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
585	if (options->address_family == -1)
586		options->address_family = AF_UNSPEC;
587	if (port == 0)
588		for (i = 0; i < options->num_ports; i++)
589			add_one_listen_addr(options, addr, options->ports[i]);
590	else
591		add_one_listen_addr(options, addr, port);
592}
593
594static void
595add_one_listen_addr(ServerOptions *options, char *addr, int port)
596{
597	struct addrinfo hints, *ai, *aitop;
598	char strport[NI_MAXSERV];
599	int gaierr;
600
601	memset(&hints, 0, sizeof(hints));
602	hints.ai_family = options->address_family;
603	hints.ai_socktype = SOCK_STREAM;
604	hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
605	snprintf(strport, sizeof strport, "%d", port);
606	if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
607		fatal("bad addr or host: %s (%s)",
608		    addr ? addr : "<NULL>",
609		    ssh_gai_strerror(gaierr));
610	for (ai = aitop; ai->ai_next; ai = ai->ai_next)
611		;
612	ai->ai_next = options->listen_addrs;
613	options->listen_addrs = aitop;
614}
615
616struct connection_info *
617get_connection_info(int populate, int use_dns)
618{
619	static struct connection_info ci;
620
621	if (!populate)
622		return &ci;
623	ci.host = get_canonical_hostname(use_dns);
624	ci.address = get_remote_ipaddr();
625	ci.laddress = get_local_ipaddr(packet_get_connection_in());
626	ci.lport = get_local_port();
627	return &ci;
628}
629
630/*
631 * The strategy for the Match blocks is that the config file is parsed twice.
632 *
633 * The first time is at startup.  activep is initialized to 1 and the
634 * directives in the global context are processed and acted on.  Hitting a
635 * Match directive unsets activep and the directives inside the block are
636 * checked for syntax only.
637 *
638 * The second time is after a connection has been established but before
639 * authentication.  activep is initialized to 2 and global config directives
640 * are ignored since they have already been processed.  If the criteria in a
641 * Match block is met, activep is set and the subsequent directives
642 * processed and actioned until EOF or another Match block unsets it.  Any
643 * options set are copied into the main server config.
644 *
645 * Potential additions/improvements:
646 *  - Add Match support for pre-kex directives, eg Protocol, Ciphers.
647 *
648 *  - Add a Tag directive (idea from David Leonard) ala pf, eg:
649 *	Match Address 192.168.0.*
650 *		Tag trusted
651 *	Match Group wheel
652 *		Tag trusted
653 *	Match Tag trusted
654 *		AllowTcpForwarding yes
655 *		GatewayPorts clientspecified
656 *		[...]
657 *
658 *  - Add a PermittedChannelRequests directive
659 *	Match Group shell
660 *		PermittedChannelRequests session,forwarded-tcpip
661 */
662
663static int
664match_cfg_line_group(const char *grps, int line, const char *user)
665{
666	int result = 0;
667	struct passwd *pw;
668
669	if (user == NULL)
670		goto out;
671
672	if ((pw = getpwnam(user)) == NULL) {
673		debug("Can't match group at line %d because user %.100s does "
674		    "not exist", line, user);
675	} else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
676		debug("Can't Match group because user %.100s not in any group "
677		    "at line %d", user, line);
678	} else if (ga_match_pattern_list(grps) != 1) {
679		debug("user %.100s does not match group list %.100s at line %d",
680		    user, grps, line);
681	} else {
682		debug("user %.100s matched group list %.100s at line %d", user,
683		    grps, line);
684		result = 1;
685	}
686out:
687	ga_free();
688	return result;
689}
690
691/*
692 * All of the attributes on a single Match line are ANDed together, so we need
693 * to check every attribute and set the result to zero if any attribute does
694 * not match.
695 */
696static int
697match_cfg_line(char **condition, int line, struct connection_info *ci)
698{
699	int result = 1, attributes = 0, port;
700	char *arg, *attrib, *cp = *condition;
701	size_t len;
702
703	if (ci == NULL)
704		debug3("checking syntax for 'Match %s'", cp);
705	else
706		debug3("checking match for '%s' user %s host %s addr %s "
707		    "laddr %s lport %d", cp, ci->user ? ci->user : "(null)",
708		    ci->host ? ci->host : "(null)",
709		    ci->address ? ci->address : "(null)",
710		    ci->laddress ? ci->laddress : "(null)", ci->lport);
711
712	while ((attrib = strdelim(&cp)) && *attrib != '\0') {
713		attributes++;
714		if (strcasecmp(attrib, "all") == 0) {
715			if (attributes != 1 ||
716			    ((arg = strdelim(&cp)) != NULL && *arg != '\0')) {
717				error("'all' cannot be combined with other "
718				    "Match attributes");
719				return -1;
720			}
721			*condition = cp;
722			return 1;
723		}
724		if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
725			error("Missing Match criteria for %s", attrib);
726			return -1;
727		}
728		len = strlen(arg);
729		if (strcasecmp(attrib, "user") == 0) {
730			if (ci == NULL || ci->user == NULL) {
731				result = 0;
732				continue;
733			}
734			if (match_pattern_list(ci->user, arg, len, 0) != 1)
735				result = 0;
736			else
737				debug("user %.100s matched 'User %.100s' at "
738				    "line %d", ci->user, arg, line);
739		} else if (strcasecmp(attrib, "group") == 0) {
740			if (ci == NULL || ci->user == NULL) {
741				result = 0;
742				continue;
743			}
744			switch (match_cfg_line_group(arg, line, ci->user)) {
745			case -1:
746				return -1;
747			case 0:
748				result = 0;
749			}
750		} else if (strcasecmp(attrib, "host") == 0) {
751			if (ci == NULL || ci->host == NULL) {
752				result = 0;
753				continue;
754			}
755			if (match_hostname(ci->host, arg, len) != 1)
756				result = 0;
757			else
758				debug("connection from %.100s matched 'Host "
759				    "%.100s' at line %d", ci->host, arg, line);
760		} else if (strcasecmp(attrib, "address") == 0) {
761			if (ci == NULL || ci->address == NULL) {
762				result = 0;
763				continue;
764			}
765			switch (addr_match_list(ci->address, arg)) {
766			case 1:
767				debug("connection from %.100s matched 'Address "
768				    "%.100s' at line %d", ci->address, arg, line);
769				break;
770			case 0:
771			case -1:
772				result = 0;
773				break;
774			case -2:
775				return -1;
776			}
777		} else if (strcasecmp(attrib, "localaddress") == 0){
778			if (ci == NULL || ci->laddress == NULL) {
779				result = 0;
780				continue;
781			}
782			switch (addr_match_list(ci->laddress, arg)) {
783			case 1:
784				debug("connection from %.100s matched "
785				    "'LocalAddress %.100s' at line %d",
786				    ci->laddress, arg, line);
787				break;
788			case 0:
789			case -1:
790				result = 0;
791				break;
792			case -2:
793				return -1;
794			}
795		} else if (strcasecmp(attrib, "localport") == 0) {
796			if ((port = a2port(arg)) == -1) {
797				error("Invalid LocalPort '%s' on Match line",
798				    arg);
799				return -1;
800			}
801			if (ci == NULL || ci->lport == 0) {
802				result = 0;
803				continue;
804			}
805			/* TODO support port lists */
806			if (port == ci->lport)
807				debug("connection from %.100s matched "
808				    "'LocalPort %d' at line %d",
809				    ci->laddress, port, line);
810			else
811				result = 0;
812		} else {
813			error("Unsupported Match attribute %s", attrib);
