1 /* $OpenBSD: servconf.h,v 1.179 2026/07/07 01:00:22 djm Exp $ */ 2 3 /* 4 * Author: Tatu Ylonen <ylo@cs.hut.fi> 5 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 6 * All rights reserved 7 * Definitions for server configuration data and for the functions reading it. 8 * 9 * As far as I am concerned, the code I have written for this software 10 * can be used freely for any purpose. Any derived versions of this 11 * software must be clearly marked as such, and if the derived work is 12 * incompatible with the protocol description in the RFC file, it must be 13 * called by a name other than "ssh" or "Secure Shell". 14 */ 15 16 #ifndef SERVCONF_H 17 #define SERVCONF_H 18 19 #include <sys/queue.h> 20 21 struct sshbuf; 22 23 #define MAX_PORTS 256 /* Max # ports. */ 24 25 /* permit_root_login */ 26 #define PERMIT_NOT_SET -1 27 #define PERMIT_NO 0 28 #define PERMIT_FORCED_ONLY 1 29 #define PERMIT_NO_PASSWD 2 30 #define PERMIT_YES 3 31 32 /* PermitOpen */ 33 #define PERMITOPEN_ANY 0 34 #define PERMITOPEN_NONE -2 35 36 /* IgnoreRhosts */ 37 #define IGNORE_RHOSTS_NO 0 38 #define IGNORE_RHOSTS_YES 1 39 #define IGNORE_RHOSTS_SHOSTS 2 40 41 #define DEFAULT_AUTH_FAIL_MAX 6 /* Default for MaxAuthTries */ 42 #define DEFAULT_SESSIONS_MAX 10 /* Default for MaxSessions */ 43 44 /* Magic name for internal sftp-server */ 45 #define INTERNAL_SFTP_NAME "internal-sftp" 46 47 /* PubkeyAuthOptions flags */ 48 #define PUBKEYAUTH_TOUCH_REQUIRED (1) 49 #define PUBKEYAUTH_VERIFY_REQUIRED (1<<1) 50 51 /* Various defaults */ 52 #define SSHD_DEFAULT_LOGIN_GRACE_TIME 120 53 #define SSHD_DEFAULT_X11_DISPLAY_OFFSET 10 54 #ifdef WITH_ZLIB 55 #define SSHD_DEFAULT_COMPRESSION COMP_DELAYED 56 #else 57 #define SSHD_DEFAULT_COMPRESSION COMP_NONE 58 #endif 59 60 struct ssh; 61 62 /* 63 * Used to store addresses from ListenAddr directives. These may be 64 * incomplete, as they may specify addresses that need to be merged 65 * with any ports requested by ListenPort. 66 */ 67 struct queued_listenaddr { 68 char *addr; 69 int port; /* <=0 if unspecified */ 70 char *rdomain; 71 }; 72 73 /* Resolved listen addresses, grouped by optional routing domain */ 74 struct listenaddr { 75 char *rdomain; 76 struct addrinfo *addrs; 77 }; 78 79 #define PER_SOURCE_PENALTY_OVERFLOW_DENY_ALL 1 80 #define PER_SOURCE_PENALTY_OVERFLOW_PERMISSIVE 2 81 struct per_source_penalty { 82 int enabled; 83 int max_sources4; 84 int max_sources6; 85 int overflow_mode; 86 int overflow_mode6; 87 double penalty_crash; 88 double penalty_grace; 89 double penalty_authfail; 90 double penalty_invaliduser; 91 double penalty_noauth; 92 double penalty_refuseconnection; 93 double penalty_max; 94 double penalty_min; 95 }; 96 97 /* Options for whether config entries are copied after Match processing */ 98 #define SSHCFG_COPY_NONE(action) 99 #define SSHCFG_COPY_MATCH(action) action 100 #define SSHCFG_COPY_MANUAL(action) 101 102 /* 103 * This macro is used to generate most of ServerOptions and some of the 104 * parsing and de/serialisation code in servconf.c. Every variable in 105 * ServerOptions *must* be represented here. 106 * 107 * Variables and configuration options that need special handling (e.g. 108 * those that represent a struct or use a single option to populate multiple 109 * values) use the SSHCONF_CUSTOM macro and get manual variable entries in 110 * ServerOptions below. 