xref: /titanic_41/usr/src/cmd/ssh/sshd/servconf.c (revision 49d3bc91e27cd871b950d56c01398fa2f2e12ab4)
1 /*
2  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
3  *                    All rights reserved
4  *
5  * As far as I am concerned, the code I have written for this software
6  * can be used freely for any purpose.  Any derived versions of this
7  * software must be clearly marked as such, and if the derived work is
8  * incompatible with the protocol description in the RFC file, it must be
9  * called by a name other than "ssh" or "Secure Shell".
10  */
11 /*
12  * Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved.
13  */
14 
15 #include "includes.h"
16 RCSID("$OpenBSD: servconf.c,v 1.115 2002/09/04 18:52:42 stevesk Exp $");
17 
18 #ifdef HAVE_DEFOPEN
19 #include <deflt.h>
20 #endif /* HAVE_DEFOPEN */
21 
22 #if defined(KRB4)
23 #include <krb.h>
24 #endif
25 #if defined(KRB5)
26 #ifdef HEIMDAL
27 #include <krb.h>
28 #else
29 /* Bodge - but then, so is using the kerberos IV KEYFILE to get a Kerberos V
30  * keytab */
31 #define KEYFILE "/etc/krb5.keytab"
32 #endif
33 #endif
34 #ifdef AFS
35 #include <kafs.h>
36 #endif
37 
38 #include "ssh.h"
39 #include "log.h"
40 #include "buffer.h"
41 #include "servconf.h"
42 #include "xmalloc.h"
43 #include "compat.h"
44 #include "pathnames.h"
45 #include "tildexpand.h"
46 #include "misc.h"
47 #include "cipher.h"
48 #include "kex.h"
49 #include "mac.h"
50 #include "auth.h"
51 #include "match.h"
52 #include "groupaccess.h"
53 
54 static void add_listen_addr(ServerOptions *, char *, u_short);
55 static void add_one_listen_addr(ServerOptions *, char *, u_short);
56 
57 extern Buffer cfg;
58 
59 /* AF_UNSPEC or AF_INET or AF_INET6 */
60 extern int IPv4or6;
61 
62 /*
63  * Initializes the server options to their initial (unset) values. Some of those
64  * that stay unset after the command line options and configuration files are
65  * read are set to their default values in fill_default_server_options().
66  */
67 void
68 initialize_server_options(ServerOptions *options)
69 {
70 	(void) memset(options, 0, sizeof(*options));
71 
72 	/* Standard Options */
73 	options->num_ports = 0;
74 	options->ports_from_cmdline = 0;
75 	options->listen_addrs = NULL;
76 	options->num_host_key_files = 0;
77 	options->pid_file = NULL;
78 	options->server_key_bits = -1;
79 	options->login_grace_time = -1;
80 	options->key_regeneration_time = -1;
81 	options->permit_root_login = PERMIT_NOT_SET;
82 	options->ignore_rhosts = -1;
83 	options->ignore_user_known_hosts = -1;
84 	options->print_motd = -1;
85 	options->print_lastlog = -1;
86 	options->x11_forwarding = -1;
87 	options->x11_display_offset = -1;
88 	options->x11_use_localhost = -1;
89 	options->xauth_location = NULL;
90 	options->strict_modes = -1;
91 	options->keepalives = -1;
92 	options->log_facility = SYSLOG_FACILITY_NOT_SET;
93 	options->log_level = SYSLOG_LEVEL_NOT_SET;
94 	options->rhosts_authentication = -1;
95 	options->rhosts_rsa_authentication = -1;
96 	options->hostbased_authentication = -1;
97 	options->hostbased_uses_name_from_packet_only = -1;
98 	options->rsa_authentication = -1;
99 	options->pubkey_authentication = -1;
100 #ifdef GSSAPI
101 	options->gss_authentication = -1;
102 	options->gss_keyex = -1;
103 	options->gss_store_creds = -1;
104 	options->gss_use_session_ccache = -1;
105 	options->gss_cleanup_creds = -1;
106 #endif
107 #if defined(KRB4) || defined(KRB5)
108 	options->kerberos_authentication = -1;
109 	options->kerberos_or_local_passwd = -1;
110 	options->kerberos_ticket_cleanup = -1;
111 #endif
112 #if defined(AFS) || defined(KRB5)
113 	options->kerberos_tgt_passing = -1;
114 #endif
115 #ifdef AFS
116 	options->afs_token_passing = -1;
117 #endif
118 	options->password_authentication = -1;
119 	options->kbd_interactive_authentication = -1;
120 	options->challenge_response_authentication = -1;
121 	options->pam_authentication_via_kbd_int = -1;
122 	options->permit_empty_passwd = -1;
123 	options->permit_user_env = -1;
124 	options->compression = -1;
125 	options->allow_tcp_forwarding = -1;
126 	options->num_allow_users = 0;
127 	options->num_deny_users = 0;
128 	options->num_allow_groups = 0;
129 	options->num_deny_groups = 0;
130 	options->ciphers = NULL;
131 	options->macs = NULL;
132 	options->protocol = SSH_PROTO_UNKNOWN;
133 	options->gateway_ports = -1;
134 	options->num_subsystems = 0;
135 	options->max_startups_begin = -1;
136 	options->max_startups_rate = -1;
137 	options->max_startups = -1;
138 	options->banner = NULL;
139 	options->verify_reverse_mapping = -1;
140 	options->client_alive_interval = -1;
141 	options->client_alive_count_max = -1;
142 	options->authorized_keys_file = NULL;
143 	options->authorized_keys_file2 = NULL;
144 
145 	options->max_auth_tries = -1;
146 	options->max_auth_tries_log = -1;
147 
148 	options->max_init_auth_tries = -1;
149 	options->max_init_auth_tries_log = -1;
150 
151 	options->lookup_client_hostnames = -1;
152 	options->use_openssl_engine = -1;
153 	options->chroot_directory = NULL;
154 	options->pre_userauth_hook = NULL;
155 	options->pam_service_name = NULL;
156 	options->pam_service_prefix = NULL;
157 }
158 
159 #ifdef HAVE_DEFOPEN
160 /*
161  * Reads /etc/default/login and defaults several ServerOptions:
162  *
163  * PermitRootLogin
164  * PermitEmptyPasswords
165  * LoginGraceTime
166  *
167  * CONSOLE=*      -> PermitRootLogin=without-password
168  * #CONSOLE=*     -> PermitRootLogin=yes
169  *
170  * PASSREQ=YES    -> PermitEmptyPasswords=no
171  * PASSREQ=NO     -> PermitEmptyPasswords=yes
172  * #PASSREQ=*     -> PermitEmptyPasswords=no
173  *
174  * TIMEOUT=<secs> -> LoginGraceTime=<secs>
175  * #TIMEOUT=<secs> -> LoginGraceTime=300
