1 2 /* $OpenBSD: servconf.c,v 1.280 2015/08/06 14:53:21 deraadt Exp $ */ 3 /* 4 * Copyright (c) 1995 Tatu Ylonen <ylo (at) cs.hut.fi>, Espoo, Finland 5 * All rights reserved 6 * 7 * As far as I am concerned, the code I have written for this software 8 * can be used freely for any purpose. Any derived versions of this 9 * software must be clearly marked as such, and if the derived work is 10 * incompatible with the protocol description in the RFC file, it must be 11 * called by a name other than "ssh" or "Secure Shell". 12 */ 13 14 #include "includes.h" 15 16 #include <sys/types.h> 17 #include <sys/socket.h> 18 19 #include <netinet/in.h> 20 #include <netinet/in_systm.h> 21 #include <netinet/ip.h> 22 23 #include <ctype.h> 24 #include <netdb.h> 25 #include <pwd.h> 26 #include <stdio.h> 27 #include <stdlib.h> 28 #include <string.h> 29 #include <signal.h> 30 #include <unistd.h> 31 #include <limits.h> 32 #include <stdarg.h> 33 #include <errno.h> 34 #ifdef HAVE_UTIL_H 35 #include <util.h> 36 #endif 37 38 #include "openbsd-compat/sys-queue.h" 39 #include "xmalloc.h" 40 #include "ssh.h" 41 #include "log.h" 42 #include "buffer.h" 43 #include "misc.h" 44 #include "servconf.h" 45 #include "compat.h" 46 #include "pathnames.h" 47 #include "cipher.h" 48 #include "key.h" 49 #include "kex.h" 50 #include "mac.h" 51 #include "match.h" 52 #include "channels.h" 53 #include "groupaccess.h" 54 #include "canohost.h" 55 #include "packet.h" 56 #include "hostfile.h" 57 #include "auth.h" 58 #include "myproposal.h" 59 #include "digest.h" 60 61 #ifdef ANDROID 62 #include <cutils/properties.h> 63 #endif 64 65 static void add_listen_addr(ServerOptions *, char *, int); 66 static void add_one_listen_addr(ServerOptions *, char *, int); 67 68 /* Use of privilege separation or not */ 69 extern int use_privsep; 70 extern Buffer cfg; 71 72 /* Initializes the server options to their default values. */ 73 74 void 75 initialize_server_options(ServerOptions *options) 76 { 77 memset(options, 0, sizeof(*options)); 78 79 /* Portable-specific options */ 80 options->use_pam = -1; 81 82 /* Standard Options */ 83 options->num_ports = 0; 84 options->ports_from_cmdline = 0; 85 options->queued_listen_addrs = NULL; 86 options->num_queued_listens = 0; 87 options->listen_addrs = NULL; 88 options->address_family = -1; 89 options->num_host_key_files = 0; 90 options->num_host_cert_files = 0; 91 options->host_key_agent = NULL; 92 options->pid_file = NULL; 93 options->server_key_bits = -1; 94 options->login_grace_time = -1; 95 options->key_regeneration_time = -1; 96 options->permit_root_login = PERMIT_NOT_SET; 97 options->ignore_rhosts = -1; 98 options->ignore_user_known_hosts = -1; 99 options->print_motd = -1; 100 options->print_lastlog = -1; 101 options->x11_forwarding = -1; 102 options->x11_display_offset = -1; 103 options->x11_use_localhost = -1; 104 options->permit_tty = -1; 105 options->permit_user_rc = -1; 106 options->xauth_location = NULL; 107 options->strict_modes = -1; 108 options->tcp_keep_alive = -1; 109 options->log_facility = SYSLOG_FACILITY_NOT_SET; 110 options->log_level = SYSLOG_LEVEL_NOT_SET; 111 options->rhosts_rsa_authentication = -1; 112 options->hostbased_authentication = -1; 113 options->hostbased_uses_name_from_packet_only = -1; 114 options->hostbased_key_types = NULL; 115 options->hostkeyalgorithms = NULL; 116 options->rsa_authentication = -1; 117 options->pubkey_authentication = -1; 118 options->pubkey_key_types = NULL; 119 options->kerberos_authentication = -1; 120 options->kerberos_or_local_passwd = -1; 121 options->kerberos_ticket_cleanup = -1; 122 options->kerberos_get_afs_token = -1; 123 options->gss_authentication=-1; 124 options->gss_cleanup_creds = -1; 125 options->gss_strict_acceptor = -1; 126 options->password_authentication = -1; 127 options->kbd_interactive_authentication = -1; 128 options->challenge_response_authentication = -1; 129 options->permit_empty_passwd = -1; 130 options->permit_user_env = -1; 131 options->use_login = -1; 132 options->compression = -1; 133 options->rekey_limit = -1; 134 options->rekey_interval = -1; 135 options->allow_tcp_forwarding = -1; 136 options->allow_streamlocal_forwarding = -1; 137 options->allow_agent_forwarding = -1; 138 options->num_allow_users = 0; 139 options->num_deny_users = 0; 140 options->num_allow_groups = 0; 141 options->num_deny_groups = 0; 142 options->ciphers = NULL; 143 options->macs = NULL; 144 options->kex_algorithms = NULL; 145 options->protocol = SSH_PROTO_UNKNOWN; 146 options->fwd_opts.gateway_ports = -1; 147 options->fwd_opts.streamlocal_bind_mask = (mode_t)-1; 148 options->fwd_opts.streamlocal_bind_unlink = -1; 149 options->num_subsystems = 0; 150 options->max_startups_begin = -1; 151 options->max_startups_rate = -1; 152 options->max_startups = -1; 153 options->max_authtries = -1; 154 options->max_sessions = -1; 155 options->banner = NULL; 156 options->use_dns = -1; 157 options->client_alive_interval = -1; 158 options->client_alive_count_max = -1; 159 options->num_authkeys_files = 0; 160 options->num_accept_env = 0; 161 options->permit_tun = -1; 162 options->num_permitted_opens = -1; 163 options->adm_forced_command = NULL; 164 options->chroot_directory = NULL; 165 options->authorized_keys_command = NULL; 166 options->authorized_keys_command_user = NULL; 167 options->revoked_keys_file = NULL; 168 options->trusted_user_ca_keys = NULL; 169 options->authorized_principals_file = NULL; 170 options->authorized_principals_command = NULL; 171 options->authorized_principals_command_user = NULL; 172 options->ip_qos_interactive = -1; 173 options->ip_qos_bulk = -1; 174 options->version_addendum = NULL; 175 options->fingerprint_hash = -1; 176 } 177 178 /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */ 179 static int 180 option_clear_or_none(const char *o) 181 { 182 return o == NULL || strcasecmp(o, "none") == 0; 183 } 184 185 void 186 fill_default_server_options(ServerOptions *options) 187 { 188 int i; 189 190 /* Portable-specific options */ 191 if (options->use_pam == -1) 192 options->use_pam = 0; 193 194 /* Standard Options */ 195 if (options->protocol == SSH_PROTO_UNKNOWN) 196 options->protocol = SSH_PROTO_2; 197 if (options->num_host_key_files == 0) { 198 /* fill default hostkeys for protocols */ 199 if (options->protocol & SSH_PROTO_1) 200 options->host_key_files[options->num_host_key_files++] = 201 _PATH_HOST_KEY_FILE; 202 if (options->protocol & SSH_PROTO_2) { 203 options->host_key_files[options->num_host_key_files++] = 204 _PATH_HOST_RSA_KEY_FILE; 205 options->host_key_files[options->num_host_key_files++] = 206 _PATH_HOST_DSA_KEY_FILE; 207 #ifdef OPENSSL_HAS_ECC 208 options->host_key_files[options->num_host_key_files++] = 209 _PATH_HOST_ECDSA_KEY_FILE; 210 #endif 211 options->host_key_files[options->num_host_key_files++] = 212 _PATH_HOST_ED25519_KEY_FILE; 213 } 214 } 215 /* No certificates by default */ 216 if (options->num_ports == 0) 217 options->ports[options->num_ports++] = SSH_DEFAULT_PORT; 218 if (options->address_family == -1) 219 options->address_family = AF_UNSPEC; 220 if (options->listen_addrs == NULL) 221 add_listen_addr(options, NULL, 0); 222 if (options->pid_file == NULL) 223 options->pid_file = xstrdup(_PATH_SSH_DAEMON_PID_FILE); 224 if (options->server_key_bits == -1) 225 options->server_key_bits = 1024; 226 if (options->login_grace_time == -1) 227 options->login_grace_time = 120; 228 if (options->key_regeneration_time == -1) 229 options->key_regeneration_time = 3600; 230 if (options->permit_root_login == PERMIT_NOT_SET) 231 options->permit_root_login = PERMIT_NO_PASSWD; 232 if (options->ignore_rhosts == -1) 233 options->ignore_rhosts = 1; 234 if (options->ignore_user_known_hosts == -1) 235 options->ignore_user_known_hosts = 0; 236 if (options->print_motd == -1) 237 options->print_motd = 1; 238 if (options->print_lastlog == -1) 239 options->print_lastlog = 1; 240 if (options->x11_forwarding == -1) 241 options->x11_forwarding = 0; 242 if (options->x11_display_offset == -1) 243 options->x11_display_offset = 10; 244 if (options->x11_use_localhost == -1) 245 options->x11_use_localhost = 1; 246 if (options->xauth_location == NULL) 247 options->xauth_location = xstrdup(_PATH_XAUTH); 248 if (options->permit_tty == -1) 249 options->permit_tty = 1; 250 if (options->permit_user_rc == -1) 251 options->permit_user_rc = 1; 252 if (options->strict_modes == -1) 253 options->strict_modes = 1; 254 if (options->tcp_keep_alive == -1) 255 options->tcp_keep_alive = 1; 256 if (options->log_facility == SYSLOG_FACILITY_NOT_SET) 257 options->log_facility = SYSLOG_FACILITY_AUTH; 258 if (options->log_level == SYSLOG_LEVEL_NOT_SET) 259 options->log_level = SYSLOG_LEVEL_INFO; 260 if (options->rhosts_rsa_authentication == -1) 261 options->rhosts_rsa_authentication = 0; 262 if (options->hostbased_authentication == -1) 263 options->hostbased_authentication = 0; 264 if (options->hostbased_uses_name_from_packet_only == -1) 265 options->hostbased_uses_name_from_packet_only = 0; 266 if (options->hostkeyalgorithms == NULL) 267 options->hostkeyalgorithms = xstrdup(KEX_DEFAULT_PK_ALG); 268 if (options->rsa_authentication == -1) 269 options->rsa_authentication = 1; 270 if (options->pubkey_authentication == -1) 271 options->pubkey_authentication = 1; 272 if (options->kerberos_authentication == -1) 273 options->kerberos_authentication = 0; 274 if (options->kerberos_or_local_passwd == -1) 275 options->kerberos_or_local_passwd = 1; 276 if (options->kerberos_ticket_cleanup == -1) 277 options->kerberos_ticket_cleanup = 1; 278 if (options->kerberos_get_afs_token == -1) 279 options->kerberos_get_afs_token = 0; 280 if (options->gss_authentication == -1) 281 options->gss_authentication = 0; 282 if (options->gss_cleanup_creds == -1) 283 options->gss_cleanup_creds = 1; 284 if (options->gss_strict_acceptor == -1) 285 options->gss_strict_acceptor = 0; 286 if (options->password_authentication == -1) 287 options->password_authentication = 1; 288 if (options->kbd_interactive_authentication == -1) 289 options->kbd_interactive_authentication = 0; 290 if (options->challenge_response_authentication == -1) 291 options->challenge_response_authentication = 1; 292 if (options->permit_empty_passwd == -1) 293 options->permit_empty_passwd = 0; 294 if (options->permit_user_env == -1) 295 options->permit_user_env = 0; 296 if (options->use_login == -1) 297 options->use_login = 0; 298 if (options->compression == -1) 299 options->compression = COMP_DELAYED; 300 if (options->rekey_limit == -1) 301 options->rekey_limit = 0; 302 if (options->rekey_interval == -1) 303 options->rekey_interval = 0; 304 if (options->allow_tcp_forwarding == -1) 305 options->allow_tcp_forwarding = FORWARD_ALLOW; 306 if (options->allow_streamlocal_forwarding == -1) 307 options->allow_streamlocal_forwarding = FORWARD_ALLOW; 308 if (options->allow_agent_forwarding == -1) 309 options->allow_agent_forwarding = 1; 310 if (options->fwd_opts.gateway_ports == -1) 311 options->fwd_opts.gateway_ports = 0; 312 if (options->max_startups == -1) 313 options->max_startups = 100; 314 if (options->max_startups_rate == -1) 315 options->max_startups_rate = 30; /* 30% */ 316 if (options->max_startups_begin == -1) 317 options->max_startups_begin = 10; 318 if (options->max_authtries == -1) 319 options->max_authtries = DEFAULT_AUTH_FAIL_MAX; 320 if (options->max_sessions == -1) 321 options->max_sessions = DEFAULT_SESSIONS_MAX; 322 if (options->use_dns == -1) 323 options->use_dns = 0; 324 if (options->client_alive_interval == -1) 325 options->client_alive_interval = 0; 326 if (options->client_alive_count_max == -1) 327 options->client_alive_count_max = 3; 328 if (options->num_authkeys_files == 0) { 329 options->authorized_keys_files[options->num_authkeys_files++] = 330 xstrdup(_PATH_SSH_USER_PERMITTED_KEYS); 331 options->authorized_keys_files[options->num_authkeys_files++] = 332 xstrdup(_PATH_SSH_USER_PERMITTED_KEYS2); 333 } 334 if (options->permit_tun == -1) 335 options->permit_tun = SSH_TUNMODE_NO; 336 if (options->ip_qos_interactive == -1) 337 options->ip_qos_interactive = IPTOS_LOWDELAY; 338 if (options->ip_qos_bulk == -1) 339 options->ip_qos_bulk = IPTOS_THROUGHPUT; 340 if (options->version_addendum == NULL) 341 options->version_addendum = xstrdup(""); 342 if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1) 343 options->fwd_opts.streamlocal_bind_mask = 0177; 344 if (options->fwd_opts.streamlocal_bind_unlink == -1) 345 options->fwd_opts.streamlocal_bind_unlink = 0; 346 if (options->fingerprint_hash == -1) 347 options->fingerprint_hash = SSH_FP_HASH_DEFAULT; 348 349 if (kex_assemble_names(KEX_SERVER_ENCRYPT, &options->ciphers) != 0 || 350 kex_assemble_names(KEX_SERVER_MAC, &options->macs) != 0 || 351 kex_assemble_names(KEX_SERVER_KEX, &options->kex_algorithms) != 0 || 352 kex_assemble_names(KEX_DEFAULT_PK_ALG, 353 &options->hostbased_key_types) != 0 || 354 kex_assemble_names(KEX_DEFAULT_PK_ALG, 355 &options->pubkey_key_types) != 0) 356 fatal("%s: kex_assemble_names failed", __func__); 357 358 /* Turn privilege separation on by default */ 359 if (use_privsep == -1) 360 use_privsep = PRIVSEP_NOSANDBOX; 361 362 #define CLEAR_ON_NONE(v) \ 363 do { \ 364 if (option_clear_or_none(v)) { \ 365 free(v); \ 366 v = NULL; \ 367 } \ 368 } while(0) 369 CLEAR_ON_NONE(options->pid_file); 370 CLEAR_ON_NONE(options->xauth_location); 371 CLEAR_ON_NONE(options->banner); 372 CLEAR_ON_NONE(options->trusted_user_ca_keys); 373 CLEAR_ON_NONE(options->revoked_keys_file); 374 CLEAR_ON_NONE(options->authorized_principals_file); 375 for (i = 0; i < options->num_host_key_files; i++) 376 CLEAR_ON_NONE(options->host_key_files[i]); 377 for (i = 0; i < options->num_host_cert_files; i++) 378 CLEAR_ON_NONE(options->host_cert_files[i]); 379 #undef CLEAR_ON_NONE 380 381 #ifndef HAVE_MMAP 382 if (use_privsep && options->compression == 1) { 383 error("This platform does not support both privilege " 384 "separation and compression"); 385 error("Compression disabled"); 386 options->compression = 0; 387 } 388 #endif 389 390 } 391 392 /* Keyword tokens. */ 393 typedef enum { 394 sBadOption, /* == unknown option */ 395 /* Portable-specific options */ 396 sUsePAM, 397 /* Standard Options */ 398 sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, 399 sKeyRegenerationTime, sPermitRootLogin, sLogFacility, sLogLevel, 400 sRhostsRSAAuthentication, sRSAAuthentication, 401 sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup, 402 sKerberosGetAFSToken, 403 sKerberosTgtPassing, sChallengeResponseAuthentication, 404 sPasswordAuthentication, sKbdInteractiveAuthentication, 405 sListenAddress, sAddressFamily, 406 sPrintMotd, sPrintLastLog, sIgnoreRhosts, 407 sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost, 408 sPermitTTY, sStrictModes, sEmptyPasswd, sTCPKeepAlive, 409 sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression, 410 sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups, 411 sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile, 412 sGatewayPorts, sPubkeyAuthentication, sPubkeyAcceptedKeyTypes, 413 sXAuthLocation, sSubsystem, sMaxStartups, sMaxAuthTries, sMaxSessions, 414 sBanner, sUseDNS, sHostbasedAuthentication, 415 sHostbasedUsesNameFromPacketOnly, sHostbasedAcceptedKeyTypes, 416 sHostKeyAlgorithms, 417 sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile, 418 sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor, 419 sAcceptEnv, sPermitTunnel, 420 sMatch, sPermitOpen, sForceCommand, sChrootDirectory, 421 sUsePrivilegeSeparation, sAllowAgentForwarding, 422 sHostCertificate, 423 sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile, 424 sAuthorizedPrincipalsCommand, sAuthorizedPrincipalsCommandUser, 425 sKexAlgorithms, sIPQoS, sVersionAddendum, 426 sAuthorizedKeysCommand, sAuthorizedKeysCommandUser, 427 sAuthenticationMethods, sHostKeyAgent, sPermitUserRC, 428 sStreamLocalBindMask, sStreamLocalBindUnlink, 429 sAllowStreamLocalForwarding, sFingerprintHash, 430 sDeprecated, sUnsupported 431 } ServerOpCodes; 432 433 #define SSHCFG_GLOBAL 0x01 /* allowed in main section of sshd_config */ 434 #define SSHCFG_MATCH 0x02 /* allowed inside a Match section */ 435 #define SSHCFG_ALL (SSHCFG_GLOBAL|SSHCFG_MATCH) 436 437 /* Textual representation of the tokens. */ 438 static struct { 439 const char *name; 440 ServerOpCodes opcode; 441 u_int flags; 442 } keywords[] = { 443 /* Portable-specific options */ 444 #ifdef USE_PAM 445 { "usepam", sUsePAM, SSHCFG_GLOBAL }, 446 #else 447 { "usepam", sUnsupported, SSHCFG_GLOBAL }, 448 #endif 449 { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL }, 450 /* Standard Options */ 451 { "port", sPort, SSHCFG_GLOBAL }, 452 { "hostkey", sHostKeyFile, SSHCFG_GLOBAL }, 453 { "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL }, /* alias */ 454 { "hostkeyagent", sHostKeyAgent, SSHCFG_GLOBAL }, 455 { "pidfile", sPidFile, SSHCFG_GLOBAL }, 456 { "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL }, 457 { "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL }, 458 { "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL }, 459 { "permitrootlogin", sPermitRootLogin, SSHCFG_ALL }, 460 { "syslogfacility", sLogFacility, SSHCFG_GLOBAL }, 461 { "loglevel", sLogLevel, SSHCFG_GLOBAL }, 462 { "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL }, 463 { "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL }, 464 { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL }, 465 { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_ALL }, 466 { "hostbasedacceptedkeytypes", sHostbasedAcceptedKeyTypes, SSHCFG_ALL }, 467 { "hostkeyalgorithms", sHostKeyAlgorithms, SSHCFG_GLOBAL }, 468 { "rsaauthentication", sRSAAuthentication, SSHCFG_ALL }, 469 { "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL }, 470 { "pubkeyacceptedkeytypes", sPubkeyAcceptedKeyTypes, SSHCFG_ALL }, 471 { "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */ 472 #ifdef KRB5 473 { "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL }, 474 { "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL }, 475 { "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL }, 476 #ifdef USE_AFS 477 { "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL }, 478 #else 479 { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL }, 480 #endif 481 #else 482 { "kerberosauthentication", sUnsupported, SSHCFG_ALL }, 483 { "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL }, 484 { "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL }, 485 { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL }, 486 #endif 487 { "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL }, 488 { "afstokenpassing", sUnsupported, SSHCFG_GLOBAL }, 489 #ifdef GSSAPI 490 { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL }, 491 { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL }, 492 { "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL }, 493 #else 494 { "gssapiauthentication", sUnsupported, SSHCFG_ALL }, 495 { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL }, 496 { "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL }, 497 #endif 498 { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL }, 499 { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL }, 500 { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, 501 { "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */ 502 { "checkmail", sDeprecated, SSHCFG_GLOBAL }, 503 { "listenaddress", sListenAddress, SSHCFG_GLOBAL }, 504 { "addressfamily", sAddressFamily, SSHCFG_GLOBAL }, 505 { "printmotd", sPrintMotd, SSHCFG_GLOBAL }, 506 { "printlastlog", sPrintLastLog, SSHCFG_GLOBAL }, 507 { "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL }, 508 { "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL }, 509 { "x11forwarding", sX11Forwarding, SSHCFG_ALL }, 510 { "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL }, 511 { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL }, 512 { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL }, 513 { "strictmodes", sStrictModes, SSHCFG_GLOBAL }, 514 { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL }, 515 { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL }, 516 { "uselogin", sUseLogin, SSHCFG_GLOBAL }, 517 { "compression", sCompression, SSHCFG_GLOBAL }, 518 { "rekeylimit", sRekeyLimit, SSHCFG_ALL }, 519 { "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL }, 520 { "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL }, /* obsolete alias */ 521 { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL }, 522 { "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL }, 523 { "allowusers", sAllowUsers, SSHCFG_ALL }, 524 { "denyusers", sDenyUsers, SSHCFG_ALL }, 525 { "allowgroups", sAllowGroups, SSHCFG_ALL }, 526 { "denygroups", sDenyGroups, SSHCFG_ALL }, 527 { "ciphers", sCiphers, SSHCFG_GLOBAL }, 528 { "macs", sMacs, SSHCFG_GLOBAL }, 529 { "protocol", sProtocol, SSHCFG_GLOBAL }, 530 { "gatewayports", sGatewayPorts, SSHCFG_ALL }, 531 { "subsystem", sSubsystem, SSHCFG_GLOBAL }, 532 { "maxstartups", sMaxStartups, SSHCFG_GLOBAL }, 533 { "maxauthtries", sMaxAuthTries, SSHCFG_ALL }, 534 { "maxsessions", sMaxSessions, SSHCFG_ALL }, 535 { "banner", sBanner, SSHCFG_ALL }, 536 { "usedns", sUseDNS, SSHCFG_GLOBAL }, 537 { "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL }, 538 { "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL }, 539 { "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL }, 540 { "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL }, 541 { "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_ALL }, 542 { "authorizedkeysfile2", sDeprecated, SSHCFG_ALL }, 543 { "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL}, 544 { "acceptenv", sAcceptEnv, SSHCFG_ALL }, 545 { "permittunnel", sPermitTunnel, SSHCFG_ALL }, 546 { "permittty", sPermitTTY, SSHCFG_ALL }, 547 { "permituserrc", sPermitUserRC, SSHCFG_ALL }, 548 { "match", sMatch, SSHCFG_ALL }, 549 { "permitopen", sPermitOpen, SSHCFG_ALL }, 550 { "forcecommand", sForceCommand, SSHCFG_ALL }, 551 { "chrootdirectory", sChrootDirectory, SSHCFG_ALL }, 552 { "hostcertificate", sHostCertificate, SSHCFG_GLOBAL }, 553 { "revokedkeys", sRevokedKeys, SSHCFG_ALL }, 554 { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL }, 555 { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL }, 556 { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL }, 557 { "ipqos", sIPQoS, SSHCFG_ALL }, 558 { "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL }, 559 { "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL }, 560 { "authorizedprincipalscommand", sAuthorizedPrincipalsCommand, SSHCFG_ALL }, 561 { "authorizedprincipalscommanduser", sAuthorizedPrincipalsCommandUser, SSHCFG_ALL }, 562 { "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL }, 563 { "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL }, 564 { "streamlocalbindmask", sStreamLocalBindMask, SSHCFG_ALL }, 565 { "streamlocalbindunlink", sStreamLocalBindUnlink, SSHCFG_ALL }, 566 { "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL }, 567 { "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL }, 568 { NULL, sBadOption, 0 } 569 }; 570 571 static struct { 572 int val; 573 char *text; 574 } tunmode_desc[] = { 575 { SSH_TUNMODE_NO, "no" }, 576 { SSH_TUNMODE_POINTOPOINT, "point-to-point" }, 577 { SSH_TUNMODE_ETHERNET, "ethernet" }, 578 { SSH_TUNMODE_YES, "yes" }, 579 { -1, NULL } 580 }; 581 582 /* 583 * Returns the number of the token pointed to by cp or sBadOption. 584 */ 585 586 static ServerOpCodes 587 parse_token(const char *cp, const char *filename, 588 int linenum, u_int *flags) 589 { 590 u_int i; 591 592 for (i = 0; keywords[i].name; i++) 593 if (strcasecmp(cp, keywords[i].name) == 0) { 594 *flags = keywords[i].flags; 595 return keywords[i].opcode; 596 } 597 598 error("%s: line %d: Bad configuration option: %s", 599 filename, linenum, cp); 600 return sBadOption; 601 } 602 603 char * 604 derelativise_path(const char *path) 605 { 606 char *expanded, *ret, cwd[PATH_MAX]; 607 608 if (strcasecmp(path, "none") == 0) 609 return xstrdup("none"); 610 expanded = tilde_expand_filename(path, getuid()); 611 if (*expanded == '/') 612 return expanded; 613 if (getcwd(cwd, sizeof(cwd)) == NULL) 614 fatal("%s: getcwd: %s", __func__, strerror(errno)); 615 xasprintf(&ret, "%s/%s", cwd, expanded); 616 free(expanded); 617 return ret; 618 } 619 620 static void 621 add_listen_addr(ServerOptions *options, char *addr, int port) 622 { 623 u_int i; 624 625 if (port == 0) 626 for (i = 0; i < options->num_ports; i++) 627 add_one_listen_addr(options, addr, options->ports[i]); 628 else 629 add_one_listen_addr(options, addr, port); 630 } 631 632 static void 633 add_one_listen_addr(ServerOptions *options, char *addr, int port) 634 { 635 struct addrinfo hints, *ai, *aitop; 636 char strport[NI_MAXSERV]; 637 int gaierr; 638 639 memset(&hints, 0, sizeof(hints)); 640 hints.ai_family = options->address_family; 641 hints.ai_socktype = SOCK_STREAM; 642 hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0; 643 snprintf(strport, sizeof strport, "%d", port); 644 if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0) 645 fatal("bad addr or host: %s (%s)", 646 addr ? addr : "<NULL>", 647 ssh_gai_strerror(gaierr)); 648 for (ai = aitop; ai->ai_next; ai = ai->ai_next) 649 ; 650 ai->ai_next = options->listen_addrs; 651 options->listen_addrs = aitop; 652 } 653 654 /* 655 * Queue a ListenAddress to be processed once we have all of the Ports 656 * and AddressFamily options. 657 */ 658 static void 659 queue_listen_addr(ServerOptions *options, char *addr, int port) 660 { 661 options->queued_listen_addrs = xreallocarray( 662 options->queued_listen_addrs, options->num_queued_listens + 1, 663 sizeof(addr)); 664 options->queued_listen_ports = xreallocarray( 665 options->queued_listen_ports, options->num_queued_listens + 1, 666 sizeof(port)); 667 options->queued_listen_addrs[options->num_queued_listens] = 668 xstrdup(addr); 669 options->queued_listen_ports[options->num_queued_listens] = port; 670 options->num_queued_listens++; 671 } 672 673 /* 674 * Process queued (text) ListenAddress entries. 675 */ 676 static void 677 process_queued_listen_addrs(ServerOptions *options) 678 { 679 u_int i; 680 681 if (options->num_ports == 0) 682 options->ports[options->num_ports++] = SSH_DEFAULT_PORT; 683 if (options->address_family == -1) 684 options->address_family = AF_UNSPEC; 685 686 for (i = 0; i < options->num_queued_listens; i++) { 687 add_listen_addr(options, options->queued_listen_addrs[i], 688 options->queued_listen_ports[i]); 689 free(options->queued_listen_addrs[i]); 690 options->queued_listen_addrs[i] = NULL; 691 } 692 free(options->queued_listen_addrs); 693 options->queued_listen_addrs = NULL; 694 free(options->queued_listen_ports); 695 options->queued_listen_ports = NULL; 696 options->num_queued_listens = 0; 697 } 698 699 struct connection_info * 700 get_connection_info(int populate, int use_dns) 701 { 702 static struct connection_info ci; 703 704 if (!populate) 705 return &ci; 706 ci.host = get_canonical_hostname(use_dns); 707 ci.address = get_remote_ipaddr(); 708 ci.laddress = get_local_ipaddr(packet_get_connection_in()); 709 ci.lport = get_local_port(); 710 return &ci; 711 } 712 713 /* 714 * The strategy for the Match blocks is that the config file is parsed twice. 715 * 716 * The first time is at startup. activep is initialized to 1 and the 717 * directives in the global context are processed and acted on. Hitting a 718 * Match directive unsets activep and the directives inside the block are 719 * checked for syntax only. 720 * 721 * The second time is after a connection has been established but before 722 * authentication. activep is initialized to 2 and global config directives 723 * are ignored since they have already been processed. If the criteria in a 724 * Match block is met, activep is set and the subsequent directives 725 * processed and actioned until EOF or another Match block unsets it. Any 726 * options set are copied into the main server config. 727 * 728 * Potential additions/improvements: 729 * - Add Match support for pre-kex directives, eg Protocol, Ciphers. 730 * 731 * - Add a Tag directive (idea from David Leonard) ala pf, eg: 732 * Match Address 192.168.0.* 733 * Tag trusted 734 * Match Group wheel 735 * Tag trusted 736 * Match Tag trusted 737 * AllowTcpForwarding yes 738 * GatewayPorts clientspecified 739 * [...] 740 * 741 * - Add a PermittedChannelRequests directive 742 * Match Group shell 743 * PermittedChannelRequests session,forwarded-tcpip 744 */ 745 746 static int 747 match_cfg_line_group(const char *grps, int line, const char *user) 748 { 749 int result = 0; 750 struct passwd *pw; 751 752 if (user == NULL) 753 goto out; 754 755 if ((pw = getpwnam(user)) == NULL) { 756 debug("Can't match group at line %d because user %.100s does " 757 "not exist", line, user); 758 } else if (ga_init(pw->pw_name, pw->pw_gid) == 0) { 759 debug("Can't Match group because user %.100s not in any group " 760 "at line %d", user, line); 761 } else if (ga_match_pattern_list(grps) != 1) { 762 debug("user %.100s does not match group list %.100s at line %d", 763 user, grps, line); 764 } else { 765 debug("user %.100s matched group list %.100s at line %d", user, 766 grps, line); 767 result = 1; 768 } 769 out: 770 ga_free(); 771 return result; 772 } 773 774 /* 775 * All of the attributes on a single Match line are ANDed together, so we need 776 * to check every attribute and set the result to zero if any attribute does 777 * not match. 