?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
- (dtucker) [contrib/aix/buildbff.sh] Fix creation of ssh_prng_cmds.default
[openssh-git.git] / servconf.c
blob7d027ddb990aeac82779b66cbdf9418b10322a76
1 /* $OpenBSD: servconf.c,v 1.207 2010/03/25 23:38:28 djm Exp $ */
2 /*
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4 * All rights reserved
5 *
6 * As far as I am concerned, the code I have written for this software
7 * can be used freely for any purpose. Any derived versions of this
8 * software must be clearly marked as such, and if the derived work is
9 * incompatible with the protocol description in the RFC file, it must be
10 * called by a name other than "ssh" or "Secure Shell".
11 */
12
13 #include "includes.h"
14
15 #include <sys/types.h>
16 #include <sys/socket.h>
17
18 #include <netdb.h>
19 #include <pwd.h>
20 #include <stdio.h>
21 #include <stdlib.h>
22 #include <string.h>
23 #include <signal.h>
24 #include <unistd.h>
25 #include <stdarg.h>
26 #include <errno.h>
27
28 #include "openbsd-compat/sys-queue.h"
29 #include "xmalloc.h"
30 #include "ssh.h"
31 #include "log.h"
32 #include "buffer.h"
33 #include "servconf.h"
34 #include "compat.h"
35 #include "pathnames.h"
36 #include "misc.h"
37 #include "cipher.h"
38 #include "key.h"
39 #include "kex.h"
40 #include "mac.h"
41 #include "match.h"
42 #include "channels.h"
43 #include "groupaccess.h"
44
45 static void add_listen_addr(ServerOptions *, char *, int);
46 static void add_one_listen_addr(ServerOptions *, char *, int);
47
48 /* Use of privilege separation or not */
49 extern int use_privsep;
50 extern Buffer cfg;
51
52 /* Initializes the server options to their default values. */
53
54 void
55 initialize_server_options(ServerOptions *options)
56 {
57 memset(options, 0, sizeof(*options));
58
59 /* Portable-specific options */
60 options->use_pam = -1;
61
62 /* Standard Options */
63 options->num_ports = 0;
64 options->ports_from_cmdline = 0;
65 options->listen_addrs = NULL;
66 options->address_family = -1;
67 options->num_host_key_files = 0;
68 options->num_host_cert_files = 0;
69 options->pid_file = NULL;
70 options->server_key_bits = -1;
71 options->login_grace_time = -1;
72 options->key_regeneration_time = -1;
73 options->permit_root_login = PERMIT_NOT_SET;
74 options->ignore_rhosts = -1;
75 options->ignore_user_known_hosts = -1;
76 options->print_motd = -1;
77 options->print_lastlog = -1;
78 options->x11_forwarding = -1;
79 options->x11_display_offset = -1;
80 options->x11_use_localhost = -1;
81 options->xauth_location = NULL;
82 options->strict_modes = -1;
83 options->tcp_keep_alive = -1;
84 options->log_facility = SYSLOG_FACILITY_NOT_SET;
85 options->log_level = SYSLOG_LEVEL_NOT_SET;
86 options->rhosts_rsa_authentication = -1;
87 options->hostbased_authentication = -1;
88 options->hostbased_uses_name_from_packet_only = -1;
89 options->rsa_authentication = -1;
90 options->pubkey_authentication = -1;
91 options->kerberos_authentication = -1;
92 options->kerberos_or_local_passwd = -1;
93 options->kerberos_ticket_cleanup = -1;
94 options->kerberos_get_afs_token = -1;
95 options->gss_authentication=-1;
96 options->gss_cleanup_creds = -1;
97 options->password_authentication = -1;
98 options->kbd_interactive_authentication = -1;
99 options->challenge_response_authentication = -1;
100 options->permit_empty_passwd = -1;
101 options->permit_user_env = -1;
102 options->use_login = -1;
103 options->compression = -1;
104 options->allow_tcp_forwarding = -1;
105 options->allow_agent_forwarding = -1;
106 options->num_allow_users = 0;
107 options->num_deny_users = 0;
108 options->num_allow_groups = 0;
109 options->num_deny_groups = 0;
110 options->ciphers = NULL;
111 options->macs = NULL;
112 options->protocol = SSH_PROTO_UNKNOWN;
113 options->gateway_ports = -1;
114 options->num_subsystems = 0;
115 options->max_startups_begin = -1;
116 options->max_startups_rate = -1;
117 options->max_startups = -1;
118 options->max_authtries = -1;
119 options->max_sessions = -1;
120 options->banner = NULL;
121 options->use_dns = -1;
122 options->client_alive_interval = -1;
123 options->client_alive_count_max = -1;
124 options->authorized_keys_file = NULL;
125 options->authorized_keys_file2 = NULL;
126 options->num_accept_env = 0;
127 options->permit_tun = -1;
128 options->num_permitted_opens = -1;
129 options->adm_forced_command = NULL;
130 options->chroot_directory = NULL;
131 options->zero_knowledge_password_authentication = -1;
132 options->revoked_keys_file = NULL;
133 options->trusted_user_ca_keys = NULL;
134 }
135
136 void
137 fill_default_server_options(ServerOptions *options)
138 {
139 /* Portable-specific options */
140 if (options->use_pam == -1)
141 options->use_pam = 0;
142
143 /* Standard Options */
144 if (options->protocol == SSH_PROTO_UNKNOWN)
145 options->protocol = SSH_PROTO_2;
146 if (options->num_host_key_files == 0) {
147 /* fill default hostkeys for protocols */
148 if (options->protocol & SSH_PROTO_1)
149 options->host_key_files[options->num_host_key_files++] =
150 _PATH_HOST_KEY_FILE;
151 if (options->protocol & SSH_PROTO_2) {
152 options->host_key_files[options->num_host_key_files++] =
153 _PATH_HOST_RSA_KEY_FILE;
154 options->host_key_files[options->num_host_key_files++] =
155 _PATH_HOST_DSA_KEY_FILE;
156 }
157 }
158 /* No certificates by default */
159 if (options->num_ports == 0)
160 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
161 if (options->listen_addrs == NULL)
162 add_listen_addr(options, NULL, 0);
163 if (options->pid_file == NULL)
164 options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
165 if (options->server_key_bits == -1)
166 options->server_key_bits = 1024;
167 if (options->login_grace_time == -1)
168 options->login_grace_time = 120;
169 if (options->key_regeneration_time == -1)
170 options->key_regeneration_time = 3600;
171 if (options->permit_root_login == PERMIT_NOT_SET)
172 options->permit_root_login = PERMIT_YES;
173 if (options->ignore_rhosts == -1)
174 options->ignore_rhosts = 1;
175 if (options->ignore_user_known_hosts == -1)
176 options->ignore_user_known_hosts = 0;
177 if (options->print_motd == -1)
178 options->print_motd = 1;
179 if (options->print_lastlog == -1)
180 options->print_lastlog = 1;
181 if (options->x11_forwarding == -1)
182 options->x11_forwarding = 0;
183 if (options->x11_display_offset == -1)
184 options->x11_display_offset = 10;
185 if (options->x11_use_localhost == -1)
186 options->x11_use_localhost = 1;
187 if (options->xauth_location == NULL)
188 options->xauth_location = _PATH_XAUTH;
189 if (options->strict_modes == -1)
190 options->strict_modes = 1;
191 if (options->tcp_keep_alive == -1)
192 options->tcp_keep_alive = 1;
193 if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
194 options->log_facility = SYSLOG_FACILITY_AUTH;
195 if (options->log_level == SYSLOG_LEVEL_NOT_SET)
196 options->log_level = SYSLOG_LEVEL_INFO;
197 if (options->rhosts_rsa_authentication == -1)
198 options->rhosts_rsa_authentication = 0;
199 if (options->hostbased_authentication == -1)
200 options->hostbased_authentication = 0;
201 if (options->hostbased_uses_name_from_packet_only == -1)
202 options->hostbased_uses_name_from_packet_only = 0;
203 if (options->rsa_authentication == -1)
204 options->rsa_authentication = 1;
205 if (options->pubkey_authentication == -1)
206 options->pubkey_authentication = 1;
207 if (options->kerberos_authentication == -1)
208 options->kerberos_authentication = 0;
209 if (options->kerberos_or_local_passwd == -1)
210 options->kerberos_or_local_passwd = 1;
211 if (options->kerberos_ticket_cleanup == -1)
212 options->kerberos_ticket_cleanup = 1;
213 if (options->kerberos_get_afs_token == -1)
214 options->kerberos_get_afs_token = 0;
215 if (options->gss_authentication == -1)
216 options->gss_authentication = 0;
217 if (options->gss_cleanup_creds == -1)
218 options->gss_cleanup_creds = 1;
219 if (options->password_authentication == -1)
220 options->password_authentication = 1;
221 if (options->kbd_interactive_authentication == -1)
222 options->kbd_interactive_authentication = 0;
223 if (options->challenge_response_authentication == -1)
224 options->challenge_response_authentication = 1;
225 if (options->permit_empty_passwd == -1)
226 options->permit_empty_passwd = 0;
227 if (options->permit_user_env == -1)
228 options->permit_user_env = 0;
229 if (options->use_login == -1)
230 options->use_login = 0;
231 if (options->compression == -1)
232 options->compression = COMP_DELAYED;
233 if (options->allow_tcp_forwarding == -1)
234 options->allow_tcp_forwarding = 1;
235 if (options->allow_agent_forwarding == -1)
236 options->allow_agent_forwarding = 1;
237 if (options->gateway_ports == -1)
238 options->gateway_ports = 0;
239 if (options->max_startups == -1)
240 options->max_startups = 10;
241 if (options->max_startups_rate == -1)
242 options->max_startups_rate = 100; /* 100% */
243 if (options->max_startups_begin == -1)
244 options->max_startups_begin = options->max_startups;
245 if (options->max_authtries == -1)
246 options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
