1 /*
2 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
3 * All rights reserved
4 *
5 * As far as I am concerned, the code I have written for this software
6 * can be used freely for any purpose. Any derived versions of this
7 * software must be clearly marked as such, and if the derived work is
8 * incompatible with the protocol description in the RFC file, it must be
9 * called by a name other than "ssh" or "Secure Shell".
10 */
11 /*
12 * Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved.
13 */
14
15 #include "includes.h"
16 RCSID("$OpenBSD: servconf.c,v 1.115 2002/09/04 18:52:42 stevesk Exp $");
17
18 #ifdef HAVE_DEFOPEN
19 #include <deflt.h>
20 #endif /* HAVE_DEFOPEN */
21
22 #if defined(KRB4)
23 #include <krb.h>
24 #endif
25 #if defined(KRB5)
26 #ifdef HEIMDAL
27 #include <krb.h>
28 #else
29 /* Bodge - but then, so is using the kerberos IV KEYFILE to get a Kerberos V
30 * keytab */
31 #define KEYFILE "/etc/krb5.keytab"
32 #endif
33 #endif
34 #ifdef AFS
35 #include <kafs.h>
36 #endif
37
38 #include "ssh.h"
39 #include "log.h"
40 #include "buffer.h"
41 #include "servconf.h"
42 #include "xmalloc.h"
43 #include "compat.h"
44 #include "pathnames.h"
45 #include "tildexpand.h"
46 #include "misc.h"
47 #include "cipher.h"
48 #include "kex.h"
49 #include "mac.h"
50 #include "auth.h"
51 #include "match.h"
52 #include "groupaccess.h"
53
54 static void add_listen_addr(ServerOptions *, char *, u_short);
55 static void add_one_listen_addr(ServerOptions *, char *, u_short);
56
57 extern Buffer cfg;
58
59 /* AF_UNSPEC or AF_INET or AF_INET6 */
60 extern int IPv4or6;
61
62 /*
63 * Initializes the server options to their initial (unset) values. Some of those
64 * that stay unset after the command line options and configuration files are
65 * read are set to their default values in fill_default_server_options().
66 */
67 void
68 initialize_server_options(ServerOptions *options)
69 {
70 (void) memset(options, 0, sizeof(*options));
71
72 /* Standard Options */
73 options->num_ports = 0;
74 options->ports_from_cmdline = 0;
75 options->listen_addrs = NULL;
76 options->num_host_key_files = 0;
77 options->pid_file = NULL;
78 options->server_key_bits = -1;
79 options->login_grace_time = -1;
80 options->key_regeneration_time = -1;
81 options->permit_root_login = PERMIT_NOT_SET;
82 options->ignore_rhosts = -1;
83 options->ignore_user_known_hosts = -1;
84 options->print_motd = -1;
85 options->print_lastlog = -1;
86 options->x11_forwarding = -1;
87 options->x11_display_offset = -1;
88 options->x11_use_localhost = -1;
89 options->xauth_location = NULL;
90 options->strict_modes = -1;
91 options->keepalives = -1;
92 options->log_facility = SYSLOG_FACILITY_NOT_SET;
93 options->log_level = SYSLOG_LEVEL_NOT_SET;
94 options->rhosts_authentication = -1;
95 options->rhosts_rsa_authentication = -1;
96 options->hostbased_authentication = -1;
97 options->hostbased_uses_name_from_packet_only = -1;
98 options->rsa_authentication = -1;
99 options->pubkey_authentication = -1;
100 #ifdef GSSAPI
101 options->gss_authentication = -1;
102 options->gss_keyex = -1;
103 options->gss_store_creds = -1;
104 options->gss_use_session_ccache = -1;
105 options->gss_cleanup_creds = -1;
106 #endif
107 #if defined(KRB4) || defined(KRB5)
108 options->kerberos_authentication = -1;
109 options->kerberos_or_local_passwd = -1;
110 options->kerberos_ticket_cleanup = -1;
111 #endif
112 #if defined(AFS) || defined(KRB5)
113 options->kerberos_tgt_passing = -1;
114 #endif
115 #ifdef AFS
116 options->afs_token_passing = -1;
117 #endif
118 options->password_authentication = -1;
119 options->kbd_interactive_authentication = -1;
120 options->challenge_response_authentication = -1;
121 options->pam_authentication_via_kbd_int = -1;
122 options->permit_empty_passwd = -1;
123 options->permit_user_env = -1;
124 options->compression = -1;
125 options->allow_tcp_forwarding = -1;
126 options->num_allow_users = 0;
127 options->num_deny_users = 0;
128 options->num_allow_groups = 0;
129 options->num_deny_groups = 0;
130 options->ciphers = NULL;
131 options->macs = NULL;
132 options->protocol = SSH_PROTO_UNKNOWN;
133 options->gateway_ports = -1;
134 options->num_subsystems = 0;
135 options->max_startups_begin = -1;
136 options->max_startups_rate = -1;
137 options->max_startups = -1;
138 options->banner = NULL;
139 options->verify_reverse_mapping = -1;
140 options->client_alive_interval = -1;
141 options->client_alive_count_max = -1;
142 options->authorized_keys_file = NULL;
143 options->authorized_keys_file2 = NULL;
144
145 options->max_auth_tries = -1;
146 options->max_auth_tries_log = -1;
147
148 options->max_init_auth_tries = -1;
149 options->max_init_auth_tries_log = -1;
150
151 options->lookup_client_hostnames = -1;
152 options->use_openssl_engine = -1;
153 options->chroot_directory = NULL;
154 options->pre_userauth_hook = NULL;
155 options->pam_service_name = NULL;
156 options->pam_service_prefix = NULL;
157 }
158
159 #ifdef HAVE_DEFOPEN
160 /*
161 * Reads /etc/default/login and defaults several ServerOptions:
162 *
163 * PermitRootLogin
164 * PermitEmptyPasswords
165 * LoginGraceTime
166 *
167 * CONSOLE=* -> PermitRootLogin=without-password
168 * #CONSOLE=* -> PermitRootLogin=yes
169 *
170 * PASSREQ=YES -> PermitEmptyPasswords=no
171 * PASSREQ=NO -> PermitEmptyPasswords=yes
172 * #PASSREQ=* -> PermitEmptyPasswords=no
173 *
174 * TIMEOUT=<secs> -> LoginGraceTime=<secs>
175 * #TIMEOUT=<secs> -> LoginGraceTime=300