778 */ 779 static int 780 match_cfg_line(char **condition, int line, struct connection_info *ci) 781 { 782 int result = 1, attributes = 0, port; 783 char *arg, *attrib, *cp = *condition; 784 785 if (ci == NULL) 786 debug3("checking syntax for 'Match %s'", cp); 787 else 788 debug3("checking match for '%s' user %s host %s addr %s " 789 "laddr %s lport %d", cp, ci->user ? ci->user : "(null)", 790 ci->host ? ci->host : "(null)", 791 ci->address ? ci->address : "(null)", 792 ci->laddress ? ci->laddress : "(null)", ci->lport); 793 794 while ((attrib = strdelim(&cp)) && *attrib != '\0') { 795 attributes++; 796 if (strcasecmp(attrib, "all") == 0) { 797 if (attributes != 1 || 798 ((arg = strdelim(&cp)) != NULL && *arg != '\0')) { 799 error("'all' cannot be combined with other " 800 "Match attributes"); 801 return -1; 802 } 803 *condition = cp; 804 return 1; 805 } 806 if ((arg = strdelim(&cp)) == NULL || *arg == '\0') { 807 error("Missing Match criteria for %s", attrib); 808 return -1; 809 } 810 if (strcasecmp(attrib, "user") == 0) { 811 if (ci == NULL || ci->user == NULL) { 812 result = 0; 813 continue; 814 } 815 if (match_pattern_list(ci->user, arg, 0) != 1) 816 result = 0; 817 else 818 debug("user %.100s matched 'User %.100s' at " 819 "line %d", ci->user, arg, line); 820 } else if (strcasecmp(attrib, "group") == 0) { 821 if (ci == NULL || ci->user == NULL) { 822 result = 0; 823 continue; 824 } 825 switch (match_cfg_line_group(arg, line, ci->user)) { 826 case -1: 827 return -1; 828 case 0: 829 result = 0; 830 } 831 } else if (strcasecmp(attrib, "host") == 0) { 832 if (ci == NULL || ci->host == NULL) { 833 result = 0; 834 continue; 835 } 836 if (match_hostname(ci->host, arg) != 1) 837 result = 0; 838 else 839 debug("connection from %.100s matched 'Host " 840 "%.100s' at line %d", ci->host, arg, line); 841 } else if (strcasecmp(attrib, "address") == 0) { 842 if (ci == NULL || ci->address == NULL) { 843 result = 0; 844 continue; 845 } 846 switch (addr_match_list(ci->address, arg)) { 847 case 1: 848 debug("connection from %.100s matched 'Address " 849 "%.100s' at line %d", ci->address, arg, line); 850 break; 851 case 0: 852 case -1: 853 result = 0; 854 break; 855 case -2: 856 return -1; 857 } 858 } else if (strcasecmp(attrib, "localaddress") == 0){ 859 if (ci == NULL || ci->laddress == NULL) { 860 result = 0; 861 continue; 862 } 863 switch (addr_match_list(ci->laddress, arg)) { 864 case 1: 865 debug("connection from %.100s matched " 866 "'LocalAddress %.100s' at line %d", 867 ci->laddress, arg, line); 868 break; 869 case 0: 870 case -1: 871 result = 0; 872 break; 873 case -2: 874 return -1; 875 } 876 } else if (strcasecmp(attrib, "localport") == 0) { 877 if ((port = a2port(arg)) == -1) { 878 error("Invalid LocalPort '%s' on Match line", 879 arg); 880 return -1; 881 } 882 if (ci == NULL || ci->lport == 0) { 883 result = 0; 884 continue; 885 } 886 /* TODO support port lists */ 887 if (port == ci->lport) 888 debug("connection from %.100s matched " 889 "'LocalPort %d' at line %d", 890 ci->laddress, port, line); 891 else 892 result = 0; 893 } else { 894 error("Unsupported Match attribute %s", attrib); 895 return -1; 896 } 897 } 898 if (attributes == 0) { 899 error("One or more attributes required for Match"); 900 return -1; 901 } 902 if (ci != NULL) 903 debug3("match %sfound", result ? "" : "not "); 904 *condition = cp; 905 return result; 906 } 907 908 #define WHITESPACE " \t\r\n" 909 910 /* Multistate option parsing */ 911 struct multistate { 912 char *key; 913 int value; 914 }; 915 static const struct multistate multistate_addressfamily[] = { 916 { "inet", AF_INET }, 917 { "inet6", AF_INET6 }, 918 { "any", AF_UNSPEC }, 919 { NULL, -1 } 920 }; 921 static const struct multistate multistate_permitrootlogin[] = { 922 { "without-password", PERMIT_NO_PASSWD }, 923 { "prohibit-password", PERMIT_NO_PASSWD }, 924 { "forced-commands-only", PERMIT_FORCED_ONLY }, 925 { "yes", PERMIT_YES }, 926 { "no", PERMIT_NO }, 927 { NULL, -1 } 928 }; 929 static const struct multistate multistate_compression[] = { 930 { "delayed", COMP_DELAYED }, 931 { "yes", COMP_ZLIB }, 932 { "no", COMP_NONE }, 933 { NULL, -1 } 934 }; 935 static const struct multistate multistate_gatewayports[] = { 936 { "clientspecified", 2 }, 937 { "yes", 1 }, 938 { "no", 0 }, 939 { NULL, -1 } 940 }; 941 static const struct multistate multistate_privsep[] = { 942 { "yes", PRIVSEP_NOSANDBOX }, 943 { "sandbox", PRIVSEP_ON }, 944 { "nosandbox", PRIVSEP_NOSANDBOX }, 945 { "no", PRIVSEP_OFF }, 946 { NULL, -1 } 947 }; 948 static const struct multistate multistate_tcpfwd[] = { 949 { "yes", FORWARD_ALLOW }, 950 { "all", FORWARD_ALLOW }, 951 { "no", FORWARD_DENY }, 952 { "remote", FORWARD_REMOTE }, 953 { "local", FORWARD_LOCAL }, 954 { NULL, -1 } 955 }; 956 957 int 958 process_server_config_line(ServerOptions *options, char *line, 959 const char *filename, int linenum, int *activep, 960 struct connection_info *connectinfo) 961 { 962 char *cp, **charptr, *arg, *p; 963 int cmdline = 0, *intptr, value, value2, n, port; 964 SyslogFacility *log_facility_ptr; 965 LogLevel *log_level_ptr; 966 ServerOpCodes opcode; 967 u_int i, flags = 0; 968 size_t len; 969 long long val64; 970 const struct multistate *multistate_ptr; 971 972 cp = line; 973 if ((arg = strdelim(&cp)) == NULL) 974 return 0; 975 /* Ignore leading whitespace */ 976 if (*arg == '\0') 977 arg = strdelim(&cp); 978 if (!arg || !*arg || *arg == '#') 979 return 0; 980 intptr = NULL; 981 charptr = NULL; 982 opcode = parse_token(arg, filename, linenum, &flags); 983 984 if (activep == NULL) { /* We are processing a command line directive */ 985 cmdline = 1; 986 activep = &cmdline; 987 } 988 if (*activep && opcode != sMatch) 989 debug3("%s:%d setting %s %s", filename, linenum, arg, cp); 990 if (*activep == 0 && !(flags & SSHCFG_MATCH)) { 991 if (connectinfo == NULL) { 992 fatal("%s line %d: Directive '%s' is not allowed " 993 "within a Match block", filename, linenum, arg); 994 } else { /* this is a directive we have already processed */ 995 while (arg) 996 arg = strdelim(&cp); 997 return 0; 998 } 999 } 1000 1001 switch (opcode) { 1002 /* Portable-specific options */ 1003 case sUsePAM: 1004 intptr = &options->use_pam; 1005 goto parse_flag; 1006 1007 /* Standard Options */ 1008 case sBadOption: 1009 return -1; 1010 case sPort: 1011 /* ignore ports from configfile if cmdline specifies ports */ 1012 if (options->ports_from_cmdline) 1013 return 0; 1014 if (options->num_ports >= MAX_PORTS) 1015 fatal("%s line %d: too many ports.", 1016 filename, linenum); 1017 arg = strdelim(&cp); 1018 if (!arg || *arg == '\0') 1019 fatal("%s line %d: missing port number.", 1020 filename, linenum); 1021 options->ports[options->num_ports++] = a2port(arg); 1022 if (options->ports[options->num_ports-1] <= 0) 1023 fatal("%s line %d: Badly formatted port number.", 1024 filename, linenum); 1025 break; 1026 1027 case sServerKeyBits: 1028 intptr = &options->server_key_bits; 1029 parse_int: 1030 arg = strdelim(&cp); 1031 if (!arg || *arg == '\0') 1032 fatal("%s line %d: missing integer value.", 1033 filename, linenum); 1034 value = atoi(arg); 1035 if (*activep && *intptr == -1) 1036 *intptr = value; 1037 break; 1038 1039 case sLoginGraceTime: 1040 intptr = &options->login_grace_time; 1041 parse_time: 1042 arg = strdelim(&cp); 1043 if (!arg || *arg == '\0') 1044 fatal("%s line %d: missing time value.", 1045 filename, linenum); 1046 if ((value = convtime(arg)) == -1) 1047 fatal("%s line %d: invalid time value.", 1048 filename, linenum); 1049 if (*activep && *intptr == -1) 1050 *intptr = value; 1051 break; 1052 1053 case sKeyRegenerationTime: 1054 intptr = &options->key_regeneration_time; 1055 goto parse_time; 1056 1057 case sListenAddress: 1058 arg = strdelim(&cp); 1059 if (arg == NULL || *arg == '\0') 1060 fatal("%s line %d: missing address", 1061 filename, linenum); 1062 /* check for bare IPv6 address: no "[]" and 2 or more ":" */ 1063 if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL 1064 && strchr(p+1, ':') != NULL) { 1065 queue_listen_addr(options, arg, 0); 1066 break; 1067 } 1068 p = hpdelim(&arg); 1069 if (p == NULL) 1070 fatal("%s line %d: bad address:port usage", 1071 filename, linenum); 1072 p = cleanhostname(p); 1073 if (arg == NULL) 1074 port = 0; 1075 else if ((port = a2port(arg)) <= 0) 1076 fatal("%s line %d: bad port number", filename, linenum); 1077 1078 queue_listen_addr(options, p, port); 1079 1080 break; 1081 1082 case sAddressFamily: 1083 intptr = &options->address_family; 1084 multistate_ptr = multistate_addressfamily; 1085 parse_multistate: 1086 arg = strdelim(&cp); 1087 if (!arg || *arg == '\0') 1088 fatal("%s line %d: missing argument.", 1089 filename, linenum); 1090 value = -1; 1091 for (i = 0; multistate_ptr[i].key != NULL; i++) { 1092 if (strcasecmp(arg, multistate_ptr[i].key) == 0) { 1093 value = multistate_ptr[i].value; 1094 break; 1095 } 1096 } 1097 if (value == -1) 1098 fatal("%s line %d: unsupported option \"%s\".", 1099 filename, linenum, arg); 1100 if (*activep && *intptr == -1) 1101 *intptr = value; 1102 break; 1103 1104 case sHostKeyFile: 1105 intptr = &options->num_host_key_files; 1106 if (*intptr >= MAX_HOSTKEYS) 1107 fatal("%s line %d: too many host keys specified (max %d).", 1108 filename, linenum, MAX_HOSTKEYS); 1109 charptr = &options->host_key_files[*intptr]; 1110 parse_filename: 1111 arg = strdelim(&cp); 1112 if (!arg || *arg == '\0') 1113 fatal("%s line %d: missing file name.", 1114 filename, linenum); 1115 if (*activep && *charptr == NULL) { 1116 *charptr = derelativise_path(arg); 1117 /* increase optional counter */ 1118 if (intptr != NULL) 1119 *intptr = *intptr + 1; 1120 } 1121 break; 1122 1123 case sHostKeyAgent: 1124 charptr = &options->host_key_agent; 1125 arg = strdelim(&cp); 1126 if (!arg || *arg == '\0') 1127 fatal("%s line %d: missing socket name.", 1128 filename, linenum); 1129 if (*activep && *charptr == NULL) 1130 *charptr = !strcmp(arg, SSH_AUTHSOCKET_ENV_NAME) ? 