111 * 112 * Variables that exist in ServerOptions but aren't populated by a keyword 113 * use the SSHCONF_NONCONF macro and also get manual entries in ServerOptions. 114 * 115 * Everything else uses one of the SSHCONF_INT, SSHCONF_INTFLAG, 116 * SSHCONF_STRING, or SSHCONF_STRARRAY macros. These automatically populate 117 * their corresponding variable definitions in ServerOptions. The integer 118 * options also include defaults for initialisation. 119 * 120 * Deprecated and ignored options use SSHCONF_DEPRECATE and don't populate 121 * ServerOptions. Unsupported options use SSHCONF_UNSUPPORTED_INT or 122 * SSHCONF_UNSUPPORTED_STRING to populate placeholders in ServerOptions that 123 * are not otherwise used. Deprecated aliases that still work use 124 * SSHCONF_ALIAS. 125 * 126 * Why go to all this trouble? It ensures a level of consistency between 127 * the configuration structure and the parsing code and helps us write 128 * serialisation/deserialisation functions that we can be pretty sure will 129 * capture every value in the configuration file. 130 * 131 * Entry formats: 132 * SSHCONF_INT(field, keyword, scope, multistate, default, copy) 133 * SSHCONF_INTFLAG(field, keyword, scope, default, copy) 134 * SSHCONF_STRING(field, keyword, scope, copy) 135 * SSHCONF_STRARRAY(field, nfield, keyword, scope, copy) 136 * SSHCONF_CUSTOM(keyword, suffix, scope, copy) 137 * SSHCONF_NONCONF(suffix) 138 * SSHCONF_DEPRECATE(keyword, scope, token) 139 * SSHCONF_UNSUPPORTED_INT(field, keyword, scope) 140 * SSHCONF_UNSUPPORTED_STRING(field, keyword, scope) 141 * SSHCONF_ALIAS(old_keyword, keyword, scope) 142 */ 143 #define SSHD_CONFIG_ENTRIES_CUSTOM \ 144 SSHCONF_CUSTOM(Port, port, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 145 SSHCONF_CUSTOM(ListenAddress, listenaddress, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 146 SSHCONF_CUSTOM(HostKey, hostkeyfile, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 147 SSHCONF_CUSTOM(IPQoS, ipqos, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 148 SSHCONF_CUSTOM(GatewayPorts, gatewayports, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 149 SSHCONF_CUSTOM(StreamLocalBindMask, streamlocalbindmask, SSHCFG_ALL, SSHCFG_COPY_MANUAL) \ 150 SSHCONF_CUSTOM(StreamLocalBindUnlink, streamlocalbindunlink, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 151 SSHCONF_CUSTOM(SyslogFacility, logfacility, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 152 SSHCONF_CUSTOM(LogLevel, loglevel, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 153 SSHCONF_CUSTOM(PermitUserEnvironment, permituserenv, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 154 SSHCONF_CUSTOM(Subsystem, subsystem, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 155 SSHCONF_CUSTOM(MaxStartups, maxstartups, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 156 SSHCONF_CUSTOM(PerSourceNetBlockSize, persourcenetblocksize, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 