247 if (options->max_sessions == -1)
248 options->max_sessions = DEFAULT_SESSIONS_MAX;
249 if (options->use_dns == -1)
250 options->use_dns = 1;
251 if (options->client_alive_interval == -1)
252 options->client_alive_interval = 0;
253 if (options->client_alive_count_max == -1)
254 options->client_alive_count_max = 3;
255 if (options->authorized_keys_file2 == NULL) {
256 /* authorized_keys_file2 falls back to authorized_keys_file */
257 if (options->authorized_keys_file != NULL)
258 options->authorized_keys_file2 = options->authorized_keys_file;
259 else
260 options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2;
261 }
262 if (options->authorized_keys_file == NULL)
263 options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;
264 if (options->permit_tun == -1)
265 options->permit_tun = SSH_TUNMODE_NO;
266 if (options->zero_knowledge_password_authentication == -1)
267 options->zero_knowledge_password_authentication = 0;
268
269 /* Turn privilege separation on by default */
270 if (use_privsep == -1)
271 use_privsep = 1;
272
273 #ifndef HAVE_MMAP
274 if (use_privsep && options->compression == 1) {
275 error("This platform does not support both privilege "
276 "separation and compression");
277 error("Compression disabled");
278 options->compression = 0;
279 }
280 #endif
281
282 }
283
284 /* Keyword tokens. */
285 typedef enum {
286 sBadOption, /* == unknown option */
287 /* Portable-specific options */
288 sUsePAM,
289 /* Standard Options */
290 sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
291 sPermitRootLogin, sLogFacility, sLogLevel,
292 sRhostsRSAAuthentication, sRSAAuthentication,
293 sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
294 sKerberosGetAFSToken,
295 sKerberosTgtPassing, sChallengeResponseAuthentication,
296 sPasswordAuthentication, sKbdInteractiveAuthentication,
297 sListenAddress, sAddressFamily,
298 sPrintMotd, sPrintLastLog, sIgnoreRhosts,
299 sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
300 sStrictModes, sEmptyPasswd, sTCPKeepAlive,
301 sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
302 sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
303 sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
304 sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
305 sMaxStartups, sMaxAuthTries, sMaxSessions,
306 sBanner, sUseDNS, sHostbasedAuthentication,
307 sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
308 sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
309 sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
310 sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
311 sUsePrivilegeSeparation, sAllowAgentForwarding,
312 sZeroKnowledgePasswordAuthentication, sHostCertificate,
313 sRevokedKeys, sTrustedUserCAKeys,
314 sDeprecated, sUnsupported
315 } ServerOpCodes;
316
317 #define SSHCFG_GLOBAL 0x01 /* allowed in main section of sshd_config */
318 #define SSHCFG_MATCH 0x02 /* allowed inside a Match section */
319 #define SSHCFG_ALL (SSHCFG_GLOBAL|SSHCFG_MATCH)
320
321 /* Textual representation of the tokens. */
322 static struct {
323 const char *name;
324 ServerOpCodes opcode;
325 u_int flags;
326 } keywords[] = {
327 /* Portable-specific options */
328 #ifdef USE_PAM
329 { "usepam", sUsePAM, SSHCFG_GLOBAL },
330 #else
331 { "usepam", sUnsupported, SSHCFG_GLOBAL },
332 #endif
333 { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
334 /* Standard Options */
335 { "port", sPort, SSHCFG_GLOBAL },
336 { "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
337 { "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL }, /* alias */
338 { "pidfile", sPidFile, SSHCFG_GLOBAL },
339 { "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL },
340 { "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
341 { "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL },
342 { "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
343 { "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
344 { "loglevel", sLogLevel, SSHCFG_GLOBAL },
345 { "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL },
346 { "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
347 { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
348 { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_GLOBAL },
349 { "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
350 { "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
351 { "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
352 #ifdef KRB5
353 { "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
354 { "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
355 { "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
356 #ifdef USE_AFS
357 { "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL },
358 #else
359 { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
360 #endif
361 #else
362 { "kerberosauthentication", sUnsupported, SSHCFG_ALL },
363 { "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
364 { "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
365 { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
366 #endif
367 { "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
368 { "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
369 #ifdef GSSAPI
370 { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
371 { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
372 #else
373 { "gssapiauthentication", sUnsupported, SSHCFG_ALL },
374 { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
375 #endif
376 { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
377 { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
378 { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
379 { "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
380 #ifdef JPAKE
381 { "zeroknowledgepasswordauthentication", sZeroKnowledgePasswordAuthentication, SSHCFG_ALL },
382 #else
383 { "zeroknowledgepasswordauthentication", sUnsupported, SSHCFG_ALL },
384 #endif
385 { "checkmail", sDeprecated, SSHCFG_GLOBAL },
386 { "listenaddress", sListenAddress, SSHCFG_GLOBAL },
387 { "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
388 { "printmotd", sPrintMotd, SSHCFG_GLOBAL },
389 { "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
390 { "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
391 { "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
392 { "x11forwarding", sX11Forwarding, SSHCFG_ALL },
393 { "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
394 { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
395 { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
396 { "strictmodes", sStrictModes, SSHCFG_GLOBAL },
397 { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
398 { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
399 { "uselogin", sUseLogin, SSHCFG_GLOBAL },
400 { "compression", sCompression, SSHCFG_GLOBAL },
401 { "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL },
402 { "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL }, /* obsolete alias */
403 { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
404 { "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL },
405 { "allowusers", sAllowUsers, SSHCFG_GLOBAL },
406 { "denyusers", sDenyUsers, SSHCFG_GLOBAL },
407 { "allowgroups", sAllowGroups, SSHCFG_GLOBAL },
408 { "denygroups", sDenyGroups, SSHCFG_GLOBAL },
409 { "ciphers", sCiphers, SSHCFG_GLOBAL },
410 { "macs", sMacs, SSHCFG_GLOBAL },
411 { "protocol", sProtocol, SSHCFG_GLOBAL },
412 { "gatewayports", sGatewayPorts, SSHCFG_ALL },
413 { "subsystem", sSubsystem, SSHCFG_GLOBAL },
414 { "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
415 { "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
416 { "maxsessions", sMaxSessions, SSHCFG_ALL },
417 { "banner", sBanner, SSHCFG_ALL },
418 { "usedns", sUseDNS, SSHCFG_GLOBAL },
419 { "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
420 { "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
421 { "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL },
422 { "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
423 { "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_GLOBAL },
424 { "authorizedkeysfile2", sAuthorizedKeysFile2, SSHCFG_GLOBAL },
425 { "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL},
426 { "acceptenv", sAcceptEnv, SSHCFG_GLOBAL },
427 { "permittunnel", sPermitTunnel, SSHCFG_GLOBAL },
428 { "match", sMatch, SSHCFG_ALL },
429 { "permitopen", sPermitOpen, SSHCFG_ALL },
430 { "forcecommand", sForceCommand, SSHCFG_ALL },
431 { "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
432 { "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
433 { "revokedkeys", sRevokedKeys, SSHCFG_ALL },
434 { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
435 { NULL, sBadOption, 0 }
436 };
437
438 static struct {
439 int val;
440 char *text;
441 } tunmode_desc[] = {
442 { SSH_TUNMODE_NO, "no" },
443 { SSH_TUNMODE_POINTOPOINT, "point-to-point" },
444 { SSH_TUNMODE_ETHERNET, "ethernet" },
445 { SSH_TUNMODE_YES, "yes" },
446 { -1, NULL }
447 };
448
449 /*
450 * Returns the number of the token pointed to by cp or sBadOption.
