xref: /dflybsd-src/crypto/openssh/servconf.c (revision f41d807a0c7c535d8f66f0593fb6e95fa20f82d4)
1 /* $OpenBSD: servconf.c,v 1.213 2010/11/13 23:27:50 djm Exp $ */
2 /*
3  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4  *                    All rights reserved
5  *
6  * As far as I am concerned, the code I have written for this software
7  * can be used freely for any purpose.  Any derived versions of this
8  * software must be clearly marked as such, and if the derived work is
9  * incompatible with the protocol description in the RFC file, it must be
10  * called by a name other than "ssh" or "Secure Shell".
11  */
12 
13 #include "includes.h"
14 
15 #include <sys/types.h>
16 #include <sys/socket.h>
17 
18 #include <netinet/in.h>
19 #include <netinet/in_systm.h>
20 #include <netinet/ip.h>
21 
22 #include <netdb.h>
23 #include <pwd.h>
24 #include <stdio.h>
25 #include <stdlib.h>
26 #include <string.h>
27 #include <signal.h>
28 #include <unistd.h>
29 #include <stdarg.h>
30 #include <errno.h>
31 
32 #include "openbsd-compat/sys-queue.h"
33 #include "xmalloc.h"
34 #include "ssh.h"
35 #include "log.h"
36 #include "buffer.h"
37 #include "servconf.h"
38 #include "compat.h"
39 #include "pathnames.h"
40 #include "misc.h"
41 #include "cipher.h"
42 #include "key.h"
43 #include "kex.h"
44 #include "mac.h"
45 #include "match.h"
46 #include "channels.h"
47 #include "groupaccess.h"
48 #include "version.h"
49 
50 static void add_listen_addr(ServerOptions *, char *, int);
51 static void add_one_listen_addr(ServerOptions *, char *, int);
52 
53 /* Use of privilege separation or not */
54 extern int use_privsep;
55 extern Buffer cfg;
56 
57 /* Initializes the server options to their default values. */
58 
59 void
60 initialize_server_options(ServerOptions *options)
61 {
62 	memset(options, 0, sizeof(*options));
63 
64 	/* Portable-specific options */
65 	options->use_pam = -1;
66 
67 	/* Standard Options */
68 	options->num_ports = 0;
69 	options->ports_from_cmdline = 0;
70 	options->listen_addrs = NULL;
71 	options->address_family = -1;
72 	options->num_host_key_files = 0;
73 	options->num_host_cert_files = 0;
74 	options->pid_file = NULL;
75 	options->server_key_bits = -1;
76 	options->login_grace_time = -1;
77 	options->key_regeneration_time = -1;
78 	options->permit_root_login = PERMIT_NOT_SET;
79 	options->ignore_rhosts = -1;
80 	options->ignore_user_known_hosts = -1;
81 	options->print_motd = -1;
82 	options->print_lastlog = -1;
83 	options->x11_forwarding = -1;
84 	options->x11_display_offset = -1;
85 	options->x11_use_localhost = -1;
86 	options->xauth_location = NULL;
87 	options->strict_modes = -1;
88 	options->tcp_keep_alive = -1;
89 	options->log_facility = SYSLOG_FACILITY_NOT_SET;
90 	options->log_level = SYSLOG_LEVEL_NOT_SET;
91 	options->rhosts_rsa_authentication = -1;
92 	options->hostbased_authentication = -1;
93 	options->hostbased_uses_name_from_packet_only = -1;
94 	options->rsa_authentication = -1;
95 	options->pubkey_authentication = -1;
96 	options->kerberos_authentication = -1;
97 	options->kerberos_or_local_passwd = -1;
98 	options->kerberos_ticket_cleanup = -1;
99 	options->kerberos_get_afs_token = -1;
100 	options->gss_authentication=-1;
101 	options->gss_cleanup_creds = -1;
102 	options->password_authentication = -1;
103 	options->kbd_interactive_authentication = -1;
104 	options->challenge_response_authentication = -1;
105 	options->permit_blacklisted_keys = -1;
106 	options->permit_empty_passwd = -1;
107 	options->permit_user_env = -1;
108 	options->use_login = -1;
109 	options->compression = -1;
110 	options->allow_tcp_forwarding = -1;
111 	options->allow_agent_forwarding = -1;
112 	options->num_allow_users = 0;
113 	options->num_deny_users = 0;
114 	options->num_allow_groups = 0;
115 	options->num_deny_groups = 0;
116 	options->ciphers = NULL;
117 	options->macs = NULL;
118 	options->kex_algorithms = NULL;
119 	options->protocol = SSH_PROTO_UNKNOWN;
120 	options->gateway_ports = -1;
121 	options->num_subsystems = 0;
122 	options->max_startups_begin = -1;
123 	options->max_startups_rate = -1;
124 	options->max_startups = -1;
125 	options->max_authtries = -1;
126 	options->max_sessions = -1;
127 	options->banner = NULL;
128 	options->use_dns = -1;
129 	options->client_alive_interval = -1;
130 	options->client_alive_count_max = -1;
131 	options->authorized_keys_file = NULL;
132 	options->authorized_keys_file2 = NULL;
133 	options->num_accept_env = 0;
134 	options->permit_tun = -1;
135 	options->num_permitted_opens = -1;
136 	options->adm_forced_command = NULL;
137 	options->chroot_directory = NULL;
138 	options->zero_knowledge_password_authentication = -1;
139 	options->none_enabled = -1;
140 	options->tcp_rcv_buf_poll = -1;
141 	options->hpn_disabled = -1;
142 	options->hpn_buffer_size = -1;
143 	options->revoked_keys_file = NULL;
144 	options->trusted_user_ca_keys = NULL;
145 	options->authorized_principals_file = NULL;
146 	options->ip_qos_interactive = -1;
147 	options->ip_qos_bulk = -1;
148 }
149 
150 void
151 fill_default_server_options(ServerOptions *options)
152 {
153 	/* needed for hpn socket tests */
154 	int sock;
155 	int socksize;
156 	int socksizelen = sizeof(int);
157 
158 	/* Portable-specific options */
159 	if (options->use_pam == -1)
160 		options->use_pam = 0;
161 
162 	/* Standard Options */
163 	if (options->protocol == SSH_PROTO_UNKNOWN)
