servconf.c revision 207319
1/* $OpenBSD: servconf.c,v 1.207 2010/03/25 23:38:28 djm Exp $ */ 2/* 3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * All rights reserved 5 * 6 * As far as I am concerned, the code I have written for this software 7 * can be used freely for any purpose. Any derived versions of this 8 * software must be clearly marked as such, and if the derived work is 9 * incompatible with the protocol description in the RFC file, it must be 10 * called by a name other than "ssh" or "Secure Shell". 11 */ 12 13#include "includes.h" 14__RCSID("$FreeBSD: head/crypto/openssh/servconf.c 207319 2010-04-28 10:36:33Z des $"); 15 16#include <sys/types.h> 17#include <sys/socket.h> 18 19#include <netdb.h> 20#include <pwd.h> 21#include <stdio.h> 22#include <stdlib.h> 23#include <string.h> 24#include <signal.h> 25#include <unistd.h> 26#include <stdarg.h> 27#include <errno.h> 28 29#include "openbsd-compat/sys-queue.h" 30#include "xmalloc.h" 31#include "ssh.h" 32#include "log.h" 33#include "buffer.h" 34#include "servconf.h" 35#include "compat.h" 36#include "pathnames.h" 37#include "misc.h" 38#include "cipher.h" 39#include "key.h" 40#include "kex.h" 41#include "mac.h" 42#include "match.h" 43#include "channels.h" 44#include "groupaccess.h" 45#include "version.h" 46 47static void add_listen_addr(ServerOptions *, char *, int); 48static void add_one_listen_addr(ServerOptions *, char *, int); 49 50/* Use of privilege separation or not */ 51extern int use_privsep; 52extern Buffer cfg; 53 54/* Initializes the server options to their default values. */ 55 56void 57initialize_server_options(ServerOptions *options) 58{ 59 memset(options, 0, sizeof(*options)); 60 61 /* Portable-specific options */ 62 options->use_pam = -1; 63 64 /* Standard Options */ 65 options->num_ports = 0; 66 options->ports_from_cmdline = 0; 67 options->listen_addrs = NULL; 68 options->address_family = -1; 69 options->num_host_key_files = 0; 70 options->num_host_cert_files = 0; 71 options->pid_file = NULL; 72 options->server_key_bits = -1; 73 options->login_grace_time = -1; 74 options->key_regeneration_time = -1; 75 options->permit_root_login = PERMIT_NOT_SET; 76 options->ignore_rhosts = -1; 77 options->ignore_user_known_hosts = -1; 78 options->print_motd = -1; 79 options->print_lastlog = -1; 80 options->x11_forwarding = -1; 81 options->x11_display_offset = -1; 82 options->x11_use_localhost = -1; 83 options->xauth_location = NULL; 84 options->strict_modes = -1; 85 options->tcp_keep_alive = -1; 86 options->log_facility = SYSLOG_FACILITY_NOT_SET; 87 options->log_level = SYSLOG_LEVEL_NOT_SET; 88 options->rhosts_rsa_authentication = -1; 89 options->hostbased_authentication = -1; 90 options->hostbased_uses_name_from_packet_only = -1; 91 options->rsa_authentication = -1; 92 options->pubkey_authentication = -1; 93 options->kerberos_authentication = -1; 94 options->kerberos_or_local_passwd = -1; 95 options->kerberos_ticket_cleanup = -1; 96 options->kerberos_get_afs_token = -1; 97 options->gss_authentication=-1; 98 options->gss_cleanup_creds = -1; 99 options->password_authentication = -1; 100 options->kbd_interactive_authentication = -1; 101 options->challenge_response_authentication = -1; 102 options->permit_empty_passwd = -1; 103 options->permit_user_env = -1; 104 options->use_login = -1; 105 options->compression = -1; 106 options->allow_tcp_forwarding = -1; 107 options->allow_agent_forwarding = -1; 108 options->num_allow_users = 0; 109 options->num_deny_users = 0; 110 options->num_allow_groups = 0; 111 options->num_deny_groups = 0; 112 options->ciphers = NULL; 113 options->macs = NULL; 114 options->protocol = SSH_PROTO_UNKNOWN; 115 options->gateway_ports = -1; 116 options->num_subsystems = 0; 117 options->max_startups_begin = -1; 118 options->max_startups_rate = -1; 119 options->max_startups = -1; 120 options->max_authtries = -1; 121 options->max_sessions = -1; 122 options->banner = NULL; 123 options->use_dns = -1; 124 options->client_alive_interval = -1; 125 options->client_alive_count_max = -1; 126 options->authorized_keys_file = NULL; 127 options->authorized_keys_file2 = NULL; 128 options->num_accept_env = 0; 129 options->permit_tun = -1; 130 options->num_permitted_opens = -1; 131 options->adm_forced_command = NULL; 132 options->chroot_directory = NULL; 133 options->zero_knowledge_password_authentication = -1; 134 options->revoked_keys_file = NULL; 135 options->trusted_user_ca_keys = NULL; 136} 137 138void 139fill_default_server_options(ServerOptions *options) 140{ 141 /* Portable-specific options */ 142 if (options->use_pam == -1) 143 options->use_pam = 1; 144 145 /* Standard Options */ 146 if (options->protocol == SSH_PROTO_UNKNOWN) 147 options->protocol = SSH_PROTO_2; 148 if (options->num_host_key_files == 0) { 149 /* fill default hostkeys for protocols */ 150 if (options->protocol & SSH_PROTO_1) 151 options->host_key_files[options->num_host_key_files++] = 152 _PATH_HOST_KEY_FILE; 153 if (options->protocol & SSH_PROTO_2) { 154 options->host_key_files[options->num_host_key_files++] = 155 _PATH_HOST_RSA_KEY_FILE; 156 options->host_key_files[options->num_host_key_files++] = 157 _PATH_HOST_DSA_KEY_FILE; 158 } 159 } 160 /* No certificates by default */ 161 if (options->num_ports == 0) 162 options->ports[options->num_ports++] = SSH_DEFAULT_PORT; 163 if (options->listen_addrs == NULL) 164 add_listen_addr(options, NULL, 0); 165 if (options->pid_file == NULL) 166 options->pid_file = _PATH_SSH_DAEMON_PID_FILE; 167 if (options->server_key_bits == -1) 168 options->server_key_bits = 1024; 169 if (options->login_grace_time == -1) 170 options->login_grace_time = 120; 171 if (options->key_regeneration_time == -1) 172 options->key_regeneration_time = 3600; 173 if (options->permit_root_login == PERMIT_NOT_SET) 174 options->permit_root_login = PERMIT_NO; 175 if (options->ignore_rhosts == -1) 176 options->ignore_rhosts = 1; 177 if (options->ignore_user_known_hosts == -1) 178 options->ignore_user_known_hosts = 0; 179 if (options->print_motd == -1) 180 options->print_motd = 1; 181 if (options->print_lastlog == -1) 182 options->print_lastlog = 1; 183 if (options->x11_forwarding == -1) 184 options->x11_forwarding = 1; 185 if (options->x11_display_offset == -1) 186 options->x11_display_offset = 10; 187 if (options->x11_use_localhost == -1) 188 options->x11_use_localhost = 1; 189 if (options->xauth_location == NULL) 190 options->xauth_location = _PATH_XAUTH; 191 if (options->strict_modes == -1) 192 options->strict_modes = 1; 193 if (options->tcp_keep_alive == -1) 194 options->tcp_keep_alive = 1; 195 if (options->log_facility == SYSLOG_FACILITY_NOT_SET) 196 options->log_facility = SYSLOG_FACILITY_AUTH; 197 if (options->log_level == SYSLOG_LEVEL_NOT_SET) 198 options->log_level = SYSLOG_LEVEL_INFO; 199 if (options->rhosts_rsa_authentication == -1) 200 options->rhosts_rsa_authentication = 0; 201 if (options->hostbased_authentication == -1) 202 options->hostbased_authentication = 0; 203 if (options->hostbased_uses_name_from_packet_only == -1) 204 options->hostbased_uses_name_from_packet_only = 0; 205 if (options->rsa_authentication == -1) 206 options->rsa_authentication = 1; 207 if (options->pubkey_authentication == -1) 208 options->pubkey_authentication = 1; 209 if (options->kerberos_authentication == -1) 210 options->kerberos_authentication = 0; 211 if (options->kerberos_or_local_passwd == -1) 212 options->kerberos_or_local_passwd = 1; 213 if (options->kerberos_ticket_cleanup == -1) 214 options->kerberos_ticket_cleanup = 1; 215 if (options->kerberos_get_afs_token == -1) 216 options->kerberos_get_afs_token = 0; 217 if (options->gss_authentication == -1) 218 options->gss_authentication = 0; 219 if (options->gss_cleanup_creds == -1) 220 options->gss_cleanup_creds = 1; 221 if (options->password_authentication == -1) 222 options->password_authentication = 0; 223 if (options->kbd_interactive_authentication == -1) 224 options->kbd_interactive_authentication = 0; 225 if (options->challenge_response_authentication == -1) 226 options->challenge_response_authentication = 1; 227 if (options->permit_empty_passwd == -1) 228 options->permit_empty_passwd = 0; 229 if (options->permit_user_env == -1) 230 options->permit_user_env = 0; 231 if (options->use_login == -1) 232 options->use_login = 0; 233 if (options->compression == -1) 234 options->compression = COMP_DELAYED; 235 if (options->allow_tcp_forwarding == -1) 236 options->allow_tcp_forwarding = 1; 237 if (options->allow_agent_forwarding == -1) 238 options->allow_agent_forwarding = 1; 239 if (options->gateway_ports == -1) 240 options->gateway_ports = 0; 241 if (options->max_startups == -1) 242 options->max_startups = 10; 243 if (options->max_startups_rate == -1) 244 options->max_startups_rate = 100; /* 100% */ 245 if (options->max_startups_begin == -1) 246 options->max_startups_begin = options->max_startups; 247 if (options->max_authtries == -1) 248 options->max_authtries = DEFAULT_AUTH_FAIL_MAX; 249 if (options->max_sessions == -1) 250 options->max_sessions = DEFAULT_SESSIONS_MAX; 251 if (options->use_dns == -1) 252 options->use_dns = 1; 253 if (options->client_alive_interval == -1) 254 options->client_alive_interval = 0; 255 if (options->client_alive_count_max == -1) 256 options->client_alive_count_max = 3; 257 if (options->authorized_keys_file2 == NULL) { 258 /* authorized_keys_file2 falls back to authorized_keys_file */ 259 if (options->authorized_keys_file != NULL) 260 options->authorized_keys_file2 = options->authorized_keys_file; 261 else 262 options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2; 263 } 264 if (options->authorized_keys_file == NULL) 265 options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS; 266 if (options->permit_tun == -1) 267 options->permit_tun = SSH_TUNMODE_NO; 268 if (options->zero_knowledge_password_authentication == -1) 269 options->zero_knowledge_password_authentication = 0; 270 271 /* Turn privilege separation on by default */ 272 if (use_privsep == -1) 273 use_privsep = 1; 274 275#ifndef HAVE_MMAP 276 if (use_privsep && options->compression == 1) { 277 error("This platform does not support both privilege " 278 "separation and compression"); 279 error("Compression disabled"); 280 options->compression = 0; 281 } 282#endif 283 284} 285 286/* Keyword tokens. */ 287typedef enum { 288 sBadOption, /* == unknown option */ 289 /* Portable-specific options */ 290 sUsePAM, 291 /* Standard Options */ 292 sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime, 293 sPermitRootLogin, sLogFacility, sLogLevel, 294 sRhostsRSAAuthentication, sRSAAuthentication, 295 sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup, 296 sKerberosGetAFSToken, 297 sKerberosTgtPassing, sChallengeResponseAuthentication, 298 sPasswordAuthentication, sKbdInteractiveAuthentication, 299 sListenAddress, sAddressFamily, 300 sPrintMotd, sPrintLastLog, sIgnoreRhosts, 301 sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost, 302 sStrictModes, sEmptyPasswd, sTCPKeepAlive, 303 sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression, 304 sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups, 305 sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile, 306 sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, 307 sMaxStartups, sMaxAuthTries, sMaxSessions, 308 sBanner, sUseDNS, sHostbasedAuthentication, 309 sHostbasedUsesNameFromPacketOnly, sClientAliveInterval, 310 sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2, 311 sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel, 312 sMatch, sPermitOpen, sForceCommand, sChrootDirectory, 313 sUsePrivilegeSeparation, sAllowAgentForwarding, 314 sZeroKnowledgePasswordAuthentication, sHostCertificate, 315 sRevokedKeys, sTrustedUserCAKeys, 316 sVersionAddendum, 317 sDeprecated, sUnsupported 318} ServerOpCodes; 319 320#define SSHCFG_GLOBAL 0x01 /* allowed in main section of sshd_config */ 321#define SSHCFG_MATCH 0x02 /* allowed inside a Match section */ 322#define SSHCFG_ALL (SSHCFG_GLOBAL|SSHCFG_MATCH) 323 324/* Textual representation of the tokens. */ 325static struct { 326 const char *name; 327 ServerOpCodes opcode; 328 u_int flags; 329} keywords[] = { 330 /* Portable-specific options */ 331#ifdef USE_PAM 332 { "usepam", sUsePAM, SSHCFG_GLOBAL }, 333#else 334 { "usepam", sUnsupported, SSHCFG_GLOBAL }, 335#endif 336 { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL }, 337 /* Standard Options */ 338 { "port", sPort, SSHCFG_GLOBAL }, 339 { "hostkey", sHostKeyFile, SSHCFG_GLOBAL }, 340 { "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL }, /* alias */ 341 { "pidfile", sPidFile, SSHCFG_GLOBAL }, 342 { "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL }, 343 { "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL }, 344 { "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL }, 345 { "permitrootlogin", sPermitRootLogin, SSHCFG_ALL }, 346 { "syslogfacility", sLogFacility, SSHCFG_GLOBAL }, 347 { "loglevel", sLogLevel, SSHCFG_GLOBAL }, 348 { "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL }, 349 { "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL }, 350 { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL }, 351 { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_GLOBAL }, 352 { "rsaauthentication", sRSAAuthentication, SSHCFG_ALL }, 353 { "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL }, 354 { "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */ 355#ifdef KRB5 356 { "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL }, 357 { "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL }, 358 { "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL }, 359#ifdef USE_AFS 360 { "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL }, 361#else 362 { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL }, 363#endif 364#else 365 { "kerberosauthentication", sUnsupported, SSHCFG_ALL }, 366 { "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL }, 367 { "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL }, 368 { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL }, 369#endif 370 { "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL }, 371 { "afstokenpassing", sUnsupported, SSHCFG_GLOBAL }, 372#ifdef GSSAPI 373 { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL }, 374 { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL }, 375#else 376 { "gssapiauthentication", sUnsupported, SSHCFG_ALL }, 377 { "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL }, 378#endif 379 { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL }, 380 { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL }, 381 { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, 382 { "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */ 383#ifdef JPAKE 384 { "zeroknowledgepasswordauthentication", sZeroKnowledgePasswordAuthentication, SSHCFG_ALL }, 385#else 386 { "zeroknowledgepasswordauthentication", sUnsupported, SSHCFG_ALL }, 387#endif 388 { "checkmail", sDeprecated, SSHCFG_GLOBAL }, 389 { "listenaddress", sListenAddress, SSHCFG_GLOBAL }, 390 { "addressfamily", sAddressFamily, SSHCFG_GLOBAL }, 391 { "printmotd", sPrintMotd, SSHCFG_GLOBAL }, 392 { "printlastlog", sPrintLastLog, SSHCFG_GLOBAL }, 393 { "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL }, 394 { "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL }, 395 { "x11forwarding", sX11Forwarding, SSHCFG_ALL }, 396 { "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL }, 397 { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL }, 398 { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL }, 399 { "strictmodes", sStrictModes, SSHCFG_GLOBAL }, 400 { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL }, 401 { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL }, 402 { "uselogin", sUseLogin, SSHCFG_GLOBAL }, 403 { "compression", sCompression, SSHCFG_GLOBAL }, 404 { "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL }, 405 { "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL }, /* obsolete alias */ 406 { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL }, 407 { "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL }, 408 { "allowusers", sAllowUsers, SSHCFG_GLOBAL }, 409 { "denyusers", sDenyUsers, SSHCFG_GLOBAL }, 410 { "allowgroups", sAllowGroups, SSHCFG_GLOBAL }, 411 { "denygroups", sDenyGroups, SSHCFG_GLOBAL }, 412 { "ciphers", sCiphers, SSHCFG_GLOBAL }, 413 { "macs", sMacs, SSHCFG_GLOBAL }, 414 { "protocol", sProtocol, SSHCFG_GLOBAL }, 415 { "gatewayports", sGatewayPorts, SSHCFG_ALL }, 416 { "subsystem", sSubsystem, SSHCFG_GLOBAL }, 417 { "maxstartups", sMaxStartups, SSHCFG_GLOBAL }, 418 { "maxauthtries", sMaxAuthTries, SSHCFG_ALL }, 419 { "maxsessions", sMaxSessions, SSHCFG_ALL }, 420 { "banner", sBanner, SSHCFG_ALL }, 421 { "usedns", sUseDNS, SSHCFG_GLOBAL }, 422 { "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL }, 423 { "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL }, 424 { "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL }, 425 { "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL }, 426 { "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_GLOBAL }, 427 { "authorizedkeysfile2", sAuthorizedKeysFile2, SSHCFG_GLOBAL }, 428 { "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL}, 429 { "acceptenv", sAcceptEnv, SSHCFG_GLOBAL }, 430 { "permittunnel", sPermitTunnel, SSHCFG_GLOBAL }, 431 { "match", sMatch, SSHCFG_ALL }, 432 { "permitopen", sPermitOpen, SSHCFG_ALL }, 433 { "forcecommand", sForceCommand, SSHCFG_ALL }, 434 { "chrootdirectory", sChrootDirectory, SSHCFG_ALL }, 435 { "hostcertificate", sHostCertificate, SSHCFG_GLOBAL }, 436 { "revokedkeys", sRevokedKeys, SSHCFG_ALL }, 437 { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL }, 438 { "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL }, 439 { NULL, sBadOption, 0 } 440}; 441 442static struct { 443 int val; 444 char *text; 445} tunmode_desc[] = { 446 { SSH_TUNMODE_NO, "no" }, 447 { SSH_TUNMODE_POINTOPOINT, "point-to-point" }, 448 { SSH_TUNMODE_ETHERNET, "ethernet" }, 449 { SSH_TUNMODE_YES, "yes" }, 450 { -1, NULL } 451}; 452 453/* 454 * Returns the number of the token pointed to by cp or sBadOption. 455 */ 456 457static ServerOpCodes 458parse_token(const char *cp, const char *filename, 459 int linenum, u_int *flags) 460{ 461 u_int i; 462 463 for (i = 0; keywords[i].name; i++) 464 if (strcasecmp(cp, keywords[i].name) == 0) { 465 *flags = keywords[i].flags; 466 return keywords[i].opcode; 467 } 468 469 error("%s: line %d: Bad configuration option: %s", 470 filename, linenum, cp); 471 return sBadOption; 472} 473 474char * 475derelativise_path(const char *path) 476{ 477 char *expanded, *ret, cwd[MAXPATHLEN]; 478 479 expanded = tilde_expand_filename(path, getuid()); 480 if (*expanded == '/') 481 return expanded; 482 if (getcwd(cwd, sizeof(cwd)) == NULL) 483 fatal("%s: getcwd: %s", __func__, strerror(errno)); 484 xasprintf(&ret, "%s/%s", cwd, expanded); 485 xfree(expanded); 486 return ret; 487} 488 489static void 490add_listen_addr(ServerOptions *options, char *addr, int port) 491{ 492 u_int i; 493 494 if (options->num_ports == 0) 495 options->ports[options->num_ports++] = SSH_DEFAULT_PORT; 496 if (options->address_family == -1) 497 options->address_family = AF_UNSPEC; 498 if (port == 0) 499 for (i = 0; i < options->num_ports; i++) 500 add_one_listen_addr(options, addr, options->ports[i]); 501 else 502 add_one_listen_addr(options, addr, port); 503} 504 505static void 506add_one_listen_addr(ServerOptions *options, char *addr, int port) 507{ 508 struct addrinfo hints, *ai, *aitop; 509 char strport[NI_MAXSERV]; 510 int gaierr; 511 512 memset(&hints, 0, sizeof(hints)); 513 hints.ai_family = options->address_family; 514 hints.ai_socktype = SOCK_STREAM; 515 hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0; 516 snprintf(strport, sizeof strport, "%d", port); 517 if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0) 518 fatal("bad addr or host: %s (%s)", 519 addr ? addr : "<NULL>", 520 ssh_gai_strerror(gaierr)); 521 for (ai = aitop; ai->ai_next; ai = ai->ai_next) 522 ; 523 ai->ai_next = options->listen_addrs; 524 options->listen_addrs = aitop; 525} 526 527/* 528 * The strategy for the Match blocks is that the config file is parsed twice. 529 * 530 * The first time is at startup. activep is initialized to 1 and the 531 * directives in the global context are processed and acted on. Hitting a 532 * Match directive unsets activep and the directives inside the block are 533 * checked for syntax only. 534 * 535 * The second time is after a connection has been established but before 536 * authentication. activep is initialized to 2 and global config directives 537 * are ignored since they have already been processed. If the criteria in a 538 * Match block is met, activep is set and the subsequent directives 539 * processed and actioned until EOF or another Match block unsets it. Any 540 * options set are copied into the main server config. 541 * 542 * Potential additions/improvements: 543 * - Add Match support for pre-kex directives, eg Protocol, Ciphers. 544 * 545 * - Add a Tag directive (idea from David Leonard) ala pf, eg: 546 * Match Address 192.168.0.