xref: /freebsd/crypto/openssh/servconf.c (revision 640235e2c2ba32947f7c59d168437ffa1280f1e6)
1 
2 /* $OpenBSD: servconf.c,v 1.285 2016/02/17 05:29:04 djm Exp $ */
3 /*
4  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5  *                    All rights reserved
6  *
7  * As far as I am concerned, the code I have written for this software
8  * can be used freely for any purpose.  Any derived versions of this
9  * software must be clearly marked as such, and if the derived work is
10  * incompatible with the protocol description in the RFC file, it must be
11  * called by a name other than "ssh" or "Secure Shell".
12  */
13 
14 #include "includes.h"
15 __RCSID("$FreeBSD$");
16 
17 #include <sys/types.h>
18 #include <sys/socket.h>
19 
20 #include <netinet/in.h>
21 #include <netinet/in_systm.h>
22 #include <netinet/ip.h>
23 
24 #include <ctype.h>
25 #include <fcntl.h>
26 #include <netdb.h>
27 #include <pwd.h>
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <string.h>
31 #include <signal.h>
32 #include <unistd.h>
33 #include <limits.h>
34 #include <stdarg.h>
35 #include <errno.h>
36 #ifdef HAVE_UTIL_H
37 #include <util.h>
38 #endif
39 
40 #include "openbsd-compat/sys-queue.h"
41 #include "xmalloc.h"
42 #include "ssh.h"
43 #include "log.h"
44 #include "buffer.h"
45 #include "misc.h"
46 #include "servconf.h"
47 #include "compat.h"
48 #include "pathnames.h"
49 #include "cipher.h"
50 #include "key.h"
51 #include "kex.h"
52 #include "mac.h"
53 #include "match.h"
54 #include "channels.h"
55 #include "groupaccess.h"
56 #include "canohost.h"
57 #include "packet.h"
58 #include "hostfile.h"
59 #include "auth.h"
60 #include "myproposal.h"
61 #include "digest.h"
62 #include "version.h"
63 
64 static void add_listen_addr(ServerOptions *, char *, int);
65 static void add_one_listen_addr(ServerOptions *, char *, int);
66 
67 /* Use of privilege separation or not */
68 extern int use_privsep;
69 extern Buffer cfg;
70 
71 /* Initializes the server options to their default values. */
72 
73 void
74 initialize_server_options(ServerOptions *options)
75 {
76 	memset(options, 0, sizeof(*options));
77 
78 	/* Portable-specific options */
79 	options->use_pam = -1;
80 
81 	/* Standard Options */
82 	options->num_ports = 0;
83 	options->ports_from_cmdline = 0;
84 	options->queued_listen_addrs = NULL;
85 	options->num_queued_listens = 0;
86 	options->listen_addrs = NULL;
87 	options->address_family = -1;
88 	options->num_host_key_files = 0;
89 	options->num_host_cert_files = 0;
90 	options->host_key_agent = NULL;
91 	options->pid_file = NULL;
92 	options->server_key_bits = -1;
93 	options->login_grace_time = -1;
94 	options->key_regeneration_time = -1;
95 	options->permit_root_login = PERMIT_NOT_SET;
96 	options->ignore_rhosts = -1;
97 	options->ignore_user_known_hosts = -1;
98 	options->print_motd = -1;
99 	options->print_lastlog = -1;
100 	options->x11_forwarding = -1;
101 	options->x11_display_offset = -1;
102 	options->x11_use_localhost = -1;
103 	options->permit_tty = -1;
104 	options->permit_user_rc = -1;
105 	options->xauth_location = NULL;
106 	options->strict_modes = -1;
107 	options->tcp_keep_alive = -1;
108 	options->log_facility = SYSLOG_FACILITY_NOT_SET;
109 	options->log_level = SYSLOG_LEVEL_NOT_SET;
110 	options->rhosts_rsa_authentication = -1;
111 	options->hostbased_authentication = -1;
112 	options->hostbased_uses_name_from_packet_only = -1;
113 	options->hostbased_key_types = NULL;
114 	options->hostkeyalgorithms = NULL;
115 	options->rsa_authentication = -1;
116 	options->pubkey_authentication = -1;
117 	options->pubkey_key_types = NULL;
118 	options->kerberos_authentication = -1;
119 	options->kerberos_or_local_passwd = -1;
120 	options->kerberos_ticket_cleanup = -1;
121 	options->kerberos_get_afs_token = -1;
122 	options->gss_authentication=-1;
123 	options->gss_cleanup_creds = -1;
124 	options->gss_strict_acceptor = -1;
125 	options->password_authentication = -1;
126 	options->kbd_interactive_authentication = -1;
127 	options->challenge_response_authentication = -1;
128 	options->permit_empty_passwd = -1;
129 	options->permit_user_env = -1;
130 	options->use_login = -1;
131 	options->compression = -1;
132 	options->rekey_limit = -1;
133 	options->rekey_interval = -1;
134 	options->allow_tcp_forwarding = -1;
135 	options->allow_streamlocal_forwarding = -1;
136 	options->allow_agent_forwarding = -1;
137 	options->num_allow_users = 0;
138 	options->num_deny_users = 0;
139 	options->num_allow_groups = 0;
140 	options->num_deny_groups = 0;
141 	options->ciphers = NULL;
142 	options->macs = NULL;
143 	options->kex_algorithms = NULL;
144 	options->protocol = SSH_PROTO_UNKNOWN;
145 	options->fwd_opts.gateway_ports = -1;
146 	options->fwd_opts.streamlocal_bind_mask = (mode_t)-1;
147 	options->fwd_opts.streamlocal_bind_unlink = -1;
148 	options->num_subsystems = 0;
149 	options->max_startups_begin = -1;
150 	options->max_startups_rate = -1;
151 	options->max_startups = -1;
152 	options->max_authtries = -1;
153 	options->max_sessions = -1;
154 	options->banner = NULL;
155 	options->use_dns = -1;
156 	options->client_alive_interval = -1;
157 	options->client_alive_count_max = -1;
158 	options->num_authkeys_files = 0;
159 	options->num_accept_env = 0;
160 	options->permit_tun = -1;
161 	options->num_permitted_opens = -1;
162 	options->adm_forced_command = NULL;
163 	options->chroot_directory = NULL;
164 	options->authorized_keys_command = NULL;
165 	options->authorized_keys_command_user = NULL;
166 	options->revoked_keys_file = NULL;
167 	options->trusted_user_ca_keys = NULL;
168 	options->authorized_principals_file = NULL;
169 	options->authorized_principals_command = NULL;
170 	options->authorized_principals_command_user = NULL;
171 	options->ip_qos_interactive = -1;
172 	options->ip_qos_bulk = -1;
173 	options->version_addendum = NULL;
174 	options->fingerprint_hash = -1;
175 }
176 
177 /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
178 static int
179 option_clear_or_none(const char *o)
180 {
181 	return o == NULL || strcasecmp(o, "none") == 0;
182 }
183 
184 static void
185 assemble_algorithms(ServerOptions *o)
186 {
187 	if (kex_assemble_names(KEX_SERVER_ENCRYPT, &o->ciphers) != 0 ||
188 	    kex_assemble_names(KEX_SERVER_MAC, &o->macs) != 0 ||
189 	    kex_assemble_names(KEX_SERVER_KEX, &o->kex_algorithms) != 0 ||
190 	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
191 	    &o->hostkeyalgorithms) != 0 ||
192 	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
193 	    &o->hostbased_key_types) != 0 ||
194 	    kex_assemble_names(KEX_DEFAULT_PK_ALG, &o->pubkey_key_types) != 0)
195 		fatal("kex_assemble_names failed");
196 }
197 
198 void
199 fill_default_server_options(ServerOptions *options)
200 {
201 	int i;
202 
203 	/* Portable-specific options */
204 	if (options->use_pam == -1)
205 		options->use_pam = 1;
206 
207 	/* Standard Options */
208 	if (options->protocol == SSH_PROTO_UNKNOWN)
209 		options->protocol = SSH_PROTO_2;
210 #define add_host_key_file(path)						\
211 	do {								\
212 		if (access((path), O_RDONLY) == 0)			\
213 			options->host_key_files				\
214 			    [options->num_host_key_files++] = (path);	\
215 	} while (0)
216 	if (options->num_host_key_files == 0) {
217 		/* fill default hostkeys for protocols */
218 		if (options->protocol & SSH_PROTO_1)
219 			add_host_key_file(_PATH_HOST_KEY_FILE);
220 		if (options->protocol & SSH_PROTO_2) {
221 			add_host_key_file(_PATH_HOST_RSA_KEY_FILE);
222 			add_host_key_file(_PATH_HOST_DSA_KEY_FILE);
223 #ifdef OPENSSL_HAS_ECC
224 			add_host_key_file(_PATH_HOST_ECDSA_KEY_FILE);
225 #endif
226 			add_host_key_file(_PATH_HOST_ED25519_KEY_FILE);
227 		}
228 	}
229 #undef add_host_key_file
230 	if (options->num_host_key_files == 0)
231 		fatal("No host key files found");
232 	/* No certificates by default */
233 	if (options->num_ports == 0)
234 		options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
235 	if (options->address_family == -1)
236 		options->address_family = AF_UNSPEC;
237 	if (options->listen_addrs == NULL)
238 		add_listen_addr(options, NULL, 0);
239 	if (options->pid_file == NULL)
240 		options->pid_file = xstrdup(_PATH_SSH_DAEMON_PID_FILE);
241 	if (options->server_key_bits == -1)
242 		options->server_key_bits = 1024;
243 	if (options->login_grace_time == -1)
244 		options->login_grace_time = 120;
245 	if (options->key_regeneration_time == -1)
246 		options->key_regeneration_time = 3600;
247 	if (options->permit_root_login == PERMIT_NOT_SET)
248 		options->permit_root_login = PERMIT_NO;
249 	if (options->ignore_rhosts == -1)
250 		options->ignore_rhosts = 1;
251 	if (options->ignore_user_known_hosts == -1)
252 		options->ignore_user_known_hosts = 0;
253 	if (options->print_motd == -1)
254 		options->print_motd = 1;
255 	if (options->print_lastlog == -1)
256 		options->print_lastlog = 1;
257 	if (options->x11_forwarding == -1)
258 		options->x11_forwarding = 1;
259 	if (options->x11_display_offset == -1)
260 		options->x11_display_offset = 10;
261 	if (options->x11_use_localhost == -1)
262 		options->x11_use_localhost = 1;
263 	if (options->xauth_location == NULL)
264 		options->xauth_location = xstrdup(_PATH_XAUTH);
265 	if (options->permit_tty == -1)
266 		options->permit_tty = 1;
267 	if (options->permit_user_rc == -1)
268 		options->permit_user_rc = 1;
269 	if (options->strict_modes == -1)
270 		options->strict_modes = 1;
271 	if (options->tcp_keep_alive == -1)
272 		options->tcp_keep_alive = 1;
273 	if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
274 		options->log_facility = SYSLOG_FACILITY_AUTH;
275 	if (options->log_level == SYSLOG_LEVEL_NOT_SET)
276 		options->log_level = SYSLOG_LEVEL_INFO;
277 	if (options->rhosts_rsa_authentication == -1)
278 		options->rhosts_rsa_authentication = 0;
279 	if (options->hostbased_authentication == -1)
280 		options->hostbased_authentication = 0;
281 	if (options->hostbased_uses_name_from_packet_only == -1)
282 		options->hostbased_uses_name_from_packet_only = 0;
283 	if (options->rsa_authentication == -1)
284 		options->rsa_authentication = 1;
285 	if (options->pubkey_authentication == -1)
286 		options->pubkey_authentication = 1;
287 	if (options->kerberos_authentication == -1)
288 		options->kerberos_authentication = 0;
289 	if (options->kerberos_or_local_passwd == -1)
290 		options->kerberos_or_local_passwd = 1;
291 	if (options->kerberos_ticket_cleanup == -1)
292 		options->kerberos_ticket_cleanup = 1;
293 	if (options->kerberos_get_afs_token == -1)
294 		options->kerberos_get_afs_token = 0;
295 	if (options->gss_authentication == -1)
296 		options->gss_authentication = 0;
297 	if (options->gss_cleanup_creds == -1)
298 		options->gss_cleanup_creds = 1;
299 	if (options->gss_strict_acceptor == -1)
300 		options->gss_strict_acceptor = 0;
301 	if (options->password_authentication == -1)
302 		options->password_authentication = 0;
303 	if (options->kbd_interactive_authentication == -1)
304 		options->kbd_interactive_authentication = 0;
305 	if (options->challenge_response_authentication == -1)
306 		options->challenge_response_authentication = 1;
307 	if (options->permit_empty_passwd == -1)
308 		options->permit_empty_passwd = 0;
309 	if (options->permit_user_env == -1)
310 		options->permit_user_env = 0;
311 	if (options->use_login == -1)
312 		options->use_login = 0;
313 	if (options->compression == -1)
314 		options->compression = COMP_DELAYED;
315 	if (options->rekey_limit == -1)
316 		options->rekey_limit = 0;
317 	if (options->rekey_interval == -1)
318 		options->rekey_interval = 0;
319 	if (options->allow_tcp_forwarding == -1)
320 		options->allow_tcp_forwarding = FORWARD_ALLOW;
321 	if (options->allow_streamlocal_forwarding == -1)
322 		options->allow_streamlocal_forwarding = FORWARD_ALLOW;
323 	if (options->allow_agent_forwarding == -1)
324 		options->allow_agent_forwarding = 1;
325 	if (options->fwd_opts.gateway_ports == -1)
326 		options->fwd_opts.gateway_ports = 0;
327 	if (options->max_startups == -1)
328 		options->max_startups = 100;
329 	if (options->max_startups_rate == -1)
330 		options->max_startups_rate = 30;		/* 30% */
331 	if (options->max_startups_begin == -1)
332 		options->max_startups_begin = 10;
333 	if (options->max_authtries == -1)
334 		options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