164 		options->protocol = SSH_PROTO_2;
165 	if (options->num_host_key_files == 0) {
166 		/* fill default hostkeys for protocols */
167 		if (options->protocol & SSH_PROTO_1)
168 			options->host_key_files[options->num_host_key_files++] =
169 			    _PATH_HOST_KEY_FILE;
170 		if (options->protocol & SSH_PROTO_2) {
171 			options->host_key_files[options->num_host_key_files++] =
172 			    _PATH_HOST_RSA_KEY_FILE;
173 			options->host_key_files[options->num_host_key_files++] =
174 			    _PATH_HOST_DSA_KEY_FILE;
175 #ifdef OPENSSL_HAS_ECC
176 			options->host_key_files[options->num_host_key_files++] =
177 			    _PATH_HOST_ECDSA_KEY_FILE;
178 #endif
179 		}
180 	}
181 	/* No certificates by default */
182 	if (options->num_ports == 0)
183 		options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
184 	if (options->listen_addrs == NULL)
185 		add_listen_addr(options, NULL, 0);
186 	if (options->pid_file == NULL)
187 		options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
188 	if (options->server_key_bits == -1)
189 		options->server_key_bits = 1024;
190 	if (options->login_grace_time == -1)
191 		options->login_grace_time = 120;
192 	if (options->key_regeneration_time == -1)
193 		options->key_regeneration_time = 3600;
194 	if (options->permit_root_login == PERMIT_NOT_SET)
195 		options->permit_root_login = PERMIT_NO;
196 	if (options->ignore_rhosts == -1)
197 		options->ignore_rhosts = 1;
198 	if (options->ignore_user_known_hosts == -1)
199 		options->ignore_user_known_hosts = 0;
200 	if (options->print_motd == -1)
201 		options->print_motd = 1;
202 	if (options->print_lastlog == -1)
203 		options->print_lastlog = 1;
204 	if (options->x11_forwarding == -1)
205 		options->x11_forwarding = 1;
206 	if (options->x11_display_offset == -1)
207 		options->x11_display_offset = 10;
208 	if (options->x11_use_localhost == -1)
209 		options->x11_use_localhost = 1;
210 	if (options->xauth_location == NULL)
211 		options->xauth_location = _PATH_XAUTH;
212 	if (options->strict_modes == -1)
213 		options->strict_modes = 1;
214 	if (options->tcp_keep_alive == -1)
215 		options->tcp_keep_alive = 1;
216 	if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
217 		options->log_facility = SYSLOG_FACILITY_AUTH;
218 	if (options->log_level == SYSLOG_LEVEL_NOT_SET)
219 		options->log_level = SYSLOG_LEVEL_INFO;
220 	if (options->rhosts_rsa_authentication == -1)
221 		options->rhosts_rsa_authentication = 0;
222 	if (options->hostbased_authentication == -1)
223 		options->hostbased_authentication = 0;
224 	if (options->hostbased_uses_name_from_packet_only == -1)
225 		options->hostbased_uses_name_from_packet_only = 0;
226 	if (options->rsa_authentication == -1)
227 		options->rsa_authentication = 1;
228 	if (options->pubkey_authentication == -1)
229 		options->pubkey_authentication = 1;
230 	if (options->kerberos_authentication == -1)
231 		options->kerberos_authentication = 0;
232 	if (options->kerberos_or_local_passwd == -1)
233 		options->kerberos_or_local_passwd = 1;
234 	if (options->kerberos_ticket_cleanup == -1)
235 		options->kerberos_ticket_cleanup = 1;
236 	if (options->kerberos_get_afs_token == -1)
237 		options->kerberos_get_afs_token = 0;
238 	if (options->gss_authentication == -1)
239 		options->gss_authentication = 0;
240 	if (options->gss_cleanup_creds == -1)
241 		options->gss_cleanup_creds = 1;
242 	if (options->password_authentication == -1)
243 		options->password_authentication = 1;
244 	if (options->kbd_interactive_authentication == -1)
245 		options->kbd_interactive_authentication = 0;
246 	if (options->challenge_response_authentication == -1)
247 		options->challenge_response_authentication = 1;
248 	if (options->permit_blacklisted_keys == -1)
249 		options->permit_blacklisted_keys = 0;
250 	if (options->permit_empty_passwd == -1)
251 		options->permit_empty_passwd = 0;
252 	if (options->permit_user_env == -1)
253 		options->permit_user_env = 0;
254 	if (options->use_login == -1)
255 		options->use_login = 0;
256 	if (options->compression == -1)
257 		options->compression = COMP_DELAYED;
258 	if (options->allow_tcp_forwarding == -1)
259 		options->allow_tcp_forwarding = 1;
260 	if (options->allow_agent_forwarding == -1)
261 		options->allow_agent_forwarding = 1;
262 	if (options->gateway_ports == -1)
263 		options->gateway_ports = 0;
264 	if (options->max_startups == -1)
265 		options->max_startups = 10;
266 	if (options->max_startups_rate == -1)
267 		options->max_startups_rate = 100;		/* 100% */
268 	if (options->max_startups_begin == -1)
269 		options->max_startups_begin = options->max_startups;
270 	if (options->max_authtries == -1)
271 		options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
272 	if (options->max_sessions == -1)
273 		options->max_sessions = DEFAULT_SESSIONS_MAX;
274 	if (options->use_dns == -1)
275 		options->use_dns = 1;
276 	if (options->client_alive_interval == -1)
277 		options->client_alive_interval = 0;
278 	if (options->client_alive_count_max == -1)
279 		options->client_alive_count_max = 3;
280 	if (options->authorized_keys_file2 == NULL) {
281 		/* authorized_keys_file2 falls back to authorized_keys_file */
282 		if (options->authorized_keys_file != NULL)
283 			options->authorized_keys_file2 = xstrdup(options->authorized_keys_file);
284 		else
285 			options->authorized_keys_file2 = xstrdup(_PATH_SSH_USER_PERMITTED_KEYS2);