176  */
177 static
178 void
179 deflt_fill_default_server_options(ServerOptions *options)
180 {
181 	int	flags;
182 	char	*ptr;
183 
184 	if (defopen(_PATH_DEFAULT_LOGIN))
185 		return;
186 
187 	/* Ignore case */
188 	flags = defcntl(DC_GETFLAGS, 0);
189 	TURNOFF(flags, DC_CASE);
190 	(void) defcntl(DC_SETFLAGS, flags);
191 
192 	if (options->permit_root_login == PERMIT_NOT_SET &&
193 	    (ptr = defread("CONSOLE=")) != NULL)
194 		options->permit_root_login = PERMIT_NO_PASSWD;
195 
196 	if (options->permit_empty_passwd == -1 &&
197 	    (ptr = defread("PASSREQ=")) != NULL) {
198 		if (strcasecmp("YES", ptr) == 0)
199 			options->permit_empty_passwd = 0;
200 		else if (strcasecmp("NO", ptr) == 0)
201 			options->permit_empty_passwd = 1;
202 	}
203 
204 	if (options->max_init_auth_tries == -1 &&
205 	    (ptr = defread("RETRIES=")) != NULL) {
206 		options->max_init_auth_tries = atoi(ptr);
207 	}
208 
209 	if (options->max_init_auth_tries_log == -1 &&
210 	    (ptr = defread("SYSLOG_FAILED_LOGINS=")) != NULL) {
211 		options->max_init_auth_tries_log = atoi(ptr);
212 	}
213 
214 	if (options->login_grace_time == -1) {
215 		if ((ptr = defread("TIMEOUT=")) != NULL)
216 			options->login_grace_time = (unsigned)atoi(ptr);
217 		else
218 			options->login_grace_time = 300;
219 	}
220 
221 	(void) defopen((char *)NULL);
222 }
223 #endif /* HAVE_DEFOPEN */
224 
225 void
226 fill_default_server_options(ServerOptions *options)
227 {
228 
229 #ifdef HAVE_DEFOPEN
230 	deflt_fill_default_server_options(options);
231 #endif /* HAVE_DEFOPEN */
232 
233 	/* Standard Options */
234 	if (options->protocol == SSH_PROTO_UNKNOWN)
235 		options->protocol = SSH_PROTO_1|SSH_PROTO_2;
236 	if (options->num_host_key_files == 0) {
237 		/* fill default hostkeys for protocols */
238 		if (options->protocol & SSH_PROTO_1)
239 			options->host_key_files[options->num_host_key_files++] =
240 			    _PATH_HOST_KEY_FILE;
241 #ifndef GSSAPI
242 		/* With GSS keyex we can run v2 w/ no host keys */
243 		if (options->protocol & SSH_PROTO_2) {
244 			options->host_key_files[options->num_host_key_files++] =
245 			    _PATH_HOST_RSA_KEY_FILE;
246 			options->host_key_files[options->num_host_key_files++] =
247 			    _PATH_HOST_DSA_KEY_FILE;
248 		}
249 #endif /* GSSAPI */
250 	}
251 	if (options->num_ports == 0)
252 		options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
253 	if (options->listen_addrs == NULL)
254 		add_listen_addr(options, NULL, 0);
255 	if (options->pid_file == NULL)
256 		options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
257 	if (options->server_key_bits == -1)
258 		options->server_key_bits = 768;
259 	if (options->login_grace_time == -1)
260 		options->login_grace_time = 120;
261 	if (options->key_regeneration_time == -1)
262 		options->key_regeneration_time = 3600;
263 	if (options->permit_root_login == PERMIT_NOT_SET)
264 		options->permit_root_login = PERMIT_YES;
265 	if (options->ignore_rhosts == -1)
266 		options->ignore_rhosts = 1;
267 	if (options->ignore_user_known_hosts == -1)
268 		options->ignore_user_known_hosts = 0;
269 	if (options->print_motd == -1)
270 		options->print_motd = 1;
271 	if (options->print_lastlog == -1)
272 		options->print_lastlog = 1;
273 	if (options->x11_forwarding == -1)
274 		options->x11_forwarding = 1;
275 	if (options->x11_display_offset == -1)
276 		options->x11_display_offset = 10;
277 	if (options->x11_use_localhost == -1)
278 		options->x11_use_localhost = 1;
279 	if (options->xauth_location == NULL)
280 		options->xauth_location = _PATH_XAUTH;
281 	if (options->strict_modes == -1)
282 		options->strict_modes = 1;
283 	if (options->keepalives == -1)
284 		options->keepalives = 1;
285 	if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
286 		options->log_facility = SYSLOG_FACILITY_AUTH;
287 	if (options->log_level == SYSLOG_LEVEL_NOT_SET)
288 		options->log_level = SYSLOG_LEVEL_INFO;
289 	if (options->rhosts_authentication == -1)
290 		options->rhosts_authentication = 0;
291 	if (options->rhosts_rsa_authentication == -1)
292 		options->rhosts_rsa_authentication = 0;
293 	if (options->hostbased_authentication == -1)
294 		options->hostbased_authentication = 0;
295 	if (options->hostbased_uses_name_from_packet_only == -1)
296 		options->hostbased_uses_name_from_packet_only = 0;
297 	if (options->rsa_authentication == -1)
298 		options->rsa_authentication = 1;
299 	if (options->pubkey_authentication == -1)
300 		options->pubkey_authentication = 1;
301 #ifdef GSSAPI
302 	if (options->gss_authentication == -1)
303 		options->gss_authentication = 1;
304 	if (options->gss_keyex == -1)
305 		options->gss_keyex = 1;
306 	if (options->gss_store_creds == -1)
307 		options->gss_store_creds = 1;
308 	if (options->gss_use_session_ccache == -1)
309 		options->gss_use_session_ccache = 1;
310 	if (options->gss_cleanup_creds == -1)
311 		options->gss_cleanup_creds = 1;
312 #endif
313 #if defined(KRB4) || defined(KRB5)
314 	if (options->kerberos_authentication == -1)
315 		options->kerberos_authentication = 0;
316 	if (options->kerberos_or_local_passwd == -1)
317 		options->kerberos_or_local_passwd = 1;
318 	if (options->kerberos_ticket_cleanup == -1)
319 		options->kerberos_ticket_cleanup = 1;
320 #endif
321 #if defined(AFS) || defined(KRB5)
322 	if (options->kerberos_tgt_passing == -1)
323 		options->kerberos_tgt_passing = 0;
324 #endif
325 #ifdef AFS
326 	if (options->afs_token_passing == -1)
327 		options->afs_token_passing = 0;
328 #endif
329 	if (options->password_authentication == -1)
330 		options->password_authentication = 1;
331 	/*
332 	 * options->pam_authentication_via_kbd_int has intentionally no default
333 	 * value since we do not need it.