157 SSHCONF_CUSTOM(PerSourcePenalties, persourcepenalties, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 158 SSHCONF_CUSTOM(RekeyLimit, rekeylimit, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 159 SSHCONF_NONCONF(timingsecret) 160 161 #define SSHD_CONFIG_ENTRIES_MAIN \ 162 SSHCONF_INT(address_family, AddressFamily, SSHCFG_GLOBAL, multistate_addressfamily, AF_UNSPEC, SSHCFG_COPY_NONE) \ 163 SSHCONF_STRING(routing_domain, RDomain, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 164 SSHCONF_STRARRAY(host_cert_files, num_host_cert_files, HostCertificate, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 165 SSHCONF_STRING(host_key_agent, HostKeyAgent, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 166 SSHCONF_STRING(pid_file, PidFile, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 167 SSHCONF_STRING(moduli_file, ModuliFile, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 168 SSHCONF_INT(login_grace_time, LoginGraceTime, SSHCFG_GLOBAL, NULL, SSHD_DEFAULT_LOGIN_GRACE_TIME, SSHCFG_COPY_NONE) \ 169 SSHCONF_INT(permit_root_login, PermitRootLogin, SSHCFG_ALL, multistate_permitrootlogin, PERMIT_NO, SSHCFG_COPY_MATCH) \ 170 SSHCONF_INT(ignore_rhosts, IgnoreRhosts, SSHCFG_ALL, multistate_ignore_rhosts, 1, SSHCFG_COPY_MATCH) \ 171 SSHCONF_INTFLAG(ignore_user_known_hosts, IgnoreUserKnownHosts, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) \ 172 SSHCONF_INTFLAG(print_motd, PrintMotd, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ 173 SSHCONF_INTFLAG(x11_forwarding, X11Forwarding, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \ 174 SSHCONF_INT(x11_display_offset, X11DisplayOffset, SSHCFG_ALL, NULL, SSHD_DEFAULT_X11_DISPLAY_OFFSET, SSHCFG_COPY_MATCH) \ 175 SSHCONF_INTFLAG(x11_use_localhost, X11UseLocalhost, SSHCFG_ALL, 1, SSHCFG_COPY_MATCH) \ 176 SSHCONF_STRING(xauth_location, XAuthLocation, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 177 SSHCONF_INTFLAG(permit_tty, PermitTTY, SSHCFG_ALL, 1, SSHCFG_COPY_MATCH) \ 178 SSHCONF_INTFLAG(permit_user_rc, PermitUserRC, SSHCFG_ALL, 1, SSHCFG_COPY_MATCH) \ 179 SSHCONF_INTFLAG(strict_modes, StrictModes, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ 180 SSHCONF_INTFLAG(tcp_keep_alive, TCPKeepAlive, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ 181 SSHCONF_STRING(ciphers, Ciphers, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 182 SSHCONF_STRING(macs, Macs, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 183 SSHCONF_STRING(kex_algorithms, KexAlgorithms, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 184 SSHCONF_STRARRAY(log_verbose, num_log_verbose, LogVerbose, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 185 SSHCONF_INTFLAG(hostbased_authentication, HostbasedAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \ 186 SSHCONF_INTFLAG(hostbased_uses_name_from_packet_only, HostbasedUsesNameFromPacketOnly, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \ 187 SSHCONF_STRING(hostbased_accepted_algos, HostbasedAcceptedAlgorithms, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 188 SSHCONF_STRING(hostkeyalgorithms, HostKeyAlgorithms, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 