286 	}
287 	if (options->authorized_keys_file == NULL)
288 		options->authorized_keys_file = xstrdup(_PATH_SSH_USER_PERMITTED_KEYS);
289 	if (options->permit_tun == -1)
290 		options->permit_tun = SSH_TUNMODE_NO;
291 	if (options->zero_knowledge_password_authentication == -1)
292 		options->zero_knowledge_password_authentication = 0;
293 	if (options->ip_qos_interactive == -1)
294 		options->ip_qos_interactive = IPTOS_LOWDELAY;
295 	if (options->ip_qos_bulk == -1)
296 		options->ip_qos_bulk = IPTOS_THROUGHPUT;
297 
298 	if (options->hpn_disabled == -1)
299 		options->hpn_disabled = 0;
300 
301 	if (options->hpn_buffer_size == -1) {
302 		/* option not explicitly set. Now we have to figure out */
303 		/* what value to use */
304 		if (options->hpn_disabled == 1) {
305 			options->hpn_buffer_size = CHAN_SES_WINDOW_DEFAULT;
306 		} else {
307 			/* get the current RCV size and set it to that */
308 			/*create a socket but don't connect it */
309 			/* we use that the get the rcv socket size */
310 			sock = socket(AF_INET, SOCK_STREAM, 0);
311 			getsockopt(sock, SOL_SOCKET, SO_RCVBUF,
312 				   &socksize, &socksizelen);
313 			close(sock);
314 			options->hpn_buffer_size = socksize;
315 			debug ("HPN Buffer Size: %d", options->hpn_buffer_size);
316 
317 		}
318 	} else {
319 		/* we have to do this incase the user sets both values in a contradictory */
320 		/* manner. hpn_disabled overrrides hpn_buffer_size*/
321 		if (options->hpn_disabled <= 0) {
322 			if (options->hpn_buffer_size == 0)
323 				options->hpn_buffer_size = 1;
324 			/* limit the maximum buffer to 64MB */
325 			if (options->hpn_buffer_size > 64*1024) {
326 				options->hpn_buffer_size = 64*1024*1024;
327 			} else {
328 				options->hpn_buffer_size *= 1024;
329 			}
330 		} else
331 			options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT;
332 	}
333 
334 	/* Turn privilege separation on by default */
335 	if (use_privsep == -1)
336 		use_privsep = 1;
337 
338 #ifndef HAVE_MMAP
339 	if (use_privsep && options->compression == 1) {
340 		error("This platform does not support both privilege "
341 		    "separation and compression");
342 		error("Compression disabled");
343 		options->compression = 0;
344 	}
345 #endif
346 
347 }
348 
349 /* Keyword tokens. */
350 typedef enum {
351 	sBadOption,		/* == unknown option */
352 	/* Portable-specific options */
353 	sUsePAM,
354 	/* Standard Options */
355 	sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
356 	sPermitRootLogin, sLogFacility, sLogLevel,
357 	sRhostsRSAAuthentication, sRSAAuthentication,
358 	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
359 	sKerberosGetAFSToken,
360 	sKerberosTgtPassing, sChallengeResponseAuthentication,
361 	sPasswordAuthentication, sKbdInteractiveAuthentication,
362 	sListenAddress, sAddressFamily,
363 	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
364 	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
365 	sStrictModes, sPermitBlacklistedKeys, sEmptyPasswd, sTCPKeepAlive,
366 	sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
367 	sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
368 	sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
369 	sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
370 	sMaxStartups, sMaxAuthTries, sMaxSessions,
371 	sBanner, sUseDNS, sHostbasedAuthentication,
372 	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
373 	sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
374 	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
375 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
376 	sUsePrivilegeSeparation, sAllowAgentForwarding,
377 	sZeroKnowledgePasswordAuthentication, sHostCertificate,
378 	sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
379 	sKexAlgorithms, sIPQoS,
380 	sNoneEnabled, sTcpRcvBufPoll, sHPNDisabled, sHPNBufferSize,
381 	sVersionAddendum,
382 	sDeprecated, sUnsupported
383 } ServerOpCodes;
384 
385 #define SSHCFG_GLOBAL	0x01	/* allowed in main section of sshd_config */
386 #define SSHCFG_MATCH	0x02	/* allowed inside a Match section */
387 #define SSHCFG_ALL	(SSHCFG_GLOBAL|SSHCFG_MATCH)
388 
389 /* Textual representation of the tokens. */
390 static struct {
391 	const char *name;
392 	ServerOpCodes opcode;
393 	u_int flags;
394 } keywords[] = {
395 	/* Portable-specific options */
396 #ifdef USE_PAM
397 	{ "usepam", sUsePAM, SSHCFG_GLOBAL },
398 #else
399 	{ "usepam", sUnsupported, SSHCFG_GLOBAL },
400 #endif
401 	{ "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
402 	/* Standard Options */
403 	{ "port", sPort, SSHCFG_GLOBAL },
404 	{ "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
405 	{ "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL },		/* alias */
406 	{ "pidfile", sPidFile, SSHCFG_GLOBAL },
407 	{ "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL },
408 	{ "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
409 	{ "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL },
410 	{ "permitrootlogin", sPermitRootLogin, SSHCFG_ALL },
411 	{ "syslogfacility", sLogFacility, SSHCFG_GLOBAL },
412 	{ "loglevel", sLogLevel, SSHCFG_GLOBAL },
413 	{ "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL },
414 	{ "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
415 	{ "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
416 	{ "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_ALL },