334 	 */
335 	if (options->kbd_interactive_authentication == -1)
336 		options->kbd_interactive_authentication = 1;
337 	if (options->challenge_response_authentication == -1)
338 		options->challenge_response_authentication = 1;
339 	if (options->permit_empty_passwd == -1)
340 		options->permit_empty_passwd = 0;
341 	if (options->permit_user_env == -1)
342 		options->permit_user_env = 0;
343 	if (options->compression == -1)
344 		options->compression = 1;
345 	if (options->allow_tcp_forwarding == -1)
346 		options->allow_tcp_forwarding = 1;
347 	if (options->gateway_ports == -1)
348 		options->gateway_ports = 0;
349 	if (options->max_startups == -1)
350 		options->max_startups = 10;
351 	if (options->max_startups_rate == -1)
352 		options->max_startups_rate = 100;		/* 100% */
353 	if (options->max_startups_begin == -1)
354 		options->max_startups_begin = options->max_startups;
355 	if (options->verify_reverse_mapping == -1)
356 		options->verify_reverse_mapping = 0;
357 	if (options->client_alive_interval == -1)
358 		options->client_alive_interval = 0;
359 	if (options->client_alive_count_max == -1)
360 		options->client_alive_count_max = 3;
361 	if (options->authorized_keys_file2 == NULL) {
362 		/* authorized_keys_file2 falls back to authorized_keys_file */
363 		if (options->authorized_keys_file != NULL)
364 			options->authorized_keys_file2 = options->authorized_keys_file;
365 		else
366 			options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2;
367 	}
368 	if (options->authorized_keys_file == NULL)
369 		options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;
370 
371 	if (options->max_auth_tries == -1)
372 		options->max_auth_tries = AUTH_FAIL_MAX;
373 	if (options->max_auth_tries_log == -1)
374 		options->max_auth_tries_log = options->max_auth_tries / 2;
375 
376 	if (options->max_init_auth_tries == -1)
377 		options->max_init_auth_tries = AUTH_FAIL_MAX;
378 	if (options->max_init_auth_tries_log == -1)
379 		options->max_init_auth_tries_log = options->max_init_auth_tries / 2;
380 
381 	if (options->lookup_client_hostnames == -1)
382 		options->lookup_client_hostnames = 1;
383 	if (options->use_openssl_engine == -1)
384 		options->use_openssl_engine = 1;
385 	if (options->pam_service_prefix == NULL)
386 		options->pam_service_prefix = _SSH_PAM_SERVICE_PREFIX;
387 	if (options->pam_service_name == NULL)
388 		options->pam_service_name = NULL;
389 }
390 
391 /* Keyword tokens. */
392 typedef enum {
393 	sBadOption,		/* == unknown option */
394 	/* Portable-specific options */
395 	sPAMAuthenticationViaKbdInt,
396 	/* Standard Options */
397 	sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
398 	sPermitRootLogin, sLogFacility, sLogLevel,
399 	sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication,
400 #ifdef GSSAPI
401 	sGssAuthentication, sGssKeyEx, sGssStoreDelegCreds,
402 	sGssUseSessionCredCache, sGssCleanupCreds,
403 #endif /* GSSAPI */
404 #if defined(KRB4) || defined(KRB5)
405 	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
406 #endif
407 #if defined(AFS) || defined(KRB5)
408 	sKerberosTgtPassing,
409 #endif
410 #ifdef AFS
411 	sAFSTokenPassing,
412 #endif
413 	sChallengeResponseAuthentication,
414 	sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress,
415 	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
416 	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
417 	sStrictModes, sEmptyPasswd, sKeepAlives,
418 	sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
419 	sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
420 	sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
421 	sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, sMaxStartups,
422 	sBanner, sVerifyReverseMapping, sHostbasedAuthentication,
423 	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
424 	sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
425 	sMaxAuthTries, sMaxAuthTriesLog, sUsePrivilegeSeparation,
426 	sLookupClientHostnames, sUseOpenSSLEngine, sChrootDirectory,
427 	sPreUserauthHook, sMatch, sPAMServicePrefix, sPAMServiceName,
428 	sDeprecated
429 } ServerOpCodes;
430 
431 #define SSHCFG_GLOBAL	0x01	/* allowed in main section of sshd_config */
432 #define SSHCFG_MATCH	0x02	/* allowed inside a Match section */
433 #define SSHCFG_ALL	(SSHCFG_GLOBAL|SSHCFG_MATCH)
434 
435 /* Textual representation of the tokens. */
436 static struct {
437 	const char *name;
438 	ServerOpCodes opcode;
439 	u_int flags;
440 } keywords[] = {
441 	/* Portable-specific options */
442 	{ "PAMAuthenticationViaKbdInt", sPAMAuthenticationViaKbdInt, SSHCFG_GLOBAL },
443 	/* Standard Options */
444 	{ "port", sPort, SSHCFG_GLOBAL },
445 	{ "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
446 	{ "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL },			/* alias */
447 	{ "pidfile", sPidFile, SSHCFG_GLOBAL },
448 	{ "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL },
449 	{ "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
450 	{ "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL },
451 	{ "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
452 	{ "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
453 	{ "loglevel", sLogLevel, SSHCFG_GLOBAL },
454 	{ "rhostsauthentication", sRhostsAuthentication, SSHCFG_GLOBAL },
455 	{ "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
456 	{ "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
457 	{ "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly },
458 	{ "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
459 	{ "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
460 	{ "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL },	/* alias */
461 #ifdef GSSAPI
462 	{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
463 	{ "gssapikeyexchange", sGssKeyEx,   SSHCFG_GLOBAL },
464 	{ "gssapistoredelegatedcredentials", sGssStoreDelegCreds, SSHCFG_GLOBAL },
465 	{ "gssauthentication", sGssAuthentication, SSHCFG_GLOBAL },	/* alias */
466 	{ "gsskeyex", sGssKeyEx, SSHCFG_GLOBAL },	/* alias */
467 	{ "gssstoredelegcreds", sGssStoreDelegCreds, SSHCFG_GLOBAL },	/* alias */
468 #ifndef SUNW_GSSAPI
469 	{ "gssusesessionccache", sGssUseSessionCredCache, SSHCFG_GLOBAL },
470 	{ "gssusesessioncredcache", sGssUseSessionCredCache, SSHCFG_GLOBAL },
471 	{ "gsscleanupcreds", sGssCleanupCreds, SSHCFG_GLOBAL },
472 #endif /* SUNW_GSSAPI */
473 #endif
474 #if defined(KRB4) || defined(KRB5)
475 	{ "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
476 	{ "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
477 	{ "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
478 #endif
479 #if defined(AFS) || defined(KRB5)
480 	{ "kerberostgtpassing", sKerberosTgtPassing, SSHCFG_GLOBAL },
481 #endif
482 #ifdef AFS
483 	{ "afstokenpassing", sAFSTokenPassing, SSHCFG_GLOBAL },
484 #endif
485 	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
486 	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
487 	{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
488 	{ "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
489 	{ "checkmail", sDeprecated, SSHCFG_GLOBAL },
490 	{ "listenaddress", sListenAddress, SSHCFG_GLOBAL },
491 	{ "printmotd", sPrintMotd, SSHCFG_GLOBAL },
492 	{ "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
493 	{ "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
494 	{ "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
495 	{ "x11forwarding", sX11Forwarding, SSHCFG_ALL },
496 	{ "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
497 	{ "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
498 	{ "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
499 	{ "strictmodes", sStrictModes, SSHCFG_GLOBAL },
500 	{ "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
501 	{ "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
502 	{ "uselogin", sUseLogin, SSHCFG_GLOBAL },
503 	{ "compression", sCompression, SSHCFG_GLOBAL },
504 	{ "keepalive", sKeepAlives, SSHCFG_GLOBAL },
505 	{ "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
506 	{ "allowusers", sAllowUsers, SSHCFG_GLOBAL },
507 	{ "denyusers", sDenyUsers, SSHCFG_GLOBAL },
508 	{ "allowgroups", sAllowGroups, SSHCFG_GLOBAL },
509 	{ "denygroups", sDenyGroups, SSHCFG_GLOBAL },
510 	{ "ciphers", sCiphers, SSHCFG_GLOBAL },
511 	{ "macs", sMacs, SSHCFG_GLOBAL},
512 	{ "protocol", sProtocol,SSHCFG_GLOBAL },
513 	{ "gatewayports", sGatewayPorts, SSHCFG_ALL },
514 	{ "subsystem", sSubsystem, SSHCFG_GLOBAL},
515 	{ "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
516 	{ "banner", sBanner, SSHCFG_ALL },
517 	{ "verifyreversemapping", sVerifyReverseMapping, SSHCFG_GLOBAL },
518 	{ "reversemappingcheck", sVerifyReverseMapping,SSHCFG_GLOBAL },
519 	{ "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL },
520 	{ "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
521 	{ "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_GLOBAL },
522 	{ "authorizedkeysfile2", sAuthorizedKeysFile2, SSHCFG_GLOBAL },
523 	{ "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
524 	{ "maxauthtrieslog", sMaxAuthTriesLog, SSHCFG_GLOBAL },
525 	{ "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL },
526 	{ "lookupclienthostnames", sLookupClientHostnames, SSHCFG_GLOBAL },
527 	{ "useopensslengine", sUseOpenSSLEngine, SSHCFG_GLOBAL },
528 	{ "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
529 	{ "preuserauthhook", sPreUserauthHook, SSHCFG_ALL},
530 	{ "match", sMatch, SSHCFG_ALL },
531 	{ "pamserviceprefix", sPAMServicePrefix, SSHCFG_GLOBAL },
532 	{ "pamservicename", sPAMServiceName, SSHCFG_GLOBAL },
533 
534 	{ NULL, sBadOption, 0 }
535 };
536 
537 /*
538  * Returns the number of the token pointed to by cp or sBadOption.