189 SSHCONF_STRING(ca_sign_algorithms, CASignatureAlgorithms, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 190 SSHCONF_INT(pubkey_auth_options, PubkeyAuthOptions, SSHCFG_ALL, NULL, 0, SSHCFG_COPY_MATCH) \ 191 SSHCONF_INTFLAG(pubkey_authentication, PubkeyAuthentication, SSHCFG_ALL, 1, SSHCFG_COPY_MATCH) \ 192 SSHCONF_STRING(pubkey_accepted_algos, PubkeyAcceptedAlgorithms, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 193 SSHCONF_INTFLAG(password_authentication, PasswordAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \ 194 SSHCONF_INTFLAG(kbd_interactive_authentication, KbdInteractiveAuthentication, SSHCFG_ALL, 1, SSHCFG_COPY_MATCH) \ 195 SSHCONF_INTFLAG(permit_empty_passwd, PermitEmptyPasswords, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \ 196 SSHCONF_INT(compression, Compression, SSHCFG_GLOBAL, multistate_compression, SSHD_DEFAULT_COMPRESSION, SSHCFG_COPY_NONE) \ 197 SSHCONF_INT(allow_tcp_forwarding, AllowTcpForwarding, SSHCFG_ALL, multistate_tcpfwd, FORWARD_ALLOW, SSHCFG_COPY_MATCH) \ 198 SSHCONF_INT(allow_streamlocal_forwarding, AllowStreamLocalForwarding, SSHCFG_ALL, multistate_tcpfwd, FORWARD_ALLOW, SSHCFG_COPY_MATCH) \ 199 SSHCONF_INTFLAG(allow_agent_forwarding, AllowAgentForwarding, SSHCFG_ALL, 1, SSHCFG_COPY_MATCH) \ 200 SSHCONF_INTFLAG(disable_forwarding, DisableForwarding, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \ 201 SSHCONF_STRARRAY(allow_users, num_allow_users, AllowUsers, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 202 SSHCONF_STRARRAY(deny_users, num_deny_users, DenyUsers, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 203 SSHCONF_STRARRAY(allow_groups, num_allow_groups, AllowGroups, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 204 SSHCONF_STRARRAY(deny_groups, num_deny_groups, DenyGroups, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 205 SSHCONF_STRARRAY(accept_env, num_accept_env, AcceptEnv, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 206 SSHCONF_STRARRAY(setenv, num_setenv, SetEnv, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 207 SSHCONF_INT(per_source_max_startups, PerSourceMaxStartups, SSHCFG_GLOBAL, NULL, INT_MAX, SSHCFG_COPY_NONE) \ 208 SSHCONF_STRING(per_source_penalty_exempt, PerSourcePenaltyExemptList, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 209 SSHCONF_INT(max_authtries, MaxAuthTries, SSHCFG_ALL, NULL, DEFAULT_AUTH_FAIL_MAX, SSHCFG_COPY_MATCH) \ 210 SSHCONF_INT(max_sessions, MaxSessions, SSHCFG_ALL, NULL, DEFAULT_SESSIONS_MAX, SSHCFG_COPY_MATCH) \ 211 SSHCONF_STRING(banner, Banner, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 212 SSHCONF_INTFLAG(use_dns, UseDNS, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ 213 SSHCONF_INT(client_alive_interval, ClientAliveInterval, SSHCFG_ALL, NULL, 0, SSHCFG_COPY_MATCH) \ 214 SSHCONF_INT(client_alive_count_max, ClientAliveCountMax, SSHCFG_ALL, NULL, 3, SSHCFG_COPY_MATCH) \ 215 SSHCONF_STRARRAY(authorized_keys_files, num_authkeys_files, AuthorizedKeysFile, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 216 SSHCONF_STRING(adm_forced_command, ForceCommand, SSHCFG_ALL, SSHCFG_COPY_MANUAL) \ 