335 	if (options->max_sessions == -1)
336 		options->max_sessions = DEFAULT_SESSIONS_MAX;
337 	if (options->use_dns == -1)
338 		options->use_dns = 1;
339 	if (options->client_alive_interval == -1)
340 		options->client_alive_interval = 0;
341 	if (options->client_alive_count_max == -1)
342 		options->client_alive_count_max = 3;
343 	if (options->num_authkeys_files == 0) {
344 		options->authorized_keys_files[options->num_authkeys_files++] =
345 		    xstrdup(_PATH_SSH_USER_PERMITTED_KEYS);
346 		options->authorized_keys_files[options->num_authkeys_files++] =
347 		    xstrdup(_PATH_SSH_USER_PERMITTED_KEYS2);
348 	}
349 	if (options->permit_tun == -1)
350 		options->permit_tun = SSH_TUNMODE_NO;
351 	if (options->ip_qos_interactive == -1)
352 		options->ip_qos_interactive = IPTOS_LOWDELAY;
353 	if (options->ip_qos_bulk == -1)
354 		options->ip_qos_bulk = IPTOS_THROUGHPUT;
355 	if (options->version_addendum == NULL)
356 		options->version_addendum = xstrdup(SSH_VERSION_FREEBSD);
357 	if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
358 		options->fwd_opts.streamlocal_bind_mask = 0177;
359 	if (options->fwd_opts.streamlocal_bind_unlink == -1)
360 		options->fwd_opts.streamlocal_bind_unlink = 0;
361 	if (options->fingerprint_hash == -1)
362 		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
363 
364 	assemble_algorithms(options);
365 
366 	/* Turn privilege separation and sandboxing on by default */
367 	if (use_privsep == -1)
368 		use_privsep = PRIVSEP_ON;
369 
370 #define CLEAR_ON_NONE(v) \
371 	do { \
372 		if (option_clear_or_none(v)) { \
373 			free(v); \
374 			v = NULL; \
375 		} \
376 	} while(0)
377 	CLEAR_ON_NONE(options->pid_file);
378 	CLEAR_ON_NONE(options->xauth_location);
379 	CLEAR_ON_NONE(options->banner);
380 	CLEAR_ON_NONE(options->trusted_user_ca_keys);
381 	CLEAR_ON_NONE(options->revoked_keys_file);
382 	CLEAR_ON_NONE(options->authorized_principals_file);
383 	CLEAR_ON_NONE(options->adm_forced_command);
384 	CLEAR_ON_NONE(options->chroot_directory);
385 	for (i = 0; i < options->num_host_key_files; i++)
386 		CLEAR_ON_NONE(options->host_key_files[i]);
387 	for (i = 0; i < options->num_host_cert_files; i++)
388 		CLEAR_ON_NONE(options->host_cert_files[i]);
389 #undef CLEAR_ON_NONE
390 
391 #ifndef HAVE_MMAP
392 	if (use_privsep && options->compression == 1) {
393 		error("This platform does not support both privilege "
394 		    "separation and compression");
395 		error("Compression disabled");
396 		options->compression = 0;
397 	}
398 #endif
399 
400 }
401 
402 /* Keyword tokens. */
403 typedef enum {
404 	sBadOption,		/* == unknown option */
405 	/* Portable-specific options */
406 	sUsePAM,
407 	/* Standard Options */
408 	sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime,
409 	sKeyRegenerationTime, sPermitRootLogin, sLogFacility, sLogLevel,
410 	sRhostsRSAAuthentication, sRSAAuthentication,
411 	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
412 	sKerberosGetAFSToken,
413 	sKerberosTgtPassing, sChallengeResponseAuthentication,
414 	sPasswordAuthentication, sKbdInteractiveAuthentication,
415 	sListenAddress, sAddressFamily,
416 	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
417 	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
418 	sPermitTTY, sStrictModes, sEmptyPasswd, sTCPKeepAlive,
419 	sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
420 	sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
421 	sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
422 	sGatewayPorts, sPubkeyAuthentication, sPubkeyAcceptedKeyTypes,
423 	sXAuthLocation, sSubsystem, sMaxStartups, sMaxAuthTries, sMaxSessions,
424 	sBanner, sUseDNS, sHostbasedAuthentication,
425 	sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedKeyTypes,
426 	sHostKeyAlgorithms,
427 	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
428 	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
429 	sAcceptEnv, sPermitTunnel,
430 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
431 	sUsePrivilegeSeparation, sAllowAgentForwarding,
432 	sHostCertificate,
433 	sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
434 	sAuthorizedPrincipalsCommand, sAuthorizedPrincipalsCommandUser,
435 	sKexAlgorithms, sIPQoS, sVersionAddendum,
436 	sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
437 	sAuthenticationMethods, sHostKeyAgent, sPermitUserRC,
438 	sStreamLocalBindMask, sStreamLocalBindUnlink,
439 	sAllowStreamLocalForwarding, sFingerprintHash,
440 	sDeprecated, sUnsupported
441 } ServerOpCodes;
442 
443 #define SSHCFG_GLOBAL	0x01	/* allowed in main section of sshd_config */
444 #define SSHCFG_MATCH	0x02	/* allowed inside a Match section */
445 #define SSHCFG_ALL	(SSHCFG_GLOBAL|SSHCFG_MATCH)
446 
447 /* Textual representation of the tokens. */
448 static struct {
449 	const char *name;
450 	ServerOpCodes opcode;
451 	u_int flags;
452 } keywords[] = {
453 	/* Portable-specific options */
454 #ifdef USE_PAM
455 	{ "usepam", sUsePAM, SSHCFG_GLOBAL },
456 #else
457 	{ "usepam", sUnsupported, SSHCFG_GLOBAL },
458 #endif
459 	{ "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
460 	/* Standard Options */
461 	{ "port", sPort, SSHCFG_GLOBAL },
462 	{ "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
463 	{ "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL },		/* alias */
464 	{ "hostkeyagent", sHostKeyAgent, SSHCFG_GLOBAL },
465 	{ "pidfile", sPidFile, SSHCFG_GLOBAL },
466 	{ "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL },
467 	{ "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
468 	{ "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL },
469 	{ "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
470 	{ "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
471 	{ "loglevel", sLogLevel, SSHCFG_GLOBAL },
472 	{ "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL },
473 	{ "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
474 	{ "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
475 	{ "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_ALL },
476 	{ "hostbasedacceptedkeytypes", sHostbasedAcceptedKeyTypes, SSHCFG_ALL },
477 	{ "hostkeyalgorithms", sHostKeyAlgorithms, SSHCFG_GLOBAL },
478 	{ "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
479 	{ "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
480 	{ "pubkeyacceptedkeytypes", sPubkeyAcceptedKeyTypes, SSHCFG_ALL },
481 	{ "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
482 #ifdef KRB5
483 	{ "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
484 	{ "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
485 	{ "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
486 #ifdef USE_AFS
487 	{ "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL },
488 #else
489 	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
490 #endif
491 #else
492 	{ "kerberosauthentication", sUnsupported, SSHCFG_ALL },
493 	{ "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
494 	{ "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
495 	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
496 #endif
497 	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
498 	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
499 #ifdef GSSAPI
500 	{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
501 	{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
502 	{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
503 #else
504 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
505 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
506 	{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
507 #endif
508 	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
509 	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
510 	{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
511 	{ "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
512 	{ "checkmail", sDeprecated, SSHCFG_GLOBAL },
513 	{ "listenaddress", sListenAddress, SSHCFG_GLOBAL },
514 	{ "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
515 	{ "printmotd", sPrintMotd, SSHCFG_GLOBAL },
516 #ifdef DISABLE_LASTLOG
517 	{ "printlastlog", sUnsupported, SSHCFG_GLOBAL },
518 #else
519 	{ "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
520 #endif
521 	{ "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
522 	{ "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
523 	{ "x11forwarding", sX11Forwarding, SSHCFG_ALL },
524 	{ "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
525 	{ "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
526 	{ "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
527 	{ "strictmodes", sStrictModes, SSHCFG_GLOBAL },
528 	{ "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
529 	{ "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
530 	{ "uselogin", sUseLogin, SSHCFG_GLOBAL },
531 	{ "compression", sCompression, SSHCFG_GLOBAL },
532 	{ "rekeylimit", sRekeyLimit, SSHCFG_ALL },
533 	{ "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL },
534 	{ "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL },	/* obsolete alias */
535 	{ "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
536 	{ "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL },
537 	{ "allowusers", sAllowUsers, SSHCFG_ALL },
538 	{ "denyusers", sDenyUsers, SSHCFG_ALL },
539 	{ "allowgroups", sAllowGroups, SSHCFG_ALL },
540 	{ "denygroups", sDenyGroups, SSHCFG_ALL },
541 	{ "ciphers", sCiphers, SSHCFG_GLOBAL },
542 	{ "macs", sMacs, SSHCFG_GLOBAL },
543 	{ "protocol", sProtocol, SSHCFG_GLOBAL },
544 	{ "gatewayports", sGatewayPorts, SSHCFG_ALL },
545 	{ "subsystem", sSubsystem, SSHCFG_GLOBAL },
546 	{ "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
547 	{ "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
548 	{ "maxsessions", sMaxSessions, SSHCFG_ALL },
549 	{ "banner", sBanner, SSHCFG_ALL },
550 	{ "usedns", sUseDNS, SSHCFG_GLOBAL },
551 	{ "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
552 	{ "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
553 	{ "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL },
554 	{ "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
555 	{ "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_ALL },
556 	{ "authorizedkeysfile2", sDeprecated, SSHCFG_ALL },
557 	{ "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL},
558 	{ "acceptenv", sAcceptEnv, SSHCFG_ALL },
559 	{ "permittunnel", sPermitTunnel, SSHCFG_ALL },
560 	{ "permittty", sPermitTTY, SSHCFG_ALL },
561 	{ "permituserrc", sPermitUserRC, SSHCFG_ALL },
562 	{ "match", sMatch, SSHCFG_ALL },
563 	{ "permitopen", sPermitOpen, SSHCFG_ALL },
564 	{ "forcecommand", sForceCommand, SSHCFG_ALL },
565 	{ "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
566 	{ "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
567 	{ "revokedkeys", sRevokedKeys, SSHCFG_ALL },
568 	{ "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
569 	{ "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
570 	{ "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
571 	{ "ipqos", sIPQoS, SSHCFG_ALL },
572 	{ "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL },
573 	{ "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL },
574 	{ "authorizedprincipalscommand", sAuthorizedPrincipalsCommand, SSHCFG_ALL },
575 	{ "authorizedprincipalscommanduser", sAuthorizedPrincipalsCommandUser, SSHCFG_ALL },
576 	{ "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL },
577 	{ "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL },
578 	{ "streamlocalbindmask", sStreamLocalBindMask, SSHCFG_ALL },
579 	{ "streamlocalbindunlink", sStreamLocalBindUnlink, SSHCFG_ALL },
580 	{ "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL },
581 	{ "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL },
582 	{ "noneenabled", sUnsupported, SSHCFG_ALL },
583 	{ "hpndisabled", sDeprecated, SSHCFG_ALL },
584 	{ "hpnbuffersize", sDeprecated, SSHCFG_ALL },
585 	{ "tcprcvbufpoll", sDeprecated, SSHCFG_ALL },
586 	{ NULL, sBadOption, 0 }
587 };
588 
589 static struct {
590 	int val;
591 	char *text;
592 } tunmode_desc[] = {
593 	{ SSH_TUNMODE_NO, "no" },
594 	{ SSH_TUNMODE_POINTOPOINT, "point-to-point" },
595 	{ SSH_TUNMODE_ETHERNET, "ethernet" },
596 	{ SSH_TUNMODE_YES, "yes" },
597 	{ -1, NULL }
598 };
599 
600 /*
601  * Returns the number of the token pointed to by cp or sBadOption.