1131 xstrdup(arg) : derelativise_path(arg); 1132 break; 1133 1134 case sHostCertificate: 1135 intptr = &options->num_host_cert_files; 1136 if (*intptr >= MAX_HOSTKEYS) 1137 fatal("%s line %d: too many host certificates " 1138 "specified (max %d).", filename, linenum, 1139 MAX_HOSTCERTS); 1140 charptr = &options->host_cert_files[*intptr]; 1141 goto parse_filename; 1142 break; 1143 1144 case sPidFile: 1145 charptr = &options->pid_file; 1146 goto parse_filename; 1147 1148 case sPermitRootLogin: 1149 intptr = &options->permit_root_login; 1150 multistate_ptr = multistate_permitrootlogin; 1151 goto parse_multistate; 1152 1153 case sIgnoreRhosts: 1154 intptr = &options->ignore_rhosts; 1155 parse_flag: 1156 arg = strdelim(&cp); 1157 if (!arg || *arg == '\0') 1158 fatal("%s line %d: missing yes/no argument.", 1159 filename, linenum); 1160 value = 0; /* silence compiler */ 1161 if (strcmp(arg, "yes") == 0) 1162 value = 1; 1163 else if (strcmp(arg, "no") == 0) 1164 value = 0; 1165 else 1166 fatal("%s line %d: Bad yes/no argument: %s", 1167 filename, linenum, arg); 1168 if (*activep && *intptr == -1) 1169 *intptr = value; 1170 break; 1171 1172 case sIgnoreUserKnownHosts: 1173 intptr = &options->ignore_user_known_hosts; 1174 goto parse_flag; 1175 1176 case sRhostsRSAAuthentication: 1177 intptr = &options->rhosts_rsa_authentication; 1178 goto parse_flag; 1179 1180 case sHostbasedAuthentication: 1181 intptr = &options->hostbased_authentication; 1182 goto parse_flag; 1183 1184 case sHostbasedUsesNameFromPacketOnly: 1185 intptr = &options->hostbased_uses_name_from_packet_only; 1186 goto parse_flag; 1187 1188 case sHostbasedAcceptedKeyTypes: 1189 charptr = &options->hostbased_key_types; 1190 parse_keytypes: 1191 arg = strdelim(&cp); 1192 if (!arg || *arg == '\0') 1193 fatal("%s line %d: Missing argument.", 1194 filename, linenum); 1195 if (!sshkey_names_valid2(*arg == '+' ? arg + 1 : arg, 1)) 1196 fatal("%s line %d: Bad key types '%s'.", 1197 filename, linenum, arg ? arg : "<NONE>"); 1198 if (*activep && *charptr == NULL) 1199 *charptr = xstrdup(arg); 1200 break; 1201 1202 case sHostKeyAlgorithms: 1203 charptr = &options->hostkeyalgorithms; 1204 goto parse_keytypes; 1205 1206 case sRSAAuthentication: 1207 intptr = &options->rsa_authentication; 1208 goto parse_flag; 1209 1210 case sPubkeyAuthentication: 1211 intptr = &options->pubkey_authentication; 1212 goto parse_flag; 1213 1214 case sPubkeyAcceptedKeyTypes: 1215 charptr = &options->pubkey_key_types; 1216 goto parse_keytypes; 1217 1218 case sKerberosAuthentication: 1219 intptr = &options->kerberos_authentication; 1220 goto parse_flag; 1221 1222 case sKerberosOrLocalPasswd: 1223 intptr = &options->kerberos_or_local_passwd; 1224 goto parse_flag; 1225 1226 case sKerberosTicketCleanup: 1227 intptr = &options->kerberos_ticket_cleanup; 1228 goto parse_flag; 1229 1230 case sKerberosGetAFSToken: 1231 intptr = &options->kerberos_get_afs_token; 1232 goto parse_flag; 1233 1234 case sGssAuthentication: 1235 intptr = &options->gss_authentication; 1236 goto parse_flag; 1237 1238 case sGssCleanupCreds: 1239 intptr = &options->gss_cleanup_creds; 1240 goto parse_flag; 1241 1242 case sGssStrictAcceptor: 1243 intptr = &options->gss_strict_acceptor; 1244 goto parse_flag; 1245 1246 case sPasswordAuthentication: 1247 intptr = &options->password_authentication; 1248 goto parse_flag; 1249 1250 case sKbdInteractiveAuthentication: 1251 intptr = &options->kbd_interactive_authentication; 1252 goto parse_flag; 1253 1254 case sChallengeResponseAuthentication: 1255 intptr = &options->challenge_response_authentication; 1256 goto parse_flag; 1257 1258 case sPrintMotd: 1259 intptr = &options->print_motd; 1260 goto parse_flag; 1261 1262 case sPrintLastLog: 1263 intptr = &options->print_lastlog; 1264 goto parse_flag; 1265 1266 case sX11Forwarding: 1267 intptr = &options->x11_forwarding; 1268 goto parse_flag; 1269 1270 case sX11DisplayOffset: 1271 intptr = &options->x11_display_offset; 1272 goto parse_int; 1273 1274 case sX11UseLocalhost: 1275 intptr = &options->x11_use_localhost; 1276 goto parse_flag; 1277 1278 case sXAuthLocation: 1279 charptr = &options->xauth_location; 1280 goto parse_filename; 1281 1282 case sPermitTTY: 1283 intptr = &options->permit_tty; 1284 goto parse_flag; 1285 1286 case sPermitUserRC: 1287 intptr = &options->permit_user_rc; 1288 goto parse_flag; 1289 1290 case sStrictModes: 1291 intptr = &options->strict_modes; 1292 goto parse_flag; 1293 1294 case sTCPKeepAlive: 1295 intptr = &options->tcp_keep_alive; 1296 goto parse_flag; 1297 1298 case sEmptyPasswd: 1299 intptr = &options->permit_empty_passwd; 1300 goto parse_flag; 1301 1302 case sPermitUserEnvironment: 1303 intptr = &options->permit_user_env; 1304 goto parse_flag; 1305 1306 case sUseLogin: 1307 intptr = &options->use_login; 1308 goto parse_flag; 1309 1310 case sCompression: 1311 intptr = &options->compression; 1312 multistate_ptr = multistate_compression; 1313 goto parse_multistate; 1314 1315 case sRekeyLimit: 1316 arg = strdelim(&cp); 1317 if (!arg || *arg == '\0') 1318 fatal("%.200s line %d: Missing argument.", filename, 1319 linenum); 1320 if (strcmp(arg, "default") == 0) { 1321 val64 = 0; 1322 } else { 1323 if (scan_scaled(arg, &val64) == -1) 1324 fatal("%.200s line %d: Bad number '%s': %s", 1325 filename, linenum, arg, strerror(errno)); 1326 /* check for too-large or too-small limits */ 1327 if (val64 > UINT_MAX) 1328 fatal("%.200s line %d: RekeyLimit too large", 1329 filename, linenum); 1330 if (val64 != 0 && val64 < 16) 1331 fatal("%.200s line %d: RekeyLimit too small", 1332 filename, linenum); 1333 } 1334 if (*activep && options->rekey_limit == -1) 1335 options->rekey_limit = (u_int32_t)val64; 1336 if (cp != NULL) { /* optional rekey interval present */ 1337 if (strcmp(cp, "none") == 0) { 1338 (void)strdelim(&cp); /* discard */ 1339 break; 1340 } 1341 intptr = &options->rekey_interval; 1342 goto parse_time; 1343 } 1344 break; 1345 1346 case sGatewayPorts: 1347 intptr = &options->fwd_opts.gateway_ports; 1348 multistate_ptr = multistate_gatewayports; 1349 goto parse_multistate; 1350 1351 case sUseDNS: 1352 intptr = &options->use_dns; 1353 goto parse_flag; 1354 1355 case sLogFacility: 1356 log_facility_ptr = &options->log_facility; 1357 arg = strdelim(&cp); 1358 value = log_facility_number(arg); 1359 if (value == SYSLOG_FACILITY_NOT_SET) 1360 fatal("%.200s line %d: unsupported log facility '%s'", 1361 filename, linenum, arg ? arg : "<NONE>"); 1362 if (*log_facility_ptr == -1) 1363 *log_facility_ptr = (SyslogFacility) value; 1364 break; 1365 1366 case sLogLevel: 1367 log_level_ptr = &options->log_level; 1368 arg = strdelim(&cp); 1369 value = log_level_number(arg); 1370 if (value == SYSLOG_LEVEL_NOT_SET) 1371 fatal("%.200s line %d: unsupported log level '%s'", 1372 filename, linenum, arg ? arg : "<NONE>"); 1373 if (*log_level_ptr == -1) 1374 *log_level_ptr = (LogLevel) value; 1375 break; 1376 1377 case sAllowTcpForwarding: 1378 intptr = &options->allow_tcp_forwarding; 1379 multistate_ptr = multistate_tcpfwd; 1380 goto parse_multistate; 1381 1382 case sAllowStreamLocalForwarding: 1383 intptr = &options->allow_streamlocal_forwarding; 1384 multistate_ptr = multistate_tcpfwd; 1385 goto parse_multistate; 1386 1387 case sAllowAgentForwarding: 1388 intptr = &options->allow_agent_forwarding; 1389 goto parse_flag; 1390 1391 case sUsePrivilegeSeparation: 1392 intptr = &use_privsep; 1393 multistate_ptr = multistate_privsep; 1394 goto parse_multistate; 1395 1396 case sAllowUsers: 1397 while ((arg = strdelim(&cp)) && *arg != '\0') { 1398 if (options->num_allow_users >= MAX_ALLOW_USERS) 1399 fatal("%s line %d: too many allow users.", 1400 filename, linenum); 1401 if (!*activep) 1402 continue; 1403 options->allow_users[options->num_allow_users++] = 1404 xstrdup(arg); 1405 } 1406 break; 1407 1408 case sDenyUsers: 1409 while ((arg = strdelim(&cp)) && *arg != '\0') { 1410 if (options->num_deny_users >= MAX_DENY_USERS) 1411 fatal("%s line %d: too many deny users.", 1412 filename, linenum); 1413 if (!*activep) 1414 continue; 1415 options->deny_users[options->num_deny_users++] = 1416 xstrdup(arg); 1417 } 1418 break; 1419 1420 case sAllowGroups: 1421 while ((arg = strdelim(&cp)) && *arg != '\0') { 1422 if (options->num_allow_groups >= MAX_ALLOW_GROUPS) 1423 fatal("%s line %d: too many allow groups.", 1424 filename, linenum); 1425 if (!*activep) 1426 continue; 1427 options->allow_groups[options->num_allow_groups++] = 1428 xstrdup(arg); 1429 } 1430 break; 1431 1432 case sDenyGroups: 1433 while ((arg = strdelim(&cp)) && *arg != '\0') { 1434 if (options->num_deny_groups >= MAX_DENY_GROUPS) 1435 fatal("%s line %d: too many deny groups.", 1436 filename, linenum); 1437 if (!