* 547 * Tag trusted 548 * Match Group wheel 549 * Tag trusted 550 * Match Tag trusted 551 * AllowTcpForwarding yes 552 * GatewayPorts clientspecified 553 * [...] 554 * 555 * - Add a PermittedChannelRequests directive 556 * Match Group shell 557 * PermittedChannelRequests session,forwarded-tcpip 558 */ 559 560static int 561match_cfg_line_group(const char *grps, int line, const char *user) 562{ 563 int result = 0; 564 struct passwd *pw; 565 566 if (user == NULL) 567 goto out; 568 569 if ((pw = getpwnam(user)) == NULL) { 570 debug("Can't match group at line %d because user %.100s does " 571 "not exist", line, user); 572 } else if (ga_init(pw->pw_name, pw->pw_gid) == 0) { 573 debug("Can't Match group because user %.100s not in any group " 574 "at line %d", user, line); 575 } else if (ga_match_pattern_list(grps) != 1) { 576 debug("user %.100s does not match group list %.100s at line %d", 577 user, grps, line); 578 } else { 579 debug("user %.100s matched group list %.100s at line %d", user, 580 grps, line); 581 result = 1; 582 } 583out: 584 ga_free(); 585 return result; 586} 587 588static int 589match_cfg_line(char **condition, int line, const char *user, const char *host, 590 const char *address) 591{ 592 int result = 1; 593 char *arg, *attrib, *cp = *condition; 594 size_t len; 595 596 if (user == NULL) 597 debug3("checking syntax for 'Match %s'", cp); 598 else 599 debug3("checking match for '%s' user %s host %s addr %s", cp, 600 user ? user : "(null)", host ? host : "(null)", 601 address ? address : "(null)"); 602 603 while ((attrib = strdelim(&cp)) && *attrib != '\0') { 604 if ((arg = strdelim(&cp)) == NULL || *arg == '\0') { 605 error("Missing Match criteria for %s", attrib); 606 return -1; 607 } 608 len = strlen(arg); 609 if (strcasecmp(attrib, "user") == 0) { 610 if (!user) { 611 result = 0; 612 continue; 613 } 614 if (match_pattern_list(user, arg, len, 0) != 1) 615 result = 0; 616 else 617 debug("user %.100s matched 'User %.100s' at " 618 "line %d", user, arg, line); 619 } else if (strcasecmp(attrib, "group") == 0) { 620 switch (match_cfg_line_group(arg, line, user)) { 621 case -1: 622 return -1; 623 case 0: 624 result = 0; 625 } 626 } else if (strcasecmp(attrib, "host") == 0) { 627 if (!host) { 628 result = 0; 629 continue; 630 } 631 if (match_hostname(host, arg, len) != 1) 632 result = 0; 633 else 634 debug("connection from %.100s matched 'Host " 635 "%.100s' at line %d", host, arg, line); 636 } else if (strcasecmp(attrib, "address") == 0) { 637 switch (addr_match_list(address, arg)) { 638 case 1: 639 debug("connection from %.100s matched 'Address " 640 "%.100s' at line %d", address, arg, line); 641 break; 642 case 0: 643 case -1: 644 result = 0; 645 break; 646 case -2: 647 return -1; 648 } 649 } else { 650 error("Unsupported Match attribute %s", attrib); 651 return -1; 652 } 653 } 654 if (user != NULL) 655 debug3("match %sfound", result ? "" : "not "); 656 *condition = cp; 657 return result; 658} 659 660#define WHITESPACE " \t\r\n" 661 662int 663process_server_config_line(ServerOptions *options, char *line, 664 const char *filename, int linenum, int *activep, const char *user, 665 const char *host, const char *address) 666{ 667 char *cp, **charptr, *arg, *p; 668 int cmdline = 0, *intptr, value, n; 669 SyslogFacility *log_facility_ptr; 670 LogLevel *log_level_ptr; 671 ServerOpCodes opcode; 672 int port; 673 u_int i, flags = 0; 674 size_t len; 675 676 cp = line; 677 if ((arg = strdelim(&cp)) == NULL) 678 return 0; 679 /* Ignore leading whitespace */ 680 if (*arg == '\0') 681 arg = strdelim(&cp); 682 if (!arg || !*arg || *arg == '#') 683 return 0; 684 intptr = NULL; 685 charptr = NULL; 686 opcode = parse_token(arg, filename, linenum, &flags); 687 688 if (activep == NULL) { /* We are processing a command line directive */ 689 cmdline = 1; 690 activep = &cmdline; 691 } 692 if (*activep && opcode != sMatch) 693 debug3("%s:%d setting %s %s", filename, linenum, arg, cp); 694 if (*activep == 0 && !(flags & SSHCFG_MATCH)) { 695 if (user == NULL) { 696 fatal("%s line %d: Directive '%s' is not allowed " 697 "within a Match block", filename, linenum, arg); 698 } else { /* this is a directive we have already processed */ 699 while (arg) 700 arg = strdelim(&cp); 701 return 0; 702 } 703 } 704 705 switch (opcode) { 706 /* Portable-specific options */ 707 case sUsePAM: 708 intptr = &options->use_pam; 709 goto parse_flag; 710 711 /* Standard Options */ 712 case sBadOption: 713 return -1; 714 case sPort: 715 /* ignore ports from configfile if cmdline specifies ports */ 716 if (options->ports_from_cmdline) 717 return 0; 718 if (options->listen_addrs != NULL) 719 fatal("%s line %d: ports must be specified before " 720 "ListenAddress.", filename, linenum); 721 if (options->num_ports >= MAX_PORTS) 722 fatal("%s line %d: too many ports.", 723 filename, linenum); 724 arg = strdelim(&cp); 725 if (!arg || *arg == '\0') 726 fatal("%s line %d: missing port number.", 727 filename, linenum); 728 options->ports[options->num_ports++] = a2port(arg); 729 if (options->ports[options->num_ports-1] <= 0) 730 fatal("%s line %d: Badly formatted port number.", 731 filename, linenum); 732 break; 733 734 case sServerKeyBits: 735 intptr = &options->server_key_bits; 736 parse_int: 737 arg = strdelim(&cp); 738 if (!arg || *arg == '\0') 739 fatal("%s line %d: missing integer value.", 740 filename, linenum); 741 value = atoi(arg); 742 if (*activep && *intptr == -1) 743 *intptr = value; 744 break; 745 746 case sLoginGraceTime: 747 intptr = &options->login_grace_time; 748 parse_time: 749 arg = strdelim(&cp); 750 if (!arg || *arg == '\0') 751 fatal("%s line %d: missing time value.", 752 filename, linenum); 753 if ((value = convtime(arg)) == -1) 754 fatal("%s line %d: invalid time value.", 755 filename, linenum); 756 if (*intptr == -1) 757 *intptr = value; 758 break; 759 760 case sKeyRegenerationTime: 761 intptr = &options->key_regeneration_time; 762 goto parse_time; 763 764 case sListenAddress: 765 arg = strdelim(&cp); 766 if (arg == NULL || *arg == '\0') 767 fatal("%s line %d: missing address", 768 filename, linenum); 769 /* check for bare IPv6 address: no "[]" and 2 or more ":" */ 770 if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL 771 && strchr(p+1, ':') != NULL) { 772 add_listen_addr(options, arg, 0); 773 break; 774 } 775 p = hpdelim(&arg); 776 if (p == NULL) 777 fatal("%s line %d: bad address:port usage", 778 filename, linenum); 779 p = cleanhostname(p); 780 if (arg == NULL) 781 port = 0; 782 else if ((port = a2port(arg)) <= 0) 783 fatal("%s line %d: bad port number", filename, linenum); 784 785 add_listen_addr(options, p, port); 786 787 break; 788 789 case sAddressFamily: 790 arg = strdelim(&cp); 791 if (!arg || *arg == '\0') 792 fatal("%s line %d: missing address family.", 793 filename, linenum); 794 intptr = &options->address_family; 795 if (options->listen_addrs != NULL) 796 fatal("%s line %d: address family must be specified before " 797 "ListenAddress.", filename, linenum); 798 if (strcasecmp(arg, "inet") == 0) 799 value = AF_INET; 800 else if (strcasecmp(arg, "inet6") == 