602  */
603 
604 static ServerOpCodes
605 parse_token(const char *cp, const char *filename,
606 	    int linenum, u_int *flags)
607 {
608 	u_int i;
609 
610 	for (i = 0; keywords[i].name; i++)
611 		if (strcasecmp(cp, keywords[i].name) == 0) {
612 			*flags = keywords[i].flags;
613 			return keywords[i].opcode;
614 		}
615 
616 	error("%s: line %d: Bad configuration option: %s",
617 	    filename, linenum, cp);
618 	return sBadOption;
619 }
620 
621 char *
622 derelativise_path(const char *path)
623 {
624 	char *expanded, *ret, cwd[PATH_MAX];
625 
626 	if (strcasecmp(path, "none") == 0)
627 		return xstrdup("none");
628 	expanded = tilde_expand_filename(path, getuid());
629 	if (*expanded == '/')
630 		return expanded;
631 	if (getcwd(cwd, sizeof(cwd)) == NULL)
632 		fatal("%s: getcwd: %s", __func__, strerror(errno));
633 	xasprintf(&ret, "%s/%s", cwd, expanded);
634 	free(expanded);
635 	return ret;
636 }
637 
638 static void
639 add_listen_addr(ServerOptions *options, char *addr, int port)
640 {
641 	u_int i;
642 
643 	if (port == 0)
644 		for (i = 0; i < options->num_ports; i++)
645 			add_one_listen_addr(options, addr, options->ports[i]);
646 	else
647 		add_one_listen_addr(options, addr, port);
648 }
649 
650 static void
651 add_one_listen_addr(ServerOptions *options, char *addr, int port)
652 {
653 	struct addrinfo hints, *ai, *aitop;
654 	char strport[NI_MAXSERV];
655 	int gaierr;
656 
657 	memset(&hints, 0, sizeof(hints));
658 	hints.ai_family = options->address_family;
659 	hints.ai_socktype = SOCK_STREAM;
660 	hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
661 	snprintf(strport, sizeof strport, "%d", port);
662 	if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
663 		fatal("bad addr or host: %s (%s)",
664 		    addr ? addr : "<NULL>",
665 		    ssh_gai_strerror(gaierr));
666 	for (ai = aitop; ai->ai_next; ai = ai->ai_next)
667 		;
668 	ai->ai_next = options->listen_addrs;
669 	options->listen_addrs = aitop;
670 }
671 
672 /*
673  * Queue a ListenAddress to be processed once we have all of the Ports
674  * and AddressFamily options.
675  */
676 static void
677 queue_listen_addr(ServerOptions *options, char *addr, int port)
678 {
679 	options->queued_listen_addrs = xreallocarray(
680 	    options->queued_listen_addrs, options->num_queued_listens + 1,
681 	    sizeof(addr));
682 	options->queued_listen_ports = xreallocarray(
683 	    options->queued_listen_ports, options->num_queued_listens + 1,
684 	    sizeof(port));
685 	options->queued_listen_addrs[options->num_queued_listens] =
686 	    xstrdup(addr);
687 	options->queued_listen_ports[options->num_queued_listens] = port;
688 	options->num_queued_listens++;
689 }
690 
691 /*
692  * Process queued (text) ListenAddress entries.
693  */
694 static void
695 process_queued_listen_addrs(ServerOptions *options)
696 {
697 	u_int i;
698 
699 	if (options->num_ports == 0)
700 		options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
701 	if (options->address_family == -1)
702 		options->address_family = AF_UNSPEC;
703 
704 	for (i = 0; i < options->num_queued_listens; i++) {
705 		add_listen_addr(options, options->queued_listen_addrs[i],
706 		    options->queued_listen_ports[i]);
707 		free(options->queued_listen_addrs[i]);
708 		options->queued_listen_addrs[i] = NULL;
709 	}
710 	free(options->queued_listen_addrs);
711 	options->queued_listen_addrs = NULL;
712 	free(options->queued_listen_ports);
713 	options->queued_listen_ports = NULL;
714 	options->num_queued_listens = 0;
715 }
716 
717 struct connection_info *
718 get_connection_info(int populate, int use_dns)
719 {
720 	static struct connection_info ci;
721 
722 	if (!populate)
723 		return &ci;
724 	ci.host = get_canonical_hostname(use_dns);
725 	ci.address = get_remote_ipaddr();
726 	ci.laddress = get_local_ipaddr(packet_get_connection_in());
727 	ci.lport = get_local_port();
728 	return &ci;
729 }
730 
731 /*
732  * The strategy for the Match blocks is that the config file is parsed twice.
733  *
734  * The first time is at startup.  activep is initialized to 1 and the
735  * directives in the global context are processed and acted on.  Hitting a
736  * Match directive unsets activep and the directives inside the block are
737  * checked for syntax only.
738  *
739  * The second time is after a connection has been established but before
740  * authentication.  activep is initialized to 2 and global config directives
741  * are ignored since they have already been processed.  If the criteria in a
742  * Match block is met, activep is set and the subsequent directives
743  * processed and actioned until EOF or another Match block unsets it.  Any
744  * options set are copied into the main server config.
745  *
746  * Potential additions/improvements:
747  *  - Add Match support for pre-kex directives, eg Protocol, Ciphers.
748  *
749  *  - Add a Tag directive (idea from David Leonard) ala pf, eg:
750  *	Match Address 192.168.0.*
751  *		Tag trusted
752  *	Match Group wheel
753  *		Tag trusted
754  *	Match Tag trusted
755  *		AllowTcpForwarding yes
756  *		GatewayPorts clientspecified
757  *		[...]
758  *
759  *  - Add a PermittedChannelRequests directive
760  *	Match Group shell
761  *		PermittedChannelRequests session,forwarded-tcpip
762  */
763 
764 static int
765 match_cfg_line_group(const char *grps, int line, const char *user)
766 {
767 	int result = 0;
768 	struct passwd *pw;
769 
770 	if (user == NULL)
771 		goto out;
772 
773 	if ((pw = getpwnam(user)) == NULL) {
774 		debug("Can't match group at line %d because user %.100s does "
775 		    "not exist", line, user);
776 	} else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
777 		debug("Can't Match group because user %.100s not in any group "
778 		    "at line %d", user, line);
779 	} else if (ga_match_pattern_list(grps) != 1) {
780 		debug("user %.100s does not match group list %.100s at line %d",
781 		    user, grps, line);
782 	} else {
783 		debug("user %.100s matched group list %.100s at line %d", user,
784 		    grps, line);
785 		result = 1;
786 	}
787 out:
788 	ga_free();
789 	return result;
790 }
791 
792 /*
793  * All of the attributes on a single Match line are ANDed together, so we need
794  * to check every attribute and set the result to zero if any attribute does
795  * not match.