451 */
452
453 static ServerOpCodes
454 parse_token(const char *cp, const char *filename,
455 int linenum, u_int *flags)
456 {
457 u_int i;
458
459 for (i = 0; keywords[i].name; i++)
460 if (strcasecmp(cp, keywords[i].name) == 0) {
461 *flags = keywords[i].flags;
462 return keywords[i].opcode;
463 }
464
465 error("%s: line %d: Bad configuration option: %s",
466 filename, linenum, cp);
467 return sBadOption;
468 }
469
470 char *
471 derelativise_path(const char *path)
472 {
473 char *expanded, *ret, cwd[MAXPATHLEN];
474
475 expanded = tilde_expand_filename(path, getuid());
476 if (*expanded == '/')
477 return expanded;
478 if (getcwd(cwd, sizeof(cwd)) == NULL)
479 fatal("%s: getcwd: %s", __func__, strerror(errno));
480 xasprintf(&ret, "%s/%s", cwd, expanded);
481 xfree(expanded);
482 return ret;
483 }
484
485 static void
486 add_listen_addr(ServerOptions *options, char *addr, int port)
487 {
488 u_int i;
489
490 if (options->num_ports == 0)
491 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
492 if (options->address_family == -1)
493 options->address_family = AF_UNSPEC;
494 if (port == 0)
495 for (i = 0; i < options->num_ports; i++)
496 add_one_listen_addr(options, addr, options->ports[i]);
497 else
498 add_one_listen_addr(options, addr, port);
499 }
500
501 static void
502 add_one_listen_addr(ServerOptions *options, char *addr, int port)
503 {
504 struct addrinfo hints, *ai, *aitop;
505 char strport[NI_MAXSERV];
506 int gaierr;
507
508 memset(&hints, 0, sizeof(hints));
509 hints.ai_family = options->address_family;
510 hints.ai_socktype = SOCK_STREAM;
511 hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
512 snprintf(strport, sizeof strport, "%d", port);
513 if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
514 fatal("bad addr or host: %s (%s)",
515 addr ? addr : "<NULL>",
516 ssh_gai_strerror(gaierr));
517 for (ai = aitop; ai->ai_next; ai = ai->ai_next)
518 ;
519 ai->ai_next = options->listen_addrs;
520 options->listen_addrs = aitop;
521 }
522
523 /*
524 * The strategy for the Match blocks is that the config file is parsed twice.
525 *
526 * The first time is at startup. activep is initialized to 1 and the
527 * directives in the global context are processed and acted on. Hitting a
528 * Match directive unsets activep and the directives inside the block are
529 * checked for syntax only.
530 *
531 * The second time is after a connection has been established but before
532 * authentication. activep is initialized to 2 and global config directives
533 * are ignored since they have already been processed. If the criteria in a
534 * Match block is met, activep is set and the subsequent directives
535 * processed and actioned until EOF or another Match block unsets it. Any
536 * options set are copied into the main server config.
537 *
538 * Potential additions/improvements:
539 * - Add Match support for pre-kex directives, eg Protocol, Ciphers.
540 *
541 * - Add a Tag directive (idea from David Leonard) ala pf, eg:
542 * Match Address 192.168.0.*
543 * Tag trusted
544 * Match Group wheel
545 * Tag trusted
546 * Match Tag trusted
547 * AllowTcpForwarding yes
548 * GatewayPorts clientspecified
549 * [...]