176 */
177 static
178 void
179 deflt_fill_default_server_options(ServerOptions *options)
180 {
181 int flags;
182 char *ptr;
183
184 if (defopen(_PATH_DEFAULT_LOGIN))
185 return;
186
187 /* Ignore case */
188 flags = defcntl(DC_GETFLAGS, 0);
189 TURNOFF(flags, DC_CASE);
190 (void) defcntl(DC_SETFLAGS, flags);
191
192 if (options->permit_root_login == PERMIT_NOT_SET &&
193 (ptr = defread("CONSOLE=")) != NULL)
194 options->permit_root_login = PERMIT_NO_PASSWD;
195
196 if (options->permit_empty_passwd == -1 &&
197 (ptr = defread("PASSREQ=")) != NULL) {
198 if (strcasecmp("YES", ptr) == 0)
199 options->permit_empty_passwd = 0;
200 else if (strcasecmp("NO", ptr) == 0)
201 options->permit_empty_passwd = 1;
202 }
203
204 if (options->max_init_auth_tries == -1 &&
205 (ptr = defread("RETRIES=")) != NULL) {
206 options->max_init_auth_tries = atoi(ptr);
207 }
208
209 if (options->max_init_auth_tries_log == -1 &&
210 (ptr = defread("SYSLOG_FAILED_LOGINS=")) != NULL) {
211 options->max_init_auth_tries_log = atoi(ptr);
212 }
213
214 if (options->login_grace_time == -1) {
215 if ((ptr = defread("TIMEOUT=")) != NULL)
216 options->login_grace_time = (unsigned)atoi(ptr);
217 else
218 options->login_grace_time = 300;
219 }
220
221 (void) defopen((char *)NULL);
222 }
223 #endif /* HAVE_DEFOPEN */
224
225 void
226 fill_default_server_options(ServerOptions *options)
227 {
228
229 #ifdef HAVE_DEFOPEN
230 deflt_fill_default_server_options(options);
231 #endif /* HAVE_DEFOPEN */
232
233 /* Standard Options */
234 if (options->protocol == SSH_PROTO_UNKNOWN)
235 options->protocol = SSH_PROTO_1|SSH_PROTO_2;
236 if (options->num_host_key_files == 0) {
237 /* fill default hostkeys for protocols */
238 if (options->protocol & SSH_PROTO_1)
239 options->host_key_files[options->num_host_key_files++] =
240 _PATH_HOST_KEY_FILE;
241 #ifndef GSSAPI
242 /* With GSS keyex we can run v2 w/ no host keys */
243 if (options->protocol & SSH_PROTO_2) {
244 options->host_key_files[options->num_host_key_files++] =
245 _PATH_HOST_RSA_KEY_FILE;
246 options->host_key_files[options->num_host_key_files++] =
247 _PATH_HOST_DSA_KEY_FILE;
248 }
249 #endif /* GSSAPI */
250 }
251 if (options->num_ports == 0)
252 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
253 if (options->listen_addrs == NULL)
254 add_listen_addr(options, NULL, 0);
255 if (options->pid_file == NULL)
256 options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
257 if (options->server_key_bits == -1)
258 options->server_key_bits = 768;
259 if (options->login_grace_time == -1)
260 options->login_grace_time = 120;
261 if (options->key_regeneration_time == -1)
262 options->key_regeneration_time = 3600;
263 if (options->permit_root_login == PERMIT_NOT_SET)
264 options->permit_root_login = PERMIT_YES;
265 if (options->ignore_rhosts == -1)
266 options->ignore_rhosts = 1;
267 if (options->ignore_user_known_hosts == -1)
268 options->ignore_user_known_hosts = 0;
269 if (options->print_motd == -1)
270 options->print_motd = 1;
271 if (options->print_lastlog == -1)
272 options->print_lastlog = 1;
273 if (options->x11_forwarding == -1)
274 options->x11_forwarding = 1;
275 if (options->x11_display_offset == -1)
276 options->x11_display_offset = 10;
277 if (options->x11_use_localhost == -1)
278 options->x11_use_localhost = 1;
279 if (options->xauth_location == NULL)
280 options->xauth_location = _PATH_XAUTH;
281 if (options->strict_modes == -1)
282 options->strict_modes = 1;
283 if (options->keepalives == -1)
284 options->keepalives = 1;
285 if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
286 options->log_facility = SYSLOG_FACILITY_AUTH;
287 if (options->log_level == SYSLOG_LEVEL_NOT_SET)
288 options->log_level = SYSLOG_LEVEL_INFO;
289 if (options->rhosts_authentication == -1)
290 options->rhosts_authentication = 0;
291 if (options->rhosts_rsa_authentication == -1)
292 options->rhosts_rsa_authentication = 0;
293 if (options->hostbased_authentication == -1)
294 options->hostbased_authentication = 0;
295 if (options->hostbased_uses_name_from_packet_only == -1)
296 options->hostbased_uses_name_from_packet_only = 0;
297 if (options->rsa_authentication == -1)
298 options->rsa_authentication = 1;
299 if (options->pubkey_authentication == -1)
300 options->pubkey_authentication = 1;
301 #ifdef GSSAPI
302 if (options->gss_authentication == -1)
303 options->gss_authentication = 1;
304 if (options->gss_keyex == -1)
305 options->gss_keyex = 1;
306 if (options->gss_store_creds == -1)
307 options->gss_store_creds = 1;
308 if (options->gss_use_session_ccache == -1)
309 options->gss_use_session_ccache = 1;
310 if (options->gss_cleanup_creds == -1)
311 options->gss_cleanup_creds = 1;
312 #endif
313 #if defined(KRB4) || defined(KRB5)
314 if (options->kerberos_authentication == -1)
315 options->kerberos_authentication = 0;
316 if (options->kerberos_or_local_passwd == -1)
317 options->kerberos_or_local_passwd = 1;
318 if (options->kerberos_ticket_cleanup == -1)
319 options->kerberos_ticket_cleanup = 1;
320 #endif
321 #if defined(AFS) || defined(KRB5)
322 if (options->kerberos_tgt_passing == -1)
323 options->kerberos_tgt_passing = 0;
324 #endif
325 #ifdef AFS
326 if (options->afs_token_passing == -1)
327 options->afs_token_passing = 0;
328 #endif
329 if (options->password_authentication == -1)
330 options->password_authentication = 1;
331 /*
332 * options->pam_authentication_via_kbd_int has intentionally no default
333 * value since we do not need it.