796  */
797 static int
798 match_cfg_line(char **condition, int line, struct connection_info *ci)
799 {
800 	int result = 1, attributes = 0, port;
801 	char *arg, *attrib, *cp = *condition;
802 
803 	if (ci == NULL)
804 		debug3("checking syntax for 'Match %s'", cp);
805 	else
806 		debug3("checking match for '%s' user %s host %s addr %s "
807 		    "laddr %s lport %d", cp, ci->user ? ci->user : "(null)",
808 		    ci->host ? ci->host : "(null)",
809 		    ci->address ? ci->address : "(null)",
810 		    ci->laddress ? ci->laddress : "(null)", ci->lport);
811 
812 	while ((attrib = strdelim(&cp)) && *attrib != '\0') {
813 		attributes++;
814 		if (strcasecmp(attrib, "all") == 0) {
815 			if (attributes != 1 ||
816 			    ((arg = strdelim(&cp)) != NULL && *arg != '\0')) {
817 				error("'all' cannot be combined with other "
818 				    "Match attributes");
819 				return -1;
820 			}
821 			*condition = cp;
822 			return 1;
823 		}
824 		if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
825 			error("Missing Match criteria for %s", attrib);
826 			return -1;
827 		}
828 		if (strcasecmp(attrib, "user") == 0) {
829 			if (ci == NULL || ci->user == NULL) {
830 				result = 0;
831 				continue;
832 			}
833 			if (match_pattern_list(ci->user, arg, 0) != 1)
834 				result = 0;
835 			else
836 				debug("user %.100s matched 'User %.100s' at "
837 				    "line %d", ci->user, arg, line);
838 		} else if (strcasecmp(attrib, "group") == 0) {
839 			if (ci == NULL || ci->user == NULL) {
840 				result = 0;
841 				continue;
842 			}
843 			switch (match_cfg_line_group(arg, line, ci->user)) {
844 			case -1:
845 				return -1;
846 			case 0:
847 				result = 0;
848 			}
849 		} else if (strcasecmp(attrib, "host") == 0) {
850 			if (ci == NULL || ci->host == NULL) {
851 				result = 0;
852 				continue;
853 			}
854 			if (match_hostname(ci->host, arg) != 1)
855 				result = 0;
856 			else
857 				debug("connection from %.100s matched 'Host "
858 				    "%.100s' at line %d", ci->host, arg, line);
859 		} else if (strcasecmp(attrib, "address") == 0) {
860 			if (ci == NULL || ci->address == NULL) {
861 				result = 0;
862 				continue;
863 			}
864 			switch (addr_match_list(ci->address, arg)) {
865 			case 1:
866 				debug("connection from %.100s matched 'Address "
867 				    "%.100s' at line %d", ci->address, arg, line);
868 				break;
869 			case 0:
870 			case -1:
871 				result = 0;
872 				break;
873 			case -2:
874 				return -1;
875 			}
876 		} else if (strcasecmp(attrib, "localaddress") == 0){
877 			if (ci == NULL || ci->laddress == NULL) {
878 				result = 0;
879 				continue;
880 			}
881 			switch (addr_match_list(ci->laddress, arg)) {
882 			case 1:
883 				debug("connection from %.100s matched "
884 				    "'LocalAddress %.100s' at line %d",
885 				    ci->laddress, arg, line);
886 				break;
887 			case 0:
888 			case -1:
889 				result = 0;
890 				break;
891 			case -2:
892 				return -1;
893 			}
894 		} else if (strcasecmp(attrib, "localport") == 0) {
895 			if ((port = a2port(arg)) == -1) {
896 				error("Invalid LocalPort '%s' on Match line",
897 				    arg);
898 				return -1;
899 			}
900 			if (ci == NULL || ci->lport == 0) {
901 				result = 0;
902 				continue;
903 			}
904 			/* TODO support port lists */
905 			if (port == ci->lport)
906 				debug("connection from %.100s matched "
907 				    "'LocalPort %d' at line %d",
908 				    ci->laddress, port, line);
909 			else
910 				result = 0;
911 		} else {
912 			error("Unsupported Match attribute %s", attrib);
913 			return -1;
914 		}
915 	}
916 	if (attributes == 0) {
917 		error("One or more attributes required for Match");
918 		return -1;
919 	}
920 	if (ci != NULL)
921 		debug3("match %sfound", result ? "" : "not ");
922 	*condition = cp;
923 	return result;
924 }
925 
926 #define WHITESPACE " \t\r\n"
927 
928 /* Multistate option parsing */
929 struct multistate {
930 	char *key;
931 	int value;
932 };
933 static const struct multistate multistate_addressfamily[] = {
934 	{ "inet",			AF_INET },
935 	{ "inet6",			AF_INET6 },
936 	{ "any",			AF_UNSPEC },
937 	{ NULL, -1 }
938 };
939 static const struct multistate multistate_permitrootlogin[] = {
940 	{ "without-password",		PERMIT_NO_PASSWD },
941 	{ "prohibit-password",		PERMIT_NO_PASSWD },
942 	{ "forced-commands-only",	PERMIT_FORCED_ONLY },
943 	{ "yes",			PERMIT_YES },
944 	{ "no",				PERMIT_NO },
945 	{ NULL, -1 }
946 };
947 static const struct multistate multistate_compression[] = {
948 	{ "delayed",			COMP_DELAYED },
949 	{ "yes",			COMP_ZLIB },
950 	{ "no",				COMP_NONE },
951 	{ NULL, -1 }
952 };
953 static const struct multistate multistate_gatewayports[] = {
954 	{ "clientspecified",		2 },
955 	{ "yes",			1 },
956 	{ "no",				0 },
957 	{ NULL, -1 }
958 };
959 static const struct multistate multistate_privsep[] = {
960 	{ "yes",			PRIVSEP_NOSANDBOX },
961 	{ "sandbox",			PRIVSEP_ON },
962 	{ "nosandbox",			PRIVSEP_NOSANDBOX },
963 	{ "no",				PRIVSEP_OFF },
964 	{ NULL, -1 }
965 };
966 static const struct multistate multistate_tcpfwd[] = {
967 	{ "yes",			FORWARD_ALLOW },
968 	{ "all",			FORWARD_ALLOW },
969 	{ "no",				FORWARD_DENY },
970 	{ "remote",			FORWARD_REMOTE },
971 	{ "local",			FORWARD_LOCAL },
972 	{ NULL, -1 }
973 };
974 
975 int
976 process_server_config_line(ServerOptions *options, char *line,
977     const char *filename, int linenum, int *activep,
978     struct connection_info *connectinfo)
979 {
980 	char *cp, **charptr, *arg, *p;
981 	int cmdline = 0, *intptr, value, value2, n, port;
982 	SyslogFacility *log_facility_ptr;
983 	LogLevel *log_level_ptr;
984 	ServerOpCodes opcode;
985 	u_int i, flags = 0;
986 	size_t len;
987 	long long val64;
988 	const struct multistate *multistate_ptr;
989 
990 	cp = line;
991 	if ((arg = strdelim(&cp)) == NULL)
992 		return 0;
993 	/* Ignore leading whitespace */
994 	if (*arg == '\0')
995 		arg = strdelim(&cp);
996 	if (!arg || !*arg || *arg == '#')
997 		return 0;
998 	intptr = NULL;
999 	charptr = NULL;
1000 	opcode = parse_token(arg, filename, linenum, &flags);
1001 
1002 	if (activep == NULL) { /* We are processing a command line directive */
1003 		cmdline = 1;
1004 		activep = &cmdline;
1005 	}
1006 	if (*activep && opcode != sMatch)
1007 		debug3("%s:%d setting %s %s", filename, linenum, arg, cp);
1008 	if (*activep == 0 && !(flags & SSHCFG_MATCH)) {
1009 		if (connectinfo == NULL) {
1010 			fatal("%s line %d: Directive '%s' is not allowed "
1011 			    "within a Match block", filename, linenum, arg);
1012 		} else { /* this is a directive we have already processed */
1013 			while (arg)
1014 				arg = strdelim(&cp);
1015 			return 0;
1016 		}
1017 	}
1018 
1019 	switch (opcode) {
1020 	/* Portable-specific options */
1021 	case sUsePAM:
1022 		intptr = &options->use_pam;
1023 		goto parse_flag;
1024 
1025 	/* Standard Options */
1026 	case sBadOption:
1027 		return -1;
1028 	case sPort:
1029 		/* ignore ports from configfile if cmdline specifies ports */
1030 		if (options->ports_from_cmdline)
1031 			return 0;
1032 		if (options->num_ports >= MAX_PORTS)
1033 			fatal("%s line %d: too many ports.",
1034 			    filename, linenum);
1035 		arg = strdelim(&cp);
1036 		if (!arg || *arg == '\0')
1037 			fatal("%s line %d: missing port number.",
1038 			    filename, linenum);
1039 		options->ports[options->num_ports++] = a2port(arg);
1040 		if (options->ports[options->num_ports-1] <= 0)
1041 			fatal("%s line %d: Badly formatted port number.",
1042 			    filename, linenum);
1043 		break;
1044 
1045 	case sServerKeyBits:
1046 		intptr = &options->server_key_bits;
1047  parse_int:
1048 		arg = strdelim(&cp);
1049 		if (!arg || *arg == '\0')
1050 			fatal("%s line %d: missing integer value.",
1051 			    filename, linenum);
1052 		value = atoi(arg);
1053 		if (*activep && *intptr == -1)
1054 			*intptr = value;
1055 		break;
1056 
1057 	case sLoginGraceTime:
1058 		intptr = &options->login_grace_time;
1059  parse_time:
1060 		arg = strdelim(&cp);
1061 		if (!arg || *arg == '\0')
1062 			fatal("%s line %d: missing time value.",
1063 			    filename, linenum);
1064 		if ((value = convtime(arg)) == -1)
1065 			fatal("%s line %d: invalid time value.",
1066 			    filename, linenum);
1067 		if (*activep && *intptr == -1)
1068 			*intptr = value;
1069 		break;
1070 
1071 	case sKeyRegenerationTime:
1072 		intptr = &options->key_regeneration_time;
1073 		goto parse_time;
1074 
1075 	case sListenAddress:
1076 		arg = strdelim(&cp);
1077 		if (arg == NULL || *arg == '\0')
1078 			fatal("%s line %d: missing address",
1079 			    filename, linenum);
1080 		/* check for bare IPv6 address: no "[]" and 2 or more ":" */
1081 		if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL
1082 		    && strchr(p+1, ':') != NULL) {
1083 			queue_listen_addr(options, arg, 0);
1084 			break;
1085 		}
1086 		p = hpdelim(&arg);
1087 		if (p == NULL)
1088 			fatal("%s line %d: bad address:port usage",
1089 			    filename, linenum);
1090 		p = cleanhostname(p);
1091 		if (arg == NULL)
1092 			port = 0;
1093 		else if ((port = a2port(arg)) <= 0)
1094 			fatal("%s line %d: bad port number", filename, linenum);
1095 
1096 		queue_listen_addr(options, p, port);
1097 
1098 		break;
1099 
1100 	case sAddressFamily:
1101 		intptr = &options->address_family;
1102 		multistate_ptr = multistate_addressfamily;
1103  parse_multistate:
1104 		arg = strdelim(&cp);
1105 		if (!arg || *arg == '\0')
1106 			fatal("%s line %d: missing argument.",
1107 			    filename, linenum);
1108 		value = -1;
1109 		for (i = 0; multistate_ptr[i].key != NULL; i++) {
1110 			if (strcasecmp(arg, multistate_ptr[i].key) == 0) {
1111 				value = multistate_ptr[i].value;
1112 				break;
1113 			}
1114 		}
1115 		if (value == -1)
1116 			fatal("%s line %d: unsupported option \"%s\".",
1117 			    filename, linenum, arg);
1118 		if (*activep && *intptr == -1)
1119 			*intptr = value;
1120 		break;
1121 
1122 	case sHostKeyFile:
1123 		intptr = &options->num_host_key_files;
1124 		if (*intptr >= MAX_HOSTKEYS)
1125 			fatal("%s line %d: too many host keys specified (max %d).",
1126 			    filename, linenum, MAX_HOSTKEYS);
1127 		charptr = &options->host_key_files[*intptr];
1128  parse_filename:
1129 		arg = strdelim(&cp);
1130 		if (!arg || *arg == '\0')
1131 			fatal("%s line %d: missing file name.",
1132 			    filename, linenum);
1133 		if (*activep && *charptr == NULL) {
1134 			*charptr = derelativise_path(arg);
1135 			/* increase optional counter */
1136 			if (intptr != NULL)
1137 				*intptr = *intptr + 1;
1138 		}
1139 		break;
1140 
1141 	case sHostKeyAgent:
1142 		charptr = &options->host_key_agent;
1143 		arg = strdelim(&cp);
1144 		if (!arg || *arg == '\0')
1145 			fatal("%s line %d: missing socket name.",
1146 			    filename, linenum);
1147 		if (*activep && *charptr == NULL)
1148 			*charptr = !strcmp(arg, SSH_AUTHSOCKET_ENV_NAME) ?