550 *
551 * - Add a PermittedChannelRequests directive
552 * Match Group shell
553 * PermittedChannelRequests session,forwarded-tcpip
554 */
555
556 static int
557 match_cfg_line_group(const char *grps, int line, const char *user)
558 {
559 int result = 0;
560 struct passwd *pw;
561
562 if (user == NULL)
563 goto out;
564
565 if ((pw = getpwnam(user)) == NULL) {
566 debug("Can't match group at line %d because user %.100s does "
567 "not exist", line, user);
568 } else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
569 debug("Can't Match group because user %.100s not in any group "
570 "at line %d", user, line);
571 } else if (ga_match_pattern_list(grps) != 1) {
572 debug("user %.100s does not match group list %.100s at line %d",
573 user, grps, line);
574 } else {
575 debug("user %.100s matched group list %.100s at line %d", user,
576 grps, line);
577 result = 1;
578 }
579 out:
580 ga_free();
581 return result;
582 }
583
584 static int
585 match_cfg_line(char **condition, int line, const char *user, const char *host,
586 const char *address)
587 {
588 int result = 1;
589 char *arg, *attrib, *cp = *condition;
590 size_t len;
591
592 if (user == NULL)
593 debug3("checking syntax for 'Match %s'", cp);
594 else
595 debug3("checking match for '%s' user %s host %s addr %s", cp,
596 user ? user : "(null)", host ? host : "(null)",
597 address ? address : "(null)");
598
599 while ((attrib = strdelim(&cp)) && *attrib != '\0') {
600 if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
601 error("Missing Match criteria for %s", attrib);
602 return -1;
603 }
604 len = strlen(arg);
605 if (strcasecmp(attrib, "user") == 0) {
606 if (!user) {
607 result = 0;
608 continue;
609 }
610 if (match_pattern_list(user, arg, len, 0) != 1)
611 result = 0;
612 else
613 debug("user %.100s matched 'User %.100s' at "
614 "line %d", user, arg, line);
615 } else if (strcasecmp(attrib, "group") == 0) {
616 switch (match_cfg_line_group(arg, line, user)) {
617 case -1:
618 return -1;
619 case 0:
620 result = 0;
621 }
622 } else if (strcasecmp(attrib, "host") == 0) {
623 if (!host) {
624 result = 0;
625 continue;
626 }
627 if (match_hostname(host, arg, len) != 1)
628 result = 0;
629 else
630 debug("connection from %.100s matched 'Host "
631 "%.100s' at line %d", host, arg, line);
632 } else if (strcasecmp(attrib, "address") == 0) {
633 switch (addr_match_list(address, arg)) {
634 case 1:
635 debug("connection from %.100s matched 'Address "
636 "%.100s' at line %d", address, arg, line);
637 break;
638 case 0:
639 case -1:
640 result = 0;
641 break;
642 case -2:
643 return -1;
644 }
645 } else {
646 error("Unsupported Match attribute %s", attrib);
647 return -1;
648 }
649 }
650 if (user != NULL)
651 debug3("match %sfound", result ? "" : "not ");
652 *condition = cp;
653 return result;
654 }
655
656 #define WHITESPACE " \t\r\n"
657
658 int
659 process_server_config_line(ServerOptions *options, char *line,
660 const char *filename, int linenum, int *activep, const char *user,
661 const char *host, const char *address)
662 {
663 char *cp, **charptr, *arg, *p;
664 int cmdline = 0, *intptr, value, n;
665 SyslogFacility *log_facility_ptr;
666 LogLevel *log_level_ptr;
667 ServerOpCodes opcode;
668 int port;
669 u_int i, flags = 0;
670 size_t len;
671
672 cp = line;
673 if ((arg = strdelim(&cp)) == NULL)
674 return 0;
675 /* Ignore leading whitespace */
676 if (*arg == '\0')
677 arg = strdelim(&cp);
678 if (!arg || !*arg || *arg == '#')
679 return 0;
680 intptr = NULL;
681 charptr = NULL;
682 opcode = parse_token(arg, filename, linenum, &flags);
683
684 if (activep == NULL) { /* We are processing a command line directive */
685 cmdline = 1;
686 activep = &cmdline;
687 }
688 if (*activep && opcode != sMatch)
689 debug3("%s:%d setting %s %s", filename, linenum, arg, cp);
690 if (*activep == 0 && !(flags & SSHCFG_MATCH)) {
691 if (user == NULL) {
692 fatal("%s line %d: Directive '%s' is not allowed "
693 "within a Match block", filename, linenum, arg);
694 } else { /* this is a directive we have already processed */
695 while (arg)
696 arg = strdelim(&cp);
697 return 0;
698 }
699 }
700
701 switch (opcode) {
702 /* Portable-specific options */
703 case sUsePAM:
704 intptr = &options->use_pam;
705 goto parse_flag;
706
707 /* Standard Options */
708 case sBadOption:
709 return -1;
710 case sPort:
711 /* ignore ports from configfile if cmdline specifies ports */
712 if (options->ports_from_cmdline)
713 return 0;
714 if (options->listen_addrs != NULL)
715 fatal("%s line %d: ports must be specified before "
716 "ListenAddress.", filename, linenum);
717 if (options->num_ports >= MAX_PORTS)
718 fatal("%s line %d: too many ports.",
719 filename, linenum);
720 arg = strdelim(&cp);
721 if (!arg || *arg == '\0')
722 fatal("%s line %d: missing port number.",
723 filename, linenum);
724 options->ports[options->num_ports++] = a2port(arg);
725 if (options->ports[options->num_ports-1] <= 0)
726 fatal("%s line %d: Badly formatted port number.",
727 filename, linenum);
728 break;
729
730 case sServerKeyBits:
731 intptr = &options->server_key_bits;
732 parse_int:
733 arg = strdelim(&cp);
734 if (!arg || *arg == '\0')
735 fatal("%s line %d: missing integer value.",
736 filename, linenum);
737 value = atoi(arg);
738 if (*activep && *intptr == -1)
739 *intptr = value;
740 break;
741
742 case sLoginGraceTime:
743 intptr = &options->login_grace_time;
744 parse_time:
745 arg = strdelim(&cp);
746 if (!arg || *arg == '\0')
747 fatal("%s line %d: missing time value.",
748 filename, linenum);
749 if ((value = convtime(arg)) == -1)
750 fatal("%s line %d: invalid time value.",
751 filename, linenum);
752 if (*intptr == -1)
753 *intptr = value;
754 break;
755
756 case sKeyRegenerationTime:
757 intptr = &options->key_regeneration_time;
758 goto parse_time;
759
760 case sListenAddress:
761 arg = strdelim(&cp);
762 if (arg == NULL || *arg == '\0')
763 fatal("%s line %d: missing address",
764 filename, linenum);
765 /* check for bare IPv6 address: no "[]" and 2 or more ":" */
766 if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL
767 && strchr(p+1, ':') != NULL) {
768 add_listen_addr(options, arg, 0);
769 break;
770 }
771 p = hpdelim(&arg);
772 if (p == NULL)
773 fatal("%s line %d: bad address:port usage",
774 filename, linenum);
775 p = cleanhostname(p);
776 if (arg == NULL)
777 port = 0;
778 else if ((port = a2port(arg)) <= 0)
779 fatal("%s line %d: bad port number", filename, linenum);
780