*activep) 1438 continue; 1439 options->deny_groups[options->num_deny_groups++] = 1440 xstrdup(arg); 1441 } 1442 break; 1443 1444 case sCiphers: 1445 arg = strdelim(&cp); 1446 if (!arg || *arg == '\0') 1447 fatal("%s line %d: Missing argument.", filename, linenum); 1448 if (!ciphers_valid(*arg == '+' ? arg + 1 : arg)) 1449 fatal("%s line %d: Bad SSH2 cipher spec '%s'.", 1450 filename, linenum, arg ? arg : "<NONE>"); 1451 if (options->ciphers == NULL) 1452 options->ciphers = xstrdup(arg); 1453 break; 1454 1455 case sMacs: 1456 arg = strdelim(&cp); 1457 if (!arg || *arg == '\0') 1458 fatal("%s line %d: Missing argument.", filename, linenum); 1459 if (!mac_valid(*arg == '+' ? arg + 1 : arg)) 1460 fatal("%s line %d: Bad SSH2 mac spec '%s'.", 1461 filename, linenum, arg ? arg : "<NONE>"); 1462 if (options->macs == NULL) 1463 options->macs = xstrdup(arg); 1464 break; 1465 1466 case sKexAlgorithms: 1467 arg = strdelim(&cp); 1468 if (!arg || *arg == '\0') 1469 fatal("%s line %d: Missing argument.", 1470 filename, linenum); 1471 if (!kex_names_valid(*arg == '+' ? arg + 1 : arg)) 1472 fatal("%s line %d: Bad SSH2 KexAlgorithms '%s'.", 1473 filename, linenum, arg ? arg : "<NONE>"); 1474 if (options->kex_algorithms == NULL) 1475 options->kex_algorithms = xstrdup(arg); 1476 break; 1477 1478 case sProtocol: 1479 intptr = &options->protocol; 1480 arg = strdelim(&cp); 1481 if (!arg || *arg == '\0') 1482 fatal("%s line %d: Missing argument.", filename, linenum); 1483 value = proto_spec(arg); 1484 if (value == SSH_PROTO_UNKNOWN) 1485 fatal("%s line %d: Bad protocol spec '%s'.", 1486 filename, linenum, arg ? arg : "<NONE>"); 1487 if (*intptr == SSH_PROTO_UNKNOWN) 1488 *intptr = value; 1489 break; 1490 1491 case sSubsystem: 1492 if (options->num_subsystems >= MAX_SUBSYSTEMS) { 1493 fatal("%s line %d: too many subsystems defined.", 1494 filename, linenum); 1495 } 1496 arg = strdelim(&cp); 1497 if (!arg || *arg == '\0') 1498 fatal("%s line %d: Missing subsystem name.", 1499 filename, linenum); 1500 if (!*activep) { 1501 arg = strdelim(&cp); 1502 break; 1503 } 1504 for (i = 0; i < options->num_subsystems; i++) 1505 if (strcmp(arg, options->subsystem_name[i]) == 0) 1506 fatal("%s line %d: Subsystem '%s' already defined.", 1507 filename, linenum, arg); 1508 options->subsystem_name[options->num_subsystems] = xstrdup(arg); 1509 arg = strdelim(&cp); 1510 if (!arg || *arg == '\0') 1511 fatal("%s line %d: Missing subsystem command.", 1512 filename, linenum); 1513 options->subsystem_command[options->num_subsystems] = xstrdup(arg); 1514 1515 /* Collect arguments (separate to executable) */ 1516 p = xstrdup(arg); 1517 len = strlen(p) + 1; 1518 while ((arg = strdelim(&cp)) != NULL && *arg != '\0') { 1519 len += 1 + strlen(arg); 1520 p = xreallocarray(p, 1, len); 1521 strlcat(p, " ", len); 1522 strlcat(p, arg, len); 1523 } 1524 options->subsystem_args[options->num_subsystems] = p; 1525 options->num_subsystems++; 1526 break; 1527 1528 case sMaxStartups: 1529 arg = strdelim(&cp); 1530 if (!arg || *arg == '\0') 1531 fatal("%s line %d: Missing MaxStartups spec.", 1532 filename, linenum); 1533 if ((n = sscanf(arg, "%d:%d:%d", 1534 &options->max_startups_begin, 1535 &options->max_startups_rate, 1536 &options->max_startups)) == 3) { 1537 if (options->max_startups_begin > 1538 options->max_startups || 1539 options->max_startups_rate > 100 || 1540 options->max_startups_rate < 1) 1541 fatal("%s line %d: Illegal MaxStartups spec.", 1542 filename, linenum); 1543 } else if (n != 1) 1544 fatal("%s line %d: Illegal MaxStartups spec.", 1545 filename, linenum); 1546 else 1547 options->max_startups = options->max_startups_begin; 1548 break; 1549 1550 case sMaxAuthTries: 1551 intptr = &options->max_authtries; 1552 goto parse_int; 1553 1554 case sMaxSessions: 1555 intptr = &options->max_sessions; 1556 goto parse_int; 1557 1558 case sBanner: 1559 charptr = &options->banner; 1560 goto parse_filename; 1561 1562 /* 1563 * These options can contain %X options expanded at 1564 * connect time, so that you can specify paths like: 1565 * 1566 * AuthorizedKeysFile /etc/ssh_keys/%u 1567 */ 1568 case sAuthorizedKeysFile: 1569 if (*activep && options->num_authkeys_files == 0) { 1570 while ((arg = strdelim(&cp)) && *arg != '\0') { 1571 if (options->num_authkeys_files >= 1572 MAX_AUTHKEYS_FILES) 1573 fatal("%s line %d: " 1574 "too many authorized keys files.", 1575 filename, linenum); 1576 options->authorized_keys_files[ 1577 options->num_authkeys_files++] = 1578 tilde_expand_filename(arg, getuid()); 1579 } 1580 } 1581 return 0; 1582 1583 case sAuthorizedPrincipalsFile: 1584 charptr = &options->authorized_principals_file; 1585 arg = strdelim(&cp); 1586 if (!arg || *arg == '\0') 1587 fatal("%s line %d: missing file name.", 1588 filename, linenum); 1589 if (*activep && *charptr == NULL) { 1590 *charptr = tilde_expand_filename(arg, getuid()); 1591 /* increase optional counter */ 1592 if (intptr != NULL) 1593 *intptr = *intptr + 1; 1594 } 1595 break; 1596 1597 case sClientAliveInterval: 1598 intptr = &options->client_alive_interval; 1599 goto parse_time; 1600 1601 case sClientAliveCountMax: 1602 intptr = &options->client_alive_count_max; 1603 goto parse_int; 1604 1605 case sAcceptEnv: 1606 while ((arg = strdelim(&cp)) && *arg != '\0') { 1607 if (strchr(arg, '=') != NULL) 1608 fatal("%s line %d: Invalid environment name.", 1609 filename, linenum); 1610 if (options->num_accept_env >= MAX_ACCEPT_ENV) 1611 fatal("%s line %d: too many allow env.", 1612 filename, linenum); 1613 if (!*activep) 1614 continue; 1615 options->accept_env[options->num_accept_env++] = 1616 xstrdup(arg); 1617 } 1618 break; 1619 1620 case sPermitTunnel: 1621 intptr = &options->permit_tun; 1622 arg = strdelim(&cp); 1623 if (!arg || *arg == '\0') 1624 fatal("%s line %d: Missing yes/point-to-point/" 1625 "ethernet/no argument.", filename, linenum); 1626 value = -1; 1627 for (i = 0; tunmode_desc[i].val != -1; i++) 1628 if (strcmp(tunmode_desc[i].text, arg) == 0) { 1629 value = tunmode_desc[i].val; 1630 break; 1631 } 1632 if (value == -1) 1633 fatal("%s line %d: Bad yes/point-to-point/ethernet/" 1634 "no argument: %s", filename, linenum, arg); 1635 if (*activep && *intptr == -1) 1636 *intptr = value; 1637 break; 1638 1639 case sMatch: 1640 if (cmdline) 1641 fatal("Match directive not supported as a command-line " 1642 "option"); 1643 value = match_cfg_line(&cp, linenum, connectinfo); 1644 if (value < 0) 1645 fatal("%s line %d: Bad Match condition", filename, 1646 linenum); 1647 *activep = value; 1648 break; 1649 1650 case sPermitOpen: 1651 arg = strdelim(&cp); 1652 if (!arg || *arg == '\0') 1653 fatal("%s line %d: missing PermitOpen specification", 1654 filename, linenum); 1655 n = options->num_permitted_opens; /* modified later */ 1656 if (strcmp(arg, "any") == 0) { 1657 if (*activep && n == -1) { 1658 channel_clear_adm_permitted_opens(); 1659 options->num_permitted_opens = 0; 1660 } 1661 break; 1662 } 1663 if (strcmp(arg, "none") == 0) { 1664 if (*activep && n == -1) { 1665 options->num_permitted_opens = 1; 1666 channel_disable_adm_local_opens(); 1667 } 1668 break; 1669 } 1670 if (*activep && n == -1) 1671 channel_clear_adm_permitted_opens(); 1672 for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) { 1673 p = hpdelim(&arg); 1674 if (p == NULL) 1675 fatal("%s line %d: missing host in PermitOpen", 1676 filename, linenum); 1677 p = cleanhostname(p); 1678 if (arg == NULL || ((port = permitopen_port(arg)) < 0)) 1679 fatal("%s line %d: bad port number in " 1680 "PermitOpen", filename, linenum); 1681 if (*activep && n == -1) 1682 options->num_permitted_opens = 1683 channel_add_adm_permitted_opens(p, port); 1684 } 1685 break; 1686 1687 case sForceCommand: 1688 if (cp == NULL || *cp == '\0') 1689 fatal("%.200s line %d: Missing argument.", filename, 1690 linenum); 1691 len = strspn(cp, WHITESPACE); 1692 if (*activep && options->adm_forced_command == NULL) 1693 options->adm_forced_command = xstrdup(cp + len); 1694 return 0; 1695 1696 case sChrootDirectory: 1697 charptr = &options->chroot_directory; 1698 1699 arg = strdelim(&cp); 1700 if (!arg || *arg == '\0') 1701 fatal("%s line %d: missing file name.", 1702 filename, linenum); 1703 if (*activep && *charptr == NULL) 1704 *charptr = xstrdup(arg); 1705 break; 1706 1707 case sTrustedUserCAKeys: 1708 charptr = &options->trusted_user_ca_keys; 1709 goto parse_filename; 1710 1711 case sRevokedKeys: 1712 charptr = &options->revoked_keys_file; 1713 goto parse_filename; 1714 1715 case sIPQoS: 1716 arg = strdelim(&cp); 1717 if ((value = parse_ipqos(arg)) == -1) 1718 fatal("%s line %d: Bad IPQoS value: %s", 1719 filename, linenum, arg); 1720 arg = strdelim(&cp); 1721 if (arg == NULL) 1722 value2 = value; 1723 else if ((value2 = parse_ipqos(arg)) == -1) 1724 fatal("%s line %d: Bad IPQoS value: %s", 1725 filename, linenum, arg); 1726 if (*activep) { 1727 options->ip_qos_interactive = value; 1728 options->ip_qos_bulk = value2; 1729 } 1730 break; 1731 1732 case sVersionAddendum: 1733 if (cp == NULL || *cp == '\0') 1734 fatal("%.200s line %d: Missing argument.", filename, 1735 linenum); 1736 len = strspn(cp, WHITESPACE); 1737 if (*activep && options->version_addendum == NULL) { 1738 if (strcasecmp(cp + len, "none") == 0) 1739 options->version_addendum = xstrdup(""); 1740 else if (strchr(cp + len, '\r') != NULL) 1741 fatal("%.200s line %d: Invalid argument", 1742 filename, linenum); 1743 else 1744 options->version_addendum = xstrdup(cp + len); 1745 } 1746 return 0; 1747 1748 case sAuthorizedKeysCommand: 1749 if (cp == NULL) 1750 fatal("%.200s line %d: Missing argument.", filename, 1751 linenum); 1752 len = strspn(cp, WHITESPACE); 1753 if (*activep && options->authorized_keys_command == NULL) { 1754 if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0) 1755 fatal("%.200s line %d: AuthorizedKeysCommand " 1756 "must be an absolute path", 1757 filename, linenum); 1758 options->authorized_keys_command = xstrdup(cp + len); 1759 } 1760 return 0; 1761 1762 case sAuthorizedKeysCommandUser: 1763 charptr = &options->authorized_keys_command_user; 1764 1765 arg = strdelim(&cp); 1766 if (!arg || *arg == '\0') 1767 fatal("%s line %d: missing AuthorizedKeysCommandUser " 1768 "argument.", filename, linenum); 1769 if (*activep && *charptr == NULL) 1770 *charptr = xstrdup(arg); 1771 break; 1772 1773 case sAuthorizedPrincipalsCommand: 1774 if (cp == NULL) 1775 fatal("%.200s line %d: Missing argument.", filename, 1776 linenum); 1777 len = strspn(cp, WHITESPACE); 1778 if (*activep && 1779 options->authorized_principals_command == NULL) { 1780 if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0) 1781 fatal("%.200s line %d: " 1782 "AuthorizedPrincipalsCommand must be " 1783 "an absolute path", filename, linenum); 1784 options->authorized_principals_command = 1785 xstrdup(cp + len); 1786 } 1787 return 0; 1788 1789 case sAuthorizedPrincipalsCommandUser: 1790 charptr = &options->authorized_principals_command_user; 1791 1792 arg = strdelim(&cp); 1793 if (!arg || *arg == '\0') 1794 fatal("%s line %d: missing " 1795 "AuthorizedPrincipalsCommandUser argument.", 1796 filename, linenum); 1797 if (*activep && *charptr == NULL) 1798 *charptr = xstrdup(arg); 1799 break; 1800 1801 case sAuthenticationMethods: 1802 if (options->num_auth_methods == 0) { 1803 while ((arg = strdelim(&cp)) && *arg != '\0') { 1804 if (options->num_auth_methods >= 1805 MAX_AUTH_METHODS) 1806 fatal("%s line %d: " 1807 "too many authentication methods.", 1808 filename, linenum); 1809 if (auth2_methods_valid(arg, 0) != 0) 1810 fatal("%s line %d: invalid " 1811 "authentication method list.", 1812 filename, linenum); 1813 if (!