1149 			    xstrdup(arg) : derelativise_path(arg);
1150 		break;
1151 
1152 	case sHostCertificate:
1153 		intptr = &options->num_host_cert_files;
1154 		if (*intptr >= MAX_HOSTKEYS)
1155 			fatal("%s line %d: too many host certificates "
1156 			    "specified (max %d).", filename, linenum,
1157 			    MAX_HOSTCERTS);
1158 		charptr = &options->host_cert_files[*intptr];
1159 		goto parse_filename;
1160 		break;
1161 
1162 	case sPidFile:
1163 		charptr = &options->pid_file;
1164 		goto parse_filename;
1165 
1166 	case sPermitRootLogin:
1167 		intptr = &options->permit_root_login;
1168 		multistate_ptr = multistate_permitrootlogin;
1169 		goto parse_multistate;
1170 
1171 	case sIgnoreRhosts:
1172 		intptr = &options->ignore_rhosts;
1173  parse_flag:
1174 		arg = strdelim(&cp);
1175 		if (!arg || *arg == '\0')
1176 			fatal("%s line %d: missing yes/no argument.",
1177 			    filename, linenum);
1178 		value = 0;	/* silence compiler */
1179 		if (strcmp(arg, "yes") == 0)
1180 			value = 1;
1181 		else if (strcmp(arg, "no") == 0)
1182 			value = 0;
1183 		else
1184 			fatal("%s line %d: Bad yes/no argument: %s",
1185 				filename, linenum, arg);
1186 		if (*activep && *intptr == -1)
1187 			*intptr = value;
1188 		break;
1189 
1190 	case sIgnoreUserKnownHosts:
1191 		intptr = &options->ignore_user_known_hosts;
1192 		goto parse_flag;
1193 
1194 	case sRhostsRSAAuthentication:
1195 		intptr = &options->rhosts_rsa_authentication;
1196 		goto parse_flag;
1197 
1198 	case sHostbasedAuthentication:
1199 		intptr = &options->hostbased_authentication;
1200 		goto parse_flag;
1201 
1202 	case sHostbasedUsesNameFromPacketOnly:
1203 		intptr = &options->hostbased_uses_name_from_packet_only;
1204 		goto parse_flag;
1205 
1206 	case sHostbasedAcceptedKeyTypes:
1207 		charptr = &options->hostbased_key_types;
1208  parse_keytypes:
1209 		arg = strdelim(&cp);
1210 		if (!arg || *arg == '\0')
1211 			fatal("%s line %d: Missing argument.",
1212 			    filename, linenum);
1213 		if (!sshkey_names_valid2(*arg == '+' ? arg + 1 : arg, 1))
1214 			fatal("%s line %d: Bad key types '%s'.",
1215 			    filename, linenum, arg ? arg : "<NONE>");
1216 		if (*activep && *charptr == NULL)
1217 			*charptr = xstrdup(arg);
1218 		break;
1219 
1220 	case sHostKeyAlgorithms:
1221 		charptr = &options->hostkeyalgorithms;
1222 		goto parse_keytypes;
1223 
1224 	case sRSAAuthentication:
1225 		intptr = &options->rsa_authentication;
1226 		goto parse_flag;
1227 
1228 	case sPubkeyAuthentication:
1229 		intptr = &options->pubkey_authentication;
1230 		goto parse_flag;
1231 
1232 	case sPubkeyAcceptedKeyTypes:
1233 		charptr = &options->pubkey_key_types;
1234 		goto parse_keytypes;
1235 
1236 	case sKerberosAuthentication:
1237 		intptr = &options->kerberos_authentication;
1238 		goto parse_flag;
1239 
1240 	case sKerberosOrLocalPasswd:
1241 		intptr = &options->kerberos_or_local_passwd;
1242 		goto parse_flag;
1243 
1244 	case sKerberosTicketCleanup:
1245 		intptr = &options->kerberos_ticket_cleanup;
1246 		goto parse_flag;
1247 
1248 	case sKerberosGetAFSToken:
1249 		intptr = &options->kerberos_get_afs_token;
1250 		goto parse_flag;
1251 
1252 	case sGssAuthentication:
1253 		intptr = &options->gss_authentication;
1254 		goto parse_flag;
1255 
1256 	case sGssCleanupCreds:
1257 		intptr = &options->gss_cleanup_creds;
1258 		goto parse_flag;
1259 
1260 	case sGssStrictAcceptor:
1261 		intptr = &options->gss_strict_acceptor;
1262 		goto parse_flag;
1263 
1264 	case sPasswordAuthentication:
1265 		intptr = &options->password_authentication;
1266 		goto parse_flag;
1267 
1268 	case sKbdInteractiveAuthentication:
1269 		intptr = &options->kbd_interactive_authentication;
1270 		goto parse_flag;
1271 
1272 	case sChallengeResponseAuthentication:
1273 		intptr = &options->challenge_response_authentication;
1274 		goto parse_flag;
1275 
1276 	case sPrintMotd:
1277 		intptr = &options->print_motd;
1278 		goto parse_flag;
1279 
1280 	case sPrintLastLog:
1281 		intptr = &options->print_lastlog;
1282 		goto parse_flag;
1283 
1284 	case sX11Forwarding:
1285 		intptr = &options->x11_forwarding;
1286 		goto parse_flag;
1287 
1288 	case sX11DisplayOffset:
1289 		intptr = &options->x11_display_offset;
1290 		goto parse_int;
1291 
1292 	case sX11UseLocalhost:
1293 		intptr = &options->x11_use_localhost;
1294 		goto parse_flag;
1295 
1296 	case sXAuthLocation:
1297 		charptr = &options->xauth_location;
1298 		goto parse_filename;
1299 
1300 	case sPermitTTY:
1301 		intptr = &options->permit_tty;
1302 		goto parse_flag;
1303 
1304 	case sPermitUserRC:
1305 		intptr = &options->permit_user_rc;
1306 		goto parse_flag;
1307 
1308 	case sStrictModes:
1309 		intptr = &options->strict_modes;
1310 		goto parse_flag;
1311 
1312 	case sTCPKeepAlive:
1313 		intptr = &options->tcp_keep_alive;
1314 		goto parse_flag;
1315 
1316 	case sEmptyPasswd:
1317 		intptr = &options->permit_empty_passwd;
1318 		goto parse_flag;
1319 
1320 	case sPermitUserEnvironment:
1321 		intptr = &options->permit_user_env;
1322 		goto parse_flag;
1323 
1324 	case sUseLogin:
1325 		intptr = &options->use_login;
1326 		goto parse_flag;
1327 
1328 	case sCompression:
1329 		intptr = &options->compression;
1330 		multistate_ptr = multistate_compression;
1331 		goto parse_multistate;
1332 
1333 	case sRekeyLimit:
1334 		arg = strdelim(&cp);
1335 		if (!arg || *arg == '\0')
1336 			fatal("%.200s line %d: Missing argument.", filename,
1337 			    linenum);
1338 		if (strcmp(arg, "default") == 0) {
1339 			val64 = 0;
1340 		} else {
1341 			if (scan_scaled(arg, &val64) == -1)
1342 				fatal("%.200s line %d: Bad number '%s': %s",
1343 				    filename, linenum, arg, strerror(errno));
1344 			if (val64 != 0 && val64 < 16)
1345 				fatal("%.200s line %d: RekeyLimit too small",
1346 				    filename, linenum);
1347 		}
1348 		if (*activep && options->rekey_limit == -1)
1349 			options->rekey_limit = val64;
1350 		if (cp != NULL) { /* optional rekey interval present */
1351 			if (strcmp(cp, "none") == 0) {
1352 				(void)strdelim(&cp);	/* discard */
1353 				break;
1354 			}
1355 			intptr = &options->rekey_interval;
1356 			goto parse_time;
1357 		}
1358 		break;
1359 
1360 	case sGatewayPorts:
1361 		intptr = &options->fwd_opts.gateway_ports;
1362 		multistate_ptr = multistate_gatewayports;
1363 		goto parse_multistate;
1364 
1365 	case sUseDNS:
1366 		intptr = &options->use_dns;
1367 		goto parse_flag;
1368 
1369 	case sLogFacility:
1370 		log_facility_ptr = &options->log_facility;
1371 		arg = strdelim(&cp);
1372 		value = log_facility_number(arg);
1373 		if (value == SYSLOG_FACILITY_NOT_SET)
1374 			fatal("%.200s line %d: unsupported log facility '%s'",
1375 			    filename, linenum, arg ? arg : "<NONE>");
1376 		if (*log_facility_ptr == -1)
1377 			*log_facility_ptr = (SyslogFacility) value;
1378 		break;
1379 
1380 	case sLogLevel:
1381 		log_level_ptr = &options->log_level;
1382 		arg = strdelim(&cp);
1383 		value = log_level_number(arg);
1384 		if (value == SYSLOG_LEVEL_NOT_SET)
1385 			fatal("%.200s line %d: unsupported log level '%s'",
1386 			    filename, linenum, arg ? arg : "<NONE>");
1387 		if (*log_level_ptr == -1)
1388 			*log_level_ptr = (LogLevel) value;
1389 		break;
1390 
1391 	case sAllowTcpForwarding:
1392 		intptr = &options->allow_tcp_forwarding;
1393 		multistate_ptr = multistate_tcpfwd;
1394 		goto parse_multistate;
1395 
1396 	case sAllowStreamLocalForwarding:
1397 		intptr = &options->allow_streamlocal_forwarding;
1398 		multistate_ptr = multistate_tcpfwd;
1399 		goto parse_multistate;
1400 
1401 	case sAllowAgentForwarding:
1402 		intptr = &options->allow_agent_forwarding;
1403 		goto parse_flag;
1404 
1405 	case sUsePrivilegeSeparation:
1406 		intptr = &use_privsep;
1407 		multistate_ptr = multistate_privsep;
1408 		goto parse_multistate;
1409 
1410 	case sAllowUsers:
1411 		while ((arg = strdelim(&cp)) && *arg != '\0') {
1412 			if (options->num_allow_users >= MAX_ALLOW_USERS)
1413 				fatal("%s line %d: too many allow users.",
1414 				    filename, linenum);
1415 			if (!*activep)
1416 				continue;
1417 			options->allow_users[options->num_allow_users++] =
1418 			    xstrdup(arg);
1419 		}
1420 		break;
1421 
1422 	case sDenyUsers:
1423 		while ((arg = strdelim(&cp)) && *arg != '\0') {
1424 			if (options->num_deny_users >= MAX_DENY_USERS)
1425 				fatal("%s line %d: too many deny users.",
1426 				    filename, linenum);
1427 			if (!*activep)
1428 				continue;
1429 			options->deny_users[options->num_deny_users++] =
1430 			    xstrdup(arg);
1431 		}
1432 		break;
1433 
1434 	case sAllowGroups:
1435 		while ((arg = strdelim(&cp)) && *arg != '\0') {
1436 			if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
1437 				fatal("%s line %d: too many allow groups.",
1438 				    filename, linenum);
1439 			if (!*activep)
1440 				continue;
1441 			options->allow_groups[options->num_allow_groups++] =
1442 			    xstrdup(arg);
1443 		}
1444 		break;
1445 
1446 	case sDenyGroups:
1447 		while ((arg = strdelim(&cp)) && *arg != '\0') {
1448 			if (options->num_deny_groups >= MAX_DENY_GROUPS)
1449 				fatal("%s line %d: too many deny groups.",
1450 				    filename, linenum);
1451 			if (!*activep)
1452 				continue;
1453 			options->deny_groups[options->num_deny_groups++] =
1454 			    xstrdup(arg);
1455 		}
1456 		break;
1457 
1458 	case sCiphers:
1459 		arg = strdelim(&cp);
1460 		if (!arg || *arg == '\0')
1461 			fatal("%s line %d: Missing argument.", filename, linenum);
1462 		if (!ciphers_valid(*arg == '+' ? arg + 1 : arg))