0) 801 value = AF_INET6; 802 else if (strcasecmp(arg, "any") == 0) 803 value = AF_UNSPEC; 804 else 805 fatal("%s line %d: unsupported address family \"%s\".", 806 filename, linenum, arg); 807 if (*intptr == -1) 808 *intptr = value; 809 break; 810 811 case sHostKeyFile: 812 intptr = &options->num_host_key_files; 813 if (*intptr >= MAX_HOSTKEYS) 814 fatal("%s line %d: too many host keys specified (max %d).", 815 filename, linenum, MAX_HOSTKEYS); 816 charptr = &options->host_key_files[*intptr]; 817 parse_filename: 818 arg = strdelim(&cp); 819 if (!arg || *arg == '\0') 820 fatal("%s line %d: missing file name.", 821 filename, linenum); 822 if (*activep && *charptr == NULL) { 823 *charptr = derelativise_path(arg); 824 /* increase optional counter */ 825 if (intptr != NULL) 826 *intptr = *intptr + 1; 827 } 828 break; 829 830 case sHostCertificate: 831 intptr = &options->num_host_cert_files; 832 if (*intptr >= MAX_HOSTKEYS) 833 fatal("%s line %d: too many host certificates " 834 "specified (max %d).", filename, linenum, 835 MAX_HOSTCERTS); 836 charptr = &options->host_cert_files[*intptr]; 837 goto parse_filename; 838 break; 839 840 case sPidFile: 841 charptr = &options->pid_file; 842 goto parse_filename; 843 844 case sPermitRootLogin: 845 intptr = &options->permit_root_login; 846 arg = strdelim(&cp); 847 if (!arg || *arg == '\0') 848 fatal("%s line %d: missing yes/" 849 "without-password/forced-commands-only/no " 850 "argument.", filename, linenum); 851 value = 0; /* silence compiler */ 852 if (strcmp(arg, "without-password") == 0) 853 value = PERMIT_NO_PASSWD; 854 else if (strcmp(arg, "forced-commands-only") == 0) 855 value = PERMIT_FORCED_ONLY; 856 else if (strcmp(arg, "yes") == 0) 857 value = PERMIT_YES; 858 else if (strcmp(arg, "no") == 0) 859 value = PERMIT_NO; 860 else 861 fatal("%s line %d: Bad yes/" 862 "without-password/forced-commands-only/no " 863 "argument: %s", filename, linenum, arg); 864 if (*activep && *intptr == -1) 865 *intptr = value; 866 break; 867 868 case sIgnoreRhosts: 869 intptr = &options->ignore_rhosts; 870 parse_flag: 871 arg = strdelim(&cp); 872 if (!arg || *arg == '\0') 873 fatal("%s line %d: missing yes/no argument.", 874 filename, linenum); 875 value = 0; /* silence compiler */ 876 if (strcmp(arg, "yes") == 0) 877 value = 1; 878 else if (strcmp(arg, "no") == 0) 879 value = 0; 880 else 881 fatal("%s line %d: Bad yes/no argument: %s", 882 filename, linenum, arg); 883 if (*activep && *intptr == -1) 884 *intptr = value; 885 break; 886 887 case sIgnoreUserKnownHosts: 888 intptr = &options->ignore_user_known_hosts; 889 goto parse_flag; 890 891 case sRhostsRSAAuthentication: 892 intptr = &options->rhosts_rsa_authentication; 893 goto parse_flag; 894 895 case sHostbasedAuthentication: 896 intptr = &options->hostbased_authentication; 897 goto parse_flag; 898 899 case sHostbasedUsesNameFromPacketOnly: 900 intptr = &options->hostbased_uses_name_from_packet_only; 901 goto parse_flag; 902 903 case sRSAAuthentication: 904 intptr = &options->rsa_authentication; 905 goto parse_flag; 906 907 case sPubkeyAuthentication: 908 intptr = &options->pubkey_authentication; 909 goto parse_flag; 910 911 case sKerberosAuthentication: 912 intptr = &options->kerberos_authentication; 913 goto parse_flag; 914 915 case sKerberosOrLocalPasswd: 916 intptr = &options->kerberos_or_local_passwd; 917 goto parse_flag; 918 919 case sKerberosTicketCleanup: 920 intptr = &options->kerberos_ticket_cleanup; 921 goto parse_flag; 922 923 case sKerberosGetAFSToken: 924 intptr = &options->kerberos_get_afs_token; 925 goto parse_flag; 926 927 case sGssAuthentication: 928 intptr = &options->gss_authentication; 929 goto parse_flag; 930 931 case sGssCleanupCreds: 932 intptr = &options->gss_cleanup_creds; 933 goto parse_flag; 934 935 case sPasswordAuthentication: 936 intptr = &options->password_authentication; 937 goto parse_flag; 938 939 case sZeroKnowledgePasswordAuthentication: 940 intptr = &options->zero_knowledge_password_authentication; 941 goto parse_flag; 942 943 case sKbdInteractiveAuthentication: 944 intptr = &options->kbd_interactive_authentication; 945 goto parse_flag; 946 947 case sChallengeResponseAuthentication: 948 intptr = &options->challenge_response_authentication; 949 goto parse_flag; 950 951 case sPrintMotd: 952 intptr = &options->print_motd; 953 goto parse_flag; 954 955 case sPrintLastLog: 956 intptr = &options->print_lastlog; 957 goto parse_flag; 958 959 case sX11Forwarding: 960 intptr = &options->x11_forwarding; 961 goto parse_flag; 962 963 case sX11DisplayOffset: 964 intptr = &options->x11_display_offset; 965 goto parse_int; 966 967 case sX11UseLocalhost: 968 intptr = &options->x11_use_localhost; 969 goto parse_flag; 970 971 case sXAuthLocation: 972 charptr = &options->xauth_location; 973 goto parse_filename; 974 975 case sStrictModes: 976 intptr = &options->strict_modes; 977 goto parse_flag; 978 979 case sTCPKeepAlive: 980 intptr = &options->tcp_keep_alive; 981 goto parse_flag; 982 983 case sEmptyPasswd: 984 intptr = &options->permit_empty_passwd; 985 goto parse_flag; 986 987 case sPermitUserEnvironment: 988 intptr = &options->permit_user_env; 989 goto parse_flag; 990 991 case sUseLogin: 992 intptr = &options->use_login; 993 goto parse_flag; 994 995 case sCompression: 996 intptr = &options->compression; 997 arg = strdelim(&cp); 998 if (!arg || *arg == '\0') 999 fatal("%s line %d: missing yes/no/delayed " 1000 "argument.", filename, linenum); 1001 value = 0; /* silence compiler */ 1002 if (strcmp(arg, "delayed") == 0) 1003 value = COMP_DELAYED; 1004 else if (strcmp(arg, "yes") == 0) 1005 value = COMP_ZLIB; 1006 else if (strcmp(arg, "no") == 0) 1007 value = COMP_NONE; 1008 else 1009 fatal("%s line %d: Bad yes/no/delayed " 1010 "argument: %s", filename, linenum, arg); 1011 if (*intptr == -1) 1012 *intptr = value; 1013 break; 1014 1015 case sGatewayPorts: 1016 intptr = &options->gateway_ports; 1017 arg = strdelim(&cp); 1018 if (!arg || *arg == '\0') 1019 fatal("%s line %d: missing yes/no/clientspecified " 1020 "argument.", filename, linenum); 1021 value = 0; /* silence compiler */ 1022 if (strcmp(arg, "clientspecified") == 0) 1023 value = 2; 1024 else if (strcmp(arg, "yes") == 0) 1025 value = 1; 1026 else if (strcmp(arg, "no") == 0) 1027 value = 0; 1028 else 1029 fatal("%s line %d: Bad yes/no/clientspecified " 1030 "argument: %s", filename, linenum, arg); 1031 if (*activep && *intptr == -1) 1032 *intptr = value; 1033 break; 1034 1035 case sUseDNS: 1036 intptr = &options->use_dns; 1037 goto parse_flag; 1038 1039 case sLogFacility: 1040 log_facility_ptr = &options->log_facility; 1041 arg = strdelim(&cp); 1042 value = log_facility_number(arg); 1043 if (value == SYSLOG_FACILITY_NOT_SET) 1044 fatal("%.200s line %d: unsupported log facility '%s'", 1045 filename, linenum, arg ? arg : "<NONE>"); 1046 if (*log_facility_ptr == -1) 1047 *log_facility_ptr = (SyslogFacility) value; 1048 break; 1049 1050 case sLogLevel: 1051 log_level_ptr = &options->log_level; 1052 arg = strdelim(&cp); 1053 value = log_level_number(arg); 1054 