*activep) 1814 continue; 1815 options->auth_methods[ 1816 options->num_auth_methods++] = xstrdup(arg); 1817 } 1818 } 1819 return 0; 1820 1821 case sStreamLocalBindMask: 1822 arg = strdelim(&cp); 1823 if (!arg || *arg == '\0') 1824 fatal("%s line %d: missing StreamLocalBindMask " 1825 "argument.", filename, linenum); 1826 /* Parse mode in octal format */ 1827 value = strtol(arg, &p, 8); 1828 if (arg == p || value < 0 || value > 0777) 1829 fatal("%s line %d: Bad mask.", filename, linenum); 1830 if (*activep) 1831 options->fwd_opts.streamlocal_bind_mask = (mode_t)value; 1832 break; 1833 1834 case sStreamLocalBindUnlink: 1835 intptr = &options->fwd_opts.streamlocal_bind_unlink; 1836 goto parse_flag; 1837 1838 case sFingerprintHash: 1839 arg = strdelim(&cp); 1840 if (!arg || *arg == '\0') 1841 fatal("%.200s line %d: Missing argument.", 1842 filename, linenum); 1843 if ((value = ssh_digest_alg_by_name(arg)) == -1) 1844 fatal("%.200s line %d: Invalid hash algorithm \"%s\".", 1845 filename, linenum, arg); 1846 if (*activep) 1847 options->fingerprint_hash = value; 1848 break; 1849 1850 case sDeprecated: 1851 logit("%s line %d: Deprecated option %s", 1852 filename, linenum, arg); 1853 while (arg) 1854 arg = strdelim(&cp); 1855 break; 1856 1857 case sUnsupported: 1858 logit("%s line %d: Unsupported option %s", 1859 filename, linenum, arg); 1860 while (arg) 1861 arg = strdelim(&cp); 1862 break; 1863 1864 default: 1865 fatal("%s line %d: Missing handler for opcode %s (%d)", 1866 filename, linenum, arg, opcode); 1867 } 1868 if ((arg = strdelim(&cp)) != NULL && *arg != '\0') 1869 fatal("%s line %d: garbage at end of line; \"%.200s\".", 1870 filename, linenum, arg); 1871 return 0; 1872 } 1873 1874 /* Reads the server configuration file. */ 1875 1876 void 1877 load_server_config(const char *filename, Buffer *conf) 1878 { 1879 char line[4096], *cp; 1880 FILE *f; 1881 int lineno = 0; 1882 1883 debug2("%s: filename %s", __func__, filename); 1884 if ((f = fopen(filename, "r")) == NULL) { 1885 perror(filename); 1886 exit(1); 1887 } 1888 buffer_clear(conf); 1889 while (fgets(line, sizeof(line), f)) { 1890 lineno++; 1891 if (strlen(line) == sizeof(line) - 1) 1892 fatal("%s line %d too long", filename, lineno); 1893 /* 1894 * Trim out comments and strip whitespace 1895 * NB - preserve newlines, they are needed to reproduce 1896 * line numbers later for error messages 1897 */ 1898 if ((cp = strchr(line, '#')) != NULL) 1899 memcpy(cp, "\n", 2); 1900 cp = line + strspn(line, " \t\r"); 1901 1902 buffer_append(conf, cp, strlen(cp)); 1903 } 1904 buffer_append(conf, "\0", 1); 1905 fclose(f); 1906 debug2("%s: done config len = %d", __func__, buffer_len(conf)); 1907 } 1908 1909 void 1910 parse_server_match_config(ServerOptions *options, 1911 struct connection_info *connectinfo) 1912 { 1913 ServerOptions mo; 1914 #if defined(ANDROID) 1915 char value[PROPERTY_VALUE_MAX]; 1916 #endif 1917 1918 initialize_server_options(&mo); 1919 parse_server_config(&mo, "reprocess config", &cfg, connectinfo); 1920 #if defined(ANDROID) 1921 /* Allow root login if ro.debuggable is set. */ 1922 property_get("ro.debuggable", value, ""); 1923 if (strcmp(value, "1") == 0) { 1924 mo.permit_root_login = PERMIT_YES; 1925 } 1926 #endif 1927 copy_set_server_options(options, &mo, 0); 1928 } 1929 1930 int parse_server_match_testspec(struct connection_info *ci, char *spec) 1931 { 1932 char *p; 1933 1934 while ((p = strsep(&spec, ",")) && *p != '\0') { 1935 if (strncmp(p, "addr=", 5) == 0) { 1936 ci->address = xstrdup(p + 5); 1937 } else if (strncmp(p, "host=", 5) == 0) { 1938 ci->host = xstrdup(p + 5); 1939 } else if (strncmp(p, "user=", 5) == 0) { 1940 ci->user = xstrdup(p + 5); 1941 } else if (strncmp(p, "laddr=", 6) == 0) { 1942 ci->laddress = xstrdup(p + 6); 1943 } else if (strncmp(p, "lport=", 6) == 0) { 1944 ci->lport = a2port(p + 6); 1945 if (ci->lport == -1) { 1946 fprintf(stderr, "Invalid port '%s' in test mode" 1947 " specification %s\n", p+6, p); 1948 return -1; 1949 } 1950 } else { 1951 fprintf(stderr, "Invalid test mode specification %s\n", 1952 p); 1953 return -1; 1954 } 1955 } 1956 return 0; 1957 } 1958 1959 /* 1960 * returns 1 for a complete spec, 0 for partial spec and -1 for an 1961 * empty spec. 1962 */ 1963 int server_match_spec_complete(struct connection_info *ci) 1964 { 1965 if (ci->user && ci->host && ci->address) 1966 return 1; /* complete */ 1967 if (!ci->user && !ci->host && !ci->address) 1968 return -1; /* empty */ 1969 return 0; /* partial */ 1970 } 1971 1972 /* 1973 * Copy any supported values that are set. 1974 * 1975 * If the preauth flag is set, we do not bother copying the string or 1976 * array values that are not used pre-authentication, because any that we 1977 * do use must be explictly sent in mm_getpwnamallow(). 1978 */ 1979 void 1980 copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth) 1981 { 1982 #define M_CP_INTOPT(n) do {\ 1983 if (src->n != -1) \ 1984 dst->n = src->n; \ 1985 } while (0) 1986 1987 M_CP_INTOPT(password_authentication); 1988 M_CP_INTOPT(gss_authentication); 1989 M_CP_INTOPT(rsa_authentication); 1990 M_CP_INTOPT(pubkey_authentication); 1991 M_CP_INTOPT(kerberos_authentication); 1992 M_CP_INTOPT(hostbased_authentication); 1993 M_CP_INTOPT(hostbased_uses_name_from_packet_only); 1994 M_CP_INTOPT(kbd_interactive_authentication); 1995 M_CP_INTOPT(permit_root_login); 1996 M_CP_INTOPT(permit_empty_passwd); 1997 1998 M_CP_INTOPT(allow_tcp_forwarding); 1999 M_CP_INTOPT(allow_streamlocal_forwarding); 2000 M_CP_INTOPT(allow_agent_forwarding); 2001 M_CP_INTOPT(permit_tun); 2002 M_CP_INTOPT(fwd_opts.gateway_ports); 2003 M_CP_INTOPT(x11_display_offset); 2004 M_CP_INTOPT(x11_forwarding); 2005 M_CP_INTOPT(x11_use_localhost); 2006 M_CP_INTOPT(permit_tty); 2007 M_CP_INTOPT(permit_user_rc); 2008 M_CP_INTOPT(max_sessions); 2009 M_CP_INTOPT(max_authtries); 2010 M_CP_INTOPT(ip_qos_interactive); 2011 M_CP_INTOPT(ip_qos_bulk); 2012 M_CP_INTOPT(rekey_limit); 2013 M_CP_INTOPT(rekey_interval); 2014 2015 /* M_CP_STROPT and M_CP_STRARRAYOPT should not appear before here */ 2016 #define M_CP_STROPT(n) do {\ 2017 if (src->n != NULL && dst->n != src->n) { \ 2018 free(dst->n); \ 2019 dst->n = src->n; \ 2020 } \ 2021 } while(0) 2022 #define M_CP_STRARRAYOPT(n, num_n) do {\ 2023 if (src->num_n != 0) { \ 2024 for (dst->num_n = 0; dst->num_n < src->num_n; dst->num_n++) \ 2025 dst->n[dst->num_n] = xstrdup(src->n[dst->num_n]); \ 2026 } \ 2027 } while(0) 2028 2029 /* See comment in servconf.h */ 2030 COPY_MATCH_STRING_OPTS(); 2031 2032 /* 2033 * The only things that should be below this point are string options 2034 * which are only used after authentication. 2035 */ 2036 if (preauth) 2037 return; 2038 2039 M_CP_STROPT(adm_forced_command); 2040 M_CP_STROPT(chroot_directory); 2041 } 2042 2043 #undef M_CP_INTOPT 2044 #undef M_CP_STROPT 2045 #undef M_CP_STRARRAYOPT 2046 2047 void 2048 parse_server_config(ServerOptions *options, const char *filename, Buffer *conf, 2049 struct connection_info *connectinfo) 2050 { 2051 int active, linenum, bad_options = 0; 2052 char *cp, *obuf, *cbuf; 2053 2054 debug2("%s: config %s len %d", __func__, filename, buffer_len(conf)); 2055 2056 obuf = cbuf = xstrdup(buffer_ptr(conf)); 2057 active = connectinfo ? 