1463 			fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1464 			    filename, linenum, arg ? arg : "<NONE>");
1465 		if (options->ciphers == NULL)
1466 			options->ciphers = xstrdup(arg);
1467 		break;
1468 
1469 	case sMacs:
1470 		arg = strdelim(&cp);
1471 		if (!arg || *arg == '\0')
1472 			fatal("%s line %d: Missing argument.", filename, linenum);
1473 		if (!mac_valid(*arg == '+' ? arg + 1 : arg))
1474 			fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1475 			    filename, linenum, arg ? arg : "<NONE>");
1476 		if (options->macs == NULL)
1477 			options->macs = xstrdup(arg);
1478 		break;
1479 
1480 	case sKexAlgorithms:
1481 		arg = strdelim(&cp);
1482 		if (!arg || *arg == '\0')
1483 			fatal("%s line %d: Missing argument.",
1484 			    filename, linenum);
1485 		if (!kex_names_valid(*arg == '+' ? arg + 1 : arg))
1486 			fatal("%s line %d: Bad SSH2 KexAlgorithms '%s'.",
1487 			    filename, linenum, arg ? arg : "<NONE>");
1488 		if (options->kex_algorithms == NULL)
1489 			options->kex_algorithms = xstrdup(arg);
1490 		break;
1491 
1492 	case sProtocol:
1493 		intptr = &options->protocol;
1494 		arg = strdelim(&cp);
1495 		if (!arg || *arg == '\0')
1496 			fatal("%s line %d: Missing argument.", filename, linenum);
1497 		value = proto_spec(arg);
1498 		if (value == SSH_PROTO_UNKNOWN)
1499 			fatal("%s line %d: Bad protocol spec '%s'.",
1500 			    filename, linenum, arg ? arg : "<NONE>");
1501 		if (*intptr == SSH_PROTO_UNKNOWN)
1502 			*intptr = value;
1503 		break;
1504 
1505 	case sSubsystem:
1506 		if (options->num_subsystems >= MAX_SUBSYSTEMS) {
1507 			fatal("%s line %d: too many subsystems defined.",
1508 			    filename, linenum);
1509 		}
1510 		arg = strdelim(&cp);
1511 		if (!arg || *arg == '\0')
1512 			fatal("%s line %d: Missing subsystem name.",
1513 			    filename, linenum);
1514 		if (!*activep) {
1515 			arg = strdelim(&cp);
1516 			break;
1517 		}
1518 		for (i = 0; i < options->num_subsystems; i++)
1519 			if (strcmp(arg, options->subsystem_name[i]) == 0)
1520 				fatal("%s line %d: Subsystem '%s' already defined.",
1521 				    filename, linenum, arg);
1522 		options->subsystem_name[options->num_subsystems] = xstrdup(arg);
1523 		arg = strdelim(&cp);
1524 		if (!arg || *arg == '\0')
1525 			fatal("%s line %d: Missing subsystem command.",
1526 			    filename, linenum);
1527 		options->subsystem_command[options->num_subsystems] = xstrdup(arg);
1528 
1529 		/* Collect arguments (separate to executable) */
1530 		p = xstrdup(arg);
1531 		len = strlen(p) + 1;
1532 		while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
1533 			len += 1 + strlen(arg);
1534 			p = xreallocarray(p, 1, len);
1535 			strlcat(p, " ", len);
1536 			strlcat(p, arg, len);
1537 		}
1538 		options->subsystem_args[options->num_subsystems] = p;
1539 		options->num_subsystems++;
1540 		break;
1541 
1542 	case sMaxStartups:
1543 		arg = strdelim(&cp);
1544 		if (!arg || *arg == '\0')
1545 			fatal("%s line %d: Missing MaxStartups spec.",
1546 			    filename, linenum);
1547 		if ((n = sscanf(arg, "%d:%d:%d",
1548 		    &options->max_startups_begin,
1549 		    &options->max_startups_rate,
1550 		    &options->max_startups)) == 3) {
1551 			if (options->max_startups_begin >
1552 			    options->max_startups ||
1553 			    options->max_startups_rate > 100 ||
1554 			    options->max_startups_rate < 1)
1555 				fatal("%s line %d: Illegal MaxStartups spec.",
1556 				    filename, linenum);
1557 		} else if (n != 1)
1558 			fatal("%s line %d: Illegal MaxStartups spec.",
1559 			    filename, linenum);
1560 		else
1561 			options->max_startups = options->max_startups_begin;
1562 		break;
1563 
1564 	case sMaxAuthTries:
1565 		intptr = &options->max_authtries;
1566 		goto parse_int;
1567 
1568 	case sMaxSessions:
1569 		intptr = &options->max_sessions;
1570 		goto parse_int;
1571 
1572 	case sBanner:
1573 		charptr = &options->banner;
1574 		goto parse_filename;
1575 
1576 	/*
1577 	 * These options can contain %X options expanded at
1578 	 * connect time, so that you can specify paths like:
1579 	 *
1580 	 * AuthorizedKeysFile	/etc/ssh_keys/%u
1581 	 */
1582 	case sAuthorizedKeysFile:
1583 		if (*activep && options->num_authkeys_files == 0) {
1584 			while ((arg = strdelim(&cp)) && *arg != '\0') {
1585 				if (options->num_authkeys_files >=
1586 				    MAX_AUTHKEYS_FILES)
1587 					fatal("%s line %d: "
1588 					    "too many authorized keys files.",
1589 					    filename, linenum);
1590 				options->authorized_keys_files[
1591 				    options->num_authkeys_files++] =
1592 				    tilde_expand_filename(arg, getuid());
1593 			}
1594 		}
1595 		return 0;
1596 
1597 	case sAuthorizedPrincipalsFile:
1598 		charptr = &options->authorized_principals_file;
1599 		arg = strdelim(&cp);
1600 		if (!arg || *arg == '\0')
1601 			fatal("%s line %d: missing file name.",
1602 			    filename, linenum);
1603 		if (*activep && *charptr == NULL) {
1604 			*charptr = tilde_expand_filename(arg, getuid());
1605 			/* increase optional counter */
1606 			if (intptr != NULL)
1607 				*intptr = *intptr + 1;
1608 		}
1609 		break;
1610 
1611 	case sClientAliveInterval:
1612 		intptr = &options->client_alive_interval;
1613 		goto parse_time;
1614 
1615 	case sClientAliveCountMax:
1616 		intptr = &options->client_alive_count_max;
1617 		goto parse_int;
1618 
1619 	case sAcceptEnv:
1620 		while ((arg = strdelim(&cp)) && *arg != '\0') {
1621 			if (strchr(arg, '=') != NULL)
1622 				fatal("%s line %d: Invalid environment name.",
1623 				    filename, linenum);
1624 			if (options->num_accept_env >= MAX_ACCEPT_ENV)
1625 				fatal("%s line %d: too many allow env.",
1626 				    filename, linenum);
1627 			if (!*activep)
1628 				continue;
1629 			options->accept_env[options->num_accept_env++] =
1630 			    xstrdup(arg);
1631 		}
1632 		break;
1633 
1634 	case sPermitTunnel:
1635 		intptr = &options->permit_tun;
1636 		arg = strdelim(&cp);
1637 		if (!arg || *arg == '\0')
1638 			fatal("%s line %d: Missing yes/point-to-point/"
1639 			    "ethernet/no argument.", filename, linenum);
1640 		value = -1;
1641 		for (i = 0; tunmode_desc[i].val != -1; i++)
1642 			if (strcmp(tunmode_desc[i].text, arg) == 0) {
1643 				value = tunmode_desc[i].val;
1644 				break;
1645 			}
1646 		if (value == -1)
1647 			fatal("%s line %d: Bad yes/point-to-point/ethernet/"
1648 			    "no argument: %s", filename, linenum, arg);
1649 		if (*activep && *intptr == -1)
1650 			*intptr = value;
1651 		break;
1652 
1653 	case sMatch:
1654 		if (cmdline)
1655 			fatal("Match directive not supported as a command-line "
1656 			   "option");
1657 		value = match_cfg_line(&cp, linenum, connectinfo);
1658 		if (value < 0)
1659 			fatal("%s line %d: Bad Match condition", filename,
1660 			    linenum);
1661 		*activep = value;
1662 		break;
1663 
1664 	case sPermitOpen:
1665 		arg = strdelim(&cp);
1666 		if (!arg || *arg == '\0')
1667 			fatal("%s line %d: missing PermitOpen specification",
1668 			    filename, linenum);
1669 		n = options->num_permitted_opens;	/* modified later */
1670 		if (strcmp(arg, "any") == 0) {
1671 			if (*activep && n == -1) {
1672 				channel_clear_adm_permitted_opens();
1673 				options->num_permitted_opens = 0;
1674 			}
1675 			break;
1676 		}
1677 		if (strcmp(arg, "none") == 0) {
1678 			if (*activep && n == -1) {
1679 				options->num_permitted_opens = 1;
1680 				channel_disable_adm_local_opens();
1681 			}
1682 			break;
1683 		}
1684 		if (*activep && n == -1)
1685 			channel_clear_adm_permitted_opens();
1686 		for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) {
1687 			p = hpdelim(&arg);
1688 			if (p == NULL)
1689 				fatal("%s line %d: missing host in PermitOpen",
1690 				    filename, linenum);
1691 			p = cleanhostname(p);
1692 			if (arg == NULL || ((port = permitopen_port(arg)) < 0))
1693 				fatal("%s line %d: bad port number in "
1694 				    "PermitOpen", filename, linenum);
1695 			if (*activep && n == -1)
1696 				options->num_permitted_opens =
1697 				    channel_add_adm_permitted_opens(p, port);
1698 		}
1699 		break;
1700 
1701 	case sForceCommand:
1702 		if (cp == NULL || *cp == '\0')
1703 			fatal("%.200s line %d: Missing argument.", filename,
1704 			    linenum);
1705 		len = strspn(cp, WHITESPACE);
1706 		if (*activep && options->adm_forced_command == NULL)
1707 			options->adm_forced_command = xstrdup(cp + len);
1708 		return 0;
1709 
1710 	case sChrootDirectory:
1711 		charptr = &options->chroot_directory;
1712 
1713 		arg = strdelim(&cp);
1714 		if (!arg || *arg == '\0')
1715 			fatal("%s line %d: missing file name.",
1716 			    filename, linenum);
1717 		if (*activep && *charptr == NULL)
1718 			*charptr = xstrdup(arg);
1719 		break;
1720 
1721 	case sTrustedUserCAKeys:
1722 		charptr = &options->trusted_user_ca_keys;
1723 		goto parse_filename;
1724 
1725 	case sRevokedKeys:
1726 		charptr = &options->revoked_keys_file;
1727 		goto parse_filename;
1728 
1729 	case sIPQoS:
1730 		arg = strdelim(&cp);
1731 		if ((value = parse_ipqos(arg)) == -1)
1732 			fatal("%s line %d: Bad IPQoS value: %s",
1733 			    filename, linenum, arg);
1734 		arg = strdelim(&cp);
1735 		if (arg == NULL)
1736 			value2 = value;
1737 		else if ((value2 = parse_ipqos(arg)) == -1)
1738 			fatal("%s line %d: Bad IPQoS value: %s",
1739 			    filename, linenum, arg);
1740 		if (*activep) {
1741 			options->ip_qos_interactive = value;
1742 			options->ip_qos_bulk = value2;
1743 		}
1744 		break;
1745 
1746 	case sVersionAddendum:
1747 		if (cp == NULL || *cp == '\0')
1748 			fatal("%.200s line %d: Missing argument.", filename,
1749 			    linenum);
1750 		len = strspn(cp, WHITESPACE);