814			return -1;
815		}
816	}
817	if (attributes == 0) {
818		error("One or more attributes required for Match");
819		return -1;
820	}
821	if (ci != NULL)
822		debug3("match %sfound", result ? "" : "not ");
823	*condition = cp;
824	return result;
825}
826
827#define WHITESPACE " \t\r\n"
828
829/* Multistate option parsing */
830struct multistate {
831	char *key;
832	int value;
833};
834static const struct multistate multistate_addressfamily[] = {
835	{ "inet",			AF_INET },
836	{ "inet6",			AF_INET6 },
837	{ "any",			AF_UNSPEC },
838	{ NULL, -1 }
839};
840static const struct multistate multistate_permitrootlogin[] = {
841	{ "without-password",		PERMIT_NO_PASSWD },
842	{ "forced-commands-only",	PERMIT_FORCED_ONLY },
843	{ "yes",			PERMIT_YES },
844	{ "no",				PERMIT_NO },
845	{ NULL, -1 }
846};
847static const struct multistate multistate_compression[] = {
848	{ "delayed",			COMP_DELAYED },
849	{ "yes",			COMP_ZLIB },
850	{ "no",				COMP_NONE },
851	{ NULL, -1 }
852};
853static const struct multistate multistate_gatewayports[] = {
854	{ "clientspecified",		2 },
855	{ "yes",			1 },
856	{ "no",				0 },
857	{ NULL, -1 }
858};
859static const struct multistate multistate_privsep[] = {
860	{ "yes",			PRIVSEP_NOSANDBOX },
861	{ "sandbox",			PRIVSEP_ON },
862	{ "nosandbox",			PRIVSEP_NOSANDBOX },
863	{ "no",				PRIVSEP_OFF },
864	{ NULL, -1 }
865};
866static const struct multistate multistate_tcpfwd[] = {
867	{ "yes",			FORWARD_ALLOW },
868	{ "all",			FORWARD_ALLOW },
869	{ "no",				FORWARD_DENY },
870	{ "remote",			FORWARD_REMOTE },
871	{ "local",			FORWARD_LOCAL },
872	{ NULL, -1 }
873};
874
875int
876process_server_config_line(ServerOptions *options, char *line,
877    const char *filename, int linenum, int *activep,
878    struct connection_info *connectinfo)
879{
880	char *cp, **charptr, *arg, *p;
881	int cmdline = 0, *intptr, value, value2, n, port;
882	SyslogFacility *log_facility_ptr;
883	LogLevel *log_level_ptr;
884	ServerOpCodes opcode;
885	u_int i, flags = 0;
886	size_t len;
887	long long val64;
888	const struct multistate *multistate_ptr;
889
890	cp = line;
891	if ((arg = strdelim(&cp)) == NULL)
892		return 0;
893	/* Ignore leading whitespace */
894	if (*arg == '\0')
895		arg = strdelim(&cp);
896	if (!arg || !*arg || *arg == '#')
897		return 0;
898	intptr = NULL;
899	charptr = NULL;
900	opcode = parse_token(arg, filename, linenum, &flags);
901
902	if (activep == NULL) { /* We are processing a command line directive */
903		cmdline = 1;
904		activep = &cmdline;
905	}
906	if (*activep && opcode != sMatch)
907		debug3("%s:%d setting %s %s", filename, linenum, arg, cp);
908	if (*activep == 0 && !(flags & SSHCFG_MATCH)) {
909		if (connectinfo == NULL) {
910			fatal("%s line %d: Directive '%s' is not allowed "
911			    "within a Match block", filename, linenum, arg);
912		} else { /* this is a directive we have already processed */
913			while (arg)
914				arg = strdelim(&cp);
915			return 0;
916		}
917	}
918
919	switch (opcode) {
920	/* Portable-specific options */
921	case sUsePAM:
922		intptr = &options->use_pam;
923		goto parse_flag;
924
925	/* Standard Options */
926	case sBadOption:
927		return -1;
928	case sPort:
929		/* ignore ports from configfile if cmdline specifies ports */
930		if (options->ports_from_cmdline)
931			return 0;
932		if (options->listen_addrs != NULL)
933			fatal("%s line %d: ports must be specified before "
934			    "ListenAddress.", filename, linenum);
935		if (options->num_ports >= MAX_PORTS)
936			fatal("%s line %d: too many ports.",
937			    filename, linenum);
938		arg = strdelim(&cp);
939		if (!arg || *arg == '\0')
940			fatal("%s line %d: missing port number.",
941			    filename, linenum);
942		options->ports[options->num_ports++] = a2port(arg);
943		if (options->ports[options->num_ports-1] <= 0)
944			fatal("%s line %d: Badly formatted port number.",
945			    filename, linenum);
946		break;
947
948	case sServerKeyBits:
949		intptr = &options->server_key_bits;
950 parse_int:
951		arg = strdelim(&cp);
952		if (!arg || *arg == '\0')
953			fatal("%s line %d: missing integer value.",
954			    filename, linenum);
955		value = atoi(arg);
956		if (*activep && *intptr == -1)
957			*intptr = value;
958		break;
959
960	case sLoginGraceTime:
961		intptr = &options->login_grace_time;
962 parse_time:
963		arg = strdelim(&cp);
964		if (!arg || *arg == '\0')
965			fatal("%s line %d: missing time value.",
966			    filename, linenum);
967		if ((value = convtime(arg)) == -1)
968			fatal("%s line %d: invalid time value.",
969			    filename, linenum);
970		if (*intptr == -1)
971			*intptr = value;
972		break;
973
974	case sKeyRegenerationTime:
975		intptr = &options->key_regeneration_time;
976		goto parse_time;
977
978	case sListenAddress:
979		arg = strdelim(&cp);
980		if (arg == NULL || *arg == '\0')
981			fatal("%s line %d: missing address",
982			    filename, linenum);
983		/* check for bare IPv6 address: no "[]" and 2 or more ":" */
984		if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL
985		    && strchr(p+1, ':') != NULL) {
986			add_listen_addr(options, arg, 0);
987			break;
988		}
989		p = hpdelim(&arg);
990		if (p == NULL)
991			fatal("%s line %d: bad address:port usage",
992			    filename, linenum);
993		p = cleanhostname(p);
994		if (arg == NULL)
995			port = 0;
996		else if ((port = a2port(arg)) <= 0)
997			fatal("%s line %d: bad port number", filename, linenum);
998
999		add_listen_addr(options, p, port);
1000
1001		break;
1002
1003	case sAddressFamily:
1004		intptr = &options->address_family;
1005		multistate_ptr = multistate_addressfamily;
1006		if (options->listen_addrs != NULL)
1007			fatal("%s line %d: address family must be specified "
1008			    "before ListenAddress.", filename, linenum);
1009 parse_multistate:
1010		arg = strdelim(&cp);
1011		if (!arg || *arg == '\0')
1012			fatal("%s line %d: missing argument.",
1013			    filename, linenum);
1014		value = -1;
1015		for (i = 0; multistate_ptr[i].key != NULL; i++) {
1016			if (strcasecmp(arg, multistate_ptr[i].key) == 0) {
1017				value = multistate_ptr[i].value;
1018				break;
1019			}
1020		}
1021		if (value == -1)
1022			fatal("%s line %d: unsupported option \"%s\".",
1023			    filename, linenum, arg);
1024		if (*activep && *intptr == -1)
1025			*intptr = value;
1026		break;
1027
1028	case sHostKeyFile:
1029		intptr = &options->num_host_key_files;
1030		if (*intptr >= MAX_HOSTKEYS)
1031			fatal("%s line %d: too many host keys specified (max %d).",
1032			    filename, linenum, MAX_HOSTKEYS);
1033		charptr = &options->host_key_files[*intptr];
1034 parse_filename:
1035		arg = strdelim(&cp);
1036		if (!arg || *arg == '\0')
1037			fatal("%s line %d: missing file name.",
1038			    filename, linenum);
1039		if (*activep && *charptr == NULL) {
1040			*charptr = derelativise_path(arg);
1041			/* increase optional counter */
1042			if (intptr != NULL)
1043				*intptr = *intptr + 1;
1044		}
1045		break;
1046
1047	case sHostKeyAgent:
1048		charptr = &options->host_key_agent;
1049		arg = strdelim(&cp);
1050		if (!arg || *arg == '\0')
1051			fatal("%s line %d: missing socket name.",
1052			    filename, linenum);
1053		if (*activep && *charptr == NULL)
1054			*charptr = !strcmp(arg, SSH_AUTHSOCKET_ENV_NAME) ?