417 	{ "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
418 	{ "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
419 	{ "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
420 #ifdef KRB5
421 	{ "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
422 	{ "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
423 	{ "kerberosticketcleanup", sKerberosTicketCleanup, SSHCFG_GLOBAL },
424 #ifdef USE_AFS
425 	{ "kerberosgetafstoken", sKerberosGetAFSToken, SSHCFG_GLOBAL },
426 #else
427 	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
428 #endif
429 #else
430 	{ "kerberosauthentication", sUnsupported, SSHCFG_ALL },
431 	{ "kerberosorlocalpasswd", sUnsupported, SSHCFG_GLOBAL },
432 	{ "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
433 	{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
434 #endif
435 	{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
436 	{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
437 #ifdef GSSAPI
438 	{ "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
439 	{ "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
440 #else
441 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
442 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
443 #endif
444 	{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
445 	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
446 	{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
447 	{ "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
448 #ifdef JPAKE
449 	{ "zeroknowledgepasswordauthentication", sZeroKnowledgePasswordAuthentication, SSHCFG_ALL },
450 #else
451 	{ "zeroknowledgepasswordauthentication", sUnsupported, SSHCFG_ALL },
452 #endif
453 	{ "checkmail", sDeprecated, SSHCFG_GLOBAL },
454 	{ "listenaddress", sListenAddress, SSHCFG_GLOBAL },
455 	{ "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
456 	{ "printmotd", sPrintMotd, SSHCFG_GLOBAL },
457 	{ "printlastlog", sPrintLastLog, SSHCFG_GLOBAL },
458 	{ "ignorerhosts", sIgnoreRhosts, SSHCFG_GLOBAL },
459 	{ "ignoreuserknownhosts", sIgnoreUserKnownHosts, SSHCFG_GLOBAL },
460 	{ "x11forwarding", sX11Forwarding, SSHCFG_ALL },
461 	{ "x11displayoffset", sX11DisplayOffset, SSHCFG_ALL },
462 	{ "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
463 	{ "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
464 	{ "strictmodes", sStrictModes, SSHCFG_GLOBAL },
465 	{ "permitblacklistedkeys", sPermitBlacklistedKeys, SSHCFG_GLOBAL },
466 	{ "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
467 	{ "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
468 	{ "uselogin", sUseLogin, SSHCFG_GLOBAL },
469 	{ "compression", sCompression, SSHCFG_GLOBAL },
470 	{ "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL },
471 	{ "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL },	/* obsolete alias */
472 	{ "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
473 	{ "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL },
474 	{ "allowusers", sAllowUsers, SSHCFG_GLOBAL },
475 	{ "denyusers", sDenyUsers, SSHCFG_GLOBAL },
476 	{ "allowgroups", sAllowGroups, SSHCFG_GLOBAL },
477 	{ "denygroups", sDenyGroups, SSHCFG_GLOBAL },
478 	{ "ciphers", sCiphers, SSHCFG_GLOBAL },
479 	{ "macs", sMacs, SSHCFG_GLOBAL },
480 	{ "protocol", sProtocol, SSHCFG_GLOBAL },
481 	{ "gatewayports", sGatewayPorts, SSHCFG_ALL },
482 	{ "subsystem", sSubsystem, SSHCFG_GLOBAL },
483 	{ "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
484 	{ "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
485 	{ "maxsessions", sMaxSessions, SSHCFG_ALL },
486 	{ "banner", sBanner, SSHCFG_ALL },
487 	{ "usedns", sUseDNS, SSHCFG_GLOBAL },
488 	{ "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
489 	{ "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
490 	{ "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL },
491 	{ "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
492 	{ "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_ALL },
493 	{ "authorizedkeysfile2", sAuthorizedKeysFile2, SSHCFG_ALL },
494 	{ "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL},
495 	{ "versionaddendum", sVersionAddendum , SSHCFG_GLOBAL },
496 	{ "acceptenv", sAcceptEnv, SSHCFG_GLOBAL },
497 	{ "permittunnel", sPermitTunnel, SSHCFG_ALL },
498 	{ "match", sMatch, SSHCFG_ALL },
499 	{ "permitopen", sPermitOpen, SSHCFG_ALL },
500 	{ "forcecommand", sForceCommand, SSHCFG_ALL },
501 	{ "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
502 	{ "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
503 	{ "revokedkeys", sRevokedKeys, SSHCFG_ALL },
504 	{ "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
505 	{ "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
506 	{ "noneenabled", sNoneEnabled },
507 	{ "hpndisabled", sHPNDisabled },
508 	{ "hpnbuffersize", sHPNBufferSize },
509 	{ "tcprcvbufpoll", sTcpRcvBufPoll },
510 	{ "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
511 	{ "ipqos", sIPQoS, SSHCFG_ALL },
512 	{ NULL, sBadOption, 0 }
513 };
514 
515 static struct {
516 	int val;
517 	char *text;
518 } tunmode_desc[] = {
519 	{ SSH_TUNMODE_NO, "no" },
520 	{ SSH_TUNMODE_POINTOPOINT, "point-to-point" },
521 	{ SSH_TUNMODE_ETHERNET, "ethernet" },
522 	{ SSH_TUNMODE_YES, "yes" },
523 	{ -1, NULL }
524 };
525 
526 /*
527  * Returns the number of the token pointed to by cp or sBadOption.