1751 		if (*activep && options->version_addendum == NULL) {
1752 			if (strcasecmp(cp + len, "none") == 0)
1753 				options->version_addendum = xstrdup("");
1754 			else if (strchr(cp + len, '\r') != NULL)
1755 				fatal("%.200s line %d: Invalid argument",
1756 				    filename, linenum);
1757 			else
1758 				options->version_addendum = xstrdup(cp + len);
1759 		}
1760 		return 0;
1761 
1762 	case sAuthorizedKeysCommand:
1763 		if (cp == NULL)
1764 			fatal("%.200s line %d: Missing argument.", filename,
1765 			    linenum);
1766 		len = strspn(cp, WHITESPACE);
1767 		if (*activep && options->authorized_keys_command == NULL) {
1768 			if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0)
1769 				fatal("%.200s line %d: AuthorizedKeysCommand "
1770 				    "must be an absolute path",
1771 				    filename, linenum);
1772 			options->authorized_keys_command = xstrdup(cp + len);
1773 		}
1774 		return 0;
1775 
1776 	case sAuthorizedKeysCommandUser:
1777 		charptr = &options->authorized_keys_command_user;
1778 
1779 		arg = strdelim(&cp);
1780 		if (!arg || *arg == '\0')
1781 			fatal("%s line %d: missing AuthorizedKeysCommandUser "
1782 			    "argument.", filename, linenum);
1783 		if (*activep && *charptr == NULL)
1784 			*charptr = xstrdup(arg);
1785 		break;
1786 
1787 	case sAuthorizedPrincipalsCommand:
1788 		if (cp == NULL)
1789 			fatal("%.200s line %d: Missing argument.", filename,
1790 			    linenum);
1791 		len = strspn(cp, WHITESPACE);
1792 		if (*activep &&
1793 		    options->authorized_principals_command == NULL) {
1794 			if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0)
1795 				fatal("%.200s line %d: "
1796 				    "AuthorizedPrincipalsCommand must be "
1797 				    "an absolute path", filename, linenum);
1798 			options->authorized_principals_command =
1799 			    xstrdup(cp + len);
1800 		}
1801 		return 0;
1802 
1803 	case sAuthorizedPrincipalsCommandUser:
1804 		charptr = &options->authorized_principals_command_user;
1805 
1806 		arg = strdelim(&cp);
1807 		if (!arg || *arg == '\0')
1808 			fatal("%s line %d: missing "
1809 			    "AuthorizedPrincipalsCommandUser argument.",
1810 			    filename, linenum);
1811 		if (*activep && *charptr == NULL)
1812 			*charptr = xstrdup(arg);
1813 		break;
1814 
1815 	case sAuthenticationMethods:
1816 		if (options->num_auth_methods == 0) {
1817 			while ((arg = strdelim(&cp)) && *arg != '\0') {
1818 				if (options->num_auth_methods >=
1819 				    MAX_AUTH_METHODS)
1820 					fatal("%s line %d: "
1821 					    "too many authentication methods.",
1822 					    filename, linenum);
1823 				if (auth2_methods_valid(arg, 0) != 0)
1824 					fatal("%s line %d: invalid "
1825 					    "authentication method list.",
1826 					    filename, linenum);
1827 				if (!*activep)
1828 					continue;
1829 				options->auth_methods[
1830 				    options->num_auth_methods++] = xstrdup(arg);
1831 			}
1832 		}
1833 		return 0;
1834 
1835 	case sStreamLocalBindMask:
1836 		arg = strdelim(&cp);
1837 		if (!arg || *arg == '\0')
1838 			fatal("%s line %d: missing StreamLocalBindMask "
1839 			    "argument.", filename, linenum);
1840 		/* Parse mode in octal format */
1841 		value = strtol(arg, &p, 8);
1842 		if (arg == p || value < 0 || value > 0777)
1843 			fatal("%s line %d: Bad mask.", filename, linenum);
1844 		if (*activep)
1845 			options->fwd_opts.streamlocal_bind_mask = (mode_t)value;
1846 		break;
1847 
1848 	case sStreamLocalBindUnlink:
1849 		intptr = &options->fwd_opts.streamlocal_bind_unlink;
1850 		goto parse_flag;
1851 
1852 	case sFingerprintHash:
1853 		arg = strdelim(&cp);
1854 		if (!arg || *arg == '\0')
1855 			fatal("%.200s line %d: Missing argument.",
1856 			    filename, linenum);
1857 		if ((value = ssh_digest_alg_by_name(arg)) == -1)
1858 			fatal("%.200s line %d: Invalid hash algorithm \"%s\".",
1859 			    filename, linenum, arg);
1860 		if (*activep)
1861 			options->fingerprint_hash = value;
1862 		break;
1863 
1864 	case sDeprecated:
1865 		logit("%s line %d: Deprecated option %s",
1866 		    filename, linenum, arg);
1867 		while (arg)
1868 		    arg = strdelim(&cp);
1869 		break;
1870 
1871 	case sUnsupported:
1872 		logit("%s line %d: Unsupported option %s",
1873 		    filename, linenum, arg);
1874 		while (arg)
1875 		    arg = strdelim(&cp);
1876 		break;
1877 
1878 	default:
1879 		fatal("%s line %d: Missing handler for opcode %s (%d)",
1880 		    filename, linenum, arg, opcode);
1881 	}
1882 	if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
1883 		fatal("%s line %d: garbage at end of line; \"%.200s\".",
1884 		    filename, linenum, arg);
1885 	return 0;
1886 }
1887 
1888 /* Reads the server configuration file. */
1889 
1890 void
1891 load_server_config(const char *filename, Buffer *conf)
1892 {
1893 	char line[4096], *cp;
1894 	FILE *f;
1895 	int lineno = 0;
1896 
1897 	debug2("%s: filename %s", __func__, filename);
1898 	if ((f = fopen(filename, "r")) == NULL) {
1899 		perror(filename);
1900 		exit(1);
1901 	}
1902 	buffer_clear(conf);
1903 	while (fgets(line, sizeof(line), f)) {
1904 		lineno++;
1905 		if (strlen(line) == sizeof(line) - 1)
1906 			fatal("%s line %d too long", filename, lineno);
1907 		/*
1908 		 * Trim out comments and strip whitespace
1909 		 * NB - preserve newlines, they are needed to reproduce
1910 		 * line numbers later for error messages
1911 		 */
1912 		if ((cp = strchr(line, '#')) != NULL)
1913 			memcpy(cp, "\n", 2);
1914 		cp = line + strspn(line, " \t\r");
1915 
1916 		buffer_append(conf, cp, strlen(cp));
1917 	}
1918 	buffer_append(conf, "\0", 1);
1919 	fclose(f);
1920 	debug2("%s: done config len = %d", __func__, buffer_len(conf));
1921 }
1922 
1923 void
1924 parse_server_match_config(ServerOptions *options,
1925    struct connection_info *connectinfo)
1926 {
1927 	ServerOptions mo;
1928 
1929 	initialize_server_options(&mo);
1930 	parse_server_config(&mo, "reprocess config", &cfg, connectinfo);
1931 	copy_set_server_options(options, &mo, 0);
1932 }
1933 
1934 int parse_server_match_testspec(struct connection_info *ci, char *spec)
1935 {
1936 	char *p;
1937 
1938 	while ((p = strsep(&spec, ",")) && *p != '\0') {
1939 		if (strncmp(p, "addr=", 5) == 0) {
1940 			ci->address = xstrdup(p + 5);
1941 		} else if (strncmp(p, "host=", 5) == 0) {
1942 			ci->host = xstrdup(p + 5);
1943 		} else if (strncmp(p, "user=", 5) == 0) {
1944 			ci->user = xstrdup(p + 5);
1945 		} else if (strncmp(p, "laddr=", 6) == 0) {
1946 			ci->laddress = xstrdup(p + 6);
1947 		} else if (strncmp(p, "lport=", 6) == 0) {
1948 			ci->lport = a2port(p + 6);
1949 			if (ci->lport == -1) {
1950 				fprintf(stderr, "Invalid port '%s' in test mode"
1951 				   " specification %s\n", p+6, p);
1952 				return -1;
1953 			}
1954 		} else {
1955 			fprintf(stderr, "Invalid test mode specification %s\n",
1956 			   p);
1957 			return -1;
1958 		}
1959 	}
1960 	return 0;
1961 }
1962 
1963 /*
1964  * returns 1 for a complete spec, 0 for partial spec and -1 for an
1965  * empty spec.
1966  */
1967 int server_match_spec_complete(struct connection_info *ci)
1968 {
1969 	if (ci->user && ci->host && ci->address)
1970 		return 1;	/* complete */
1971 	if (!ci->user && !ci->host && !ci->address)
1972 		return -1;	/* empty */
1973 	return 0;	/* partial */
1974 }
1975 
1976 /*
1977  * Copy any supported values that are set.
1978  *
1979  * If the preauth flag is set, we do not bother copying the string or
1980  * array values that are not used pre-authentication, because any that we
1981  * do use must be explictly sent in mm_getpwnamallow().
1982  */
1983 void
1984 copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
1985 {
1986 #define M_CP_INTOPT(n) do {\
1987 	if (src->n != -1) \
1988 		dst->n = src->n; \
1989 } while (0)
1990 
1991 	M_CP_INTOPT(password_authentication);
1992 	M_CP_INTOPT(gss_authentication);
1993 	M_CP_INTOPT(rsa_authentication);
1994 	M_CP_INTOPT(pubkey_authentication);
1995 	M_CP_INTOPT(kerberos_authentication);
1996 	M_CP_INTOPT(hostbased_authentication);
1997 	M_CP_INTOPT(hostbased_uses_name_from_packet_only);
1998 	M_CP_INTOPT(kbd_interactive_authentication);
1999 	M_CP_INTOPT(permit_root_login);
2000 	M_CP_INTOPT(permit_empty_passwd);
2001 
2002 	M_CP_INTOPT(allow_tcp_forwarding);
2003 	M_CP_INTOPT(allow_streamlocal_forwarding);
2004 	M_CP_INTOPT(allow_agent_forwarding);
2005 	M_CP_INTOPT(permit_tun);
2006 	M_CP_INTOPT(fwd_opts.gateway_ports);
2007 	M_CP_INTOPT(x11_display_offset);
2008 	M_CP_INTOPT(x11_forwarding);
2009 	M_CP_INTOPT(x11_use_localhost);
2010 	M_CP_INTOPT(permit_tty);
2011 	M_CP_INTOPT(permit_user_rc);
2012 	M_CP_INTOPT(max_sessions);
2013 	M_CP_INTOPT(max_authtries);
2014 	M_CP_INTOPT(ip_qos_interactive);
2015 	M_CP_INTOPT(ip_qos_bulk);
2016 	M_CP_INTOPT(rekey_limit);
2017 	M_CP_INTOPT(rekey_interval);
2018 
2019 	/* M_CP_STROPT and M_CP_STRARRAYOPT should not appear before here */
2020 #define M_CP_STROPT(n) do {\
2021 	if (src->n != NULL && dst->n != src->n) { \
2022 		free(dst->n); \
2023 		dst->n = src->n; \
2024 	} \
2025 } while(0)
2026 #define M_CP_STRARRAYOPT(n, num_n) do {\
2027 	if (src->num_n != 0) { \
2028 		for (dst->num_n = 0; dst->num_n < src->num_n; dst->num_n++) \
2029 			dst->n[dst->num_n] = xstrdup(src->n[dst->num_n]); \
2030 	} \
2031 } while(0)
2032 
2033 	/* See comment in servconf.h */
2034 	COPY_MATCH_STRING_OPTS();
2035 
2036 	/* Arguments that accept '+...' need to be expanded */
2037 	assemble_algorithms(dst);
2038 
2039 	/*
2040 	 * The only things that should be below this point are string options
2041 	 * which are only used after authentication.