0 : 1; 2058 linenum = 1; 2059 while ((cp = strsep(&cbuf, "\n")) != NULL) { 2060 if (process_server_config_line(options, cp, filename, 2061 linenum++, &active, connectinfo) != 0) 2062 bad_options++; 2063 } 2064 free(obuf); 2065 if (bad_options > 0) 2066 fatal("%s: terminating, %d bad configuration options", 2067 filename, bad_options); 2068 process_queued_listen_addrs(options); 2069 } 2070 2071 static const char * 2072 fmt_multistate_int(int val, const struct multistate *m) 2073 { 2074 u_int i; 2075 2076 for (i = 0; m[i].key != NULL; i++) { 2077 if (m[i].value == val) 2078 return m[i].key; 2079 } 2080 return "UNKNOWN"; 2081 } 2082 2083 static const char * 2084 fmt_intarg(ServerOpCodes code, int val) 2085 { 2086 if (val == -1) 2087 return "unset"; 2088 switch (code) { 2089 case sAddressFamily: 2090 return fmt_multistate_int(val, multistate_addressfamily); 2091 case sPermitRootLogin: 2092 return fmt_multistate_int(val, multistate_permitrootlogin); 2093 case sGatewayPorts: 2094 return fmt_multistate_int(val, multistate_gatewayports); 2095 case sCompression: 2096 return fmt_multistate_int(val, multistate_compression); 2097 case sUsePrivilegeSeparation: 2098 return fmt_multistate_int(val, multistate_privsep); 2099 case sAllowTcpForwarding: 2100 return fmt_multistate_int(val, multistate_tcpfwd); 2101 case sAllowStreamLocalForwarding: 2102 return fmt_multistate_int(val, multistate_tcpfwd); 2103 case sFingerprintHash: 2104 return ssh_digest_alg_name(val); 2105 case sProtocol: 2106 switch (val) { 2107 case SSH_PROTO_1: 2108 return "1"; 2109 case SSH_PROTO_2: 2110 return "2"; 2111 case (SSH_PROTO_1|SSH_PROTO_2): 2112 return "2,1"; 2113 default: 2114 return "UNKNOWN"; 2115 } 2116 default: 2117 switch (val) { 2118 case 0: 2119 return "no"; 2120 case 1: 2121 return "yes"; 2122 default: 2123 return "UNKNOWN"; 2124 } 2125 } 2126 } 2127 2128 static const char * 2129 lookup_opcode_name(ServerOpCodes code) 2130 { 2131 u_int i; 2132 2133 for (i = 0; keywords[i].name != NULL; i++) 2134 if (keywords[i].opcode == code) 2135 return(keywords[i].name); 2136 return "UNKNOWN"; 2137 } 2138 2139 static void 2140 dump_cfg_int(ServerOpCodes code, int val) 2141 { 2142 printf("%s %d\n", lookup_opcode_name(code), val); 2143 } 2144 2145 static void 2146 dump_cfg_oct(ServerOpCodes code, int val) 2147 { 2148 printf("%s 0%o\n", lookup_opcode_name(code), val); 2149 } 2150 2151 static void 2152 dump_cfg_fmtint(ServerOpCodes code, int val) 2153 { 2154 printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val)); 2155 } 2156 2157 static void 2158 dump_cfg_string(ServerOpCodes code, const char *val) 2159 { 2160 if (val == NULL) 2161 return; 2162 printf("%s %s\n", lookup_opcode_name(code), 2163 val == NULL ? "none" : val); 2164 } 2165 2166 static void 2167 dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals) 2168 { 2169 u_int i; 2170 2171 for (i = 0; i < count; i++) 2172 printf("%s %s\n", lookup_opcode_name(code), vals[i]); 2173 } 2174 2175 static void 2176 dump_cfg_strarray_oneline(ServerOpCodes code, u_int count, char **vals) 2177 { 2178 u_int i; 2179 2180 if (count <= 0) 2181 return; 2182 printf("%s", lookup_opcode_name(code)); 2183 for (i = 0; i < count; i++) 2184 printf(" %s", vals[i]); 2185 printf("\n"); 2186 } 2187 2188 void 2189 dump_config(ServerOptions *o) 2190 { 2191 u_int i; 2192 int ret; 2193 struct addrinfo *ai; 2194 char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL; 2195 char *laddr1 = xstrdup(""), *laddr2 = NULL; 2196 2197 /* these are usually at the top of the config */ 2198 for (i = 0; i < o->num_ports; i++) 2199 printf("port %d\n", o->ports[i]); 2200 dump_cfg_fmtint(sProtocol, o->protocol); 2201 dump_cfg_fmtint(sAddressFamily, o->address_family); 2202 2203 /* 2204 * ListenAddress must be after Port. add_one_listen_addr pushes 2205 * addresses onto a stack, so to maintain ordering we need to 2206 * print these in reverse order. 2207 */ 2208 for (ai = o->listen_addrs; ai; ai = ai->ai_next) { 2209 if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr, 2210 sizeof(addr), port, sizeof(port), 2211 NI_NUMERICHOST|NI_NUMERICSERV)) != 0) { 2212 error("getnameinfo failed: %.100s", 2213 (ret != EAI_SYSTEM) ? gai_strerror(ret) : 2214 strerror(errno)); 2215 } else { 2216 laddr2 = laddr1; 2217 if (ai->ai_family == AF_INET6) 2218 xasprintf(&laddr1, "listenaddress [%s]:%s\n%s", 2219 addr, port, laddr2); 2220 else 2221 xasprintf(&laddr1, "listenaddress %s:%s\n%s", 2222 addr, port, laddr2); 2223 free(laddr2); 2224 } 2225 } 2226 printf("%s", laddr1); 2227 free(laddr1); 2228 2229 /* integer arguments */ 2230 #ifdef USE_PAM 2231 dump_cfg_fmtint(sUsePAM, o->use_pam); 2232 #endif 2233 dump_cfg_int(sServerKeyBits, o->server_key_bits); 2234 dump_cfg_int(sLoginGraceTime, o->login_grace_time); 2235 dump_cfg_int(sKeyRegenerationTime, o->key_regeneration_time); 2236 dump_cfg_int(sX11DisplayOffset, o->x11_display_offset); 2237 dump_cfg_int(sMaxAuthTries, o->max_authtries); 2238 dump_cfg_int(sMaxSessions, o->max_sessions); 2239 dump_cfg_int(sClientAliveInterval, o->client_alive_interval); 2240 dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max); 2241 dump_cfg_oct(sStreamLocalBindMask, o->fwd_opts.streamlocal_bind_mask); 2242 2243 /* formatted integer arguments */ 2244 dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login); 2245 dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts); 2246 dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts); 2247 dump_cfg_fmtint(sRhostsRSAAuthentication, o->rhosts_rsa_authentication); 2248 dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication); 2249 dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly, 2250 o->hostbased_uses_name_from_packet_only); 2251 dump_cfg_fmtint(sRSAAuthentication, o->rsa_authentication); 2252 dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication); 2253 #ifdef KRB5 2254 dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication); 2255 dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd); 2256 dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup); 2257 # ifdef USE_AFS 2258 dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token); 2259 # endif 2260 #endif 2261 #ifdef GSSAPI 2262 dump_cfg_fmtint(sGssAuthentication, o->gss_authentication); 2263 dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds); 2264 #endif 2265 dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication); 2266 dump_cfg_fmtint(sKbdInteractiveAuthentication, 2267 o->kbd_interactive_authentication); 2268 dump_cfg_fmtint(sChallengeResponseAuthentication, 2269 o->challenge_response_authentication); 2270 dump_cfg_fmtint(sPrintMotd, o->print_motd); 2271 dump_cfg_fmtint(sPrintLastLog, o->print_lastlog); 2272 dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding); 2273 dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost); 2274 dump_cfg_fmtint(sPermitTTY, o->permit_tty); 2275 dump_cfg_fmtint(sPermitUserRC, o->permit_user_rc); 2276 dump_cfg_fmtint(sStrictModes, o->strict_modes); 2277 dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive); 2278 dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd); 2279 dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env); 2280 dump_cfg_fmtint(sUseLogin, o->use_login); 2281 dump_cfg_fmtint(sCompression, o->compression); 2282 dump_cfg_fmtint(sGatewayPorts, o->fwd_opts.gateway_ports); 2283 dump_cfg_fmtint(sUseDNS, o->use_dns); 2284 dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding); 2285 dump_cfg_fmtint(sAllowAgentForwarding, o->allow_agent_forwarding); 2286 dump_cfg_fmtint(sAllowStreamLocalForwarding, o->allow_streamlocal_forwarding); 2287 dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep); 2288 dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash); 2289 2290 /* string arguments */ 2291 dump_cfg_string(sPidFile, o->pid_file); 2292 dump_cfg_string(sXAuthLocation, o->xauth_location); 2293 dump_cfg_string(sCiphers, o->ciphers ? o->ciphers : KEX_SERVER_ENCRYPT); 2294 dump_cfg_string(sMacs, o->macs ? o->macs : KEX_SERVER_MAC); 2295 dump_cfg_string(sBanner, o->banner); 2296 dump_cfg_string(sForceCommand, o->adm_forced_command); 2297 dump_cfg_string(sChrootDirectory, o->chroot_directory); 2298 dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys); 2299 dump_cfg_string(sRevokedKeys, o->revoked_keys_file); 2300 dump_cfg_string(sAuthorizedPrincipalsFile, 2301 o->authorized_principals_file); 2302 dump_cfg_string(sVersionAddendum, *o->version_addendum == '\0' 2303 ? "none" : o->version_addendum); 2304 dump_cfg_string(sAuthorizedKeysCommand, o->authorized_keys_command); 2305 dump_cfg_string(sAuthorizedKeysCommandUser, o->authorized_keys_command_user); 2306 dump_cfg_string(sAuthorizedPrincipalsCommand, o->authorized_principals_command); 2307 dump_cfg_string(sAuthorizedPrincipalsCommandUser, o->authorized_principals_command_user); 2308 dump_cfg_string(sHostKeyAgent, o->host_key_agent); 2309 dump_cfg_string(sKexAlgorithms, 2310 o->kex_algorithms ? o->kex_algorithms : KEX_SERVER_KEX); 2311 dump_cfg_string(sHostbasedAcceptedKeyTypes, o->hostbased_key_types ? 2312 o->hostbased_key_types : KEX_DEFAULT_PK_ALG); 2313 dump_cfg_string(sHostKeyAlgorithms, o->hostkeyalgorithms ? 2314 o->hostkeyalgorithms : KEX_DEFAULT_PK_ALG); 2315 dump_cfg_string(sPubkeyAcceptedKeyTypes, o->pubkey_key_types ? 2316 o->pubkey_key_types : KEX_DEFAULT_PK_ALG); 2317 2318 /* string arguments requiring a lookup */ 2319 dump_cfg_string(sLogLevel, log_level_name(o->log_level)); 2320 dump_cfg_string(sLogFacility, log_facility_name(o->log_facility)); 2321 2322 /* string array arguments */ 2323 dump_cfg_strarray_oneline(sAuthorizedKeysFile, o->num_authkeys_files, 2324 o->authorized_keys_files); 2325 dump_cfg_strarray(sHostKeyFile, o->num_host_key_files, 2326 o->host_key_files); 2327 dump_cfg_strarray(sHostCertificate, o->num_host_cert_files, 2328 o->host_cert_files); 2329 dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users); 2330 dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users); 2331 dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups); 2332 dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups); 2333 dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env); 2334 dump_cfg_strarray_oneline(sAuthenticationMethods, 2335 o->num_auth_methods, o->auth_methods); 2336 2337 /* other arguments */ 2338 for (i = 0; i < o->num_subsystems; i++) 2339 printf("subsystem %s %s\n", o->subsystem_name[i], 2340 o->subsystem_args[i]); 2341 2342 printf("maxstartups %d:%d:%d\n", o->max_startups_begin, 2343 o->max_startups_rate, o->max_startups); 2344 2345 for (i = 0; tunmode_desc[i].val != -1; i++) 2346 if (tunmode_desc[i].val == o->permit_tun) { 2347 s = tunmode_desc[i].text; 2348 break; 2349 } 2350 dump_cfg_string(sPermitTunnel, s); 2351 2352 printf("ipqos %s ", iptos2str(o->ip_qos_interactive)); 2353 printf("%s\n", iptos2str(o->ip_qos_bulk)); 2354 2355 printf("rekeylimit %lld %d\n", (long long)o->rekey_limit, 2356 o->rekey_interval); 2357 2358 channel_print_adm_permitted_opens(); 2359 } 2360