528  */
529 
530 static ServerOpCodes
531 parse_token(const char *cp, const char *filename,
532 	    int linenum, u_int *flags)
533 {
534 	u_int i;
535 
536 	for (i = 0; keywords[i].name; i++)
537 		if (strcasecmp(cp, keywords[i].name) == 0) {
538 		        debug ("Config token is %s", keywords[i].name);
539 			*flags = keywords[i].flags;
540 			return keywords[i].opcode;
541 		}
542 
543 	error("%s: line %d: Bad configuration option: %s",
544 	    filename, linenum, cp);
545 	return sBadOption;
546 }
547 
548 char *
549 derelativise_path(const char *path)
550 {
551 	char *expanded, *ret, cwd[MAXPATHLEN];
552 
553 	expanded = tilde_expand_filename(path, getuid());
554 	if (*expanded == '/')
555 		return expanded;
556 	if (getcwd(cwd, sizeof(cwd)) == NULL)
557 		fatal("%s: getcwd: %s", __func__, strerror(errno));
558 	xasprintf(&ret, "%s/%s", cwd, expanded);
559 	xfree(expanded);
560 	return ret;
561 }
562 
563 static void
564 add_listen_addr(ServerOptions *options, char *addr, int port)
565 {
566 	u_int i;
567 
568 	if (options->num_ports == 0)
569 		options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
570 	if (options->address_family == -1)
571 		options->address_family = AF_UNSPEC;
572 	if (port == 0)
573 		for (i = 0; i < options->num_ports; i++)
574 			add_one_listen_addr(options, addr, options->ports[i]);
575 	else
576 		add_one_listen_addr(options, addr, port);
577 }
578 
579 static void
580 add_one_listen_addr(ServerOptions *options, char *addr, int port)
581 {
582 	struct addrinfo hints, *ai, *aitop;
583 	char strport[NI_MAXSERV];
584 	int gaierr;
585 
586 	memset(&hints, 0, sizeof(hints));
587 	hints.ai_family = options->address_family;
588 	hints.ai_socktype = SOCK_STREAM;
589 	hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
590 	snprintf(strport, sizeof strport, "%d", port);
591 	if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
592 		fatal("bad addr or host: %s (%s)",
593 		    addr ? addr : "<NULL>",
594 		    ssh_gai_strerror(gaierr));
595 	for (ai = aitop; ai->ai_next; ai = ai->ai_next)
596 		;
597 	ai->ai_next = options->listen_addrs;
598 	options->listen_addrs = aitop;
599 }
600 
601 /*
602  * The strategy for the Match blocks is that the config file is parsed twice.
603  *
604  * The first time is at startup.  activep is initialized to 1 and the
605  * directives in the global context are processed and acted on.  Hitting a
606  * Match directive unsets activep and the directives inside the block are
607  * checked for syntax only.
608  *
609  * The second time is after a connection has been established but before
610  * authentication.  activep is initialized to 2 and global config directives
611  * are ignored since they have already been processed.  If the criteria in a
612  * Match block is met, activep is set and the subsequent directives
613  * processed and actioned until EOF or another Match block unsets it.  Any
614  * options set are copied into the main server config.
615  *
616  * Potential additions/improvements:
617  *  - Add Match support for pre-kex directives, eg Protocol, Ciphers.
618  *
619  *  - Add a Tag directive (idea from David Leonard) ala pf, eg:
620  *	Match Address 192.168.0.*
621  *		Tag trusted
622  *	Match Group wheel
623  *		Tag trusted
624  *	Match Tag trusted
625  *		AllowTcpForwarding yes
626  *		GatewayPorts clientspecified
627  *		[...]
628  *
629  *  - Add a PermittedChannelRequests directive
630  *	Match Group shell
631  *		PermittedChannelRequests session,forwarded-tcpip
632  */
633 
634 static int
635 match_cfg_line_group(const char *grps, int line, const char *user)
636 {
637 	int result = 0;
638 	struct passwd *pw;
639 
640 	if (user == NULL)
641 		goto out;
642 
643 	if ((pw = getpwnam(user)) == NULL) {
644 		debug("Can't match group at line %d because user %.100s does "
645 		    "not exist", line, user);
646 	} else if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
647 		debug("Can't Match group because user %.100s not in any group "
648 		    "at line %d", user, line);
649 	} else if (ga_match_pattern_list(grps) != 1) {
650 		debug("user %.100s does not match group list %.100s at line %d",
651 		    user, grps, line);
652 	} else {
653 		debug("user %.100s matched group list %.100s at line %d", user,
654 		    grps, line);
655 		result = 1;
656 	}
657 out:
658 	ga_free();
659 	return result;
660 }
661 
662 static int
663 match_cfg_line(char **condition, int line, const char *user, const char *host,
664     const char *address)
665 {
666 	int result = 1;
667 	char *arg, *attrib, *cp = *condition;
668 	size_t len;
669 
670 	if (user == NULL)
671 		debug3("checking syntax for 'Match %s'", cp);
672 	else
673 		debug3("checking match for '%s' user %s host %s addr %s", cp,
674 		    user ? user : "(null)", host ? host : "(null)",
675 		    address ? address : "(null)");
676 
677 	while ((attrib = strdelim(&cp)) && *attrib != '\0') {