1055			    xstrdup(arg) : derelativise_path(arg);
1056		break;
1057
1058	case sHostCertificate:
1059		intptr = &options->num_host_cert_files;
1060		if (*intptr >= MAX_HOSTKEYS)
1061			fatal("%s line %d: too many host certificates "
1062			    "specified (max %d).", filename, linenum,
1063			    MAX_HOSTCERTS);
1064		charptr = &options->host_cert_files[*intptr];
1065		goto parse_filename;
1066		break;
1067
1068	case sPidFile:
1069		charptr = &options->pid_file;
1070		goto parse_filename;
1071
1072	case sPermitRootLogin:
1073		intptr = &options->permit_root_login;
1074		multistate_ptr = multistate_permitrootlogin;
1075		goto parse_multistate;
1076
1077	case sIgnoreRhosts:
1078		intptr = &options->ignore_rhosts;
1079 parse_flag:
1080		arg = strdelim(&cp);
1081		if (!arg || *arg == '\0')
1082			fatal("%s line %d: missing yes/no argument.",
1083			    filename, linenum);
1084		value = 0;	/* silence compiler */
1085		if (strcmp(arg, "yes") == 0)
1086			value = 1;
1087		else if (strcmp(arg, "no") == 0)
1088			value = 0;
1089		else
1090			fatal("%s line %d: Bad yes/no argument: %s",
1091				filename, linenum, arg);
1092		if (*activep && *intptr == -1)
1093			*intptr = value;
1094		break;
1095
1096	case sIgnoreUserKnownHosts:
1097		intptr = &options->ignore_user_known_hosts;
1098		goto parse_flag;
1099
1100	case sRhostsRSAAuthentication:
1101		intptr = &options->rhosts_rsa_authentication;
1102		goto parse_flag;
1103
1104	case sHostbasedAuthentication:
1105		intptr = &options->hostbased_authentication;
1106		goto parse_flag;
1107
1108	case sHostbasedUsesNameFromPacketOnly:
1109		intptr = &options->hostbased_uses_name_from_packet_only;
1110		goto parse_flag;
1111
1112	case sRSAAuthentication:
1113		intptr = &options->rsa_authentication;
1114		goto parse_flag;
1115
1116	case sPubkeyAuthentication:
1117		intptr = &options->pubkey_authentication;
1118		goto parse_flag;
1119
1120	case sKerberosAuthentication:
1121		intptr = &options->kerberos_authentication;
1122		goto parse_flag;
1123
1124	case sKerberosOrLocalPasswd:
1125		intptr = &options->kerberos_or_local_passwd;
1126		goto parse_flag;
1127
1128	case sKerberosTicketCleanup:
1129		intptr = &options->kerberos_ticket_cleanup;
1130		goto parse_flag;
1131
1132	case sKerberosGetAFSToken:
1133		intptr = &options->kerberos_get_afs_token;
1134		goto parse_flag;
1135
1136	case sGssAuthentication:
1137		intptr = &options->gss_authentication;
1138		goto parse_flag;
1139
1140	case sGssCleanupCreds:
1141		intptr = &options->gss_cleanup_creds;
1142		goto parse_flag;
1143
1144	case sPasswordAuthentication:
1145		intptr = &options->password_authentication;
1146		goto parse_flag;
1147
1148	case sKbdInteractiveAuthentication:
1149		intptr = &options->kbd_interactive_authentication;
1150		goto parse_flag;
1151
1152	case sChallengeResponseAuthentication:
1153		intptr = &options->challenge_response_authentication;
1154		goto parse_flag;
1155
1156	case sPrintMotd:
1157		intptr = &options->print_motd;
1158		goto parse_flag;
1159
1160	case sPrintLastLog:
1161		intptr = &options->print_lastlog;
1162		goto parse_flag;
1163
1164	case sX11Forwarding:
1165		intptr = &options->x11_forwarding;
1166		goto parse_flag;
1167
1168	case sX11DisplayOffset:
1169		intptr = &options->x11_display_offset;
1170		goto parse_int;
1171
1172	case sX11UseLocalhost:
1173		intptr = &options->x11_use_localhost;
1174		goto parse_flag;
1175
1176	case sXAuthLocation:
1177		charptr = &options->xauth_location;
1178		goto parse_filename;
1179
1180	case sPermitTTY:
1181		intptr = &options->permit_tty;
1182		goto parse_flag;
1183
1184	case sStrictModes:
1185		intptr = &options->strict_modes;
1186		goto parse_flag;
1187
1188	case sTCPKeepAlive:
1189		intptr = &options->tcp_keep_alive;
1190		goto parse_flag;
1191
1192	case sEmptyPasswd:
1193		intptr = &options->permit_empty_passwd;
1194		goto parse_flag;
1195
1196	case sPermitUserEnvironment:
1197		intptr = &options->permit_user_env;
1198		goto parse_flag;
1199
1200	case sUseLogin:
1201		intptr = &options->use_login;
1202		goto parse_flag;
1203
1204	case sCompression:
1205		intptr = &options->compression;
1206		multistate_ptr = multistate_compression;
1207		goto parse_multistate;
1208
1209	case sRekeyLimit:
1210		arg = strdelim(&cp);
1211		if (!arg || *arg == '\0')
1212			fatal("%.200s line %d: Missing argument.", filename,
1213			    linenum);
1214		if (strcmp(arg, "default") == 0) {
1215			val64 = 0;
1216		} else {
1217			if (scan_scaled(arg, &val64) == -1)
1218				fatal("%.200s line %d: Bad number '%s': %s",
1219				    filename, linenum, arg, strerror(errno));
1220			/* check for too-large or too-small limits */
1221			if (val64 > UINT_MAX)
1222				fatal("%.200s line %d: RekeyLimit too large",
1223				    filename, linenum);
1224			if (val64 != 0 && val64 < 16)
1225				fatal("%.200s line %d: RekeyLimit too small",
1226				    filename, linenum);
1227		}
1228		if (*activep && options->rekey_limit == -1)
1229			options->rekey_limit = (u_int32_t)val64;
1230		if (cp != NULL) { /* optional rekey interval present */
1231			if (strcmp(cp, "none") == 0) {
1232				(void)strdelim(&cp);	/* discard */
1233				break;
1234			}
1235			intptr = &options->rekey_interval;
1236			goto parse_time;
1237		}
1238		break;
1239
1240	case sGatewayPorts:
1241		intptr = &options->gateway_ports;
1242		multistate_ptr = multistate_gatewayports;
1243		goto parse_multistate;
1244
1245	case sUseDNS:
1246		intptr = &options->use_dns;
1247		goto parse_flag;
1248
1249	case sLogFacility:
1250		log_facility_ptr = &options->log_facility;
1251		arg = strdelim(&cp);
1252		value = log_facility_number(arg);
1253		if (value == SYSLOG_FACILITY_NOT_SET)