217 SSHCONF_INTFLAG(permit_tun, PermitTunnel, SSHCFG_ALL, SSH_TUNMODE_NO, SSHCFG_COPY_MATCH) \ 218 SSHCONF_STRARRAY(permitted_opens, num_permitted_opens, PermitOpen, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 219 SSHCONF_STRARRAY(permitted_listens, num_permitted_listens, PermitListen, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 220 SSHCONF_STRING(chroot_directory, ChrootDirectory, SSHCFG_ALL, SSHCFG_COPY_MANUAL) \ 221 SSHCONF_STRARRAY(revoked_keys_files, num_revoked_keys_files, RevokedKeys, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 222 SSHCONF_STRING(trusted_user_ca_keys, TrustedUserCAKeys, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 223 SSHCONF_STRING(authorized_keys_command, AuthorizedKeysCommand, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 224 SSHCONF_STRING(authorized_keys_command_user, AuthorizedKeysCommandUser, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 225 SSHCONF_STRING(authorized_principals_file, AuthorizedPrincipalsFile, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 226 SSHCONF_STRING(authorized_principals_command, AuthorizedPrincipalsCommand, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 227 SSHCONF_STRING(authorized_principals_command_user, AuthorizedPrincipalsCommandUser, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 228 SSHCONF_STRING(version_addendum, VersionAddendum, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 229 SSHCONF_STRARRAY(auth_methods, num_auth_methods, AuthenticationMethods, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 230 SSHCONF_INT(fingerprint_hash, FingerprintHash, SSHCFG_GLOBAL, NULL, SSH_FP_HASH_DEFAULT, SSHCFG_COPY_NONE) \ 231 SSHCONF_INTFLAG(expose_userauth_info, ExposeAuthInfo, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \ 232 SSHCONF_STRING(sk_provider, SecurityKeyProvider, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 233 SSHCONF_INT(required_rsa_size, RequiredRSASize, SSHCFG_ALL, NULL, SSH_RSA_MINIMUM_MODULUS_SIZE, SSHCFG_COPY_MATCH) \ 234 SSHCONF_STRARRAY(channel_timeouts, num_channel_timeouts, ChannelTimeout, SSHCFG_ALL, SSHCFG_COPY_MATCH) \ 235 SSHCONF_INT(unused_connection_timeout, UnusedConnectionTimeout, SSHCFG_ALL, NULL, 0, SSHCFG_COPY_MATCH) \ 236 SSHCONF_STRING(sshd_session_path, SshdSessionPath, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 237 SSHCONF_STRING(sshd_auth_path, SshdAuthPath, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) \ 238 SSHCONF_INTFLAG(refuse_connection, RefuseConnection, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \ 239 SSHCONF_INTFLAG(use_blocklist, UseBlocklist, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) 240 241 #define SSHD_CONFIG_ENTRIES_LEGACY \ 242 SSHCONF_DEPRECATE(ServerKeyBits, SSHCFG_GLOBAL, SSHCONF_DEPRECATED) \ 243 SSHCONF_DEPRECATE(KeyRegenerationInterval, SSHCFG_GLOBAL, SSHCONF_DEPRECATED) \ 244 SSHCONF_DEPRECATE(RHostsAuthentication, SSHCFG_GLOBAL, SSHCONF_DEPRECATED) \ 245 SSHCONF_DEPRECATE(RhostsRSAAuthentication, SSHCFG_ALL, SSHCONF_DEPRECATED) \ 246 SSHCONF_DEPRECATE(RSAAuthentication, SSHCFG_ALL, SSHCONF_DEPRECATED) \ 247 