678 		if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
679 			error("Missing Match criteria for %s", attrib);
680 			return -1;
681 		}
682 		len = strlen(arg);
683 		if (strcasecmp(attrib, "user") == 0) {
684 			if (!user) {
685 				result = 0;
686 				continue;
687 			}
688 			if (match_pattern_list(user, arg, len, 0) != 1)
689 				result = 0;
690 			else
691 				debug("user %.100s matched 'User %.100s' at "
692 				    "line %d", user, arg, line);
693 		} else if (strcasecmp(attrib, "group") == 0) {
694 			switch (match_cfg_line_group(arg, line, user)) {
695 			case -1:
696 				return -1;
697 			case 0:
698 				result = 0;
699 			}
700 		} else if (strcasecmp(attrib, "host") == 0) {
701 			if (!host) {
702 				result = 0;
703 				continue;
704 			}
705 			if (match_hostname(host, arg, len) != 1)
706 				result = 0;
707 			else
708 				debug("connection from %.100s matched 'Host "
709 				    "%.100s' at line %d", host, arg, line);
710 		} else if (strcasecmp(attrib, "address") == 0) {
711 			switch (addr_match_list(address, arg)) {
712 			case 1:
713 				debug("connection from %.100s matched 'Address "
714 				    "%.100s' at line %d", address, arg, line);
715 				break;
716 			case 0:
717 			case -1:
718 				result = 0;
719 				break;
720 			case -2:
721 				return -1;
722 			}
723 		} else {
724 			error("Unsupported Match attribute %s", attrib);
725 			return -1;
726 		}
727 	}
728 	if (user != NULL)
729 		debug3("match %sfound", result ? "" : "not ");
730 	*condition = cp;
731 	return result;
732 }
733 
734 #define WHITESPACE " \t\r\n"
735 
736 int
737 process_server_config_line(ServerOptions *options, char *line,
738     const char *filename, int linenum, int *activep, const char *user,
739     const char *host, const char *address)
740 {
741 	char *cp, **charptr, *arg, *p;
742 	int cmdline = 0, *intptr, value, value2, n;
743 	SyslogFacility *log_facility_ptr;
744 	LogLevel *log_level_ptr;
745 	ServerOpCodes opcode;
746 	int port;
747 	u_int i, flags = 0;
748 	size_t len;
749 
750 	cp = line;
751 	if ((arg = strdelim(&cp)) == NULL)
752 		return 0;
753 	/* Ignore leading whitespace */
754 	if (*arg == '\0')
755 		arg = strdelim(&cp);
756 	if (!arg || !*arg || *arg == '#')
757 		return 0;
758 	intptr = NULL;
759 	charptr = NULL;
760 	opcode = parse_token(arg, filename, linenum, &flags);
761 
762 	if (activep == NULL) { /* We are processing a command line directive */
763 		cmdline = 1;
764 		activep = &cmdline;
765 	}
766 	if (*activep && opcode != sMatch)
767 		debug3("%s:%d setting %s %s", filename, linenum, arg, cp);
768 	if (*activep == 0 && !(flags & SSHCFG_MATCH)) {
769 		if (user == NULL) {
770 			fatal("%s line %d: Directive '%s' is not allowed "
771 			    "within a Match block", filename, linenum, arg);
772 		} else { /* this is a directive we have already processed */
773 			while (arg)
774 				arg = strdelim(&cp);
775 			return 0;
776 		}
777 	}
778 
779 	switch (opcode) {
780 	/* Portable-specific options */
781 	case sUsePAM:
782 		intptr = &options->use_pam;
783 		goto parse_flag;
784 
785 	/* Standard Options */
786 	case sBadOption:
787 		return -1;
788 	case sPort:
789 		/* ignore ports from configfile if cmdline specifies ports */
790 		if (options->ports_from_cmdline)
791 			return 0;
792 		if (options->listen_addrs != NULL)
793 			fatal("%s line %d: ports must be specified before "
794 			    "ListenAddress.", filename, linenum);
795 		if (options->num_ports >= MAX_PORTS)
796 			fatal("%s line %d: too many ports.",
797 			    filename, linenum);
798 		arg = strdelim(&cp);
799 		if (!arg || *arg == '\0')
800 			fatal("%s line %d: missing port number.",
801 			    filename, linenum);
802 		options->ports[options->num_ports++] = a2port(arg);
803 		if (options->ports[options->num_ports-1] <= 0)
804 			fatal("%s line %d: Badly formatted port number.",
805 			    filename, linenum);
806 		break;
807 
808 	case sServerKeyBits:
809 		intptr = &options->server_key_bits;
810  parse_int:
811 		arg = strdelim(&cp);
812 		if (!arg || *arg == '\0')
813 			fatal("%s line %d: missing integer value.",
814 			    filename, linenum);
815 		value = atoi(arg);
816 		if (*activep && *intptr == -1)
817 			*intptr = value;
818 		break;
819 
820 	case sLoginGraceTime:
821 		intptr = &options->login_grace_time;
822  parse_time:
823 		arg = strdelim(&cp);
824 		if (!arg || *arg == '\0')
825 			fatal("%s line %d: missing time value.",
826 			    filename, linenum);
827 		if ((value = convtime(arg)) == -1)
828 			fatal("%s line %d: invalid time value.",
829 			    filename, linenum);
830 		if (*intptr == -1)
831 			*intptr = value;
832 		break;
833 
834 	case sKeyRegenerationTime:
835 		intptr = &options->key_regeneration_time;
836 		goto parse_time;
837 
838 	case sListenAddress:
839 		arg = strdelim(&cp);
840 		if (arg == NULL || *arg == '\0')
841 			fatal("%s line %d: missing address",
842 			    filename, linenum);
843 		/* check for bare IPv6 address: no "[]" and 2 or more ":" */