1254			fatal("%.200s line %d: unsupported log facility '%s'",
1255			    filename, linenum, arg ? arg : "<NONE>");
1256		if (*log_facility_ptr == -1)
1257			*log_facility_ptr = (SyslogFacility) value;
1258		break;
1259
1260	case sLogLevel:
1261		log_level_ptr = &options->log_level;
1262		arg = strdelim(&cp);
1263		value = log_level_number(arg);
1264		if (value == SYSLOG_LEVEL_NOT_SET)
1265			fatal("%.200s line %d: unsupported log level '%s'",
1266			    filename, linenum, arg ? arg : "<NONE>");
1267		if (*log_level_ptr == -1)
1268			*log_level_ptr = (LogLevel) value;
1269		break;
1270
1271	case sAllowTcpForwarding:
1272		intptr = &options->allow_tcp_forwarding;
1273		multistate_ptr = multistate_tcpfwd;
1274		goto parse_multistate;
1275
1276	case sAllowAgentForwarding:
1277		intptr = &options->allow_agent_forwarding;
1278		goto parse_flag;
1279
1280	case sUsePrivilegeSeparation:
1281		intptr = &use_privsep;
1282		multistate_ptr = multistate_privsep;
1283		goto parse_multistate;
1284
1285	case sAllowUsers:
1286		while ((arg = strdelim(&cp)) && *arg != '\0') {
1287			if (options->num_allow_users >= MAX_ALLOW_USERS)
1288				fatal("%s line %d: too many allow users.",
1289				    filename, linenum);
1290			if (!*activep)
1291				continue;
1292			options->allow_users[options->num_allow_users++] =
1293			    xstrdup(arg);
1294		}
1295		break;
1296
1297	case sDenyUsers:
1298		while ((arg = strdelim(&cp)) && *arg != '\0') {
1299			if (options->num_deny_users >= MAX_DENY_USERS)
1300				fatal("%s line %d: too many deny users.",
1301				    filename, linenum);
1302			if (!*activep)
1303				continue;
1304			options->deny_users[options->num_deny_users++] =
1305			    xstrdup(arg);
1306		}
1307		break;
1308
1309	case sAllowGroups:
1310		while ((arg = strdelim(&cp)) && *arg != '\0') {
1311			if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
1312				fatal("%s line %d: too many allow groups.",
1313				    filename, linenum);
1314			if (!*activep)
1315				continue;
1316			options->allow_groups[options->num_allow_groups++] =
1317			    xstrdup(arg);
1318		}
1319		break;
1320
1321	case sDenyGroups:
1322		while ((arg = strdelim(&cp)) && *arg != '\0') {
1323			if (options->num_deny_groups >= MAX_DENY_GROUPS)
1324				fatal("%s line %d: too many deny groups.",
1325				    filename, linenum);
1326			if (!*activep)
1327				continue;
1328			options->deny_groups[options->num_deny_groups++] =
1329			    xstrdup(arg);
1330		}
1331		break;
1332
1333	case sCiphers:
1334		arg = strdelim(&cp);
1335		if (!arg || *arg == '\0')
1336			fatal("%s line %d: Missing argument.", filename, linenum);
1337		if (!ciphers_valid(arg))
1338			fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1339			    filename, linenum, arg ? arg : "<NONE>");
1340		if (options->ciphers == NULL)
1341			options->ciphers = xstrdup(arg);
1342		break;
1343
1344	case sMacs:
1345		arg = strdelim(&cp);
1346		if (!arg || *arg == '\0')
1347			fatal("%s line %d: Missing argument.", filename, linenum);
1348		if (!mac_valid(arg))
1349			fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1350			    filename, linenum, arg ? arg : "<NONE>");
1351		if (options->macs == NULL)
1352			options->macs = xstrdup(arg);
1353		break;
1354
1355	case sKexAlgorithms:
1356		arg = strdelim(&cp);
1357		if (!arg || *arg == '\0')
1358			fatal("%s line %d: Missing argument.",
1359			    filename, linenum);
1360		if (!kex_names_valid(arg))
1361			fatal("%s line %d: Bad SSH2 KexAlgorithms '%s'.",
1362			    filename, linenum, arg ? arg : "<NONE>");
1363		if (options->kex_algorithms == NULL)
1364			options->kex_algorithms = xstrdup(arg);
1365		break;
1366
1367	case sProtocol:
1368		intptr = &options->protocol;
1369		arg = strdelim(&cp);
1370		if (!arg || *arg == '\0')
1371			fatal("%s line %d: Missing argument.", filename, linenum);
1372		value = proto_spec(arg);
1373		if (value == SSH_PROTO_UNKNOWN)
1374			fatal("%s line %d: Bad protocol spec '%s'.",
1375			    filename, linenum, arg ? arg : "<NONE>");
1376		if (*intptr == SSH_PROTO_UNKNOWN)
1377			*intptr = value;
1378		break;
1379
1380	case sSubsystem:
1381		if (options->num_subsystems >= MAX_SUBSYSTEMS) {
1382			fatal("%s line %d: too many subsystems defined.",
1383			    filename, linenum);
1384		}
1385		arg = strdelim(&cp);
1386		if (!arg || *arg == '\0')
1387			fatal("%s line %d: Missing subsystem name.",
1388			    filename, linenum);
1389		if (!*activep) {
1390			arg = strdelim(&cp);
1391			break;
1392		}
1393		for (i = 0; i < options->num_subsystems; i++)
1394			if (strcmp(arg, options->subsystem_name[i]) == 0)
1395				fatal("%s line %d: Subsystem '%s' already defined.",
1396				    filename, linenum, arg);
1397		options->subsystem_name[options->num_subsystems] = xstrdup(arg);
1398		arg = strdelim(&cp);
1399		if (!arg || *arg == '\0')
1400			fatal("%s line %d: Missing subsystem command.",
1401			    filename, linenum);
1402		options->subsystem_command[options->num_subsystems] = xstrdup(arg);
1403
1404		/* Collect arguments (separate to executable) */
1405		p = xstrdup(arg);
1406		len = strlen(p) + 1;
1407		while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
1408			len += 1 + strlen(arg);
1409			p = xrealloc(p, 1, len);
1410			strlcat(p, " ", len);
1411			strlcat(p, arg, len);
1412		}
1413		options->subsystem_args[options->num_subsystems] = p;
1414		options->num_subsystems++;
1415		break;
1416
1417	case sMaxStartups:
1418		arg = strdelim(&cp);
1419		if (!arg || *arg == '\0')
1420			fatal("%s line %d: Missing MaxStartups spec.",
1421			    filename, linenum);
1422		if ((n = sscanf(arg, "%d:%d:%d",
1423		    &options->max_startups_begin,