SSHCONF_DEPRECATE(CheckMail, SSHCFG_GLOBAL, SSHCONF_DEPRECATED) \ 248 SSHCONF_DEPRECATE(UseLogin, SSHCFG_GLOBAL, SSHCONF_DEPRECATED) \ 249 SSHCONF_DEPRECATE(VerifyReverseMapping, SSHCFG_GLOBAL, SSHCONF_DEPRECATED) \ 250 SSHCONF_DEPRECATE(ReverseMappingCheck, SSHCFG_GLOBAL, SSHCONF_DEPRECATED) \ 251 SSHCONF_DEPRECATE(AuthorizedKeysFile2, SSHCFG_ALL, SSHCONF_DEPRECATED) \ 252 SSHCONF_DEPRECATE(UsePrivilegeSeparation, SSHCFG_GLOBAL, SSHCONF_DEPRECATED) \ 253 SSHCONF_DEPRECATE(KerberosTgtPassing, SSHCFG_GLOBAL, SSHCONF_DEPRECATED) \ 254 SSHCONF_DEPRECATE(AFSTokenPassing, SSHCFG_GLOBAL, SSHCONF_DEPRECATED) \ 255 SSHCONF_DEPRECATE(Protocol, SSHCFG_GLOBAL, SSHCONF_IGNORE) 256 257 #define SSHD_CONFIG_ENTRIES_ALIASES \ 258 SSHCONF_ALIAS(HostDSAKey, HostKey, SSHCFG_GLOBAL) \ 259 SSHCONF_ALIAS(HostBasedAcceptedKeyTypes, HostbasedAcceptedAlgorithms, SSHCFG_ALL) \ 260 SSHCONF_ALIAS(PubkeyAcceptedKeyTypes, PubkeyAcceptedAlgorithms, SSHCFG_ALL) \ 261 SSHCONF_ALIAS(DSAAuthentication, PubkeyAuthentication, SSHCFG_GLOBAL) \ 262 SSHCONF_ALIAS(ChallengeResponseAuthentication, KbdInteractiveAuthentication, SSHCFG_ALL) \ 263 SSHCONF_ALIAS(SKeyAuthentication, KbdInteractiveAuthentication, SSHCFG_ALL) \ 264 SSHCONF_ALIAS(KeepAlive, TCPKeepAlive, SSHCFG_GLOBAL) \ 265 SSHCONF_ALIAS(UseBlacklist, UseBlocklist, SSHCFG_GLOBAL) 266 267 #define SSHD_CONFIG_ENTRIES_BASE \ 268 SSHD_CONFIG_ENTRIES_CUSTOM \ 269 SSHD_CONFIG_ENTRIES_MAIN \ 270 SSHD_CONFIG_ENTRIES_LEGACY \ 271 SSHD_CONFIG_ENTRIES_ALIASES \ 272 SSHD_CONFIG_ENTRIES_PAM \ 273 SSHD_CONFIG_ENTRIES_LASTLOG 274 275 #ifdef USE_PAM 276 #define SSHD_CONFIG_ENTRIES_PAM \ 277 SSHCONF_INTFLAG(use_pam, UsePAM, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ 278 SSHCONF_STRING(pam_service_name, PAMServiceName, SSHCFG_GLOBAL, SSHCFG_COPY_NONE) 279 #else 280 #define SSHD_CONFIG_ENTRIES_PAM \ 281 SSHCONF_UNSUPPORTED_INT(use_pam, UsePAM, SSHCFG_GLOBAL) \ 282 SSHCONF_UNSUPPORTED_STRING(pam_service_name, PAMServiceName, SSHCFG_GLOBAL) 283 #endif 284 285 #ifdef DISABLE_LASTLOG 286 #define SSHD_CONFIG_ENTRIES_LASTLOG \ 287 SSHCONF_UNSUPPORTED_INT(print_lastlog, PrintLastLog, SSHCFG_GLOBAL) 288 #else 289 #define SSHD_CONFIG_ENTRIES_LASTLOG \ 290 SSHCONF_INTFLAG(print_lastlog, PrintLastLog, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) 291 #endif 292 293 /* Compile-time enabled options */ 294 #ifdef KRB5 295 296 #ifdef USE_AFS 297 #define SSHD_CONFIG_KRB5_AFS \ 298 SSHCONF_INTFLAG(kerberos_get_afs_token, KerberosGetAFSToken, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE) 299 #else /* USE_AFS */ 300 #define SSHD_CONFIG_KRB5_AFS \ 301 SSHCONF_UNSUPPORTED_INT(kerberos_get_afs_token, KerberosGetAFSToken, SSHCFG_GLOBAL) 302 #endif /* USE_AFS */ 303 304 #define SSHD_CONFIG_ENTRIES_KRB5 \ 305 SSHCONF_INTFLAG(kerberos_authentication, KerberosAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \ 306 SSHCONF_INTFLAG(kerberos_or_local_passwd, KerberosOrLocalPasswd, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ 307 SSHCONF_INTFLAG(kerberos_ticket_cleanup, KerberosTicketCleanup, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ 308 SSHD_CONFIG_KRB5_AFS 309 #else /* KRB5 */ 310 #define SSHD_CONFIG_ENTRIES_KRB5 \ 311 SSHCONF_UNSUPPORTED_INT(kerberos_authentication, KerberosAuthentication, SSHCFG_ALL) \ 312 SSHCONF_UNSUPPORTED_INT(kerberos_or_local_passwd, KerberosOrLocalPasswd, SSHCFG_GLOBAL) \ 313 SSHCONF_UNSUPPORTED_INT(kerberos_ticket_cleanup, KerberosTicketCleanup, SSHCFG_GLOBAL) \ 314 SSHCONF_UNSUPPORTED_INT(kerberos_get_afs_token, KerberosGetAFSToken, SSHCFG_GLOBAL) 315 #endif /* KRB5 */ 316 317 #ifdef GSSAPI 318 #define SSHD_CONFIG_ENTRIES_GSS \ 319 SSHCONF_INTFLAG(gss_authentication, GSSAPIAuthentication, SSHCFG_ALL, 0, SSHCFG_COPY_MATCH) \ 320 SSHCONF_INTFLAG(gss_cleanup_creds, GSSAPICleanupCredentials, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ 321 SSHCONF_INTFLAG(gss_deleg_creds, GSSAPIDelegateCredentials, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) \ 322 SSHCONF_INTFLAG(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL, 1, SSHCFG_COPY_NONE) 323 #else /* GSSAPI */ 324 #define SSHD_CONFIG_ENTRIES_GSS \ 325 SSHCONF_UNSUPPORTED_INT(gss_authentication, GSSAPIAuthentication, SSHCFG_ALL) \ 326 SSHCONF_UNSUPPORTED_INT(gss_cleanup_creds, GSSAPICleanupCredentials, SSHCFG_GLOBAL) \ 327 SSHCONF_UNSUPPORTED_INT(gss_deleg_creds, GSSAPIDelegateCredentials, SSHCFG_GLOBAL) \ 328 SSHCONF_UNSUPPORTED_INT(gss_strict_acceptor, GSSAPIStrictAcceptorCheck, SSHCFG_GLOBAL) 329 #endif /* GSSAPI */ 330 331 #define SSHD_CONFIG_ENTRIES \ 332 SSHD_CONFIG_ENTRIES_BASE \ 333 SSHD_CONFIG_ENTRIES_KRB5 \ 334 SSHD_CONFIG_ENTRIES_GSS \ 335 336 /* Macros to declare ServerOptions member variables */ 337 #define SSHCONF_INT(var, conf, flags, ms, def, cp) int var; 338 #define SSHCONF_INTFLAG(var, conf, flags, def, cp) int var; 339 #define SSHCONF_STRING(var, conf, flags, cp) char *var; 340 #define SSHCONF_STRARRAY(var, nvar, conf, flags, cp) \ 341 char **var; \ 342 u_int nvar; 343 #define SSHCONF_CUSTOM(conf, funcsuffix, flags, cp) /* empty */ 344 #define SSHCONF_NONCONF(funcsuffix) /* empty */ 345 #define SSHCONF_DEPRECATE(conf, flags, opcode) /* empty */ 346 #define SSHCONF_UNSUPPORTED_INT(var, conf, flags) int var; 347 #define SSHCONF_UNSUPPORTED_STRING(var, conf, flags) char *var; 348 #define SSHCONF_ALIAS(old, conf, flags) /* empty */ 349 350 typedef struct ServerOptions { 351 SSHD_CONFIG_ENTRIES 352 /* Ports */ 353 u_int num_ports; 354 u_int ports_from_cmdline; 355 int ports[MAX_PORTS]; /* Port number to listen on. */ 356 /* ListenAddress */ 357 struct queued_listenaddr *queued_listen_addrs; 358 u_int num_queued_listens; 359 struct listenaddr *listen_addrs; 360 u_int num_listen_addrs; 361 /* HostKey */ 362 char **host_key_files; /* Files containing host keys. */ 363 int *host_key_file_userprovided; /* Key was specified by user. */ 364 u_int num_host_key_files; /* Number of files for host keys. */ 365 /* IPQoS */ 366 int ip_qos_interactive; /* IP ToS/DSCP/class for interactive */ 367 int ip_qos_bulk; /* IP ToS/DSCP/class for bulk traffic */ 368 /* GatewayPorts, StreamLocalBindMask, StreamLocalBindUnlink */ 369 struct ForwardOptions fwd_opts; /* forwarding options */ 370 /* LogFacility */ 371 SyslogFacility log_facility; /* Facility for system logging. */ 