781 add_listen_addr(options, p, port);
782
783 break;
784
785 case sAddressFamily:
786 arg = strdelim(&cp);
787 if (!arg || *arg == '\0')
788 fatal("%s line %d: missing address family.",
789 filename, linenum);
790 intptr = &options->address_family;
791 if (options->listen_addrs != NULL)
792 fatal("%s line %d: address family must be specified before "
793 "ListenAddress.", filename, linenum);
794 if (strcasecmp(arg, "inet") == 0)
795 value = AF_INET;
796 else if (strcasecmp(arg, "inet6") == 0)
797 value = AF_INET6;
798 else if (strcasecmp(arg, "any") == 0)
799 value = AF_UNSPEC;
800 else
801 fatal("%s line %d: unsupported address family \"%s\".",
802 filename, linenum, arg);
803 if (*intptr == -1)
804 *intptr = value;
805 break;
806
807 case sHostKeyFile:
808 intptr = &options->num_host_key_files;
809 if (*intptr >= MAX_HOSTKEYS)
810 fatal("%s line %d: too many host keys specified (max %d).",
811 filename, linenum, MAX_HOSTKEYS);
812 charptr = &options->host_key_files[*intptr];
813 parse_filename:
814 arg = strdelim(&cp);
815 if (!arg || *arg == '\0')
816 fatal("%s line %d: missing file name.",
817 filename, linenum);
818 if (*activep && *charptr == NULL) {
819 *charptr = derelativise_path(arg);
820 /* increase optional counter */
821 if (intptr != NULL)
822 *intptr = *intptr + 1;
823 }
824 break;
825
826 case sHostCertificate:
827 intptr = &options->num_host_cert_files;
828 if (*intptr >= MAX_HOSTKEYS)
829 fatal("%s line %d: too many host certificates "
830 "specified (max %d).", filename, linenum,
831 MAX_HOSTCERTS);
832 charptr = &options->host_cert_files[*intptr];
833 goto parse_filename;
834 break;
835
836 case sPidFile:
837 charptr = &options->pid_file;
838 goto parse_filename;
839
840 case sPermitRootLogin:
841 intptr = &options->permit_root_login;
842 arg = strdelim(&cp);
843 if (!arg || *arg == '\0')
844 fatal("%s line %d: missing yes/"
845 "without-password/forced-commands-only/no "
846 "argument.", filename, linenum);
847 value = 0; /* silence compiler */
848 if (strcmp(arg, "without-password") == 0)
849 value = PERMIT_NO_PASSWD;
850 else if (strcmp(arg, "forced-commands-only") == 0)
851 value = PERMIT_FORCED_ONLY;
852 else if (strcmp(arg, "yes") == 0)
853 value = PERMIT_YES;
854 else if (strcmp(arg, "no") == 0)
855 value = PERMIT_NO;
856 else
857 fatal("%s line %d: Bad yes/"
858 "without-password/forced-commands-only/no "
859 "argument: %s", filename, linenum, arg);
860 if (*activep && *intptr == -1)
861 *intptr = value;
862 break;
863
864 case sIgnoreRhosts:
865 intptr = &options->ignore_rhosts;
866 parse_flag:
867 arg = strdelim(&cp);
868 if (!arg || *arg == '\0')
869 fatal("%s line %d: missing yes/no argument.",
870 filename, linenum);
871 value = 0; /* silence compiler */
872 if (strcmp(arg, "yes") == 0)
873 value = 1;
874 else if (strcmp(arg, "no") == 0)
875 value = 0;
876 else
877 fatal("%s line %d: Bad yes/no argument: %s",
878 filename, linenum, arg);
879 if (*activep && *intptr == -1)
880 *intptr = value;
881 break;
882
883 case sIgnoreUserKnownHosts:
884 intptr = &options->ignore_user_known_hosts;
885 goto parse_flag;
886
887 case sRhostsRSAAuthentication:
888 intptr = &options->rhosts_rsa_authentication;
889 goto parse_flag;
890
891 case sHostbasedAuthentication:
892 intptr = &options->hostbased_authentication;
893 goto parse_flag;
894
895 case sHostbasedUsesNameFromPacketOnly:
896 intptr = &options->hostbased_uses_name_from_packet_only;
897 goto parse_flag;
898
899 case sRSAAuthentication:
900 intptr = &options->rsa_authentication;
901 goto parse_flag;
902
903 case sPubkeyAuthentication:
904 intptr = &options->pubkey_authentication;
905 goto parse_flag;
906
907 case sKerberosAuthentication:
908 intptr = &options->kerberos_authentication;
909 goto parse_flag;
910
911 case sKerberosOrLocalPasswd:
912 intptr = &options->kerberos_or_local_passwd;
913 goto parse_flag;
914
915 case sKerberosTicketCleanup:
916 intptr = &options->kerberos_ticket_cleanup;
917 goto parse_flag;
918
919 case sKerberosGetAFSToken:
920 intptr = &options->kerberos_get_afs_token;
921 goto parse_flag;
922
923 case sGssAuthentication:
924 intptr = &options->gss_authentication;
925 goto parse_flag;
926
927 case sGssCleanupCreds:
928 intptr = &options->gss_cleanup_creds;
929 goto parse_flag;
930
931 case sPasswordAuthentication:
932 intptr = &options->password_authentication;
933 goto parse_flag;
934
935 case sZeroKnowledgePasswordAuthentication:
936 intptr = &options->zero_knowledge_password_authentication;
937 goto parse_flag;
938
939 case sKbdInteractiveAuthentication:
940 intptr = &options->kbd_interactive_authentication;
941 goto parse_flag;
942
943 case sChallengeResponseAuthentication:
944 intptr = &options->challenge_response_authentication;
945 goto parse_flag;
946
947 case sPrintMotd:
948 intptr = &options->print_motd;
949 goto parse_flag;
950
951 case sPrintLastLog:
952 intptr = &options->print_lastlog;
953 goto parse_flag;
954
955 case sX11Forwarding:
956 intptr = &options->x11_forwarding;
957 goto parse_flag;
958
959 case sX11DisplayOffset:
960 intptr = &options->x11_display_offset;
961 goto parse_int;
962
963 case sX11UseLocalhost:
964 intptr = &options->x11_use_localhost;
965 goto parse_flag;
966
967 case sXAuthLocation:
968 charptr = &options->xauth_location;
969 goto parse_filename;
970
971 case sStrictModes:
972 intptr = &options->strict_modes;
973 goto parse_flag;
974
975 case sTCPKeepAlive:
976 intptr = &options->tcp_keep_alive;
977 goto parse_flag;
978
979 case sEmptyPasswd:
980 intptr = &options->permit_empty_passwd;
981 goto parse_flag;
982
983 case sPermitUserEnvironment:
984 intptr = &options->permit_user_env;
985 goto parse_flag;
986
987 case sUseLogin:
988 intptr = &options->use_login;
989 goto parse_flag;
990
991 case sCompression:
992 intptr = &options->compression;
993 arg = strdelim(&cp);
994 if (!arg || *arg == '\0')
995 fatal("%s line %d: missing yes/no/delayed "
996 "argument.", filename, linenum);
997 value = 0; /* silence compiler */
998 if (strcmp(arg, "delayed") == 0)
999 value = COMP_DELAYED;
1000 else if (strcmp(arg, "yes") == 0)
1001 value = COMP_ZLIB;
1002 else if (strcmp(arg, "no") == 0)
1003 value = COMP_NONE;
1004 else
1005 fatal("%s line %d: Bad yes/no/delayed "
1006 "argument: %s", filename, linenum, arg);
1007 if (*intptr == -1)
1008 *intptr = value;
1009 break;
1010
1011 case sGatewayPorts:
1012 intptr = &options->gateway_ports;
1013 arg = strdelim(&cp);
1014 if (!arg || *arg == '\0')