if (value == SYSLOG_LEVEL_NOT_SET) 1055 fatal("%.200s line %d: unsupported log level '%s'", 1056 filename, linenum, arg ? arg : "<NONE>"); 1057 if (*log_level_ptr == -1) 1058 *log_level_ptr = (LogLevel) value; 1059 break; 1060 1061 case sAllowTcpForwarding: 1062 intptr = &options->allow_tcp_forwarding; 1063 goto parse_flag; 1064 1065 case sAllowAgentForwarding: 1066 intptr = &options->allow_agent_forwarding; 1067 goto parse_flag; 1068 1069 case sUsePrivilegeSeparation: 1070 intptr = &use_privsep; 1071 goto parse_flag; 1072 1073 case sAllowUsers: 1074 while ((arg = strdelim(&cp)) && *arg != '\0') { 1075 if (options->num_allow_users >= MAX_ALLOW_USERS) 1076 fatal("%s line %d: too many allow users.", 1077 filename, linenum); 1078 options->allow_users[options->num_allow_users++] = 1079 xstrdup(arg); 1080 } 1081 break; 1082 1083 case sDenyUsers: 1084 while ((arg = strdelim(&cp)) && *arg != '\0') { 1085 if (options->num_deny_users >= MAX_DENY_USERS) 1086 fatal("%s line %d: too many deny users.", 1087 filename, linenum); 1088 options->deny_users[options->num_deny_users++] = 1089 xstrdup(arg); 1090 } 1091 break; 1092 1093 case sAllowGroups: 1094 while ((arg = strdelim(&cp)) && *arg != '\0') { 1095 if (options->num_allow_groups >= MAX_ALLOW_GROUPS) 1096 fatal("%s line %d: too many allow groups.", 1097 filename, linenum); 1098 options->allow_groups[options->num_allow_groups++] = 1099 xstrdup(arg); 1100 } 1101 break; 1102 1103 case sDenyGroups: 1104 while ((arg = strdelim(&cp)) && *arg != '\0') { 1105 if (options->num_deny_groups >= MAX_DENY_GROUPS) 1106 fatal("%s line %d: too many deny groups.", 1107 filename, linenum); 1108 options->deny_groups[options->num_deny_groups++] = xstrdup(arg); 1109 } 1110 break; 1111 1112 case sCiphers: 1113 arg = strdelim(&cp); 1114 if (!arg || *arg == '\0') 1115 fatal("%s line %d: Missing argument.", filename, linenum); 1116 if (!ciphers_valid(arg)) 1117 fatal("%s line %d: Bad SSH2 cipher spec '%s'.", 1118 filename, linenum, arg ? arg : "<NONE>"); 1119 if (options->ciphers == NULL) 1120 options->ciphers = xstrdup(arg); 1121 break; 1122 1123 case sMacs: 1124 arg = strdelim(&cp); 1125 if (!arg || *arg == '\0') 1126 fatal("%s line %d: Missing argument.", filename, linenum); 1127 if (!mac_valid(arg)) 1128 fatal("%s line %d: Bad SSH2 mac spec '%s'.", 1129 filename, linenum, arg ? arg : "<NONE>"); 1130 if (options->macs == NULL) 1131 options->macs = xstrdup(arg); 1132 break; 1133 1134 case sProtocol: 1135 intptr = &options->protocol; 1136 arg = strdelim(&cp); 1137 if (!arg || *arg == '\0') 1138 fatal("%s line %d: Missing argument.", filename, linenum); 1139 value = proto_spec(arg); 1140 if (value == SSH_PROTO_UNKNOWN) 1141 fatal("%s line %d: Bad protocol spec '%s'.", 1142 filename, linenum, arg ? arg : "<NONE>"); 1143 if (*intptr == SSH_PROTO_UNKNOWN) 1144 *intptr = value; 1145 break; 1146 1147 case sSubsystem: 1148 if (options->num_subsystems >= MAX_SUBSYSTEMS) { 1149 fatal("%s line %d: too many subsystems defined.", 1150 filename, linenum); 1151 } 1152 arg = strdelim(&cp); 1153 if (!arg || *arg == '\0') 1154 fatal("%s line %d: Missing subsystem name.", 1155 filename, linenum); 1156 if (!*activep) { 1157 arg = strdelim(&cp); 1158 break; 1159 } 1160 for (i = 0; i < options->num_subsystems; i++) 1161 if (strcmp(arg, options->subsystem_name[i]) == 0) 1162 fatal("%s line %d: Subsystem '%s' already defined.", 1163 filename, linenum, arg); 1164 options->subsystem_name[options->num_subsystems] = xstrdup(arg); 1165 arg = strdelim(&cp); 1166 if (!arg || *arg == '\0') 1167 fatal("%s line %d: Missing subsystem command.", 1168 filename, linenum); 1169 options->subsystem_command[options->num_subsystems] = xstrdup(arg); 1170 1171 /* Collect arguments (separate to executable) */ 1172 p = xstrdup(arg); 1173 len = strlen(p) + 1; 1174 while ((arg = strdelim(&cp)) != NULL && *arg != '\0') { 1175 len += 1 + strlen(arg); 1176 p = xrealloc(p, 1, len); 1177 strlcat(p, " ", len); 1178 strlcat(p, arg, len); 1179 } 1180 options->subsystem_args[options->num_subsystems] = p; 1181 options->num_subsystems++; 1182 break; 1183 1184 case sMaxStartups: 1185 arg = strdelim(&cp); 1186 if (!arg || *arg == '\0') 1187 fatal("%s line %d: Missing MaxStartups spec.", 1188 filename, linenum); 1189 if ((n = sscanf(arg, "%d:%d:%d", 1190 &options->max_startups_begin, 1191 &options->max_startups_rate, 1192 &options->max_startups)) == 3) { 1193 if (options->max_startups_begin > 1194 options->max_startups || 1195 options->max_startups_rate > 100 || 1196 options->max_startups_rate < 1) 1197 fatal("%s line %d: Illegal MaxStartups spec.", 1198 filename, linenum); 1199 } else if (n != 1) 1200 fatal("%s line %d: Illegal MaxStartups spec.", 1201 filename, linenum); 1202 else 1203 options->max_startups = options->max_startups_begin; 1204 break; 1205 1206 case sMaxAuthTries: 1207 intptr = &options->max_authtries; 1208 goto parse_int; 1209 1210 case sMaxSessions: 1211 intptr = &options->max_sessions; 1212 goto parse_int; 1213 1214 case sBanner: 1215 charptr = &options->banner; 1216 goto parse_filename; 1217 1218 /* 1219 * These options can contain %X options expanded at 1220 * connect time, so that you can specify paths like: 1221 * 1222 * AuthorizedKeysFile /etc/ssh_keys/%u 1223 */ 1224 case sAuthorizedKeysFile: 1225 case sAuthorizedKeysFile2: 1226 charptr = (opcode == sAuthorizedKeysFile) ? 1227 &options->authorized_keys_file : 1228 &options->authorized_keys_file2; 1229 arg = strdelim(&cp); 1230 if (!arg || *arg == '\0') 1231 fatal("%s line %d: missing file name.", 1232 filename, linenum); 1233 if (*activep && *charptr == NULL) { 1234 *charptr = tilde_expand_filename(arg, getuid()); 1235 /* increase optional counter */ 1236 if (intptr != NULL) 1237 *intptr = *intptr + 1; 1238 } 1239 break; 1240 1241 case sClientAliveInterval: 1242 intptr = &options->client_alive_interval; 1243 goto parse_time; 1244 1245 case sClientAliveCountMax: 1246 intptr = &options->client_alive_count_max; 1247 goto parse_int; 1248 1249 case sAcceptEnv: 1250 while ((arg = strdelim(&cp)) && *arg != '\0') { 1251 if (strchr(arg, '=') != NULL) 1252 fatal("%s line %d: Invalid environment name.", 1253 filename, linenum); 1254 if (options->num_accept_env >= MAX_ACCEPT_ENV) 1255 fatal("%s line %d: too many allow env.", 1256 filename, linenum); 1257 if (!