334 */
335 if (options->kbd_interactive_authentication == -1)
336 options->kbd_interactive_authentication = 1;
337 if (options->challenge_response_authentication == -1)
338 options->challenge_response_authentication = 1;
339 if (options->permit_empty_passwd == -1)
340 options->permit_empty_passwd = 0;
341 if (options->permit_user_env == -1)
342 options->permit_user_env = 0;
343 if (options->compression == -1)
344 options->compression = 1;
345 if (options->allow_tcp_forwarding == -1)
346 options->allow_tcp_forwarding = 1;
347 if (options->gateway_ports == -1)
348 options->gateway_ports = 0;
349 if (options->max_startups == -1)
350 options->max_startups = 10;
351 if (options->max_startups_rate == -1)
352 options->max_startups_rate = 100; /* 100% */
353 if (options->max_startups_begin == -1)
354 options->max_startups_begin = options->max_startups;
355 if (options->verify_reverse_mapping == -1)
356 options->verify_reverse_mapping = 0;
357 if (options->client_alive_interval == -1)
358 options->client_alive_interval = 0;
359 if (options->client_alive_count_max == -1)
360 options->client_alive_count_max = 3;
361 if (options->authorized_keys_file2 == NULL) {
362 /* authorized_keys_file2 falls back to authorized_keys_file */
363 if (options->authorized_keys_file != NULL)
364 options->authorized_keys_file2 = options->authorized_keys_file;
365 else
366 options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2;
367 }
368 if (options->authorized_keys_file == NULL)
369 options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;
370
371 if (options->max_auth_tries == -1)
372 options->max_auth_tries = AUTH_FAIL_MAX;
373 if (options->max_auth_tries_log == -1)
374 options->max_auth_tries_log = options->max_auth_tries / 2;
375
376 if (options->max_init_auth_tries == -1)
377 options->max_init_auth_tries = AUTH_FAIL_MAX;
378 if (options->max_init_auth_tries_log == -1)
379 options->max_init_auth_tries_log = options->max_init_auth_tries / 2;
380
381 if (options->lookup_client_hostnames == -1)
382 options->lookup_client_hostnames = 1;
383 if (options->use_openssl_engine == -1)
384 options->use_openssl_engine = 1;
385 if (options->pam_service_prefix == NULL)
386 options->pam_service_prefix = _SSH_PAM_SERVICE_PREFIX;
387 if (options->pam_service_name == NULL)
388 options->pam_service_name = NULL;
389 }
390
391 /* Keyword tokens. */
392 typedef enum {
393 sBadOption, /* == unknown option */
394 /* Portable-specific options */
395 sPAMAuthenticationViaKbdInt,
396 /* Standard Options */
397 sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
398 sPermitRootLogin, sLogFacility, sLogLevel,
399 sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication,
400 #ifdef GSSAPI
401 sGssAuthentication, sGssKeyEx, sGssStoreDelegCreds,
402 sGssUseSessionCredCache, sGssCleanupCreds,
403 #endif /* GSSAPI */
404 #if defined(KRB4) || defined(KRB5)
405 sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
406 #endif
407 #if defined(AFS) || defined(KRB5)
408 sKerberosTgtPassing,
409 #endif
410 #ifdef AFS
411 sAFSTokenPassing,
412 #endif
413 sChallengeResponseAuthentication,
414 sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress,
415 sPrintMotd, sPrintLastLog, sIgnoreRhosts,
416 sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
417 sStrictModes, sEmptyPasswd, sKeepAlives,
418 sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
419 sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
420 sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
421 sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, sMaxStartups,
422 sBanner, sVerifyReverseMapping, sHostbasedAuthentication,
423 sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
424 sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
425 sMaxAuthTries, sMaxAuthTriesLog, sUsePrivilegeSeparation,
426 sLookupClientHostnames, sUseOpenSSLEngine, sChrootDirectory,
427 sPreUserauthHook, sMatch, sPAMServicePrefix, sPAMServiceName,
428 sDeprecated
429 } ServerOpCodes;
430
431 #define SSHCFG_GLOBAL 0x01 /* allowed in main section of sshd_config */
432 #define SSHCFG_MATCH 0x02 /* allowed inside a Match section */
433 #define SSHCFG_ALL (SSHCFG_GLOBAL|SSHCFG_MATCH)
434
435 /* Textual representation of the tokens. */
436 static struct {
437 const char *name;
438 ServerOpCodes opcode;
439 u_int flags;
440 } keywords[] = {
441 /* Portable-specific options */
442 { "PAMAuthenticationViaKbdInt", sPAMAuthenticationViaKbdInt, SSHCFG_GLOBAL },
443 /* Standard Options */
444 { "port", sPort, SSHCFG_GLOBAL },
445 { "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
446 { "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL }, /* alias */
447 { "pidfile", sPidFile, SSHCFG_GLOBAL },
448 { "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL },
449 { "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
450 { "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL },
451 { "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
452 { "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
453 { "loglevel", sLogLevel, SSHCFG_GLOBAL },
454 { "rhostsauthentication", sRhostsAuthentication, SSHCFG_GLOBAL },
455 { "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
456 { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
457 { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly },
458 { "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
459 { "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
460 { "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
461 #ifdef GSSAPI
462 { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
463 { "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
464 { "gssapistoredelegatedcredentials", sGssStoreDelegCreds, SSHCFG_GLOBAL },
465 { "gssauthentication", sGssAuthentication, SSHCFG_GLOBAL }, /* alias */
466 { "gsskeyex", sGssKeyEx, SSHCFG_GLOBAL }, /* alias */
467 { "gssstoredelegcreds", sGssStoreDelegCreds, SSHCFG_GLOBAL }, /* alias */
468 #ifndef SUNW_GSSAPI
469 { "gssusesessionccache", sGssUseSessionCredCache, SSHCFG_GLOBAL },
470 { "gssusesessioncredcache", sGssUseSessionCredCache, SSHCFG_GLOBAL },
471 { "gsscleanupcreds", sGssCleanupCreds, SSHCFG_GLOBAL },
472 #endif /* SUNW_GSSAPI */
473 #endif
474 #if defined(KRB4) || defined(KRB5)
475 { "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
476 { "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
477 { "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
478 #endif
479 #if defined(AFS) || defined(KRB5)
480 { "kerberostgtpassing", sKerberosTgtPassing, SSHCFG_GLOBAL },
481 #endif
482 #ifdef AFS
483 { "afstokenpassing", sAFSTokenPassing, SSHCFG_GLOBAL },
484 #endif
485 { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
486 { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
487 { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
488 { "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
489 { "checkmail", sDeprecated, SSHCFG_GLOBAL },
490 { "listenaddress", sListenAddress, SSHCFG_GLOBAL },
491 { "printmotd", sPrintMotd, SSHCFG_GLOBAL },
492 { "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
493 { "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
494 { "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
495 { "x11forwarding", sX11Forwarding, SSHCFG_ALL },
496 { "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
497 { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
498 { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
499 { "strictmodes", sStrictModes, SSHCFG_GLOBAL },
500 { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
501 { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
502 { "uselogin", sUseLogin, SSHCFG_GLOBAL },
503 { "compression", sCompression, SSHCFG_GLOBAL },
504 { "keepalive", sKeepAlives, SSHCFG_GLOBAL },
505 { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
506 { "allowusers", sAllowUsers, SSHCFG_GLOBAL },
507 { "denyusers", sDenyUsers, SSHCFG_GLOBAL },
508 { "allowgroups", sAllowGroups, SSHCFG_GLOBAL },
509 { "denygroups", sDenyGroups, SSHCFG_GLOBAL },
510 { "ciphers", sCiphers, SSHCFG_GLOBAL },
511 { "macs", sMacs, SSHCFG_GLOBAL},
512 { "protocol", sProtocol,SSHCFG_GLOBAL },
513 { "gatewayports", sGatewayPorts, SSHCFG_ALL },
514 { "subsystem", sSubsystem, SSHCFG_GLOBAL},
515 { "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
516 { "banner", sBanner, SSHCFG_ALL },
517 { "verifyreversemapping", sVerifyReverseMapping, SSHCFG_GLOBAL },
518 { "reversemappingcheck", sVerifyReverseMapping,SSHCFG_GLOBAL },
519 { "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL },
520 { "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
521 { "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_GLOBAL },
522 { "authorizedkeysfile2", sAuthorizedKeysFile2, SSHCFG_GLOBAL },
523 { "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
524 { "maxauthtrieslog", sMaxAuthTriesLog, SSHCFG_GLOBAL },
525 { "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL },
526 { "lookupclienthostnames", sLookupClientHostnames, SSHCFG_GLOBAL },
527 { "useopensslengine", sUseOpenSSLEngine, SSHCFG_GLOBAL },
528 { "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
529 { "preuserauthhook", sPreUserauthHook, SSHCFG_ALL},
530 { "match", sMatch, SSHCFG_ALL },
531 { "pamserviceprefix", sPAMServicePrefix, SSHCFG_GLOBAL },
532 { "pamservicename", sPAMServiceName, SSHCFG_GLOBAL },
533
534 { NULL, sBadOption, 0 }
535 };
536
537 /*
538 * Returns the number of the token pointed to by cp or sBadOption.