1015 fatal("%s line %d: missing yes/no/clientspecified "
1016 "argument.", filename, linenum);
1017 value = 0; /* silence compiler */
1018 if (strcmp(arg, "clientspecified") == 0)
1019 value = 2;
1020 else if (strcmp(arg, "yes") == 0)
1021 value = 1;
1022 else if (strcmp(arg, "no") == 0)
1023 value = 0;
1024 else
1025 fatal("%s line %d: Bad yes/no/clientspecified "
1026 "argument: %s", filename, linenum, arg);
1027 if (*activep && *intptr == -1)
1028 *intptr = value;
1029 break;
1030
1031 case sUseDNS:
1032 intptr = &options->use_dns;
1033 goto parse_flag;
1034
1035 case sLogFacility:
1036 log_facility_ptr = &options->log_facility;
1037 arg = strdelim(&cp);
1038 value = log_facility_number(arg);
1039 if (value == SYSLOG_FACILITY_NOT_SET)
1040 fatal("%.200s line %d: unsupported log facility '%s'",
1041 filename, linenum, arg ? arg : "<NONE>");
1042 if (*log_facility_ptr == -1)
1043 *log_facility_ptr = (SyslogFacility) value;
1044 break;
1045
1046 case sLogLevel:
1047 log_level_ptr = &options->log_level;
1048 arg = strdelim(&cp);
1049 value = log_level_number(arg);
1050 if (value == SYSLOG_LEVEL_NOT_SET)
1051 fatal("%.200s line %d: unsupported log level '%s'",
1052 filename, linenum, arg ? arg : "<NONE>");
1053 if (*log_level_ptr == -1)
1054 *log_level_ptr = (LogLevel) value;
1055 break;
1056
1057 case sAllowTcpForwarding:
1058 intptr = &options->allow_tcp_forwarding;
1059 goto parse_flag;
1060
1061 case sAllowAgentForwarding:
1062 intptr = &options->allow_agent_forwarding;
1063 goto parse_flag;
1064
1065 case sUsePrivilegeSeparation:
1066 intptr = &use_privsep;
1067 goto parse_flag;
1068
1069 case sAllowUsers:
1070 while ((arg = strdelim(&cp)) && *arg != '\0') {
1071 if (options->num_allow_users >= MAX_ALLOW_USERS)
1072 fatal("%s line %d: too many allow users.",
1073 filename, linenum);
1074 options->allow_users[options->num_allow_users++] =
1075 xstrdup(arg);
1076 }
1077 break;
1078
1079 case sDenyUsers:
1080 while ((arg = strdelim(&cp)) && *arg != '\0') {
1081 if (options->num_deny_users >= MAX_DENY_USERS)
1082 fatal("%s line %d: too many deny users.",
1083 filename, linenum);
1084 options->deny_users[options->num_deny_users++] =
1085 xstrdup(arg);
1086 }
1087 break;
1088
1089 case sAllowGroups:
1090 while ((arg = strdelim(&cp)) && *arg != '\0') {
1091 if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
1092 fatal("%s line %d: too many allow groups.",
1093 filename, linenum);
1094 options->allow_groups[options->num_allow_groups++] =
1095 xstrdup(arg);
1096 }
1097 break;
1098
1099 case sDenyGroups:
1100 while ((arg = strdelim(&cp)) && *arg != '\0') {
1101 if (options->num_deny_groups >= MAX_DENY_GROUPS)
1102 fatal("%s line %d: too many deny groups.",
1103 filename, linenum);
1104 options->deny_groups[options->num_deny_groups++] = xstrdup(arg);
1105 }
1106 break;
1107
1108 case sCiphers:
1109 arg = strdelim(&cp);
1110 if (!arg || *arg == '\0')
1111 fatal("%s line %d: Missing argument.", filename, linenum);
1112 if (!ciphers_valid(arg))
1113 fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1114 filename, linenum, arg ? arg : "<NONE>");
1115 if (options->ciphers == NULL)
1116 options->ciphers = xstrdup(arg);
1117 break;
1118
1119 case sMacs:
1120 arg = strdelim(&cp);
1121 if (!arg || *arg == '\0')
1122 fatal("%s line %d: Missing argument.", filename, linenum);
1123 if (!mac_valid(arg))
1124 fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1125 filename, linenum, arg ? arg : "<NONE>");
1126 if (options->macs == NULL)
1127 options->macs = xstrdup(arg);
1128 break;
1129
1130 case sProtocol:
1131 intptr = &options->protocol;
1132 arg = strdelim(&cp);
1133 if (!arg || *arg == '\0')
1134 fatal("%s line %d: Missing argument.", filename, linenum);
1135 value = proto_spec(arg);
1136 if (value == SSH_PROTO_UNKNOWN)
1137 fatal("%s line %d: Bad protocol spec '%s'.",
1138 filename, linenum, arg ? arg : "<NONE>");
1139 if (*intptr == SSH_PROTO_UNKNOWN)
1140 *intptr = value;
1141 break;
1142
1143 case sSubsystem:
1144 if (options->num_subsystems >= MAX_SUBSYSTEMS) {
1145 fatal("%s line %d: too many subsystems defined.",
1146 filename, linenum);
1147 }
1148 arg = strdelim(&cp);
1149 if (!arg || *arg == '\0')
1150 fatal("%s line %d: Missing subsystem name.",
1151 filename, linenum);
1152 if (!*activep) {
1153 arg = strdelim(&cp);
1154 break;
1155 }
1156 for (i = 0; i < options->num_subsystems; i++)
1157 if (strcmp(arg, options->subsystem_name[i]) == 0)
1158 fatal("%s line %d: Subsystem '%s' already defined.",
1159 filename, linenum, arg);
1160 options->subsystem_name[options->num_subsystems] = xstrdup(arg);
1161 arg = strdelim(&cp);
1162 if (!arg || *arg == '\0')
1163 fatal("%s line %d: Missing subsystem command.",
1164 filename, linenum);
1165 options->subsystem_command[options->num_subsystems] = xstrdup(arg);
1166
1167 /* Collect arguments (separate to executable) */
1168 p = xstrdup(arg);
1169 len = strlen(p) + 1;
1170 while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
1171 len += 1 + strlen(arg);
1172 p = xrealloc(p, 1, len);
1173 strlcat(p, " ", len);
1174 strlcat(p, arg, len);
1175 }
1176 options->subsystem_args[options->num_subsystems] = p;
1177 options->num_subsystems++;
1178 break;
1179
1180 case sMaxStartups:
1181 arg = strdelim(&cp);
1182 if (!arg || *arg == '\0')
1183 fatal("%s line %d: Missing MaxStartups spec.",
1184 filename, linenum);
1185 if ((n = sscanf(arg, "%d:%d:%d",
1186 &options->max_startups_begin,
1187 &options->max_startups_rate,
1188 &options->max_startups)) == 3) {
1189 if (options->max_startups_begin >
1190 options->max_startups ||
1191 options->max_startups_rate > 100 ||
1192 options->max_startups_rate < 1)
1193 fatal("%s line %d: Illegal MaxStartups spec.",
1194 filename, linenum);
1195 } else if (n != 1)
1196 fatal("%s line %d: Illegal MaxStartups spec.",
1197 filename, linenum);
1198 else
1199 options->max_startups = options->max_startups_begin;
1200 break;
1201
1202 case sMaxAuthTries:
1203 intptr = &options->max_authtries;
1204 goto parse_int;
1205
1206 case sMaxSessions:
1207 intptr = &options->max_sessions;
1208 goto parse_int;
1209
1210 case sBanner:
1211 charptr = &options->banner;
1212 goto parse_filename;
1213
1214 /*
1215 * These options can contain %X options expanded at
1216 * connect time, so that you can specify paths like:
1217 *
1218 * AuthorizedKeysFile /etc/ssh_keys/%u
1219 */
1220 case sAuthorizedKeysFile:
1221 case sAuthorizedKeysFile2:
1222 charptr = (opcode == sAuthorizedKeysFile) ?