*activep) 1258 break; 1259 options->accept_env[options->num_accept_env++] = 1260 xstrdup(arg); 1261 } 1262 break; 1263 1264 case sPermitTunnel: 1265 intptr = &options->permit_tun; 1266 arg = strdelim(&cp); 1267 if (!arg || *arg == '\0') 1268 fatal("%s line %d: Missing yes/point-to-point/" 1269 "ethernet/no argument.", filename, linenum); 1270 value = -1; 1271 for (i = 0; tunmode_desc[i].val != -1; i++) 1272 if (strcmp(tunmode_desc[i].text, arg) == 0) { 1273 value = tunmode_desc[i].val; 1274 break; 1275 } 1276 if (value == -1) 1277 fatal("%s line %d: Bad yes/point-to-point/ethernet/" 1278 "no argument: %s", filename, linenum, arg); 1279 if (*intptr == -1) 1280 *intptr = value; 1281 break; 1282 1283 case sMatch: 1284 if (cmdline) 1285 fatal("Match directive not supported as a command-line " 1286 "option"); 1287 value = match_cfg_line(&cp, linenum, user, host, address); 1288 if (value < 0) 1289 fatal("%s line %d: Bad Match condition", filename, 1290 linenum); 1291 *activep = value; 1292 break; 1293 1294 case sPermitOpen: 1295 arg = strdelim(&cp); 1296 if (!arg || *arg == '\0') 1297 fatal("%s line %d: missing PermitOpen specification", 1298 filename, linenum); 1299 n = options->num_permitted_opens; /* modified later */ 1300 if (strcmp(arg, "any") == 0) { 1301 if (*activep && n == -1) { 1302 channel_clear_adm_permitted_opens(); 1303 options->num_permitted_opens = 0; 1304 } 1305 break; 1306 } 1307 if (*activep && n == -1) 1308 channel_clear_adm_permitted_opens(); 1309 for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) { 1310 p = hpdelim(&arg); 1311 if (p == NULL) 1312 fatal("%s line %d: missing host in PermitOpen", 1313 filename, linenum); 1314 p = cleanhostname(p); 1315 if (arg == NULL || (port = a2port(arg)) <= 0) 1316 fatal("%s line %d: bad port number in " 1317 "PermitOpen", filename, linenum); 1318 if (*activep && n == -1) 1319 options->num_permitted_opens = 1320 channel_add_adm_permitted_opens(p, port); 1321 } 1322 break; 1323 1324 case sForceCommand: 1325 if (cp == NULL) 1326 fatal("%.200s line %d: Missing argument.", filename, 1327 linenum); 1328 len = strspn(cp, WHITESPACE); 1329 if (*activep && options->adm_forced_command == NULL) 1330 options->adm_forced_command = xstrdup(cp + len); 1331 return 0; 1332 1333 case sChrootDirectory: 1334 charptr = &options->chroot_directory; 1335 1336 arg = strdelim(&cp); 1337 if (!arg || *arg == '\0') 1338 fatal("%s line %d: missing file name.", 1339 filename, linenum); 1340 if (*activep && *charptr == NULL) 1341 *charptr = xstrdup(arg); 1342 break; 1343 1344 case sTrustedUserCAKeys: 1345 charptr = &options->trusted_user_ca_keys; 1346 goto parse_filename; 1347 1348 case sRevokedKeys: 1349 charptr = &options->revoked_keys_file; 1350 goto parse_filename; 1351 1352 case sVersionAddendum: 1353 ssh_version_set_addendum(strtok(cp, "\n")); 1354 do { 1355 arg = strdelim(&cp); 1356 } while (arg != NULL && *arg != '\0'); 1357 break; 1358 1359 case sDeprecated: 1360 logit("%s line %d: Deprecated option %s", 1361 filename, linenum, arg); 1362 while (arg) 1363 arg = strdelim(&cp); 1364 break; 1365 1366 case sUnsupported: 1367 logit("%s line %d: Unsupported option %s", 1368 filename, linenum, arg); 1369 while (arg) 1370 arg = strdelim(&cp); 1371 break; 1372 1373 default: 1374 fatal("%s line %d: Missing handler for opcode %s (%d)", 1375 filename, linenum, arg, opcode); 1376 } 1377 if ((arg = strdelim(&cp)) != NULL && *arg != '\0') 1378 fatal("%s line %d: garbage at end of line; \"%.200s\".", 1379 filename, linenum, arg); 1380 return 0; 1381} 1382 1383/* Reads the server configuration file. */ 1384 1385void 1386load_server_config(const char *filename, Buffer *conf) 1387{ 1388 char line[1024], *cp; 1389 FILE *f; 1390 1391 debug2("%s: filename %s", __func__, filename); 1392 if ((f = fopen(filename, "r")) == NULL) { 1393 perror(filename); 1394 exit(1); 1395 } 1396 buffer_clear(conf); 1397 while (fgets(line, sizeof(line), f)) { 1398 /* 1399 * Trim out comments and strip whitespace 1400 * NB - preserve newlines, they are needed to reproduce 1401 * line numbers later for error messages 1402 */ 1403 if ((cp = strchr(line, '#')) != NULL) 1404 memcpy(cp, "\n", 2); 1405 cp = line + strspn(line, " \t\r"); 1406 1407 buffer_append(conf, cp, strlen(cp)); 1408 } 1409 buffer_append(conf, "\0", 1); 1410 fclose(f); 1411 debug2("%s: done config len = %d", __func__, buffer_len(conf)); 1412} 1413 1414void 1415parse_server_match_config(ServerOptions *options, const char *user, 1416 const char *host, const char *address) 1417{ 1418 ServerOptions mo; 1419 1420 initialize_server_options(&mo); 1421 parse_server_config(&mo, "reprocess config", &cfg, user, host, address); 1422 copy_set_server_options(options, &mo, 0); 1423} 1424 1425/* Helper macros */ 1426#define M_CP_INTOPT(n) do {\ 1427 if (src->n != -1) \ 1428 dst->n = src->n; \ 1429} while (0) 1430#define M_CP_STROPT(n) do {\ 1431 if (src->n != NULL) { \ 1432 if (dst->n != NULL) \ 1433 xfree(dst->n); \ 1434 dst->n = src->n; \ 1435 } \ 1436} while(0) 1437 1438/* 1439 * Copy any supported values that are set. 1440 * 1441 * If the preauth flag is set, we do not bother copying the string or 1442 * array values that are not used pre-authentication, because any that we 1443 * do use must be explictly sent in mm_getpwnamallow(). 1444 */ 1445void 1446copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth) 1447{ 1448 M_CP_INTOPT(password_authentication); 1449 M_CP_INTOPT(gss_authentication); 1450 M_CP_INTOPT(rsa_authentication); 1451 M_CP_INTOPT(pubkey_authentication); 1452 M_CP_INTOPT(kerberos_authentication); 1453 M_CP_INTOPT(hostbased_authentication); 1454 M_CP_INTOPT(kbd_interactive_authentication); 1455 M_CP_INTOPT(zero_knowledge_password_authentication); 1456 M_CP_INTOPT(permit_root_login); 1457 M_CP_INTOPT(permit_empty_passwd); 1458 1459 M_CP_INTOPT(allow_tcp_forwarding); 1460 M_CP_INTOPT(allow_agent_forwarding); 1461 M_CP_INTOPT(gateway_ports); 1462 M_CP_INTOPT(x11_display_offset); 1463 M_CP_INTOPT(x11_forwarding); 1464 M_CP_INTOPT(x11_use_localhost); 1465 M_CP_INTOPT(max_sessions); 1466 M_CP_INTOPT(max_authtries); 1467 1468 M_CP_STROPT(banner); 1469 if (preauth) 1470 return; 1471 M_CP_STROPT(adm_forced_command); 1472 M_CP_STROPT(chroot_directory); 1473 M_CP_STROPT(trusted_user_ca_keys); 1474 M_CP_STROPT(revoked_keys_file); 1475} 1476 1477#undef M_CP_INTOPT 1478#undef M_CP_STROPT 1479 1480void 1481parse_server_config(ServerOptions *options, const char *filename, Buffer *conf, 1482 const char *user, const char *host, const char *address) 1483{ 1484 int active, linenum, bad_options = 0; 1485 char *cp, *obuf, *cbuf; 1486 1487 debug2("%s: config %s len %d", __func__, filename, buffer_len(conf)); 1488 1489 obuf = cbuf = xstrdup(buffer_ptr(conf)); 1490 active = user ? 