539 */
540
541 static ServerOpCodes
542 parse_token(const char *cp, const char *filename,
543 int linenum, u_int *flags)
544 {
545 u_int i;
546
547 for (i = 0; keywords[i].name; i++)
548 if (strcasecmp(cp, keywords[i].name) == 0) {
549 *flags = keywords[i].flags;
550 return keywords[i].opcode;
551 }
552
553 error("%s: line %d: Bad configuration option: %s",
554 filename, linenum, cp);
555 return sBadOption;
556 }
557
558 static void
559 add_listen_addr(ServerOptions *options, char *addr, u_short port)
560 {
561 int i;
562
563 if (options->num_ports == 0)
564 options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
565 if (port == 0)
566 for (i = 0; i < options->num_ports; i++)
567 add_one_listen_addr(options, addr, options->ports[i]);
568 else
569 add_one_listen_addr(options, addr, port);
570 }
571
572 static void
573 add_one_listen_addr(ServerOptions *options, char *addr, u_short port)
574 {
575 struct addrinfo hints, *ai, *aitop;
576 char strport[NI_MAXSERV];
577 int gaierr;
578
579 (void) memset(&hints, 0, sizeof(hints));
580 hints.ai_family = IPv4or6;
581 hints.ai_socktype = SOCK_STREAM;
582 hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
583 (void) snprintf(strport, sizeof strport, "%u", port);
584 if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
585 fatal("bad addr or host: %s (%s)",
586 addr ? addr : "<NULL>",
587 gai_strerror(gaierr));
588 for (ai = aitop; ai->ai_next; ai = ai->ai_next)
589 ;
590 ai->ai_next = options->listen_addrs;
591 options->listen_addrs = aitop;
592 }
593
594 /*
595 * The strategy for the Match blocks is that the config file is parsed twice.
596 *
597 * The first time is at startup. activep is initialized to 1 and the
598 * directives in the global context are processed and acted on. Hitting a
599 * Match directive unsets activep and the directives inside the block are
600 * checked for syntax only.
601 *
602 * The second time is after a connection has been established but before
603 * authentication. activep is initialized to 2 and global config directives
604 * are ignored since they have already been processed. If the criteria in a
605 * Match block is met, activep is set and the subsequent directives
606 * processed and actioned until EOF or another Match block unsets it. Any
607 * options set are copied into the main server config.
608 *
609 * Potential additions/improvements:
610 * - Add Match support for pre-kex directives, eg Protocol, Ciphers.
611 *
612 * - Add a Tag directive (idea from David Leonard) ala pf, eg:
613 * Match Address 192.168.0.*
614 * Tag trusted
615 * Match Group wheel
616 * Tag trusted
617 * Match Tag trusted
618 * AllowTcpForwarding yes
619 * GatewayPorts clientspecified
620 * [...]
621 *
622 * - Add a PermittedChannelRequests directive
623 * Match Group shell
624 * PermittedChannelRequests session,forwarded-tcpip
625 */
626
627 static int
628 match_cfg_line_group(const char *grps, int line, const char *user)
629 {
630 int result = 0;
631 struct passwd *pw;
632
633 if (user == NULL)
634 goto out;
635
636 if ((pw = getpwnam(user)) == NULL) {
637 debug("Can't match group at line %d because user %.100s does "
638 "not exist", line, user);
639 } else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
640 debug("Can't Match group because user %.100s not in any group "
641 "at line %d", user, line);
642 } else if (ga_match_pattern_list(grps) != 1) {
643 debug("user %.100s does not match group list %.100s at line %d",
644 user, grps, line);
645 } else {
646 debug("user %.100s matched group list %.100s at line %d", user,
647 grps, line);
648 result = 1;
649 }
650 out:
651 ga_free();
652 return result;
653 }
654
655 static int
656 match_cfg_line(char **condition, int line, const char *user, const char *host,
657 const char *address)
658 {
659 int result = 1;
660 char *arg, *attrib, *cp = *condition;
661 size_t len;
662
663 if (user == NULL)
664 debug3("checking syntax for 'Match %s'", cp);
665 else
666 debug3("checking match for '%s' user %s host %s addr %s", cp,
667 user ? user : "(null)", host ? host : "(null)",
668 address ? address : "(null)");
669
670 while ((attrib = strdelim(&cp)) != NULL && *attrib != '\0') {
671 if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
672 error("Missing Match criteria for %s", attrib);
673 return -1;
674 }
675 len = strlen(arg);
676 if (strcasecmp(attrib, "user") == 0) {
677 if (!user) {
678 result = 0;
679 continue;
680 }
681 if (match_pattern_list(user, arg, len, 0) != 1)
682 result = 0;
683 else
684 debug("user %.100s matched 'User %.100s' at "
685 "line %d", user, arg, line);
686 } else if (strcasecmp(attrib, "group") == 0) {
687 switch (match_cfg_line_group(arg, line, user)) {
688 case -1:
689 return -1;
690 case 0:
691 result = 0;
692 }
693 } else if (strcasecmp(attrib, "host") == 0) {
694 if (!host) {
695 result = 0;
696 continue;
697 }
698 if (match_hostname(host, arg, len) != 1)
699 result = 0;
700 else
701 debug("connection from %.100s matched 'Host "
702 "%.100s' at line %d", host, arg, line);
703 } else if (strcasecmp(attrib, "address") == 0) {
704 switch (addr_match_list(address, arg)) {
705 case 1:
706 debug("connection from %.100s matched 'Address "
707 "%.100s' at line %d", address, arg, line);
708 break;
709 case 0:
710 case -1:
711 result = 0;
712 break;
713 case -2:
714 return -1;
715 }
716 } else {
717 error("Unsupported Match attribute %s", attrib);
718 return -1;
719 }
720 }
721 if (user != NULL)
722 debug3("match %sfound", result ? "" : "not ");
723 *condition = cp;
724 return result;
725 }
726
727 #define WHITESPACE " \t\r\n"
728
729 int