1223 &options->authorized_keys_file :
1224 &options->authorized_keys_file2;
1225 arg = strdelim(&cp);
1226 if (!arg || *arg == '\0')
1227 fatal("%s line %d: missing file name.",
1228 filename, linenum);
1229 if (*activep && *charptr == NULL) {
1230 *charptr = tilde_expand_filename(arg, getuid());
1231 /* increase optional counter */
1232 if (intptr != NULL)
1233 *intptr = *intptr + 1;
1234 }
1235 break;
1236
1237 case sClientAliveInterval:
1238 intptr = &options->client_alive_interval;
1239 goto parse_time;
1240
1241 case sClientAliveCountMax:
1242 intptr = &options->client_alive_count_max;
1243 goto parse_int;
1244
1245 case sAcceptEnv:
1246 while ((arg = strdelim(&cp)) && *arg != '\0') {
1247 if (strchr(arg, '=') != NULL)
1248 fatal("%s line %d: Invalid environment name.",
1249 filename, linenum);
1250 if (options->num_accept_env >= MAX_ACCEPT_ENV)
1251 fatal("%s line %d: too many allow env.",
1252 filename, linenum);
1253 if (!*activep)
1254 break;
1255 options->accept_env[options->num_accept_env++] =
1256 xstrdup(arg);
1257 }
1258 break;
1259
1260 case sPermitTunnel:
1261 intptr = &options->permit_tun;
1262 arg = strdelim(&cp);
1263 if (!arg || *arg == '\0')
1264 fatal("%s line %d: Missing yes/point-to-point/"
1265 "ethernet/no argument.", filename, linenum);
1266 value = -1;
1267 for (i = 0; tunmode_desc[i].val != -1; i++)
1268 if (strcmp(tunmode_desc[i].text, arg) == 0) {
1269 value = tunmode_desc[i].val;
1270 break;
1271 }
1272 if (value == -1)
1273 fatal("%s line %d: Bad yes/point-to-point/ethernet/"
1274 "no argument: %s", filename, linenum, arg);
1275 if (*intptr == -1)
1276 *intptr = value;
1277 break;
1278
1279 case sMatch:
1280 if (cmdline)
1281 fatal("Match directive not supported as a command-line "
1282 "option");
1283 value = match_cfg_line(&cp, linenum, user, host, address);
1284 if (value < 0)
1285 fatal("%s line %d: Bad Match condition", filename,
1286 linenum);
1287 *activep = value;
1288 break;
1289
1290 case sPermitOpen:
1291 arg = strdelim(&cp);
1292 if (!arg || *arg == '\0')
1293 fatal("%s line %d: missing PermitOpen specification",
1294 filename, linenum);
1295 n = options->num_permitted_opens; /* modified later */
1296 if (strcmp(arg, "any") == 0) {
1297 if (*activep && n == -1) {
1298 channel_clear_adm_permitted_opens();
1299 options->num_permitted_opens = 0;
1300 }
1301 break;
1302 }
1303 if (*activep && n == -1)
1304 channel_clear_adm_permitted_opens();
1305 for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) {
1306 p = hpdelim(&arg);
1307 if (p == NULL)
1308 fatal("%s line %d: missing host in PermitOpen",
1309 filename, linenum);
1310 p = cleanhostname(p);
1311 if (arg == NULL || (port = a2port(arg)) <= 0)
1312 fatal("%s line %d: bad port number in "
1313 "PermitOpen", filename, linenum);
1314 if (*activep && n == -1)
1315 options->num_permitted_opens =
1316 channel_add_adm_permitted_opens(p, port);
1317 }
1318 break;
1319
1320 case sForceCommand:
1321 if (cp == NULL)
1322 fatal("%.200s line %d: Missing argument.", filename,
1323 linenum);
1324 len = strspn(cp, WHITESPACE);
1325 if (*activep && options->adm_forced_command == NULL)
1326 options->adm_forced_command = xstrdup(cp + len);
1327 return 0;
1328
1329 case sChrootDirectory:
1330 charptr = &options->chroot_directory;
1331
1332 arg = strdelim(&cp);
1333 if (!arg || *arg == '\0')
1334 fatal("%s line %d: missing file name.",
1335 filename, linenum);
1336 if (*activep && *charptr == NULL)
1337 *charptr = xstrdup(arg);
1338 break;
1339
1340 case sTrustedUserCAKeys:
1341 charptr = &options->trusted_user_ca_keys;
1342 goto parse_filename;
1343
1344 case sRevokedKeys:
1345 charptr = &options->revoked_keys_file;
1346 goto parse_filename;
1347
1348 case sDeprecated:
1349 logit("%s line %d: Deprecated option %s",
1350 filename, linenum, arg);
1351 while (arg)
1352 arg = strdelim(&cp);
1353 break;
1354
1355 case sUnsupported:
1356 logit("%s line %d: Unsupported option %s",
1357 filename, linenum, arg);
1358 while (arg)
1359 arg = strdelim(&cp);
1360 break;
1361
1362 default:
1363 fatal("%s line %d: Missing handler for opcode %s (%d)",
1364 filename, linenum, arg, opcode);
1365 }
1366 if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
1367 fatal("%s line %d: garbage at end of line; \"%.200s\".",
1368 filename, linenum, arg);
1369 return 0;
1370 }
1371
1372 /* Reads the server configuration file. */
1373
1374 void
1375 load_server_config(const char *filename, Buffer *conf)
1376 {
1377 char line[1024], *cp;
1378 FILE *f;
1379
1380 debug2("%s: filename %s", __func__, filename);
1381 if ((f = fopen(filename, "r")) == NULL) {
1382 perror(filename);
1383 exit(1);
1384 }
1385 buffer_clear(conf);
1386 while (fgets(line, sizeof(line), f)) {
1387 /*
1388 * Trim out comments and strip whitespace
1389 * NB - preserve newlines, they are needed to reproduce
1390 * line numbers later for error messages
1391 */
1392 if ((cp = strchr(line, '#')) != NULL)
1393 memcpy(cp, "\n", 2);
1394 cp = line + strspn(line, " \t\r");
1395
1396 buffer_append(conf, cp, strlen(cp));
1397 }
1398 buffer_append(conf, "\0", 1);
1399 fclose(f);
1400 debug2("%s: done config len = %d", __func__, buffer_len(conf));
1401 }
1402
1403 void
1404 parse_server_match_config(ServerOptions *options, const char *user,
1405 const char *host, const char *address)
1406 {
1407 ServerOptions mo;
1408
1409 initialize_server_options(&mo);
1410 parse_server_config(&mo, "reprocess config", &cfg, user, host, address);
1411 copy_set_server_options(options, &mo, 0);
1412 }
1413
1414 /* Helper macros */
1415 #define M_CP_INTOPT(n) do {\
1416 if (src->n != -1) \
1417 dst->n = src->n; \
1418 } while (0)
1419 #define M_CP_STROPT(n) do {\
1420 if (src->n != NULL) { \
1421 if (dst->n != NULL) \
1422 xfree(dst->n); \
1423 dst->n = src->n; \
1424 } \
1425 } while(0)
1426
1427 /*
1428 * Copy any supported values that are set.
1429 *
1430 * If the preauth flag is set, we do not bother copying the string or
1431 * array values that are not used pre-authentication, because any that we
1432 * do use must be explictly sent in mm_getpwnamallow().
1433 */
1434 void
1435 copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
1436 {
1437 M_CP_INTOPT(password_authentication);
1438 M_CP_INTOPT(gss_authentication);
1439 M_CP_INTOPT(rsa_authentication);
1440 M_CP_INTOPT(pubkey_authentication);
1441 M_CP_INTOPT(kerberos_authentication);
1442 M_CP_INTOPT(hostbased_authentication);
1443 M_CP_INTOPT(kbd_interactive_authentication);
1444 M_CP_INTOPT(zero_knowledge_password_authentication);
1445 M_CP_INTOPT(permit_root_login);
1446 M_CP_INTOPT(permit_empty_passwd);
1447
1448 M_CP_INTOPT(allow_tcp_forwarding);
1449 M_CP_INTOPT(allow_agent_forwarding);
1450 M_CP_INTOPT(gateway_ports);
1451 M_CP_INTOPT(x11_display_offset);
1452 M_CP_INTOPT(x11_forwarding);
1453 M_CP_INTOPT(x11_use_localhost);
1454 M_CP_INTOPT(max_sessions);
1455 M_CP_INTOPT(max_authtries);
1456
1457 M_CP_STROPT(banner);
1458 if (preauth)
1459 return;
1460 M_CP_STROPT(adm_forced_command);
1461 M_CP_STROPT(chroot_directory);
1462 M_CP_STROPT(trusted_user_ca_keys);
1463 M_CP_STROPT(revoked_keys_file);
1464 }
1465
1466 #undef M_CP_INTOPT
1467 #undef M_CP_STROPT
1468
1469 void
1470 parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
1471 const char *user, const char *host, const char *address)
1472 {
1473 int active, linenum, bad_options = 0;
1474 char *cp, *obuf, *cbuf;
1475
1476 debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
1477
1478 obuf = cbuf = xstrdup(buffer_ptr(conf));
1479 active = user ? 0 : 1;
1480 linenum = 1;
1481 while ((cp = strsep(&cbuf, "\n")) != NULL) {
1482 if (process_server_config_line(options, cp, filename,
1483 linenum++, &active, user, host, address) != 0)
1484 bad_options++;
1485 }
1486 xfree(obuf);
1487 if (bad_options > 0)
1488 fatal("%s: terminating, %d bad configuration options",