0 : 1; 1491 linenum = 1; 1492 while ((cp = strsep(&cbuf, "\n")) != NULL) { 1493 if (process_server_config_line(options, cp, filename, 1494 linenum++, &active, user, host, address) != 0) 1495 bad_options++; 1496 } 1497 xfree(obuf); 1498 if (bad_options > 0) 1499 fatal("%s: terminating, %d bad configuration options", 1500 filename, bad_options); 1501} 1502 1503static const char * 1504fmt_intarg(ServerOpCodes code, int val) 1505{ 1506 if (code == sAddressFamily) { 1507 switch (val) { 1508 case AF_INET: 1509 return "inet"; 1510 case AF_INET6: 1511 return "inet6"; 1512 case AF_UNSPEC: 1513 return "any"; 1514 default: 1515 return "UNKNOWN"; 1516 } 1517 } 1518 if (code == sPermitRootLogin) { 1519 switch (val) { 1520 case PERMIT_NO_PASSWD: 1521 return "without-password"; 1522 case PERMIT_FORCED_ONLY: 1523 return "forced-commands-only"; 1524 case PERMIT_YES: 1525 return "yes"; 1526 } 1527 } 1528 if (code == sProtocol) { 1529 switch (val) { 1530 case SSH_PROTO_1: 1531 return "1"; 1532 case SSH_PROTO_2: 1533 return "2"; 1534 case (SSH_PROTO_1|SSH_PROTO_2): 1535 return "2,1"; 1536 default: 1537 return "UNKNOWN"; 1538 } 1539 } 1540 if (code == sGatewayPorts && val == 2) 1541 return "clientspecified"; 1542 if (code == sCompression && val == COMP_DELAYED) 1543 return "delayed"; 1544 switch (val) { 1545 case -1: 1546 return "unset"; 1547 case 0: 1548 return "no"; 1549 case 1: 1550 return "yes"; 1551 } 1552 return "UNKNOWN"; 1553} 1554 1555static const char * 1556lookup_opcode_name(ServerOpCodes code) 1557{ 1558 u_int i; 1559 1560 for (i = 0; keywords[i].name != NULL; i++) 1561 if (keywords[i].opcode == code) 1562 return(keywords[i].name); 1563 return "UNKNOWN"; 1564} 1565 1566static void 1567dump_cfg_int(ServerOpCodes code, int val) 1568{ 1569 printf("%s %d\n", lookup_opcode_name(code), val); 1570} 1571 1572static void 1573dump_cfg_fmtint(ServerOpCodes code, int val) 1574{ 1575 printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val)); 1576} 1577 1578static void 1579dump_cfg_string(ServerOpCodes code, const char *val) 1580{ 1581 if (val == NULL) 1582 return; 1583 printf("%s %s\n", lookup_opcode_name(code), val); 1584} 1585 1586static void 1587dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals) 1588{ 1589 u_int i; 1590 1591 for (i = 0; i < count; i++) 1592 printf("%s %s\n", lookup_opcode_name(code), vals[i]); 1593} 1594 1595void 1596dump_config(ServerOptions *o) 1597{ 1598 u_int i; 1599 int ret; 1600 struct addrinfo *ai; 1601 char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL; 1602 1603 /* these are usually at the top of the config */ 1604 for (i = 0; i < o->num_ports; i++) 1605 printf("port %d\n", o->ports[i]); 1606 dump_cfg_fmtint(sProtocol, o->protocol); 1607 dump_cfg_fmtint(sAddressFamily, o->address_family); 1608 1609 /* ListenAddress must be after Port */ 1610 for (ai = o->listen_addrs; ai; ai = ai->ai_next) { 1611 if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr, 1612 sizeof(addr), port, sizeof(port), 1613 NI_NUMERICHOST|NI_NUMERICSERV)) != 0) { 1614 error("getnameinfo failed: %.100s", 1615 (ret != EAI_SYSTEM) ? gai_strerror(ret) : 1616 strerror(errno)); 1617 } else { 1618 if (ai->ai_family == AF_INET6) 1619 printf("listenaddress [%s]:%s\n", addr, port); 1620 else 1621 printf("listenaddress %s:%s\n", addr, port); 1622 } 1623 } 1624 1625 /* integer arguments */ 1626#ifdef USE_PAM 1627 dump_cfg_int(sUsePAM, o->use_pam); 1628#endif 1629 dump_cfg_int(sServerKeyBits, o->server_key_bits); 1630 dump_cfg_int(sLoginGraceTime, o->login_grace_time); 1631 dump_cfg_int(sKeyRegenerationTime, o->key_regeneration_time); 1632 dump_cfg_int(sX11DisplayOffset, o->x11_display_offset); 1633 dump_cfg_int(sMaxAuthTries, o->max_authtries); 1634 dump_cfg_int(sMaxSessions, o->max_sessions); 1635 dump_cfg_int(sClientAliveInterval, o->client_alive_interval); 1636 dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max); 1637 1638 /* formatted integer arguments */ 1639 dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login); 1640 dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts); 1641 dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts); 1642 dump_cfg_fmtint(sRhostsRSAAuthentication, o->rhosts_rsa_authentication); 1643 dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication); 1644 dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly, 1645 o->hostbased_uses_name_from_packet_only); 1646 dump_cfg_fmtint(sRSAAuthentication, o->rsa_authentication); 1647 dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication); 1648#ifdef KRB5 1649 dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication); 1650 dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd); 1651 dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup); 1652# ifdef USE_AFS 1653 dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token); 1654# endif 1655#endif 1656#ifdef GSSAPI 1657 dump_cfg_fmtint(sGssAuthentication, o->gss_authentication); 1658 dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds); 1659#endif 1660#ifdef JPAKE 1661 dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication, 1662 o->zero_knowledge_password_authentication); 1663#endif 1664 dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication); 1665 dump_cfg_fmtint(sKbdInteractiveAuthentication, 1666 o->kbd_interactive_authentication); 1667 dump_cfg_fmtint(sChallengeResponseAuthentication, 1668 o->challenge_response_authentication); 1669 dump_cfg_fmtint(sPrintMotd, o->print_motd); 1670 dump_cfg_fmtint(sPrintLastLog, o->print_lastlog); 1671 dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding); 1672 dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost); 1673 dump_cfg_fmtint(sStrictModes, o->strict_modes); 1674 dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive); 1675 dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd); 1676 dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env); 1677 dump_cfg_fmtint(sUseLogin, o->use_login); 1678 dump_cfg_fmtint(sCompression, o->compression); 1679 dump_cfg_fmtint(sGatewayPorts, o->gateway_ports); 1680 dump_cfg_fmtint(sUseDNS, o->use_dns); 1681 dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding); 1682 dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep); 1683 1684 /* string arguments */ 1685 dump_cfg_string(sPidFile, o->pid_file); 1686 dump_cfg_string(sXAuthLocation, o->xauth_location); 1687 dump_cfg_string(sCiphers, o->ciphers); 1688 dump_cfg_string(sMacs, o->macs); 1689 dump_cfg_string(sBanner, o->banner); 1690 dump_cfg_string(sAuthorizedKeysFile, o->authorized_keys_file); 1691 dump_cfg_string(sAuthorizedKeysFile2, o->authorized_keys_file2); 1692 dump_cfg_string(sForceCommand, o->adm_forced_command); 1693 dump_cfg_string(sChrootDirectory, o->chroot_directory); 1694 dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys); 1695 dump_cfg_string(sRevokedKeys, o->revoked_keys_file); 1696 1697 /* string arguments requiring a lookup */ 1698 dump_cfg_string(sLogLevel, log_level_name(o->log_level)); 1699 dump_cfg_string(sLogFacility, log_facility_name(o->log_facility)); 1700 1701 /* string array arguments */ 1702 dump_cfg_strarray(sHostKeyFile, o->num_host_key_files, 1703 o->host_key_files); 1704 dump_cfg_strarray(sHostKeyFile, o->num_host_cert_files, 1705 o->host_cert_files); 1706 dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users); 1707 dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users); 1708 dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups); 1709 dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups); 1710 dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env); 1711 1712 /* other arguments */ 1713 for (i = 0; i < o->num_subsystems; i++) 1714 printf("subsystem %s %s\n", o->subsystem_name[i], 1715 o->subsystem_args[i]); 1716 1717 printf("maxstartups %d:%d:%d\n", o->max_startups_begin, 1718 o->max_startups_rate, o->max_startups); 1719 1720 for (i = 0; tunmode_desc[i].val != -1; i++) 1721 if (tunmode_desc[i].val == o->permit_tun) { 1722 s = tunmode_desc[i].text; 1723 break; 1724 } 1725 dump_cfg_string(sPermitTunnel, s); 1726 1727 channel_print_adm_permitted_opens(); 1728} 1729