1424		    &options->max_startups_rate,
1425		    &options->max_startups)) == 3) {
1426			if (options->max_startups_begin >
1427			    options->max_startups ||
1428			    options->max_startups_rate > 100 ||
1429			    options->max_startups_rate < 1)
1430				fatal("%s line %d: Illegal MaxStartups spec.",
1431				    filename, linenum);
1432		} else if (n != 1)
1433			fatal("%s line %d: Illegal MaxStartups spec.",
1434			    filename, linenum);
1435		else
1436			options->max_startups = options->max_startups_begin;
1437		break;
1438
1439	case sMaxAuthTries:
1440		intptr = &options->max_authtries;
1441		goto parse_int;
1442
1443	case sMaxSessions:
1444		intptr = &options->max_sessions;
1445		goto parse_int;
1446
1447	case sBanner:
1448		charptr = &options->banner;
1449		goto parse_filename;
1450
1451	/*
1452	 * These options can contain %X options expanded at
1453	 * connect time, so that you can specify paths like:
1454	 *
1455	 * AuthorizedKeysFile	/etc/ssh_keys/%u
1456	 */
1457	case sAuthorizedKeysFile:
1458		if (*activep && options->num_authkeys_files == 0) {
1459			while ((arg = strdelim(&cp)) && *arg != '\0') {
1460				if (options->num_authkeys_files >=
1461				    MAX_AUTHKEYS_FILES)
1462					fatal("%s line %d: "
1463					    "too many authorized keys files.",
1464					    filename, linenum);
1465				options->authorized_keys_files[
1466				    options->num_authkeys_files++] =
1467				    tilde_expand_filename(arg, getuid());
1468			}
1469		}
1470		return 0;
1471
1472	case sAuthorizedPrincipalsFile:
1473		charptr = &options->authorized_principals_file;
1474		arg = strdelim(&cp);
1475		if (!arg || *arg == '\0')
1476			fatal("%s line %d: missing file name.",
1477			    filename, linenum);
1478		if (*activep && *charptr == NULL) {
1479			*charptr = tilde_expand_filename(arg, getuid());
1480			/* increase optional counter */
1481			if (intptr != NULL)
1482				*intptr = *intptr + 1;
1483		}
1484		break;
1485
1486	case sClientAliveInterval:
1487		intptr = &options->client_alive_interval;
1488		goto parse_time;
1489
1490	case sClientAliveCountMax:
1491		intptr = &options->client_alive_count_max;
1492		goto parse_int;
1493
1494	case sAcceptEnv:
1495		while ((arg = strdelim(&cp)) && *arg != '\0') {
1496			if (strchr(arg, '=') != NULL)
1497				fatal("%s line %d: Invalid environment name.",
1498				    filename, linenum);
1499			if (options->num_accept_env >= MAX_ACCEPT_ENV)
1500				fatal("%s line %d: too many allow env.",
1501				    filename, linenum);
1502			if (!*activep)
1503				continue;
1504			options->accept_env[options->num_accept_env++] =
1505			    xstrdup(arg);
1506		}
1507		break;
1508
1509	case sPermitTunnel:
1510		intptr = &options->permit_tun;
1511		arg = strdelim(&cp);
1512		if (!arg || *arg == '\0')
1513			fatal("%s line %d: Missing yes/point-to-point/"
1514			    "ethernet/no argument.", filename, linenum);
1515		value = -1;
1516		for (i = 0; tunmode_desc[i].val != -1; i++)
1517			if (strcmp(tunmode_desc[i].text, arg) == 0) {
1518				value = tunmode_desc[i].val;
1519				break;
1520			}
1521		if (value == -1)
1522			fatal("%s line %d: Bad yes/point-to-point/ethernet/"
1523			    "no argument: %s", filename, linenum, arg);
1524		if (*intptr == -1)
1525			*intptr = value;
1526		break;
1527
1528	case sMatch:
1529		if (cmdline)
1530			fatal("Match directive not supported as a command-line "
1531			   "option");
1532		value = match_cfg_line(&cp, linenum, connectinfo);
1533		if (value < 0)
1534			fatal("%s line %d: Bad Match condition", filename,
1535			    linenum);
1536		*activep = value;
1537		break;
1538
1539	case sPermitOpen:
1540		arg = strdelim(&cp);
1541		if (!arg || *arg == '\0')
1542			fatal("%s line %d: missing PermitOpen specification",
1543			    filename, linenum);
1544		n = options->num_permitted_opens;	/* modified later */
1545		if (strcmp(arg, "any") == 0) {
1546			if (*activep && n == -1) {
1547				channel_clear_adm_permitted_opens();
1548				options->num_permitted_opens = 0;
1549			}
1550			break;
1551		}
1552		if (strcmp(arg, "none") == 0) {
1553			if (*activep && n == -1) {
1554				options->num_permitted_opens = 1;
1555				channel_disable_adm_local_opens();
1556			}
1557			break;
1558		}
1559		if (*activep && n == -1)
1560			channel_clear_adm_permitted_opens();
1561		for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) {
1562			p = hpdelim(&arg);
1563			if (p == NULL)
1564				fatal("%s line %d: missing host in PermitOpen",
1565				    filename, linenum);
1566			p = cleanhostname(p);
1567			if (arg == NULL || ((port = permitopen_port(arg)) < 0))
1568				fatal("%s line %d: bad port number in "
1569				    "PermitOpen", filename, linenum);
1570			if (*activep && n == -1)
1571				options->num_permitted_opens =
1572				    channel_add_adm_permitted_opens(p, port);
1573		}
1574		break;
1575
1576	case sForceCommand:
1577		if (cp == NULL)
1578			fatal("%.200s line %d: Missing argument.", filename,
1579			    linenum);
1580		len = strspn(cp, WHITESPACE);
1581		if (*activep && options->adm_forced_command == NULL)
1582			options->adm_forced_command = xstrdup(cp + len);
1583		return 0;
1584
1585	case sChrootDirectory:
1586		charptr = &options->chroot_directory;
1587
1588		arg = strdelim(&cp);
1589		if (!arg || *arg == '\0')
1590			fatal("%s line %d: missing file name.",
1591			    filename, linenum);
1592		if (*activep && *charptr == NULL)
1593			*charptr = xstrdup(arg);
1594		break;
1595
1596	case sTrustedUserCAKeys:
1597		charptr = &options->trusted_user_ca_keys;
1598		goto parse_filename;
1599
1600	case sRevokedKeys:
1601		charptr = &options->revoked_keys_file;
1602		goto parse_filename;
1603
1604	case sIPQoS:
1605		arg = strdelim(&cp);
1606		if ((value = parse_ipqos(arg)) == -1)
1607			fatal("%s line %d: Bad IPQoS value: %s",
1608			    filename, linenum, arg);
1609		arg = strdelim(&cp);
1610		if (arg == NULL)
1611			value2 = value;
1612		else if ((value2 = parse_ipqos(arg)) == -1)
1613			fatal("%s line %d: Bad IPQoS value: %s",
1614			    filename, linenum, arg);
1615		if (*activep) {
1616			options->ip_qos_interactive = value;
1617			options->ip_qos_bulk = value2;
1618		}
1619		break;
1620
1621	case sVersionAddendum:
1622		if (cp == NULL)
1623			fatal("%.200s line %d: Missing argument.", filename,
1624			    linenum);
1625		len = strspn(cp, WHITESPACE);
1626		if (*activep && options->version_addendum == NULL) {
1627			if (strcasecmp(cp + len, "none") == 0)
1628				options->version_addendum = xstrdup("");
1629			else if (strchr(cp + len, '\r') != NULL)
1630				fatal("%.200s line %d: Invalid argument",
1631				    filename, linenum);
1632			else
1633				options->version_addendum = xstrdup(cp + len);
1634		}
1635		return 0;
1636
1637	case sAuthorizedKeysCommand:
1638		len = strspn(cp, WHITESPACE);
1639		if (*activep && options->authorized_keys_command == NULL) {
1640			if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0)
1641				fatal("%.200s line %d: AuthorizedKeysCommand "
1642				    "must be an absolute path",
1643				    filename, linenum);
1644			options->authorized_keys_command = xstrdup(cp + len);
1645		}
1646		return 0;
1647
1648	case sAuthorizedKeysCommandUser:
1649		charptr = &options->authorized_keys_command_user;
1650
1651		arg = strdelim(&cp);
1652		if (*activep && *charptr == NULL)
1653			*charptr = xstrdup(arg);
1654		break;
1655
1656	case sAuthenticationMethods:
1657		if (*activep && options->num_auth_methods == 0) {
1658			while ((arg = strdelim(&cp)) && *arg != '\0') {
1659				if (options->num_auth_methods >=
1660				    MAX_AUTH_METHODS)
1661					fatal("%s line %d: "
1662					    "too many authentication methods.",
1663					    filename, linenum);
1664				if (auth2_methods_valid(arg, 0) != 0)
1665					fatal("%s line %d: invalid "
1666					    "authentication method list.",
1667					    filename, linenum);
1668				options->auth_methods[
1669				    options->num_auth_methods++] = xstrdup(arg);
1670			}
1671		}
1672		return 0;
1673
1674	case sHPNDisabled:
1675		intptr = &options->hpn_disabled;
1676		goto parse_flag;
1677
1678	case sHPNBufferSize:
1679		intptr = &options->hpn_buffer_size;
1680		goto parse_int;
1681
1682	case sTcpRcvBufPoll:
1683		intptr = &options->tcp_rcv_buf_poll;
1684		goto parse_flag;
1685
1686#ifdef	NONE_CIPHER_ENABLED
1687	case sNoneEnabled:
1688		intptr = &options->none_enabled;
1689		goto parse_flag;
1690#endif
1691
1692	case sDeprecated:
1693		logit("%s line %d: Deprecated option %s",
1694		    filename, linenum, arg);
1695		while (arg)
1696		    arg = strdelim(&cp);
1697		break;
1698
1699	case sUnsupported:
1700		logit("%s line %d: Unsupported option %s",
1701		    filename, linenum, arg);
1702		while (arg)
1703		    arg = strdelim(&cp);
1704		break;
1705
1706	default:
1707		fatal("%s line %d: Missing handler for opcode %s (%d)",
1708		    filename, linenum, arg, opcode);
1709	}
1710	if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
1711		fatal("%s line %d: garbage at end of line; \"%.200s\".",
1712		    filename, linenum, arg);
1713	return 0;
1714}
1715
1716/* Reads the server configuration file. */
1717
1718void
1719load_server_config(const char *filename, Buffer *conf)
1720{
1721	char line[4096], *cp;
1722	FILE *f;
1723	int lineno = 0;
1724
1725	debug2("%s: filename %s", __func__, filename);
1726	if ((f = fopen(filename, "r")) == NULL) {
1727		perror(filename);
1728		exit(1);
1729	}
1730	buffer_clear(conf);
1731	while (fgets(line, sizeof(line), f)) {
1732		lineno++;
1733		if (strlen(line) == sizeof(line) - 1)
1734			fatal("%s line %d too long", filename, lineno);
1735		/*
1736		 * Trim out comments and strip whitespace
1737		 * NB - preserve newlines, they are needed to reproduce
1738		 * line numbers later for error messages
1739		 */
1740		if ((cp = strchr(line, '#')) != NULL)
1741			memcpy(cp, "\n", 2);
1742		cp = line + strspn(line, " \t\r");
1743
1744		buffer_append(conf, cp, strlen(cp));
1745	}
1746	buffer_append(conf, "\0", 1);
1747	fclose(f);
1748	debug2("%s: done config len = %d", __func__, buffer_len(conf));
1749}
1750
1751void
1752parse_server_match_config(ServerOptions *options,
1753   struct connection_info *connectinfo)
1754{
1755	ServerOptions mo;
1756
1757	initialize_server_options(&mo);
1758	parse_server_config(&mo, "reprocess config", &cfg, connectinfo);
1759	copy_set_server_options(options, &mo, 0);
1760}
1761
1762int parse_server_match_testspec(struct connection_info *ci, char *spec)
1763{
1764	char *p;
1765
1766	while ((p = strsep(&spec, ",")) && *p != '\0') {
1767		if (strncmp(p, "addr=", 5) == 0) {
1768			ci->address = xstrdup(p + 5);
1769		} else if (strncmp(p, "host=", 5) == 0) {
1770			ci->host = xstrdup(p + 5);
1771		} else if (strncmp(p, "user=", 5) == 0) {
1772			ci->user = xstrdup(p + 5);
1773		} else if (strncmp(p, "laddr=", 6) == 0) {
1774			ci->laddress = xstrdup(p + 6);
1775		} else if (strncmp(p, "lport=", 6) == 0) {
1776			ci->lport = a2port(p + 6);
1777			if (ci->lport == -1) {
1778				fprintf(stderr, "Invalid port '%s' in test mode"
1779				   " specification %s\n", p+6, p);
1780				return -1;
1781			}
1782		} else {
1783			fprintf(stderr, "Invalid test mode specification %s\n",
1784			   p);
1785			return -1;
1786		}
1787	}
1788	return 0;
1789}
1790
1791/*
1792 * returns 1 for a complete spec, 0 for partial spec and -1 for an
1793 * empty spec.