1489 filename, bad_options);
1490 }
1491
1492 static const char *
1493 fmt_intarg(ServerOpCodes code, int val)
1494 {
1495 if (code == sAddressFamily) {
1496 switch (val) {
1497 case AF_INET:
1498 return "inet";
1499 case AF_INET6:
1500 return "inet6";
1501 case AF_UNSPEC:
1502 return "any";
1503 default:
1504 return "UNKNOWN";
1505 }
1506 }
1507 if (code == sPermitRootLogin) {
1508 switch (val) {
1509 case PERMIT_NO_PASSWD:
1510 return "without-password";
1511 case PERMIT_FORCED_ONLY:
1512 return "forced-commands-only";
1513 case PERMIT_YES:
1514 return "yes";
1515 }
1516 }
1517 if (code == sProtocol) {
1518 switch (val) {
1519 case SSH_PROTO_1:
1520 return "1";
1521 case SSH_PROTO_2:
1522 return "2";
1523 case (SSH_PROTO_1|SSH_PROTO_2):
1524 return "2,1";
1525 default:
1526 return "UNKNOWN";
1527 }
1528 }
1529 if (code == sGatewayPorts && val == 2)
1530 return "clientspecified";
1531 if (code == sCompression && val == COMP_DELAYED)
1532 return "delayed";
1533 switch (val) {
1534 case -1:
1535 return "unset";
1536 case 0:
1537 return "no";
1538 case 1:
1539 return "yes";
1540 }
1541 return "UNKNOWN";
1542 }
1543
1544 static const char *
1545 lookup_opcode_name(ServerOpCodes code)
1546 {
1547 u_int i;
1548
1549 for (i = 0; keywords[i].name != NULL; i++)
1550 if (keywords[i].opcode == code)
1551 return(keywords[i].name);
1552 return "UNKNOWN";
1553 }
1554
1555 static void
1556 dump_cfg_int(ServerOpCodes code, int val)
1557 {
1558 printf("%s %d\n", lookup_opcode_name(code), val);
1559 }
1560
1561 static void
1562 dump_cfg_fmtint(ServerOpCodes code, int val)
1563 {
1564 printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
1565 }
1566
1567 static void
1568 dump_cfg_string(ServerOpCodes code, const char *val)
1569 {
1570 if (val == NULL)
1571 return;
1572 printf("%s %s\n", lookup_opcode_name(code), val);
1573 }
1574
1575 static void
1576 dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals)
1577 {
1578 u_int i;
1579
1580 for (i = 0; i < count; i++)
1581 printf("%s %s\n", lookup_opcode_name(code), vals[i]);
1582 }
1583
1584 void
1585 dump_config(ServerOptions *o)
1586 {
1587 u_int i;
1588 int ret;
1589 struct addrinfo *ai;
1590 char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL;
1591
1592 /* these are usually at the top of the config */
1593 for (i = 0; i < o->num_ports; i++)
1594 printf("port %d\n", o->ports[i]);
1595 dump_cfg_fmtint(sProtocol, o->protocol);
1596 dump_cfg_fmtint(sAddressFamily, o->address_family);
1597
1598 /* ListenAddress must be after Port */
1599 for (ai = o->listen_addrs; ai; ai = ai->ai_next) {
1600 if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr,
1601 sizeof(addr), port, sizeof(port),
1602 NI_NUMERICHOST|NI_NUMERICSERV)) != 0) {
1603 error("getnameinfo failed: %.100s",
1604 (ret != EAI_SYSTEM) ? gai_strerror(ret) :
1605 strerror(errno));
1606 } else {
1607 if (ai->ai_family == AF_INET6)
1608 printf("listenaddress [%s]:%s\n", addr, port);
1609 else
1610 printf("listenaddress %s:%s\n", addr, port);
1611 }
1612 }
1613
1614 /* integer arguments */
1615 #ifdef USE_PAM
1616 dump_cfg_int(sUsePAM, o->use_pam);
1617 #endif
1618 dump_cfg_int(sServerKeyBits, o->server_key_bits);
1619 dump_cfg_int(sLoginGraceTime, o->login_grace_time);
1620 dump_cfg_int(sKeyRegenerationTime, o->key_regeneration_time);
1621 dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
1622 dump_cfg_int(sMaxAuthTries, o->max_authtries);
1623 dump_cfg_int(sMaxSessions, o->max_sessions);
1624 dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
1625 dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max);
1626
1627 /* formatted integer arguments */
1628 dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login);
1629 dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts);
1630 dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts);
1631 dump_cfg_fmtint(sRhostsRSAAuthentication, o->rhosts_rsa_authentication);
1632 dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication);
1633 dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly,
1634 o->hostbased_uses_name_from_packet_only);
1635 dump_cfg_fmtint(sRSAAuthentication, o->rsa_authentication);
1636 dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication);
1637 #ifdef KRB5
1638 dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication);
1639 dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd);
1640 dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup);
1641 # ifdef USE_AFS
1642 dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
1643 # endif
1644 #endif
1645 #ifdef GSSAPI
1646 dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
1647 dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
1648 #endif
1649 #ifdef JPAKE
1650 dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication,
1651 o->zero_knowledge_password_authentication);
1652 #endif
1653 dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
1654 dump_cfg_fmtint(sKbdInteractiveAuthentication,
1655 o->kbd_interactive_authentication);
1656 dump_cfg_fmtint(sChallengeResponseAuthentication,
1657 o->challenge_response_authentication);
1658 dump_cfg_fmtint(sPrintMotd, o->print_motd);
1659 dump_cfg_fmtint(sPrintLastLog, o->print_lastlog);
1660 dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding);
1661 dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
1662 dump_cfg_fmtint(sStrictModes, o->strict_modes);
1663 dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
1664 dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
1665 dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
1666 dump_cfg_fmtint(sUseLogin, o->use_login);
1667 dump_cfg_fmtint(sCompression, o->compression);
1668 dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
1669 dump_cfg_fmtint(sUseDNS, o->use_dns);
1670 dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
1671 dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
1672
1673 /* string arguments */
1674 dump_cfg_string(sPidFile, o->pid_file);
1675 dump_cfg_string(sXAuthLocation, o->xauth_location);
1676 dump_cfg_string(sCiphers, o->ciphers);
1677 dump_cfg_string(sMacs, o->macs);
1678 dump_cfg_string(sBanner, o->banner);
1679 dump_cfg_string(sAuthorizedKeysFile, o->authorized_keys_file);
1680 dump_cfg_string(sAuthorizedKeysFile2, o->authorized_keys_file2);
1681 dump_cfg_string(sForceCommand, o->adm_forced_command);
1682 dump_cfg_string(sChrootDirectory, o->chroot_directory);
1683 dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
1684 dump_cfg_string(sRevokedKeys, o->revoked_keys_file);
1685
1686 /* string arguments requiring a lookup */
1687 dump_cfg_string(sLogLevel, log_level_name(o->log_level));
1688 dump_cfg_string(sLogFacility, log_facility_name(o->log_facility));
1689
1690 /* string array arguments */
1691 dump_cfg_strarray(sHostKeyFile, o->num_host_key_files,
1692 o->host_key_files);
1693 dump_cfg_strarray(sHostKeyFile, o->num_host_cert_files,
1694 o->host_cert_files);
1695 dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users);
1696 dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users);
1697 dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups);
1698 dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups);
1699 dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env);
1700
1701 /* other arguments */
1702 for (i = 0; i < o->num_subsystems; i++)
1703 printf("subsystem %s %s\n", o->subsystem_name[i],
1704 o->subsystem_args[i]);
1705
1706 printf("maxstartups %d:%d:%d\n", o->max_startups_begin,
1707 o->max_startups_rate, o->max_startups);
1708
1709 for (i = 0; tunmode_desc[i].val != -1; i++)
1710 if (tunmode_desc[i].val == o->permit_tun) {
1711 s = tunmode_desc[i].text;
1712 break;
1713 }
1714 dump_cfg_string(sPermitTunnel, s);
1715
1716 channel_print_adm_permitted_opens();
1717 }
A clone of openssh git repository