372 /* LogLevel */ 373 LogLevel log_level; /* Level for system logging. */ 374 /* PermitUserEnvironment */ 375 int permit_user_env; /* If true, read ~/.ssh/environment */ 376 char *permit_user_env_allowlist; /* pattern-list of allowed env names */ 377 /* Subsystem */ 378 u_int num_subsystems; 379 char **subsystem_name; 380 char **subsystem_command; 381 char **subsystem_args; 382 /* MaxStartups */ 383 int max_startups_begin; 384 int max_startups_rate; 385 int max_startups; 386 /* PerSourceNetBlockSize */ 387 int per_source_masklen_ipv4; 388 int per_source_masklen_ipv6; 389 /* PerSourcePenalties */ 390 struct per_source_penalty per_source_penalty; 391 /* RekeyLimit */ 392 int64_t rekey_limit; 393 int rekey_interval; 394 /* Passed by config but not keyword for this */ 395 uint64_t timing_secret; 396 } ServerOptions; 397 #undef SSHCONF_INT 398 #undef SSHCONF_INTFLAG 399 #undef SSHCONF_STRING 400 #undef SSHCONF_STRARRAY 401 #undef SSHCONF_CUSTOM 402 #undef SSHCONF_NONCONF 403 #undef SSHCONF_DEPRECATE 404 #undef SSHCONF_UNSUPPORTED_INT 405 #undef SSHCONF_UNSUPPORTED_STRING 406 #undef SSHCONF_ALIAS 407 408 /* Information about the incoming connection as used by Match */ 409 struct connection_info { 410 const char *user; 411 int user_invalid; 412 const char *host; /* possibly resolved hostname */ 413 const char *address; /* remote address */ 414 const char *laddress; /* local address */ 415 int lport; /* local port */ 416 const char *rdomain; /* routing domain if available */ 417 int test; /* test mode, allow some attributes to be 418 * unspecified */ 419 }; 420 421 /* List of included files for re-exec from the parsed configuration */ 422 struct include_item { 423 char *selector; 424 char *filename; 425 struct sshbuf *contents; 426 TAILQ_ENTRY(include_item) entry; 427 }; 428 TAILQ_HEAD(include_list, include_item); 429 430 431 void initialize_server_options(ServerOptions *); 432 void fill_default_server_options(ServerOptions *); 433 int process_server_config_line(ServerOptions *, char *, const char *, int, 434 int *, struct connection_info *, struct include_list *includes); 435 void load_server_config(const char *, struct sshbuf *); 436 void parse_server_config(ServerOptions *, const char *, struct sshbuf *, 437 struct include_list *includes, struct connection_info *, int); 438 void parse_server_match_config(ServerOptions *, 439 struct include_list *includes, struct connection_info *); 440 int parse_server_match_testspec(struct connection_info *, char *); 441 void servconf_merge_subsystems(ServerOptions *, ServerOptions *); 442 void copy_set_server_options(ServerOptions *, ServerOptions *, int); 443 void dump_config(ServerOptions *); 444 char *derelativise_path(const char *); 445 void servconf_add_hostkey(const char *, const int, 446 ServerOptions *, const char *path, int); 447 void servconf_add_hostcert(const char *, const int, 448 ServerOptions *, const char *path); 449 450 int serialise_server_options(const ServerOptions *, struct sshbuf **); 451 int deserialise_server_options(struct sshbuf *, ServerOptions *); 452 void free_server_options(ServerOptions *); 453 454 #endif /* SERVCONF_H */ 455