730 process_server_config_line(ServerOptions *options, char *line,
731 const char *filename, int linenum, int *activep, const char *user,
732 const char *host, const char *address)
733 {
734 char *cp, **charptr, *arg, *p;
735 int cmdline = 0, *intptr, value, n;
736 ServerOpCodes opcode;
737 u_int i, flags = 0;
738 size_t len;
739
740 cp = line;
741 arg = strdelim(&cp);
742 /* Ignore leading whitespace */
743 if (*arg == '\0')
744 arg = strdelim(&cp);
745 if (!arg || !*arg || *arg == '#')
746 return 0;
747 intptr = NULL;
748 charptr = NULL;
749 opcode = parse_token(arg, filename, linenum, &flags);
750
751 if (activep == NULL) { /* We are processing a command line directive */
752 cmdline = 1;
753 activep = &cmdline;
754 }
755 if (*activep && opcode != sMatch)
756 debug3("%s:%d setting %s %s", filename, linenum, arg, cp);
757 if (*activep == 0 && !(flags & SSHCFG_MATCH)) {
758 if (user == NULL) {
759 fatal("%s line %d: Directive '%s' is not allowed "
760 "within a Match block", filename, linenum, arg);
761 } else { /* this is a directive we have already processed */
762 while (arg)
763 arg = strdelim(&cp);
764 return 0;
765 }
766 }
767
768 switch (opcode) {
769 /* Portable-specific options */
770 case sPAMAuthenticationViaKbdInt:
771 log("%s line %d: PAMAuthenticationViaKbdInt has been "
772 "deprecated. You should use KbdInteractiveAuthentication "
773 "instead (which defaults to \"yes\").", filename, linenum);
774 intptr = &options->pam_authentication_via_kbd_int;
775 goto parse_flag;
776
777 /* Standard Options */
778 case sBadOption:
779 return -1;
780 case sPort:
781 /* ignore ports from configfile if cmdline specifies ports */
782 if (options->ports_from_cmdline)
783 return 0;
784 if (options->listen_addrs != NULL)
785 fatal("%s line %d: ports must be specified before "
786 "ListenAddress.", filename, linenum);
787 if (options->num_ports >= MAX_PORTS)
788 fatal("%s line %d: too many ports.",
789 filename, linenum);
790 arg = strdelim(&cp);
791 if (!arg || *arg == '\0')
792 fatal("%s line %d: missing port number.",
793 filename, linenum);
794 options->ports[options->num_ports++] = a2port(arg);
795 if (options->ports[options->num_ports-1] == 0)
796 fatal("%s line %d: Badly formatted port number.",
797 filename, linenum);
798 break;
799
800 case sServerKeyBits:
801 intptr = &options->server_key_bits;
802 parse_int:
803 arg = strdelim(&cp);
804 if (!arg || *arg == '\0')
805 fatal("%s line %d: missing integer value.",
806 filename, linenum);
807 value = atoi(arg);
808 if (*activep && *intptr == -1)
809 *intptr = value;
810 break;
811
812 case sLoginGraceTime:
813 intptr = &options->login_grace_time;
814 parse_time:
815 arg = strdelim(&cp);
816 if (!arg || *arg == '\0')
817 fatal("%s line %d: missing time value.",
818 filename, linenum);
819 if ((value = convtime(arg)) == -1)
820 fatal("%s line %d: invalid time value.",
821 filename, linenum);
822 if (*intptr == -1)
823 *intptr = value;
824 break;
825
826 case sKeyRegenerationTime:
827 intptr = &options->key_regeneration_time;
828 goto parse_time;
829
830 case sListenAddress:
831 arg = strdelim(&cp);
832 if (!arg || *arg == '\0' || strncmp(arg, "[]", 2) == 0)
833 fatal("%s line %d: missing inet addr.",
834 filename, linenum);
835 if (*arg == '[') {
836 if ((p = strchr(arg, ']')) == NULL)
837 fatal("%s line %d: bad ipv6 inet addr usage.",
838 filename, linenum);
839 arg++;
840 (void) memmove(p, p+1, strlen(p+1)+1);
841 } else if (((p = strchr(arg, ':')) == NULL) ||
842 (strchr(p+1, ':') != NULL)) {
843 add_listen_addr(options, arg, 0);
844 break;
845 }
846 if (*p == ':') {
847 u_short port;
848
849 p++;
850 if (*p == '\0')
851 fatal("%s line %d: bad inet addr:port usage.",
852 filename, linenum);
853 else {
854 *(p-1) = '\0';
855 if ((port = a2port(p)) == 0)
856 fatal("%s line %d: bad port number.",
857 filename, linenum);
858 add_listen_addr(options, arg, port);
859 }
860 } else if (*p == '\0')
861 add_listen_addr(options, arg, 0);
862 else
863 fatal("%s line %d: bad inet addr usage.",
864 filename, linenum);
865 break;
866
867 case sHostKeyFile:
868 intptr = &options->num_host_key_files;
869 if (*intptr >= MAX_HOSTKEYS)
870 fatal("%s line %d: too many host keys specified (max %d).",
871 filename, linenum, MAX_HOSTKEYS);
872 charptr = &options->host_key_files[*intptr];
873 parse_filename:
874 arg = strdelim(&cp);
875 if (!arg || *arg == '\0')
876 fatal("%s line %d: missing file name.",
877 filename, linenum);
878 if (*activep && *charptr == NULL) {
879 *charptr = tilde_expand_filename(arg, getuid());
880 /* increase optional counter */
881 if (intptr != NULL)
882 *intptr = *intptr + 1;
883 }
884 break;
885
886 case sPidFile:
887 charptr = &options->pid_file;
888 goto parse_filename;
889
890 case sPermitRootLogin:
891 intptr = &options->permit_root_login;
892 arg = strdelim(&cp);
893 if (!arg || *arg == '\0')
894 fatal("%s line %d: missing yes/"
895 "without-password/forced-commands-only/no "
896 "argument.", filename, linenum);
897 value = 0; /* silence compiler */
898 if (strcmp(arg, "without-password") == 0)
899 value = PERMIT_NO_PASSWD;
900 else if (strcmp(arg, "forced-commands-only") == 0)
901 value = PERMIT_FORCED_ONLY;
902 else if (strcmp(arg, "yes") == 0)
903 value = PERMIT_YES;
904 else if (strcmp(arg, "no") == 0)
905 value = PERMIT_NO;
906 else
907 fatal("%s line %d: Bad yes/"
908 "without-password/forced-commands-only/no "
909 "argument: %s", filename, linenum, arg);
910 if (*activep && *intptr == -1)
911 *intptr = value;
912 break;
913
914 case sIgnoreRhosts:
915 intptr = &options->ignore_rhosts;
916 parse_flag:
917 arg = strdelim(&cp);
918 if (!arg || *arg == '\0')
919 fatal("%s line %d: missing yes/no argument.",
920 filename, linenum);
921 value = 0; /* silence compiler */
922 if (strcmp(arg, "yes") == 0)
923 value = 1;
924 else if (strcmp(arg, "no") == 0)
925 value = 0;
926 else
927 fatal("%s line %d: Bad yes/no argument: %s",
928 filename, linenum, arg);
929 if (*activep && *intptr == -1)
930 *intptr = value;
931 break;
932
933 case sIgnoreUserKnownHosts:
934 intptr = &options->ignore_user_known_hosts;
935 goto parse_flag;
936
937 case sRhostsAuthentication:
938 intptr = &options->rhosts_authentication;
939 goto parse_flag;
940
941 case sRhostsRSAAuthentication:
942 intptr = &options->rhosts_rsa_authentication;
943 goto parse_flag;
944
945 case sHostbasedAuthentication:
946 intptr = &options->hostbased_authentication;
947 goto parse_flag;
948
949 case sHostbasedUsesNameFromPacketOnly:
950 intptr = &options->hostbased_uses_name_from_packet_only;
951 goto parse_flag;
952
953 case sRSAAuthentication:
954 intptr = &options->rsa_authentication;
955 goto parse_flag;
956
957 case sPubkeyAuthentication:
958 intptr = &options->pubkey_authentication;
959 goto parse_flag;
960 #ifdef GSSAPI
961 case sGssAuthentication:
962 intptr = &options->gss_authentication;
963 goto parse_flag;
964 case sGssKeyEx:
965 intptr = &options->gss_keyex;
966 goto parse_flag;
967 case sGssStoreDelegCreds:
968 intptr = &options->gss_keyex;
969 goto parse_flag;
970 #ifndef SUNW_GSSAPI
971 case sGssUseSessionCredCache:
972 intptr = &options->gss_use_session_ccache;
973 goto parse_flag;
974 case sGssCleanupCreds:
975 intptr = &options->gss_cleanup_creds;
976 goto parse_flag;
977 #endif /* SUNW_GSSAPI */
978 #endif /* GSSAPI */
979 #if defined(KRB4) || defined(KRB5)
980 case sKerberosAuthentication:
981 intptr = &options->kerberos_authentication;
982 goto parse_flag;
983
984 case sKerberosOrLocalPasswd:
985 intptr = &options->kerberos_or_local_passwd;
986 goto parse_flag;
987
988 case sKerberosTicketCleanup:
989 intptr = &options->kerberos_ticket_cleanup;
990 goto parse_flag;
991 #endif
992 #if defined(AFS) || defined(KRB5)
993 case sKerberosTgtPassing:
994 intptr = &options->kerberos_tgt_passing;
995 goto parse_flag;
996 #endif
997 #ifdef AFS
998 case sAFSTokenPassing:
999 intptr = &options->afs_token_passing;
1000 goto parse_flag;
1001 #endif
1002
1003 case sPasswordAuthentication:
1004 intptr = &options->password_authentication;
1005 goto parse_flag;
1006
1007 case sKbdInteractiveAuthentication:
1008 intptr = &options->kbd_interactive_authentication;
1009 goto parse_flag;
1010
1011 case sChallengeResponseAuthentication:
1012 intptr = &options->challenge_response_authentication;
1013 goto parse_flag;
1014
1015 case sPrintMotd:
1016 intptr = &options->print_motd;
1017 goto parse_flag;
1018
1019 case sPrintLastLog:
1020 intptr = &options->print_lastlog;
1021 goto parse_flag;
1022
1023 case sX11Forwarding:
1024 intptr = &options->x11_forwarding;
1025 goto parse_flag;
1026
1027 case sX11DisplayOffset:
1028 intptr = &options->x11_display_offset;
1029 goto parse_int;
1030
1031 case sX11UseLocalhost:
1032 intptr = &options->x11_use_localhost;
1033 goto parse_flag;
1034
1035 case sXAuthLocation:
1036 charptr = &options->xauth_location;
1037 goto parse_filename;
1038
1039 case sStrictModes:
1040 intptr = &options->strict_modes;
1041 goto parse_flag;
1042
1043 case sKeepAlives:
1044 intptr = &options->keepalives;
1045 goto parse_flag;
1046
1047 case sEmptyPasswd:
1048 intptr = &options->permit_empty_passwd;
1049 goto parse_flag;
1050
1051 case sPermitUserEnvironment:
1052 intptr = &options->permit_user_env;
1053 goto parse_flag;
1054
1055 case sUseLogin:
1056 log("%s line %d: ignoring UseLogin option value."
1057 " This option is always off.", filename, linenum);
1058 while (arg)
1059 arg = strdelim(&cp);
1060 break;
1061
1062 case sCompression:
1063 intptr = &options->compression;
1064 goto parse_flag;
1065
1066 case sGatewayPorts:
1067 intptr = &options->gateway_ports;
1068 arg = strdelim(&cp);
1069 if (!arg || *arg == '\0')
1070 fatal("%s line %d: missing yes/no/clientspecified "
1071 "argument.", filename, linenum);
1072 value = 0; /* silence compiler */
1073 if (strcmp(arg, "clientspecified") == 0)
1074 value = 2;
1075 else if (strcmp(arg, "yes") == 0)
1076 value = 1;
1077 else if (strcmp(arg, "no") == 0)
1078 value = 0;
1079 else
1080 fatal("%s line %d: Bad yes/no/clientspecified "
1081 "argument: %s", filename, linenum, arg);
1082 if (*activep && *intptr == -1)
1083 *intptr = value;
1084 break;
1085
1086 case sVerifyReverseMapping:
1087 intptr = &options->verify_reverse_mapping;
1088 goto parse_flag;
1089
1090 case sLogFacility:
1091 intptr = (int *) &options->log_facility;
1092 arg = strdelim(&cp);
1093 value = log_facility_number(arg);
1094 if (value == SYSLOG_FACILITY_NOT_SET)
1095 fatal("%.200s line %d: unsupported log facility '%s'",
1096 filename, linenum, arg ? arg : "<NONE>");
1097 if (*intptr == -1)
1098 *intptr = (SyslogFacility) value;
1099 break;
1100
1101 case sLogLevel:
1102 intptr = (int *) &options->log_level;
1103 arg = strdelim(&cp);
1104 value = log_level_number(arg);
1105 if (value == SYSLOG_LEVEL_NOT_SET)
1106 fatal("%.200s line %d: unsupported log level '%s'",
1107 filename, linenum, arg ? arg : "<NONE>");
1108 if (*intptr == -1)
1109 *intptr = (LogLevel) value;
1110 break;
1111
1112 case sAllowTcpForwarding:
1113 intptr = &options->allow_tcp_forwarding;
1114 goto parse_flag;
1115
1116 case sUsePrivilegeSeparation:
1117 log("%s line %d: ignoring UsePrivilegeSeparation option value."