1794 */
1795int server_match_spec_complete(struct connection_info *ci)
1796{
1797	if (ci->user && ci->host && ci->address)
1798		return 1;	/* complete */
1799	if (!ci->user && !ci->host && !ci->address)
1800		return -1;	/* empty */
1801	return 0;	/* partial */
1802}
1803
1804/*
1805 * Copy any supported values that are set.
1806 *
1807 * If the preauth flag is set, we do not bother copying the string or
1808 * array values that are not used pre-authentication, because any that we
1809 * do use must be explictly sent in mm_getpwnamallow().
1810 */
1811void
1812copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
1813{
1814#define M_CP_INTOPT(n) do {\
1815	if (src->n != -1) \
1816		dst->n = src->n; \
1817} while (0)
1818
1819	M_CP_INTOPT(password_authentication);
1820	M_CP_INTOPT(gss_authentication);
1821	M_CP_INTOPT(rsa_authentication);
1822	M_CP_INTOPT(pubkey_authentication);
1823	M_CP_INTOPT(kerberos_authentication);
1824	M_CP_INTOPT(hostbased_authentication);
1825	M_CP_INTOPT(hostbased_uses_name_from_packet_only);
1826	M_CP_INTOPT(kbd_interactive_authentication);
1827	M_CP_INTOPT(permit_root_login);
1828	M_CP_INTOPT(permit_empty_passwd);
1829
1830	M_CP_INTOPT(allow_tcp_forwarding);
1831	M_CP_INTOPT(allow_agent_forwarding);
1832	M_CP_INTOPT(permit_tun);
1833	M_CP_INTOPT(gateway_ports);
1834	M_CP_INTOPT(x11_display_offset);
1835	M_CP_INTOPT(x11_forwarding);
1836	M_CP_INTOPT(x11_use_localhost);
1837	M_CP_INTOPT(permit_tty);
1838	M_CP_INTOPT(max_sessions);
1839	M_CP_INTOPT(max_authtries);
1840	M_CP_INTOPT(ip_qos_interactive);
1841	M_CP_INTOPT(ip_qos_bulk);
1842	M_CP_INTOPT(rekey_limit);
1843	M_CP_INTOPT(rekey_interval);
1844
1845	/* M_CP_STROPT and M_CP_STRARRAYOPT should not appear before here */
1846#define M_CP_STROPT(n) do {\
1847	if (src->n != NULL && dst->n != src->n) { \
1848		free(dst->n); \
1849		dst->n = src->n; \
1850	} \
1851} while(0)
1852#define M_CP_STRARRAYOPT(n, num_n) do {\
1853	if (src->num_n != 0) { \
1854		for (dst->num_n = 0; dst->num_n < src->num_n; dst->num_n++) \
1855			dst->n[dst->num_n] = xstrdup(src->n[dst->num_n]); \
1856	} \
1857} while(0)
1858
1859	/* See comment in servconf.h */
1860	COPY_MATCH_STRING_OPTS();
1861
1862	/*
1863	 * The only things that should be below this point are string options
1864	 * which are only used after authentication.
1865	 */
1866	if (preauth)
1867		return;
1868
1869	M_CP_STROPT(adm_forced_command);
1870	M_CP_STROPT(chroot_directory);
1871}
1872
1873#undef M_CP_INTOPT
1874#undef M_CP_STROPT
1875#undef M_CP_STRARRAYOPT
1876
1877void
1878parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
1879    struct connection_info *connectinfo)
1880{
1881	int active, linenum, bad_options = 0;
1882	char *cp, *obuf, *cbuf;
1883
1884	debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
1885
1886	obuf = cbuf = xstrdup(buffer_ptr(conf));
1887	active = connectinfo ? 0 : 1;
1888	linenum = 1;
1889	while ((cp = strsep(&cbuf, "\n")) != NULL) {
1890		if (process_server_config_line(options, cp, filename,
1891		    linenum++, &active, connectinfo) != 0)
1892			bad_options++;
1893	}
1894	free(obuf);
1895	if (bad_options > 0)
1896		fatal("%s: terminating, %d bad configuration options",
1897		    filename, bad_options);
1898}
1899
1900static const char *
1901fmt_multistate_int(int val, const struct multistate *m)
1902{
1903	u_int i;
1904
1905	for (i = 0; m[i].key != NULL; i++) {
1906		if (m[i].value == val)
1907			return m[i].key;
1908	}
1909	return "UNKNOWN";
1910}
1911
1912static const char *
1913fmt_intarg(ServerOpCodes code, int val)
1914{
1915	if (val == -1)
1916		return "unset";
1917	switch (code) {
1918	case sAddressFamily:
1919		return fmt_multistate_int(val, multistate_addressfamily);
1920	case sPermitRootLogin:
1921		return fmt_multistate_int(val, multistate_permitrootlogin);
1922	case sGatewayPorts:
1923		return fmt_multistate_int(val, multistate_gatewayports);
1924	case sCompression:
1925		return fmt_multistate_int(val, multistate_compression);
1926	case sUsePrivilegeSeparation:
1927		return fmt_multistate_int(val, multistate_privsep);
1928	case sAllowTcpForwarding:
1929		return fmt_multistate_int(val, multistate_tcpfwd);
1930	case sProtocol:
1931		switch (val) {
1932		case SSH_PROTO_1:
1933			return "1";
1934		case SSH_PROTO_2:
1935			return "2";
1936		case (SSH_PROTO_1|SSH_PROTO_2):
1937			return "2,1";
1938		default:
1939			return "UNKNOWN";
1940		}
1941	default:
1942		switch (val) {
1943		case 0:
1944			return "no";
1945		case 1:
1946			return "yes";
1947		default:
1948			return "UNKNOWN";
1949		}
1950	}
1951}
1952
1953static const char *
1954lookup_opcode_name(ServerOpCodes code)
1955{
1956	u_int i;
1957
1958	for (i = 0; keywords[i].name != NULL; i++)
1959		if (keywords[i].opcode == code)
1960			return(keywords[i].name);
1961	return "UNKNOWN";
1962}
1963
1964static void
1965dump_cfg_int(ServerOpCodes code, int val)
1966{
1967	printf("%s %d\n", lookup_opcode_name(code), val);
1968}
1969
1970static void
1971dump_cfg_fmtint(ServerOpCodes code, int val)
1972{
1973	printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
1974}
1975
1976static void
1977dump_cfg_string(ServerOpCodes code, const char *val)
1978{
1979	if (val == NULL)
1980		return;
1981	printf("%s %s\n", lookup_opcode_name(code), val);
1982}
1983
1984static void
1985dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals)
1986{
1987	u_int i;
1988
1989	for (i = 0; i < count; i++)
1990		printf("%s %s\n", lookup_opcode_name(code), vals[i]);
1991}
1992
1993static void
1994dump_cfg_strarray_oneline(ServerOpCodes code, u_int count, char **vals)
1995{
1996	u_int i;
1997
1998	printf("%s", lookup_opcode_name(code));
1999	for (i = 0; i < count; i++)
2000		printf(" %s",  vals[i]);
2001	printf("\n");
2002}
2003
2004void
2005dump_config(ServerOptions *o)
2006{
2007	u_int i;
2008	int ret;
2009	struct addrinfo *ai;
2010	char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL;
2011
2012	/* these are usually at the top of the config */
2013	for (i = 0; i < o->num_ports; i++)
2014		printf("port %d\n", o->ports[i]);
2015	dump_cfg_fmtint(sProtocol, o->protocol);