539  */
540 
541 static ServerOpCodes
542 parse_token(const char *cp, const char *filename,
543 	    int linenum, u_int *flags)
544 {
545 	u_int i;
546 
547 	for (i = 0; keywords[i].name; i++)
548 		if (strcasecmp(cp, keywords[i].name) == 0) {
549 			*flags = keywords[i].flags;
550 			return keywords[i].opcode;
551 		}
552 
553 	error("%s: line %d: Bad configuration option: %s",
554 	    filename, linenum, cp);
555 	return sBadOption;
556 }
557 
558 static void
559 add_listen_addr(ServerOptions *options, char *addr, u_short port)
560 {
561 	int i;
562 
563 	if (options->num_ports == 0)
564 		options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
565 	if (port == 0)
566 		for (i = 0; i < options->num_ports; i++)
567 			add_one_listen_addr(options, addr, options->ports[i]);
568 	else
569 		add_one_listen_addr(options, addr, port);
570 }
571 
572 static void
573 add_one_listen_addr(ServerOptions *options, char *addr, u_short port)
574 {
575 	struct addrinfo hints, *ai, *aitop;
576 	char strport[NI_MAXSERV];
577 	int gaierr;
578 
579 	(void) memset(&hints, 0, sizeof(hints));
580 	hints.ai_family = IPv4or6;
581 	hints.ai_socktype = SOCK_STREAM;
582 	hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
583 	(void) snprintf(strport, sizeof strport, "%u", port);
584 	if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
585 		fatal("bad addr or host: %s (%s)",
586 		    addr ? addr : "<NULL>",
587 		    gai_strerror(gaierr));
588 	for (ai = aitop; ai->ai_next; ai = ai->ai_next)
589 		;
590 	ai->ai_next = options->listen_addrs;
591 	options->listen_addrs = aitop;
592 }
593 
594 /*
595  * The strategy for the Match blocks is that the config file is parsed twice.
596  *
597  * The first time is at startup.  activep is initialized to 1 and the
598  * directives in the global context are processed and acted on.  Hitting a
599  * Match directive unsets activep and the directives inside the block are
600  * checked for syntax only.
601  *
602  * The second time is after a connection has been established but before
603  * authentication.  activep is initialized to 2 and global config directives
604  * are ignored since they have already been processed.  If the criteria in a
605  * Match block is met, activep is set and the subsequent directives
606  * processed and actioned until EOF or another Match block unsets it.  Any
607  * options set are copied into the main server config.
608  *
609  * Potential additions/improvements:
610  *  - Add Match support for pre-kex directives, eg Protocol, Ciphers.
611  *
612  *  - Add a Tag directive (idea from David Leonard) ala pf, eg:
613  *	Match Address 192.168.0.*
614  *		Tag trusted
615  *	Match Group wheel
616  *		Tag trusted
617  *	Match Tag trusted
618  *		AllowTcpForwarding yes
619  *		GatewayPorts clientspecified
620  *		[...]
621  *
622  *  - Add a PermittedChannelRequests directive
623  *	Match Group shell
624  *		PermittedChannelRequests session,forwarded-tcpip
625  */
626 
627 static int
628 match_cfg_line_group(const char *grps, int line, const char *user)
629 {
630 	int result = 0;
631 	struct passwd *pw;
632 
633 	if (user == NULL)
634 		goto out;
635 
636 	if ((pw = getpwnam(user)) == NULL) {
637 		debug("Can't match group at line %d because user %.100s does "
638 		    "not exist", line, user);
639 	} else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
640 		debug("Can't Match group because user %.100s not in any group "
641 		    "at line %d", user, line);
642 	} else if (ga_match_pattern_list(grps) != 1) {
643 		debug("user %.100s does not match group list %.100s at line %d",
644 		    user, grps, line);
645 	} else {
646 		debug("user %.100s matched group list %.100s at line %d", user,
647 		    grps, line);
648 		result = 1;
649 	}
650 out:
651 	ga_free();
652 	return result;
653 }
654 
655 static int
656 match_cfg_line(char **condition, int line, const char *user, const char *host,
657     const char *address)
658 {
659 	int result = 1;
660 	char *arg, *attrib, *cp = *condition;
661 	size_t len;
662 
663 	if (user == NULL)
664 		debug3("checking syntax for 'Match %s'", cp);
665 	else
666 		debug3("checking match for '%s' user %s host %s addr %s", cp,
667 		    user ? user : "(null)", host ? host : "(null)",
668 		    address ? address : "(null)");
669 
670 	while ((attrib = strdelim(&cp)) != NULL && *attrib != '\0') {
671 		if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
672 			error("Missing Match criteria for %s", attrib);
673 			return -1;
674 		}
675 		len = strlen(arg);
676 		if (strcasecmp(attrib, "user") == 0) {
677 			if (!user) {
678 				result = 0;
679 				continue;
680 			}
681 			if (match_pattern_list(user, arg, len, 0) != 1)
682 				result = 0;
683 			else
684 				debug("user %.100s matched 'User %.100s' at "
685 				    "line %d", user, arg, line);
686 		} else if (strcasecmp(attrib, "group") == 0) {
687 			switch (match_cfg_line_group(arg, line, user)) {
688 			case -1:
689 				return -1;
690 			case 0:
691 				result = 0;
692 			}
693 		} else if (strcasecmp(attrib, "host") == 0) {
694 			if (!host) {
695 				result = 0;
696 				continue;
697 			}
698 			if (match_hostname(host, arg, len) != 1)
699 				result = 0;
700 			else
701 				debug("connection from %.100s matched 'Host "
702 				    "%.100s' at line %d", host, arg, line);
703 		} else if (strcasecmp(attrib, "address") == 0) {
704 			switch (addr_match_list(address, arg)) {
705 			case 1:
706 				debug("connection from %.100s matched 'Address "
707 				    "%.100s' at line %d", address, arg, line);
708 				break;
709 			case 0:
710 			case -1:
711 				result = 0;
712 				break;
713 			case -2:
714 				return -1;
715 			}
716 		} else {
717 			error("Unsupported Match attribute %s", attrib);
718 			return -1;
719 		}
720 	}
721 	if (user != NULL)
722 		debug3("match %sfound", result ? "" : "not ");
723 	*condition = cp;
724 	return result;
725 }
726 
727 #define WHITESPACE " \t\r\n"
728 
729 int