1118 " This option is always on.", filename, linenum);
1119 while (arg)
1120 arg = strdelim(&cp);
1121 break;
1122
1123 case sAllowUsers:
1124 while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') {
1125 if (options->num_allow_users >= MAX_ALLOW_USERS)
1126 fatal("%s line %d: too many allow users.",
1127 filename, linenum);
1128 options->allow_users[options->num_allow_users++] =
1129 xstrdup(arg);
1130 }
1131 break;
1132
1133 case sDenyUsers:
1134 while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') {
1135 if (options->num_deny_users >= MAX_DENY_USERS)
1136 fatal( "%s line %d: too many deny users.",
1137 filename, linenum);
1138 options->deny_users[options->num_deny_users++] =
1139 xstrdup(arg);
1140 }
1141 break;
1142
1143 case sAllowGroups:
1144 while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') {
1145 if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
1146 fatal("%s line %d: too many allow groups.",
1147 filename, linenum);
1148 options->allow_groups[options->num_allow_groups++] =
1149 xstrdup(arg);
1150 }
1151 break;
1152
1153 case sDenyGroups:
1154 while (((arg = strdelim(&cp)) != NULL) && *arg != '\0') {
1155 if (options->num_deny_groups >= MAX_DENY_GROUPS)
1156 fatal("%s line %d: too many deny groups.",
1157 filename, linenum);
1158 options->deny_groups[options->num_deny_groups++] = xstrdup(arg);
1159 }
1160 break;
1161
1162 case sCiphers:
1163 arg = strdelim(&cp);
1164 if (!arg || *arg == '\0')
1165 fatal("%s line %d: Missing argument.", filename, linenum);
1166 if (!ciphers_valid(arg))
1167 fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1168 filename, linenum, arg ? arg : "<NONE>");
1169 if (options->ciphers == NULL)
1170 options->ciphers = xstrdup(arg);
1171 break;
1172
1173 case sMacs:
1174 arg = strdelim(&cp);
1175 if (!arg || *arg == '\0')
1176 fatal("%s line %d: Missing argument.", filename, linenum);
1177 if (!mac_valid(arg))
1178 fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1179 filename, linenum, arg ? arg : "<NONE>");
1180 if (options->macs == NULL)
1181 options->macs = xstrdup(arg);
1182 break;
1183
1184 case sProtocol:
1185 intptr = &options->protocol;
1186 arg = strdelim(&cp);
1187 if (!arg || *arg == '\0')
1188 fatal("%s line %d: Missing argument.", filename, linenum);
1189 value = proto_spec(arg);
1190 if (value == SSH_PROTO_UNKNOWN)
1191 fatal("%s line %d: Bad protocol spec '%s'.",
1192 filename, linenum, arg ? arg : "<NONE>");
1193 if (*intptr == SSH_PROTO_UNKNOWN)
1194 *intptr = value;
1195 break;
1196
1197 case sSubsystem:
1198 if (options->num_subsystems >= MAX_SUBSYSTEMS) {
1199 fatal("%s line %d: too many subsystems defined.",
1200 filename, linenum);
1201 }
1202 arg = strdelim(&cp);
1203 if (!arg || *arg == '\0')
1204 fatal("%s line %d: Missing subsystem name.",
1205 filename, linenum);
1206 if (!*activep) {
1207 arg = strdelim(&cp);
1208 break;
1209 }
1210 for (i = 0; i < options->num_subsystems; i++)
1211 if (strcmp(arg, options->subsystem_name[i]) == 0)
1212 fatal("%s line %d: Subsystem '%s' already defined.",
1213 filename, linenum, arg);
1214 options->subsystem_name[options->num_subsystems] = xstrdup(arg);
1215 arg = strdelim(&cp);
1216 if (!arg || *arg == '\0')
1217 fatal("%s line %d: Missing subsystem command.",
1218 filename, linenum);
1219 options->subsystem_command[options->num_subsystems] = xstrdup(arg);
1220
1221 /*
1222 * Collect arguments (separate to executable), including the
1223 * name of the executable, in a way that is easier to parse
1224 * later.
1225 */
1226 p = xstrdup(arg);
1227 len = strlen(p) + 1;
1228 while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
1229 len += 1 + strlen(arg);
1230 p = xrealloc(p, len);
1231 strlcat(p, " ", len);
1232 strlcat(p, arg, len);
1233 }
1234 options->subsystem_args[options->num_subsystems] = p;
1235 options->num_subsystems++;
1236 break;
1237
1238 case sMaxStartups:
1239 arg = strdelim(&cp);
1240 if (!arg || *arg == '\0')
1241 fatal("%s line %d: Missing MaxStartups spec.",
1242 filename, linenum);
1243 if ((n = sscanf(arg, "%d:%d:%d",
1244 &options->max_startups_begin,
1245 &options->max_startups_rate,
1246 &options->max_startups)) == 3) {
1247 if (options->max_startups_begin >
1248 options->max_startups ||
1249 options->max_startups_rate > 100 ||
1250 options->max_startups_rate < 1)
1251 fatal("%s line %d: Illegal MaxStartups spec.",
1252 filename, linenum);
1253 } else if (n != 1)
1254 fatal("%s line %d: Illegal MaxStartups spec.",
1255 filename, linenum);
1256 else
1257 options->max_startups = options->max_startups_begin;
1258 break;
1259
1260 case sBanner:
1261 charptr = &options->banner;
1262 goto parse_filename;
1263 /*
1264 * These options can contain %X options expanded at
1265 * connect time, so that you can specify paths like:
1266 *
1267 * AuthorizedKeysFile /etc/ssh_keys/%u
1268 */
1269 case sAuthorizedKeysFile:
1270 case sAuthorizedKeysFile2:
1271 charptr = (opcode == sAuthorizedKeysFile) ?