2042 	 */
2043 	if (preauth)
2044 		return;
2045 
2046 	/* These options may be "none" to clear a global setting */
2047 	M_CP_STROPT(adm_forced_command);
2048 	if (option_clear_or_none(dst->adm_forced_command)) {
2049 		free(dst->adm_forced_command);
2050 		dst->adm_forced_command = NULL;
2051 	}
2052 	M_CP_STROPT(chroot_directory);
2053 	if (option_clear_or_none(dst->chroot_directory)) {
2054 		free(dst->chroot_directory);
2055 		dst->chroot_directory = NULL;
2056 	}
2057 }
2058 
2059 #undef M_CP_INTOPT
2060 #undef M_CP_STROPT
2061 #undef M_CP_STRARRAYOPT
2062 
2063 void
2064 parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
2065     struct connection_info *connectinfo)
2066 {
2067 	int active, linenum, bad_options = 0;
2068 	char *cp, *obuf, *cbuf;
2069 
2070 	debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
2071 
2072 	obuf = cbuf = xstrdup(buffer_ptr(conf));
2073 	active = connectinfo ? 0 : 1;
2074 	linenum = 1;
2075 	while ((cp = strsep(&cbuf, "\n")) != NULL) {
2076 		if (process_server_config_line(options, cp, filename,
2077 		    linenum++, &active, connectinfo) != 0)
2078 			bad_options++;
2079 	}
2080 	free(obuf);
2081 	if (bad_options > 0)
2082 		fatal("%s: terminating, %d bad configuration options",
2083 		    filename, bad_options);
2084 	process_queued_listen_addrs(options);
2085 }
2086 
2087 static const char *
2088 fmt_multistate_int(int val, const struct multistate *m)
2089 {
2090 	u_int i;
2091 
2092 	for (i = 0; m[i].key != NULL; i++) {
2093 		if (m[i].value == val)
2094 			return m[i].key;
2095 	}
2096 	return "UNKNOWN";
2097 }
2098 
2099 static const char *
2100 fmt_intarg(ServerOpCodes code, int val)
2101 {
2102 	if (val == -1)
2103 		return "unset";
2104 	switch (code) {
2105 	case sAddressFamily:
2106 		return fmt_multistate_int(val, multistate_addressfamily);
2107 	case sPermitRootLogin:
2108 		return fmt_multistate_int(val, multistate_permitrootlogin);
2109 	case sGatewayPorts:
2110 		return fmt_multistate_int(val, multistate_gatewayports);
2111 	case sCompression:
2112 		return fmt_multistate_int(val, multistate_compression);
2113 	case sUsePrivilegeSeparation:
2114 		return fmt_multistate_int(val, multistate_privsep);
2115 	case sAllowTcpForwarding:
2116 		return fmt_multistate_int(val, multistate_tcpfwd);
2117 	case sAllowStreamLocalForwarding:
2118 		return fmt_multistate_int(val, multistate_tcpfwd);
2119 	case sFingerprintHash:
2120 		return ssh_digest_alg_name(val);
2121 	case sProtocol:
2122 		switch (val) {
2123 		case SSH_PROTO_1:
2124 			return "1";
2125 		case SSH_PROTO_2:
2126 			return "2";
2127 		case (SSH_PROTO_1|SSH_PROTO_2):
2128 			return "2,1";
2129 		default:
2130 			return "UNKNOWN";
2131 		}
2132 	default:
2133 		switch (val) {
2134 		case 0:
2135 			return "no";
2136 		case 1:
2137 			return "yes";
2138 		default:
2139 			return "UNKNOWN";
2140 		}
2141 	}
2142 }
2143 
2144 static const char *
2145 lookup_opcode_name(ServerOpCodes code)
2146 {
2147 	u_int i;
2148 
2149 	for (i = 0; keywords[i].name != NULL; i++)
2150 		if (keywords[i].opcode == code)
2151 			return(keywords[i].name);
2152 	return "UNKNOWN";
2153 }
2154 
2155 static void
2156 dump_cfg_int(ServerOpCodes code, int val)
2157 {
2158 	printf("%s %d\n", lookup_opcode_name(code), val);
2159 }
2160 
2161 static void
2162 dump_cfg_oct(ServerOpCodes code, int val)
2163 {
2164 	printf("%s 0%o\n", lookup_opcode_name(code), val);
2165 }
2166 
2167 static void
2168 dump_cfg_fmtint(ServerOpCodes code, int val)
2169 {
2170 	printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
2171 }
2172 
2173 static void
2174 dump_cfg_string(ServerOpCodes code, const char *val)
2175 {
2176 	if (val == NULL)
2177 		return;
2178 	printf("%s %s\n", lookup_opcode_name(code),
2179 	    val == NULL ? "none" : val);
2180 }
2181 
2182 static void
2183 dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals)
2184 {
2185 	u_int i;
2186 
2187 	for (i = 0; i < count; i++)
2188 		printf("%s %s\n", lookup_opcode_name(code), vals[i]);
2189 }
2190 
2191 static void
2192 dump_cfg_strarray_oneline(ServerOpCodes code, u_int count, char **vals)
2193 {
2194 	u_int i;
2195 
2196 	if (count <= 0)
2197 		return;
2198 	printf("%s", lookup_opcode_name(code));
2199 	for (i = 0; i < count; i++)
2200 		printf(" %s",  vals[i]);
2201 	printf("\n");
2202 }
2203 
2204 void
2205 dump_config(ServerOptions *o)
2206 {
2207 	u_int i;
2208 	int ret;
2209 	struct addrinfo *ai;
2210 	char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL;
2211 	char *laddr1 = xstrdup(""), *laddr2 = NULL;
2212 
2213 	/* these are usually at the top of the config */
2214 	for (i = 0; i < o->num_ports; i++)
2215 		printf("port %d\n", o->ports[i]);
2216 	dump_cfg_fmtint(sProtocol, o->protocol);
2217 	dump_cfg_fmtint(sAddressFamily, o->address_family);
2218 
2219 	/*
2220 	 * ListenAddress must be after Port.  add_one_listen_addr pushes
2221 	 * addresses onto a stack, so to maintain ordering we need to
2222 	 * print these in reverse order.
2223 	 */
2224 	for (ai = o->listen_addrs; ai; ai = ai->ai_next) {
2225 		if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr,
2226 		    sizeof(addr), port, sizeof(port),
2227 		    NI_NUMERICHOST|NI_NUMERICSERV)) != 0) {
2228 			error("getnameinfo failed: %.100s",
2229 			    (ret != EAI_SYSTEM) ? gai_strerror(ret) :
2230 			    strerror(errno));
2231 		} else {
2232 			laddr2 = laddr1;
2233 			if (ai->ai_family == AF_INET6)
2234 				xasprintf(&laddr1, "listenaddress [%s]:%s\n%s",
2235 				    addr, port, laddr2);
2236 			else
2237 				xasprintf(&laddr1, "listenaddress %s:%s\n%s",
2238 				    addr, port, laddr2);
2239 			free(laddr2);
2240 		}
2241 	}
2242 	printf("%s", laddr1);
2243 	free(laddr1);
2244 
2245 	/* integer arguments */
2246 #ifdef USE_PAM
2247 	dump_cfg_fmtint(sUsePAM, o->use_pam);
2248 #endif
2249 	dump_cfg_int(sServerKeyBits, o->server_key_bits);
2250 	dump_cfg_int(sLoginGraceTime, o->login_grace_time);
2251 	dump_cfg_int(sKeyRegenerationTime, o->key_regeneration_time);
2252 	dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
2253 	dump_cfg_int(sMaxAuthTries, o->max_authtries);
2254 	dump_cfg_int(sMaxSessions, o->max_sessions);
2255 	dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
2256 	dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max);
2257 	dump_cfg_oct(sStreamLocalBindMask, o->fwd_opts.streamlocal_bind_mask);
2258 
2259 	/* formatted integer arguments */
2260 	dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login);
2261 	dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts);
2262 	dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts);
2263 	dump_cfg_fmtint(sRhostsRSAAuthentication, o->rhosts_rsa_authentication);
2264 	dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication);
2265 	dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly,
2266 	    o->hostbased_uses_name_from_packet_only);
2267 	dump_cfg_fmtint(sRSAAuthentication, o->rsa_authentication);
2268 	dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication);
2269 #ifdef KRB5
2270 	dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication);
2271 	dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd);
2272 	dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup);
2273 # ifdef USE_AFS
2274 	dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
2275 # endif
2276 #endif
2277 #ifdef GSSAPI
2278 	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
2279 	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
2280 #endif
2281 	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
2282 	dump_cfg_fmtint(sKbdInteractiveAuthentication,
2283 	    o->kbd_interactive_authentication);
2284 	dump_cfg_fmtint(sChallengeResponseAuthentication,
2285 	    o->challenge_response_authentication);
2286 	dump_cfg_fmtint(sPrintMotd, o->print_motd);
2287 #ifndef DISABLE_LASTLOG
2288 	dump_cfg_fmtint(sPrintLastLog, o->print_lastlog);
2289 #endif
2290 	dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding);
2291 	dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
2292 	dump_cfg_fmtint(sPermitTTY, o->permit_tty);
2293 	dump_cfg_fmtint(sPermitUserRC, o->permit_user_rc);
2294 	dump_cfg_fmtint(sStrictModes, o->strict_modes);
2295 	dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
2296 	dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
2297 	dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
2298 	dump_cfg_fmtint(sUseLogin, o->use_login);
2299 	dump_cfg_fmtint(sCompression, o->compression);
2300 	dump_cfg_fmtint(sGatewayPorts, o->fwd_opts.gateway_ports);
2301 	dump_cfg_fmtint(sUseDNS, o->use_dns);
2302 	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
2303 	dump_cfg_fmtint(sAllowAgentForwarding, o->allow_agent_forwarding);
2304 	dump_cfg_fmtint(sAllowStreamLocalForwarding, o->allow_streamlocal_forwarding);
2305 	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
2306 	dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);
2307 
2308 	/* string arguments */
2309 	dump_cfg_string(sPidFile, o->pid_file);
2310 	dump_cfg_string(sXAuthLocation, o->xauth_location);
2311 	dump_cfg_string(sCiphers, o->ciphers ? o->ciphers : KEX_SERVER_ENCRYPT);
2312 	dump_cfg_string(sMacs, o->macs ? o->macs : KEX_SERVER_MAC);
2313 	dump_cfg_string(sBanner, o->banner);
2314 	dump_cfg_string(sForceCommand, o->adm_forced_command);
2315 	dump_cfg_string(sChrootDirectory, o->chroot_directory);
2316 	dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
2317 	dump_cfg_string(sRevokedKeys, o->revoked_keys_file);
2318 	dump_cfg_string(sAuthorizedPrincipalsFile,
2319 	    o->authorized_principals_file);
2320 	dump_cfg_string(sVersionAddendum, *o->version_addendum == '\0'
2321 	    ? "none" : o->version_addendum);
2322 	dump_cfg_string(sAuthorizedKeysCommand, o->authorized_keys_command);
2323 	dump_cfg_string(sAuthorizedKeysCommandUser, o->authorized_keys_command_user);
2324 	dump_cfg_string(sAuthorizedPrincipalsCommand, o->authorized_principals_command);
2325 	dump_cfg_string(sAuthorizedPrincipalsCommandUser, o->authorized_principals_command_user);
2326 	dump_cfg_string(sHostKeyAgent, o->host_key_agent);
2327 	dump_cfg_string(sKexAlgorithms,
2328 	    o->kex_algorithms ? o->kex_algorithms : KEX_SERVER_KEX);
2329 	dump_cfg_string(sHostbasedAcceptedKeyTypes, o->hostbased_key_types ?
2330 	    o->hostbased_key_types : KEX_DEFAULT_PK_ALG);
2331 	dump_cfg_string(sHostKeyAlgorithms, o->hostkeyalgorithms ?
2332 	    o->hostkeyalgorithms : KEX_DEFAULT_PK_ALG);
2333 	dump_cfg_string(sPubkeyAcceptedKeyTypes, o->pubkey_key_types ?
2334 	    o->pubkey_key_types : KEX_DEFAULT_PK_ALG);
2335 
2336 	/* string arguments requiring a lookup */
2337 	dump_cfg_string(sLogLevel, log_level_name(o->log_level));
2338 	dump_cfg_string(sLogFacility, log_facility_name(o->log_facility));
2339 
2340 	/* string array arguments */
2341 	dump_cfg_strarray_oneline(sAuthorizedKeysFile, o->num_authkeys_files,
2342 	    o->authorized_keys_files);
2343 	dump_cfg_strarray(sHostKeyFile, o->num_host_key_files,
2344 	     o->host_key_files);
2345 	dump_cfg_strarray(sHostCertificate, o->num_host_cert_files,
2346 	     o->host_cert_files);
2347 	dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users);
2348 	dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users);
2349 	dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups);
2350 	dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups);
2351 	dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env);
2352 	dump_cfg_strarray_oneline(sAuthenticationMethods,
2353 	    o->num_auth_methods, o->auth_methods);
2354 
2355 	/* other arguments */
2356 	for (i = 0; i < o->num_subsystems; i++)
2357 		printf("subsystem %s %s\n", o->subsystem_name[i],
2358 		    o->subsystem_args[i]);
2359 
2360 	printf("maxstartups %d:%d:%d\n", o->max_startups_begin,
2361 	    o->max_startups_rate, o->max_startups);
2362 
2363 	for (i = 0; tunmode_desc[i].val != -1; i++)
2364 		if (tunmode_desc[i].val == o->permit_tun) {
2365 			s = tunmode_desc[i].text;
2366 			break;
2367 		}
2368 	dump_cfg_string(sPermitTunnel, s);
2369 
2370 	printf("ipqos %s ", iptos2str(o->ip_qos_interactive));
2371 	printf("%s\n", iptos2str(o->ip_qos_bulk));
2372 
2373 	printf("rekeylimit %llu %d\n", (unsigned long long)o->rekey_limit,
2374 	    o->rekey_interval);
2375 
2376 	channel_print_adm_permitted_opens();
2377 }
2378