730 process_server_config_line(ServerOptions *options, char *line,
731     const char *filename, int linenum, int *activep, const char *user,
732     const char *host, const char *address)
733 {
734 	char *cp, **charptr, *arg, *p;
735 	int cmdline = 0, *intptr, value, n;
736 	ServerOpCodes opcode;
737 	u_int i, flags = 0;
738 	size_t len;
739 
740 	cp = line;
741 	arg = strdelim(&cp);
742 	/* Ignore leading whitespace */
743 	if (*arg == '\0')
744 		arg = strdelim(&cp);
745 	if (!arg || !*arg || *arg == '#')
746 		return 0;
747 	intptr = NULL;
748 	charptr = NULL;
749 	opcode = parse_token(arg, filename, linenum, &flags);
750 
751 	if (activep == NULL) { /* We are processing a command line directive */
752 		cmdline = 1;
753 		activep = &cmdline;
754 	}
755 	if (*activep && opcode != sMatch)
756 		debug3("%s:%d setting %s %s", filename, linenum, arg, cp);
757 	if (*activep == 0 && !(flags & SSHCFG_MATCH)) {
758 		if (user == NULL) {
759 			fatal("%s line %d: Directive '%s' is not allowed "
760 			    "within a Match block", filename, linenum, arg);
761 		} else { /* this is a directive we have already processed */
762 			while (arg)
763 				arg = strdelim(&cp);
764 			return 0;
765 		}
766 	}
767 
768 	switch (opcode) {
769 	/* Portable-specific options */
770 	case sPAMAuthenticationViaKbdInt:
771 		log("%s line %d: PAMAuthenticationViaKbdInt has been "
772 		    "deprecated. You should use KbdInteractiveAuthentication "
773 		    "instead (which defaults to \"yes\").", filename, linenum);
774 		intptr = &options->pam_authentication_via_kbd_int;
775 		goto parse_flag;
776 
777 	/* Standard Options */
778 	case sBadOption:
779 		return -1;
780 	case sPort:
781 		/* ignore ports from configfile if cmdline specifies ports */
782 		if (options->ports_from_cmdline)
783 			return 0;
784 		if (options->listen_addrs != NULL)
785 			fatal("%s line %d: ports must be specified before "
786 			    "ListenAddress.", filename, linenum);
787 		if (options->num_ports >= MAX_PORTS)
788 			fatal("%s line %d: too many ports.",
789 			    filename, linenum);
790 		arg = strdelim(&cp);
791 		if (!arg || *arg == '\0')
792 			fatal("%s line %d: missing port number.",
793 			    filename, linenum);
794 		options->ports[options->num_ports++] = a2port(arg);
795 		if (options->ports[options->num_ports-1] == 0)
796 			fatal("%s line %d: Badly formatted port number.",
797 			    filename, linenum);
798 		break;
799 
800 	case sServerKeyBits:
801 		intptr = &options->server_key_bits;
802 parse_int:
803 		arg = strdelim(&cp);
804 		if (!arg || *arg == '\0')
805 			fatal("%s line %d: missing integer value.",
806 			    filename, linenum);
807 		value = atoi(arg);
808 		if (*activep && *intptr == -1)
809 			*intptr = value;
810 		break;
811 
812 	case sLoginGraceTime:
813 		intptr = &options->login_grace_time;
814 parse_time:
815 		arg = strdelim(&cp);
816 		if (!arg || *arg == '\0')
817 			fatal("%s line %d: missing time value.",
818 			    filename, linenum);
819 		if ((value = convtime(arg)) == -1)
820 			fatal("%s line %d: invalid time value.",
821 			    filename, linenum);
822 		if (*intptr == -1)
823 			*intptr = value;
824 		break;
825 
826 	case sKeyRegenerationTime:
827 		intptr = &options->key_regeneration_time;
828 		goto parse_time;
829 
830 	case sListenAddress:
831 		arg = strdelim(&cp);
832 		if (!arg || *arg == '\0' || strncmp(arg, "[]", 2) == 0)
833 			fatal("%s line %d: missing inet addr.",
834 			    filename, linenum);
835 		if (*arg == '[') {
836 			if ((p = strchr(arg, ']')) == NULL)
837 				fatal("%s line %d: bad ipv6 inet addr usage.",
838 				    filename, linenum);
839 			arg++;
840 			(void) memmove(p, p+1, strlen(p+1)+1);
841 		} else if (((p = strchr(arg, ':')) == NULL) ||
842 			    (strchr(p+1, ':') != NULL)) {
843 			add_listen_addr(options, arg, 0);
844 			break;
845 		}
846 		if (*p == ':') {
847 			u_short port;
848 
849 			p++;
850 			if (*p == '\0')
851 				fatal("%s line %d: bad inet addr:port usage.",
852 				    filename, linenum);
853 			else {
854 				*(p-1) = '\0';
855 				if ((port = a2port(p)) == 0)
856 					fatal("%s line %d: bad port number.",
857 					    filename, linenum);
858 				add_listen_addr(options, arg, port);
859 			}
860 		} else if (*p == '\0')
861 			add_listen_addr(options, arg, 0);
862 		else
863 			fatal("%s line %d: bad inet addr usage.",
864 			    filename, linenum);
865 		break;
866 
867 	case sHostKeyFile:
868 		intptr = &options->num_host_key_files;
869 		if (*intptr >= MAX_HOSTKEYS)
870 			fatal("%s line %d: too many host keys specified (max %d).",
871 			    filename, linenum, MAX_HOSTKEYS);
872 		charptr = &options->host_key_files[*intptr];
873 parse_filename:
874 		arg = strdelim(&cp);
875 		if (!arg || *arg == '\0')
876 			fatal("%s line %d: missing file name.",
877 			    filename, linenum);
878 		if (*activep && *charptr == NULL) {
879 			*charptr = tilde_expand_filename(arg, getuid());
880 			/* increase optional counter */
881 			if (intptr != NULL)
882 				*intptr = *intptr + 1;
883 		}
884 		break;
885 
886 	case sPidFile:
887 		charptr = &options->pid_file;
888 		goto parse_filename;
889 
890 	case sPermitRootLogin:
891 		intptr = &options->permit_root_login;
892 		arg = strdelim(&cp);
893 		if (!arg || *arg == '\0')
894 			fatal("%s line %d: missing yes/"
895 			    "without-password/forced-commands-only/no "
896 			    "argument.", filename, linenum);
897 		value = 0;	/* silence compiler */
898 		if (strcmp(arg, "without-password") == 0)
899 			value = PERMIT_NO_PASSWD;
900 		else if (strcmp(arg, "forced-commands-only") == 0)
901 			value = PERMIT_FORCED_ONLY;
902 		else if (strcmp(arg, "yes") == 0)
903 			value = PERMIT_YES;
904 		else if (strcmp(arg, "no") == 0)
905 			value = PERMIT_NO;
906 		else
907 			fatal("%s line %d: Bad yes/"
908 			    "without-password/forced-commands-only/no "
909 			    "argument: %s", filename, linenum, arg);
910 		if (*activep && *intptr == -1)
911 			*intptr = value;
912 		break;
913 
914 	case sIgnoreRhosts:
915 		intptr = &options->ignore_rhosts;
916 parse_flag:
917 		arg = strdelim(&cp);
918 		if (!arg || *arg == '\0')
919 			fatal("%s line %d: missing yes/no argument.",
920 			    filename, linenum);
921 		value = 0;	/* silence compiler */
922 		if (strcmp(arg, "yes") == 0)
923 			value = 1;
924 		else if (strcmp(arg, "no") == 0)
925 			value = 0;
926 		else
927 			fatal("%s line %d: Bad yes/no argument: %s",
928 				filename, linenum, arg);
929 		if (*activep && *intptr == -1)
930 			*intptr = value;
931 		break;
932 
933 	case sIgnoreUserKnownHosts:
934 		intptr = &options->ignore_user_known_hosts;
935 		goto parse_flag;
936 
937 	case sRhostsAuthentication:
938 		intptr = &options->rhosts_authentication;
939 		goto parse_flag;
940 
941 	case sRhostsRSAAuthentication:
942 		intptr = &options->rhosts_rsa_authentication;
943 		goto parse_flag;
944 
945 	case sHostbasedAuthentication:
946 		intptr = &options->hostbased_authentication;
947 		goto parse_flag;
948 
949 	case sHostbasedUsesNameFromPacketOnly:
950 		intptr = &options->hostbased_uses_name_from_packet_only;
951 		goto parse_flag;
952 
953 	case sRSAAuthentication:
954 		intptr = &options->rsa_authentication;
955 		goto parse_flag;
956 
957 	case sPubkeyAuthentication:
958 		intptr = &options->pubkey_authentication;
959 		goto parse_flag;
960 #ifdef GSSAPI
961 	case sGssAuthentication:
962 		intptr = &options->gss_authentication;
963 		goto parse_flag;
964 	case sGssKeyEx:
965 		intptr = &options->gss_keyex;
966 		goto parse_flag;
967 	case sGssStoreDelegCreds:
968 		intptr = &options->gss_keyex;
969 		goto parse_flag;
970 #ifndef SUNW_GSSAPI
971 	case sGssUseSessionCredCache:
972 		intptr = &options->gss_use_session_ccache;
973 		goto parse_flag;
974 	case sGssCleanupCreds:
975 		intptr = &options->gss_cleanup_creds;
976 		goto parse_flag;
977 #endif /* SUNW_GSSAPI */
978 #endif /* GSSAPI */
979 #if defined(KRB4) || defined(KRB5)
980 	case sKerberosAuthentication:
981 		intptr = &options->kerberos_authentication;
982 		goto parse_flag;
983 
984 	case sKerberosOrLocalPasswd:
985 		intptr = &options->kerberos_or_local_passwd;
986 		goto parse_flag;
987 
988 	case sKerberosTicketCleanup:
989 		intptr = &options->kerberos_ticket_cleanup;
990 		goto parse_flag;
991 #endif
992 #if defined(AFS) || defined(KRB5)
993 	case sKerberosTgtPassing:
994 		intptr = &options->kerberos_tgt_passing;
995 		goto parse_flag;
996 #endif
997 #ifdef AFS
998 	case sAFSTokenPassing:
999 		intptr = &options->afs_token_passing;
1000 		goto parse_flag;
1001 #endif
1002 
1003 	case sPasswordAuthentication:
1004 		intptr = &options->password_authentication;
1005 		goto parse_flag;
1006 
1007 	case sKbdInteractiveAuthentication:
1008 		intptr = &options->kbd_interactive_authentication;
1009 		goto parse_flag;
1010 
1011 	case sChallengeResponseAuthentication:
1012 		intptr = &options->challenge_response_authentication;
1013 		goto parse_flag;
1014 
1015 	case sPrintMotd:
1016 		intptr = &options->print_motd;
1017 		goto parse_flag;
1018 
1019 	case sPrintLastLog:
1020 		intptr = &options->print_lastlog;
1021 		goto parse_flag;
1022 
1023 	case sX11Forwarding:
1024 		intptr = &options->x11_forwarding;
1025 		goto parse_flag;
1026 
1027 	case sX11DisplayOffset:
1028 		intptr = &options->x11_display_offset;
1029 		goto parse_int;
1030 
1031 	case sX11UseLocalhost:
1032 		intptr = &options->x11_use_localhost;
1033 		goto parse_flag;
1034 
1035 	case sXAuthLocation:
1036 		charptr = &options->xauth_location;
1037 		goto parse_filename;
1038 
1039 	case sStrictModes:
1040 		intptr = &options->strict_modes;
1041 		goto parse_flag;
1042 
1043 	case sKeepAlives:
1044 		intptr = &options->keepalives;
1045 		goto parse_flag;
1046 
1047 	case sEmptyPasswd:
1048 		intptr = &options->permit_empty_passwd;
1049 		goto parse_flag;
1050 
1051 	case sPermitUserEnvironment:
1052 		intptr = &options->permit_user_env;
1053 		goto parse_flag;
1054 
1055 	case sUseLogin:
1056 		log("%s line %d: ignoring UseLogin option value."
1057 		    " This option is always off.", filename, linenum);
1058 		while (arg)
1059 			arg = strdelim(&cp);
1060 		break;
1061 
1062 	case sCompression:
1063 		intptr = &options->compression;
1064 		goto parse_flag;
1065 
1066 	case sGatewayPorts:
1067 		intptr = &options->gateway_ports;
1068 		arg = strdelim(&cp);
1069 		if (!arg || *arg == '\0')
1070 			fatal("%s line %d: missing yes/no/clientspecified "
1071 			    "argument.", filename, linenum);
1072 		value = 0;	/* silence compiler */
1073 		if (strcmp(arg, "clientspecified") == 0)
1074 			value = 2;
1075 		else if (strcmp(arg, "yes") == 0)
1076 			value = 1;
1077 		else if (strcmp(arg, "no") == 0)
1078 			value = 0;
1079 		else
1080 			fatal("%s line %d: Bad yes/no/clientspecified "
1081 			    "argument: %s", filename, linenum, arg);
1082 		if (*activep && *intptr == -1)
1083 			*intptr = value;
1084 		break;
1085 
1086 	case sVerifyReverseMapping:
1087 		intptr = &options->verify_reverse_mapping;
1088 		goto parse_flag;
1089 
1090 	case sLogFacility:
1091 		intptr = (int *) &options->log_facility;
1092 		arg = strdelim(&cp);
1093 		value = log_facility_number(arg);
1094 		if (value == SYSLOG_FACILITY_NOT_SET)
1095 			fatal("%.200s line %d: unsupported log facility '%s'",
1096 			    filename, linenum, arg ? arg : "<NONE>");
1097 		if (*intptr == -1)
1098 			*intptr = (SyslogFacility) value;
1099 		break;
1100 
1101 	case sLogLevel:
1102 		intptr = (int *) &options->log_level;
1103 		arg = strdelim(&cp);
1104 		value = log_level_number(arg);
1105 		if (value == SYSLOG_LEVEL_NOT_SET)
1106 			fatal("%.200s line %d: unsupported log level '%s'",
1107 			    filename, linenum, arg ? arg : "<NONE>");
1108 		if (*intptr == -1)
1109 			*intptr = (LogLevel) value;
1110 		break;
1111 
1112 	case sAllowTcpForwarding:
1113 		intptr = &options->allow_tcp_forwarding;
1114 		goto parse_flag;
1115 
1116 	case sUsePrivilegeSeparation:
1117 		log("%s line %d: ignoring UsePrivilegeSeparation option value."