2016	dump_cfg_fmtint(sAddressFamily, o->address_family);
2017
2018	/* ListenAddress must be after Port */
2019	for (ai = o->listen_addrs; ai; ai = ai->ai_next) {
2020		if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr,
2021		    sizeof(addr), port, sizeof(port),
2022		    NI_NUMERICHOST|NI_NUMERICSERV)) != 0) {
2023			error("getnameinfo failed: %.100s",
2024			    (ret != EAI_SYSTEM) ? gai_strerror(ret) :
2025			    strerror(errno));
2026		} else {
2027			if (ai->ai_family == AF_INET6)
2028				printf("listenaddress [%s]:%s\n", addr, port);
2029			else
2030				printf("listenaddress %s:%s\n", addr, port);
2031		}
2032	}
2033
2034	/* integer arguments */
2035#ifdef USE_PAM
2036	dump_cfg_int(sUsePAM, o->use_pam);
2037#endif
2038	dump_cfg_int(sServerKeyBits, o->server_key_bits);
2039	dump_cfg_int(sLoginGraceTime, o->login_grace_time);
2040	dump_cfg_int(sKeyRegenerationTime, o->key_regeneration_time);
2041	dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
2042	dump_cfg_int(sMaxAuthTries, o->max_authtries);
2043	dump_cfg_int(sMaxSessions, o->max_sessions);
2044	dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
2045	dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max);
2046
2047	/* formatted integer arguments */
2048	dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login);
2049	dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts);
2050	dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts);
2051	dump_cfg_fmtint(sRhostsRSAAuthentication, o->rhosts_rsa_authentication);
2052	dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication);
2053	dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly,
2054	    o->hostbased_uses_name_from_packet_only);
2055	dump_cfg_fmtint(sRSAAuthentication, o->rsa_authentication);
2056	dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication);
2057#ifdef KRB5
2058	dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication);
2059	dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd);
2060	dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup);
2061# ifdef USE_AFS
2062	dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
2063# endif
2064#endif
2065#ifdef GSSAPI
2066	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
2067	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
2068#endif
2069	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
2070	dump_cfg_fmtint(sKbdInteractiveAuthentication,
2071	    o->kbd_interactive_authentication);
2072	dump_cfg_fmtint(sChallengeResponseAuthentication,
2073	    o->challenge_response_authentication);
2074	dump_cfg_fmtint(sPrintMotd, o->print_motd);
2075	dump_cfg_fmtint(sPrintLastLog, o->print_lastlog);
2076	dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding);
2077	dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
2078	dump_cfg_fmtint(sPermitTTY, o->permit_tty);
2079	dump_cfg_fmtint(sStrictModes, o->strict_modes);
2080	dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
2081	dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
2082	dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
2083	dump_cfg_fmtint(sUseLogin, o->use_login);
2084	dump_cfg_fmtint(sCompression, o->compression);
2085	dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
2086	dump_cfg_fmtint(sUseDNS, o->use_dns);
2087	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
2088	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
2089
2090	/* string arguments */
2091	dump_cfg_string(sPidFile, o->pid_file);
2092	dump_cfg_string(sXAuthLocation, o->xauth_location);
2093	dump_cfg_string(sCiphers, o->ciphers ? o->ciphers :
2094	    cipher_alg_list(',', 0));
2095	dump_cfg_string(sMacs, o->macs ? o->macs : mac_alg_list(','));
2096	dump_cfg_string(sBanner, o->banner);
2097	dump_cfg_string(sForceCommand, o->adm_forced_command);
2098	dump_cfg_string(sChrootDirectory, o->chroot_directory);
2099	dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
2100	dump_cfg_string(sRevokedKeys, o->revoked_keys_file);
2101	dump_cfg_string(sAuthorizedPrincipalsFile,
2102	    o->authorized_principals_file);
2103	dump_cfg_string(sVersionAddendum, o->version_addendum);
2104	dump_cfg_string(sAuthorizedKeysCommand, o->authorized_keys_command);
2105	dump_cfg_string(sAuthorizedKeysCommandUser, o->authorized_keys_command_user);
2106	dump_cfg_string(sHostKeyAgent, o->host_key_agent);
2107	dump_cfg_string(sKexAlgorithms, o->kex_algorithms ? o->kex_algorithms :
2108	    kex_alg_list(','));
2109
2110	/* string arguments requiring a lookup */
2111	dump_cfg_string(sLogLevel, log_level_name(o->log_level));
2112	dump_cfg_string(sLogFacility, log_facility_name(o->log_facility));
2113
2114	/* string array arguments */
2115	dump_cfg_strarray_oneline(sAuthorizedKeysFile, o->num_authkeys_files,
2116	    o->authorized_keys_files);
2117	dump_cfg_strarray(sHostKeyFile, o->num_host_key_files,
2118	     o->host_key_files);
2119	dump_cfg_strarray(sHostKeyFile, o->num_host_cert_files,
2120	     o->host_cert_files);
2121	dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users);
2122	dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users);
2123	dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups);
2124	dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups);
2125	dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env);
2126	dump_cfg_strarray_oneline(sAuthenticationMethods,
2127	    o->num_auth_methods, o->auth_methods);
2128
2129	/* other arguments */
2130	for (i = 0; i < o->num_subsystems; i++)
2131		printf("subsystem %s %s\n", o->subsystem_name[i],
2132		    o->subsystem_args[i]);
2133
2134	printf("maxstartups %d:%d:%d\n", o->max_startups_begin,
2135	    o->max_startups_rate, o->max_startups);
2136
2137	for (i = 0; tunmode_desc[i].val != -1; i++)
2138		if (tunmode_desc[i].val == o->permit_tun) {
2139			s = tunmode_desc[i].text;
2140			break;
2141		}
2142	dump_cfg_string(sPermitTunnel, s);
2143
2144	printf("ipqos %s ", iptos2str(o->ip_qos_interactive));
2145	printf("%s\n", iptos2str(o->ip_qos_bulk));
2146
2147	printf("rekeylimit %lld %d\n", (long long)o->rekey_limit,
2148	    o->rekey_interval);
2149
2150	channel_print_adm_permitted_opens();
2151}
2152