844 		if (strchr(arg, '[') == NULL && (p = strchr(arg, ':')) != NULL
845 		    && strchr(p+1, ':') != NULL) {
846 			add_listen_addr(options, arg, 0);
847 			break;
848 		}
849 		p = hpdelim(&arg);
850 		if (p == NULL)
851 			fatal("%s line %d: bad address:port usage",
852 			    filename, linenum);
853 		p = cleanhostname(p);
854 		if (arg == NULL)
855 			port = 0;
856 		else if ((port = a2port(arg)) <= 0)
857 			fatal("%s line %d: bad port number", filename, linenum);
858 
859 		add_listen_addr(options, p, port);
860 
861 		break;
862 
863 	case sAddressFamily:
864 		arg = strdelim(&cp);
865 		if (!arg || *arg == '\0')
866 			fatal("%s line %d: missing address family.",
867 			    filename, linenum);
868 		intptr = &options->address_family;
869 		if (options->listen_addrs != NULL)
870 			fatal("%s line %d: address family must be specified before "
871 			    "ListenAddress.", filename, linenum);
872 		if (strcasecmp(arg, "inet") == 0)
873 			value = AF_INET;
874 		else if (strcasecmp(arg, "inet6") == 0)
875 			value = AF_INET6;
876 		else if (strcasecmp(arg, "any") == 0)
877 			value = AF_UNSPEC;
878 		else
879 			fatal("%s line %d: unsupported address family \"%s\".",
880 			    filename, linenum, arg);
881 		if (*intptr == -1)
882 			*intptr = value;
883 		break;
884 
885 	case sHostKeyFile:
886 		intptr = &options->num_host_key_files;
887 		if (*intptr >= MAX_HOSTKEYS)
888 			fatal("%s line %d: too many host keys specified (max %d).",
889 			    filename, linenum, MAX_HOSTKEYS);
890 		charptr = &options->host_key_files[*intptr];
891  parse_filename:
892 		arg = strdelim(&cp);
893 		if (!arg || *arg == '\0')
894 			fatal("%s line %d: missing file name.",
895 			    filename, linenum);
896 		if (*activep && *charptr == NULL) {
897 			*charptr = derelativise_path(arg);
898 			/* increase optional counter */
899 			if (intptr != NULL)
900 				*intptr = *intptr + 1;
901 		}
902 		break;
903 
904 	case sHostCertificate:
905 		intptr = &options->num_host_cert_files;
906 		if (*intptr >= MAX_HOSTKEYS)
907 			fatal("%s line %d: too many host certificates "
908 			    "specified (max %d).", filename, linenum,
909 			    MAX_HOSTCERTS);
910 		charptr = &options->host_cert_files[*intptr];
911 		goto parse_filename;
912 		break;
913 
914 	case sPidFile:
915 		charptr = &options->pid_file;
916 		goto parse_filename;
917 
918 	case sPermitRootLogin:
919 		intptr = &options->permit_root_login;
920 		arg = strdelim(&cp);
921 		if (!arg || *arg == '\0')
922 			fatal("%s line %d: missing yes/"
923 			    "without-password/forced-commands-only/no "
924 			    "argument.", filename, linenum);
925 		value = 0;	/* silence compiler */
926 		if (strcmp(arg, "without-password") == 0)
927 			value = PERMIT_NO_PASSWD;
928 		else if (strcmp(arg, "forced-commands-only") == 0)
929 			value = PERMIT_FORCED_ONLY;
930 		else if (strcmp(arg, "yes") == 0)
931 			value = PERMIT_YES;
932 		else if (strcmp(arg, "no") == 0)
933 			value = PERMIT_NO;
934 		else
935 			fatal("%s line %d: Bad yes/"
936 			    "without-password/forced-commands-only/no "
937 			    "argument: %s", filename, linenum, arg);
938 		if (*activep && *intptr == -1)
939 			*intptr = value;
940 		break;
941 
942 	case sIgnoreRhosts:
943 		intptr = &options->ignore_rhosts;
944  parse_flag:
945 		arg = strdelim(&cp);
946 		if (!arg || *arg == '\0')
947 			fatal("%s line %d: missing yes/no argument.",
948 			    filename, linenum);
949 		value = 0;	/* silence compiler */
950 		if (strcmp(arg, "yes") == 0)
951 			value = 1;
952 		else if (strcmp(arg, "no") == 0)
953 			value = 0;
954 		else
955 			fatal("%s line %d: Bad yes/no argument: %s",
956 				filename, linenum, arg);
957 		if (*activep && *intptr == -1)
958 			*intptr = value;
959 		break;
960 
961 	case sNoneEnabled:
962 		intptr = &options->none_enabled;
963 		goto parse_flag;
964 
965 	case sTcpRcvBufPoll:
966 		intptr = &options->tcp_rcv_buf_poll;
967 		goto parse_flag;
968 
969 	case sHPNDisabled:
970 		intptr = &options->hpn_disabled;
971 		goto parse_flag;
972 
973 	case sHPNBufferSize:
974 		intptr = &options->hpn_buffer_size;
975 		goto parse_int;
976 
977 	case sIgnoreUserKnownHosts:
978 		intptr = &options->ignore_user_known_hosts;
979 		goto parse_flag;
980 
981 	case sRhostsRSAAuthentication:
982 		intptr = &options->rhosts_rsa_authentication;
983 		goto parse_flag;
984 
985 	case sHostbasedAuthentication:
986 		intptr = &options->hostbased_authentication;
987 		goto parse_flag;
988 
989 	case sHostbasedUsesNameFromPacketOnly:
990 		intptr = &options->hostbased_uses_name_from_packet_only;
991 		goto parse_flag;
992 
993 	case sRSAAuthentication:
994 		intptr = &options->rsa_authentication;
995 		goto parse_flag;
996 
997 	case sPubkeyAuthentication:
998 		intptr = &options->pubkey_authentication;
999 		goto parse_flag;
1000 
1001 	case sKerberosAuthentication:
1002 		intptr = &options->kerberos_authentication;
1003 		goto parse_flag;