1118 		    " This option is always on.", filename, linenum);
1119 		while (arg)
1120 			arg = strdelim(&cp);
1121 		break;
1122 
1123 	case sAllowUsers:
1124 		while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') {
1125 			if (options->num_allow_users >= MAX_ALLOW_USERS)
1126 				fatal("%s line %d: too many allow users.",
1127 				    filename, linenum);
1128 			options->allow_users[options->num_allow_users++] =
1129 			    xstrdup(arg);
1130 		}
1131 		break;
1132 
1133 	case sDenyUsers:
1134 		while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') {
1135 			if (options->num_deny_users >= MAX_DENY_USERS)
1136 				fatal( "%s line %d: too many deny users.",
1137 				    filename, linenum);
1138 			options->deny_users[options->num_deny_users++] =
1139 			    xstrdup(arg);
1140 		}
1141 		break;
1142 
1143 	case sAllowGroups:
1144 		while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') {
1145 			if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
1146 				fatal("%s line %d: too many allow groups.",
1147 				    filename, linenum);
1148 			options->allow_groups[options->num_allow_groups++] =
1149 			    xstrdup(arg);
1150 		}
1151 		break;
1152 
1153 	case sDenyGroups:
1154 		while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') {
1155 			if (options->num_deny_groups >= MAX_DENY_GROUPS)
1156 				fatal("%s line %d: too many deny groups.",
1157 				    filename, linenum);
1158 			options->deny_groups[options->num_deny_groups++] = xstrdup(arg);
1159 		}
1160 		break;
1161 
1162 	case sCiphers:
1163 		arg = strdelim(&cp);
1164 		if (!arg || *arg == '\0')
1165 			fatal("%s line %d: Missing argument.", filename, linenum);
1166 		if (!ciphers_valid(arg))
1167 			fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1168 			    filename, linenum, arg ? arg : "<NONE>");
1169 		if (options->ciphers == NULL)
1170 			options->ciphers = xstrdup(arg);
1171 		break;
1172 
1173 	case sMacs:
1174 		arg = strdelim(&cp);
1175 		if (!arg || *arg == '\0')
1176 			fatal("%s line %d: Missing argument.", filename, linenum);
1177 		if (!mac_valid(arg))
1178 			fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1179 			    filename, linenum, arg ? arg : "<NONE>");
1180 		if (options->macs == NULL)
1181 			options->macs = xstrdup(arg);
1182 		break;
1183 
1184 	case sProtocol:
1185 		intptr = &options->protocol;
1186 		arg = strdelim(&cp);
1187 		if (!arg || *arg == '\0')
1188 			fatal("%s line %d: Missing argument.", filename, linenum);
1189 		value = proto_spec(arg);
1190 		if (value == SSH_PROTO_UNKNOWN)
1191 			fatal("%s line %d: Bad protocol spec '%s'.",
1192 			    filename, linenum, arg ? arg : "<NONE>");
1193 		if (*intptr == SSH_PROTO_UNKNOWN)
1194 			*intptr = value;
1195 		break;
1196 
1197 	case sSubsystem:
1198 		if (options->num_subsystems >= MAX_SUBSYSTEMS) {
1199 			fatal("%s line %d: too many subsystems defined.",
1200 			    filename, linenum);
1201 		}
1202 		arg = strdelim(&cp);
1203 		if (!arg || *arg == '\0')
1204 			fatal("%s line %d: Missing subsystem name.",
1205 			    filename, linenum);
1206 		if (!*activep) {
1207 			arg = strdelim(&cp);
1208 			break;
1209 		}
1210 		for (i = 0; i < options->num_subsystems; i++)
1211 			if (strcmp(arg, options->subsystem_name[i]) == 0)
1212 				fatal("%s line %d: Subsystem '%s' already defined.",
1213 				    filename, linenum, arg);
1214 		options->subsystem_name[options->num_subsystems] = xstrdup(arg);
1215 		arg = strdelim(&cp);
1216 		if (!arg || *arg == '\0')
1217 			fatal("%s line %d: Missing subsystem command.",
1218 			    filename, linenum);
1219 		options->subsystem_command[options->num_subsystems] = xstrdup(arg);
1220 
1221 		/*
1222 		 * Collect arguments (separate to executable), including the
1223 		 * name of the executable, in a way that is easier to parse
1224 		 * later.
1225 		 */
1226 		p = xstrdup(arg);
1227 		len = strlen(p) + 1;
1228 		while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
1229 			len += 1 + strlen(arg);
1230 			p = xrealloc(p, len);
1231 			strlcat(p, " ", len);
1232 			strlcat(p, arg, len);
1233 		}
1234 		options->subsystem_args[options->num_subsystems] = p;
1235 		options->num_subsystems++;
1236 		break;
1237 
1238 	case sMaxStartups:
1239 		arg = strdelim(&cp);
1240 		if (!arg || *arg == '\0')
1241 			fatal("%s line %d: Missing MaxStartups spec.",
1242 			    filename, linenum);
1243 		if ((n = sscanf(arg, "%d:%d:%d",
1244 		    &options->max_startups_begin,
1245 		    &options->max_startups_rate,
1246 		    &options->max_startups)) == 3) {
1247 			if (options->max_startups_begin >
1248 			    options->max_startups ||
1249 			    options->max_startups_rate > 100 ||
1250 			    options->max_startups_rate < 1)
1251 				fatal("%s line %d: Illegal MaxStartups spec.",
1252 				    filename, linenum);
1253 		} else if (n != 1)
1254 			fatal("%s line %d: Illegal MaxStartups spec.",
1255 			    filename, linenum);
1256 		else
1257 			options->max_startups = options->max_startups_begin;
1258 		break;
1259 
1260 	case sBanner:
1261 		charptr = &options->banner;
1262 		goto parse_filename;
1263 	/*
1264 	 * These options can contain %X options expanded at
1265 	 * connect time, so that you can specify paths like:
1266 	 *
1267 	 * AuthorizedKeysFile	/etc/ssh_keys/%u
1268 	 */
1269 	case sAuthorizedKeysFile:
1270 	case sAuthorizedKeysFile2:
1271 		charptr = (opcode == sAuthorizedKeysFile) ?