1272 &options->authorized_keys_file :
1273 &options->authorized_keys_file2;
1274 goto parse_filename;
1275
1276 case sClientAliveInterval:
1277 intptr = &options->client_alive_interval;
1278 goto parse_time;
1279
1280 case sClientAliveCountMax:
1281 intptr = &options->client_alive_count_max;
1282 goto parse_int;
1283
1284 case sMaxAuthTries:
1285 intptr = &options->max_auth_tries;
1286 goto parse_int;
1287
1288 case sMaxAuthTriesLog:
1289 intptr = &options->max_auth_tries_log;
1290 goto parse_int;
1291
1292 case sLookupClientHostnames:
1293 intptr = &options->lookup_client_hostnames;
1294 goto parse_flag;
1295
1296 case sUseOpenSSLEngine:
1297 intptr = &options->use_openssl_engine;
1298 goto parse_flag;
1299
1300 case sChrootDirectory:
1301 charptr = &options->chroot_directory;
1302
1303 arg = strdelim(&cp);
1304 if (arg == NULL || *arg == '\0')
1305 fatal("%s line %d: missing directory name for "
1306 "ChrootDirectory.", filename, linenum);
1307 if (*activep && *charptr == NULL)
1308 *charptr = xstrdup(arg);
1309 break;
1310
1311 case sPreUserauthHook:
1312 charptr = &options->pre_userauth_hook;
1313 goto parse_filename;
1314
1315 case sMatch:
1316 if (cmdline)
1317 fatal("Match directive not supported as a command-line "
1318 "option");
1319 value = match_cfg_line(&cp, linenum, user, host, address);
1320 if (value < 0)
1321 fatal("%s line %d: Bad Match condition", filename,
1322 linenum);
1323 *activep = value;
1324 break;
1325
1326 case sDeprecated:
1327 log("%s line %d: Deprecated option %s",
1328 filename, linenum, arg);
1329 while (arg)
1330 arg = strdelim(&cp);
1331 break;
1332
1333 case sPAMServicePrefix:
1334 arg = strdelim(&cp);
1335 if (!arg || *arg == '\0')
1336 fatal("%s line %d: Missing argument.",
1337 filename, linenum);
1338 if (options->pam_service_name != NULL)
1339 fatal("%s line %d: PAMServiceName and PAMServicePrefix "
1340 "are mutually exclusive.", filename, linenum);
1341 if (options->pam_service_prefix == NULL)
1342 options->pam_service_prefix = xstrdup(arg);
1343 break;
1344
1345 case sPAMServiceName:
1346 arg = strdelim(&cp);
1347 if (!arg || *arg == '\0')
1348 fatal("%s line %d: Missing argument.",
1349 filename, linenum);
1350 if (options->pam_service_prefix != NULL)
1351 fatal("%s line %d: PAMServiceName and PAMServicePrefix "
1352 "are mutually exclusive.", filename, linenum);
1353 if (options->pam_service_name == NULL)
1354 options->pam_service_name = xstrdup(arg);
1355 break;
1356
1357 default:
1358 fatal("%s line %d: Missing handler for opcode %s (%d)",
1359 filename, linenum, arg, opcode);
1360 }
1361 if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
1362 fatal("%s line %d: garbage at end of line; \"%.200s\".",
1363 filename, linenum, arg);
1364 return 0;
1365 }
1366
1367
1368 /* Reads the server configuration file. */
1369
1370 void
1371 load_server_config(const char *filename, Buffer *conf)
1372 {
1373 char line[1024], *cp;
1374 FILE *f;
1375
1376 debug2("%s: filename %s", __func__, filename);
1377 if ((f = fopen(filename, "r")) == NULL) {
1378 perror(filename);
1379 exit(1);
1380 }
1381 buffer_clear(conf);
1382 while (fgets(line, sizeof(line), f)) {
1383 /*
1384 * Trim out comments and strip whitespace
1385 * NB - preserve newlines, they are needed to reproduce
1386 * line numbers later for error messages
1387 */
1388 if ((cp = strchr(line, '#')) != NULL)
1389 memcpy(cp, "\n", 2);
1390 cp = line + strspn(line, " \t\r");
1391
1392 buffer_append(conf, cp, strlen(cp));
1393 }
1394 buffer_append(conf, "\0", 1);
1395 fclose(f);
1396 debug2("%s: done config len = %d", __func__, buffer_len(conf));
1397 }
1398
1399 void
1400 parse_server_match_config(ServerOptions *options, const char *user,
1401 const char *host, const char *address)
1402 {
1403 ServerOptions mo;
1404
1405 initialize_server_options(&mo);
1406 parse_server_config(&mo, "reprocess config", &cfg, user, host, address);
1407 copy_set_server_options(options, &mo, 0);
1408 }
1409
1410
1411
1412 /* Helper macros */
1413 #define M_CP_INTOPT(n) do {\
1414 if (src->n != -1) \
1415 dst->n = src->n; \
1416 } while (0)
1417 #define M_CP_STROPT(n) do {\
1418 if (src->n != NULL) { \
1419 if (dst->n != NULL) \
1420 xfree(dst->n); \
1421 dst->n = src->n; \
1422 } \
1423 } while(0)
1424
1425 /*
1426 * Copy any supported values that are set.
1427 *
1428 * If the preauth flag is set, we do not bother copying the the string or
1429 * array values that are not used pre-authentication, because any that we
1430 * do use must be explictly sent in mm_getpwnamallow().
1431 */
1432 void
1433 copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
1434 {
1435 M_CP_INTOPT(password_authentication);
1436 M_CP_INTOPT(gss_authentication);
1437 M_CP_INTOPT(rsa_authentication);
1438 M_CP_INTOPT(pubkey_authentication);
1439 M_CP_INTOPT(hostbased_authentication);
1440 M_CP_INTOPT(kbd_interactive_authentication);
1441 M_CP_INTOPT(permit_root_login);
1442 M_CP_INTOPT(permit_empty_passwd);
1443 M_CP_INTOPT(allow_tcp_forwarding);
1444 M_CP_INTOPT(gateway_ports);
1445 M_CP_INTOPT(x11_display_offset);
1446 M_CP_INTOPT(x11_forwarding);
1447 M_CP_INTOPT(x11_use_localhost);
1448 M_CP_INTOPT(max_auth_tries);
1449 M_CP_STROPT(banner);
1450
1451 if (preauth)
1452 return;
1453 M_CP_STROPT(chroot_directory);
1454 }
1455
1456 #undef M_CP_INTOPT
1457 #undef M_CP_STROPT
1458
1459 void
1460 parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
1461 const char *user, const char *host, const char *address)
1462 {
1463 int active, linenum, bad_options = 0;
1464 char *cp, *obuf, *cbuf;
1465
1466 debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
1467
1468 obuf = cbuf = xstrdup(buffer_ptr(conf));
1469 active = user ? 0 : 1;
1470 linenum = 1;
1471 while ((cp = strsep(&cbuf, "\n")) != NULL) {
1472 if (process_server_config_line(options, cp, filename,
1473 linenum++, &active, user, host, address) != 0)
1474 bad_options++;
1475 }
1476 xfree(obuf);
1477 if (bad_options > 0)
1478 fatal("%s: terminating, %d bad configuration options",
1479 filename, bad_options);
1480 }
1481
1482
1483 /*
1484 * Note that "none" is a special path having the same affect on sshd
1485 * configuration as not specifying ChrootDirectory at all.
1486 */
1487 int
1488 chroot_requested(char *chroot_directory)
1489 {
1490 return (chroot_directory != NULL &&
1491 strcasecmp(chroot_directory, "none") != 0);
1492 }