1272 		    &options->authorized_keys_file :
1273 		    &options->authorized_keys_file2;
1274 		goto parse_filename;
1275 
1276 	case sClientAliveInterval:
1277 		intptr = &options->client_alive_interval;
1278 		goto parse_time;
1279 
1280 	case sClientAliveCountMax:
1281 		intptr = &options->client_alive_count_max;
1282 		goto parse_int;
1283 
1284 	case sMaxAuthTries:
1285 		intptr = &options->max_auth_tries;
1286 		goto parse_int;
1287 
1288 	case sMaxAuthTriesLog:
1289 		intptr = &options->max_auth_tries_log;
1290 		goto parse_int;
1291 
1292 	case sLookupClientHostnames:
1293 		intptr = &options->lookup_client_hostnames;
1294 		goto parse_flag;
1295 
1296 	case sUseOpenSSLEngine:
1297 		intptr = &options->use_openssl_engine;
1298 		goto parse_flag;
1299 
1300 	case sChrootDirectory:
1301 		charptr = &options->chroot_directory;
1302 
1303 		arg = strdelim(&cp);
1304 		if (arg == NULL || *arg == '\0')
1305 			fatal("%s line %d: missing directory name for "
1306 			    "ChrootDirectory.", filename, linenum);
1307 		if (*activep && *charptr == NULL)
1308 			*charptr = xstrdup(arg);
1309 		break;
1310 
1311 	case sPreUserauthHook:
1312 		charptr = &options->pre_userauth_hook;
1313 		goto parse_filename;
1314 
1315 	case sMatch:
1316 		if (cmdline)
1317 			fatal("Match directive not supported as a command-line "
1318 			   "option");
1319 		value = match_cfg_line(&cp, linenum, user, host, address);
1320 		if (value < 0)
1321 			fatal("%s line %d: Bad Match condition", filename,
1322 			    linenum);
1323 		*activep = value;
1324 		break;
1325 
1326 	case sDeprecated:
1327 		log("%s line %d: Deprecated option %s",
1328 		    filename, linenum, arg);
1329 		while (arg)
1330 		    arg = strdelim(&cp);
1331 		break;
1332 
1333 	case sPAMServicePrefix:
1334 		arg = strdelim(&cp);
1335 		if (!arg || *arg == '\0')
1336 			fatal("%s line %d: Missing argument.",
1337 			    filename, linenum);
1338 		if (options->pam_service_name != NULL)
1339 			fatal("%s line %d: PAMServiceName and PAMServicePrefix "
1340 			    "are mutually exclusive.", filename, linenum);
1341 		if (options->pam_service_prefix == NULL)
1342 			options->pam_service_prefix = xstrdup(arg);
1343 		break;
1344 
1345 	case sPAMServiceName:
1346 		arg = strdelim(&cp);
1347 		if (!arg || *arg == '\0')
1348 			fatal("%s line %d: Missing argument.",
1349 			    filename, linenum);
1350 		if (options->pam_service_prefix != NULL)
1351 			fatal("%s line %d: PAMServiceName and PAMServicePrefix "
1352 			    "are mutually exclusive.", filename, linenum);
1353 		if (options->pam_service_name == NULL)
1354 			options->pam_service_name = xstrdup(arg);
1355 		break;
1356 
1357 	default:
1358 		fatal("%s line %d: Missing handler for opcode %s (%d)",
1359 		    filename, linenum, arg, opcode);
1360 	}
1361 	if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
1362 		fatal("%s line %d: garbage at end of line; \"%.200s\".",
1363 		    filename, linenum, arg);
1364 	return 0;
1365 }
1366 
1367 
1368 /* Reads the server configuration file. */
1369 
1370 void
1371 load_server_config(const char *filename, Buffer *conf)
1372 {
1373 	char line[1024], *cp;
1374 	FILE *f;
1375 
1376 	debug2("%s: filename %s", __func__, filename);
1377 	if ((f = fopen(filename, "r")) == NULL) {
1378 		perror(filename);
1379 		exit(1);
1380 	}
1381 	buffer_clear(conf);
1382 	while (fgets(line, sizeof(line), f)) {
1383 		/*
1384 		 * Trim out comments and strip whitespace
1385 		 * NB - preserve newlines, they are needed to reproduce
1386 		 * line numbers later for error messages
1387 		 */
1388 		if ((cp = strchr(line, '#')) != NULL)
1389 			memcpy(cp, "\n", 2);
1390 		cp = line + strspn(line, " \t\r");
1391 
1392 		buffer_append(conf, cp, strlen(cp));
1393 	}
1394 	buffer_append(conf, "\0", 1);
1395 	fclose(f);
1396 	debug2("%s: done config len = %d", __func__, buffer_len(conf));
1397 }
1398 
1399 void
1400 parse_server_match_config(ServerOptions *options, const char *user,
1401     const char *host, const char *address)
1402 {
1403 	ServerOptions mo;
1404 
1405 	initialize_server_options(&mo);
1406 	parse_server_config(&mo, "reprocess config", &cfg, user, host, address);
1407 	copy_set_server_options(options, &mo, 0);
1408 }
1409 
1410 
1411 
1412 /* Helper macros */
1413 #define M_CP_INTOPT(n) do {\
1414 	if (src->n != -1) \
1415 		dst->n = src->n; \
1416 } while (0)
1417 #define M_CP_STROPT(n) do {\
1418 	if (src->n != NULL) { \
1419 		if (dst->n != NULL) \
1420 			xfree(dst->n); \
1421 		dst->n = src->n; \
1422 	} \
1423 } while(0)
1424 
1425 /*
1426  * Copy any supported values that are set.
1427  *
1428  * If the preauth flag is set, we do not bother copying the the string or
1429  * array values that are not used pre-authentication, because any that we
1430  * do use must be explictly sent in mm_getpwnamallow().
1431  */
1432 void
1433 copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
1434 {
1435 	M_CP_INTOPT(password_authentication);
1436 	M_CP_INTOPT(gss_authentication);
1437 	M_CP_INTOPT(rsa_authentication);
1438 	M_CP_INTOPT(pubkey_authentication);
1439 	M_CP_INTOPT(hostbased_authentication);
1440 	M_CP_INTOPT(kbd_interactive_authentication);
1441 	M_CP_INTOPT(permit_root_login);
1442 	M_CP_INTOPT(permit_empty_passwd);
1443 	M_CP_INTOPT(allow_tcp_forwarding);
1444 	M_CP_INTOPT(gateway_ports);
1445 	M_CP_INTOPT(x11_display_offset);
1446 	M_CP_INTOPT(x11_forwarding);
1447 	M_CP_INTOPT(x11_use_localhost);
1448 	M_CP_INTOPT(max_auth_tries);
1449 	M_CP_STROPT(banner);
1450 
1451 	if (preauth)
1452 		return;
1453 	M_CP_STROPT(chroot_directory);
1454 }
1455 
1456 #undef M_CP_INTOPT
1457 #undef M_CP_STROPT
1458 
1459 void
1460 parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
1461     const char *user, const char *host, const char *address)
1462 {
1463 	int active, linenum, bad_options = 0;
1464 	char *cp, *obuf, *cbuf;
1465 
1466 	debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
1467 
1468 	obuf = cbuf = xstrdup(buffer_ptr(conf));
1469 	active = user ? 0 : 1;
1470 	linenum = 1;
1471 	while ((cp = strsep(&cbuf, "\n")) != NULL) {
1472 		if (process_server_config_line(options, cp, filename,
1473 		    linenum++, &active, user, host, address) != 0)
1474 			bad_options++;
1475 	}
1476 	xfree(obuf);
1477 	if (bad_options > 0)
1478 		fatal("%s: terminating, %d bad configuration options",
1479 		    filename, bad_options);
1480 }
1481 
1482 
1483 /*
1484  * Note that "none" is a special path having the same affect on sshd
1485  * configuration as not specifying ChrootDirectory at all.
1486  */
1487 int
1488 chroot_requested(char *chroot_directory)
1489 {
1490 	return (chroot_directory != NULL &&
1491 	    strcasecmp(chroot_directory, "none") != 0);
1492 }
1493