1004 
1005 	case sKerberosOrLocalPasswd:
1006 		intptr = &options->kerberos_or_local_passwd;
1007 		goto parse_flag;
1008 
1009 	case sKerberosTicketCleanup:
1010 		intptr = &options->kerberos_ticket_cleanup;
1011 		goto parse_flag;
1012 
1013 	case sKerberosGetAFSToken:
1014 		intptr = &options->kerberos_get_afs_token;
1015 		goto parse_flag;
1016 
1017 	case sGssAuthentication:
1018 		intptr = &options->gss_authentication;
1019 		goto parse_flag;
1020 
1021 	case sGssCleanupCreds:
1022 		intptr = &options->gss_cleanup_creds;
1023 		goto parse_flag;
1024 
1025 	case sPasswordAuthentication:
1026 		intptr = &options->password_authentication;
1027 		goto parse_flag;
1028 
1029 	case sZeroKnowledgePasswordAuthentication:
1030 		intptr = &options->zero_knowledge_password_authentication;
1031 		goto parse_flag;
1032 
1033 	case sKbdInteractiveAuthentication:
1034 		intptr = &options->kbd_interactive_authentication;
1035 		goto parse_flag;
1036 
1037 	case sChallengeResponseAuthentication:
1038 		intptr = &options->challenge_response_authentication;
1039 		goto parse_flag;
1040 
1041 	case sPrintMotd:
1042 		intptr = &options->print_motd;
1043 		goto parse_flag;
1044 
1045 	case sPrintLastLog:
1046 		intptr = &options->print_lastlog;
1047 		goto parse_flag;
1048 
1049 	case sX11Forwarding:
1050 		intptr = &options->x11_forwarding;
1051 		goto parse_flag;
1052 
1053 	case sX11DisplayOffset:
1054 		intptr = &options->x11_display_offset;
1055 		goto parse_int;
1056 
1057 	case sX11UseLocalhost:
1058 		intptr = &options->x11_use_localhost;
1059 		goto parse_flag;
1060 
1061 	case sXAuthLocation:
1062 		charptr = &options->xauth_location;
1063 		goto parse_filename;
1064 
1065 	case sStrictModes:
1066 		intptr = &options->strict_modes;
1067 		goto parse_flag;
1068 
1069 	case sTCPKeepAlive:
1070 		intptr = &options->tcp_keep_alive;
1071 		goto parse_flag;
1072 
1073 	case sPermitBlacklistedKeys:
1074 		intptr = &options->permit_blacklisted_keys;
1075 		goto parse_flag;
1076 
1077 	case sEmptyPasswd:
1078 		intptr = &options->permit_empty_passwd;
1079 		goto parse_flag;
1080 
1081 	case sPermitUserEnvironment:
1082 		intptr = &options->permit_user_env;
1083 		goto parse_flag;
1084 
1085 	case sUseLogin:
1086 		intptr = &options->use_login;
1087 		goto parse_flag;
1088 
1089 	case sCompression:
1090 		intptr = &options->compression;
1091 		arg = strdelim(&cp);
1092 		if (!arg || *arg == '\0')
1093 			fatal("%s line %d: missing yes/no/delayed "
1094 			    "argument.", filename, linenum);
1095 		value = 0;	/* silence compiler */
1096 		if (strcmp(arg, "delayed") == 0)
1097 			value = COMP_DELAYED;
1098 		else if (strcmp(arg, "yes") == 0)
1099 			value = COMP_ZLIB;
1100 		else if (strcmp(arg, "no") == 0)
1101 			value = COMP_NONE;
1102 		else
1103 			fatal("%s line %d: Bad yes/no/delayed "
1104 			    "argument: %s", filename, linenum, arg);
1105 		if (*intptr == -1)
1106 			*intptr = value;
1107 		break;
1108 
1109 	case sGatewayPorts:
1110 		intptr = &options->gateway_ports;
1111 		arg = strdelim(&cp);
1112 		if (!arg || *arg == '\0')
1113 			fatal("%s line %d: missing yes/no/clientspecified "
1114 			    "argument.", filename, linenum);
1115 		value = 0;	/* silence compiler */
1116 		if (strcmp(arg, "clientspecified") == 0)
1117 			value = 2;
1118 		else if (strcmp(arg, "yes") == 0)
1119 			value = 1;
1120 		else if (strcmp(arg, "no") == 0)
1121 			value = 0;
1122 		else
1123 			fatal("%s line %d: Bad yes/no/clientspecified "
1124 			    "argument: %s", filename, linenum, arg);
1125 		if (*activep && *intptr == -1)
1126 			*intptr = value;
1127 		break;
1128 
1129 	case sUseDNS:
1130 		intptr = &options->use_dns;
1131 		goto parse_flag;
1132 
1133 	case sLogFacility:
1134 		log_facility_ptr = &options->log_facility;
1135 		arg = strdelim(&cp);
1136 		value = log_facility_number(arg);
1137 		if (value == SYSLOG_FACILITY_NOT_SET)
1138 			fatal("%.200s line %d: unsupported log facility '%s'",
1139 			    filename, linenum, arg ? arg : "<NONE>");
1140 		if (*log_facility_ptr == -1)
1141 			*log_facility_ptr = (SyslogFacility) value;
1142 		break;
1143 
1144 	case sLogLevel:
1145 		log_level_ptr = &options->log_level;
1146 		arg = strdelim(&cp);
1147 		value = log_level_number(arg);
1148 		if (value == SYSLOG_LEVEL_NOT_SET)
1149 			fatal("%.200s line %d: unsupported log level '%s'",
1150 			    filename, linenum, arg ? arg : "<NONE>");
1151 		if (*log_level_ptr == -1)
1152 			*log_level_ptr = (LogLevel) value;
1153 		break;
1154 
1155 	case sAllowTcpForwarding:
1156 		intptr = &options->allow_tcp_forwarding;
1157 		goto parse_flag;
1158 
1159 	case sAllowAgentForwarding:
1160 		intptr = &options->allow_agent_forwarding;
1161 		goto parse_flag;
1162 
1163 	case sUsePrivilegeSeparation:
1164 		intptr = &use_privsep;
1165 		goto parse_flag;
1166 
1167 	case sAllowUsers:
1168 		while ((arg = strdelim(&cp)) && *arg != '\0') {
1169 			if (options->num_allow_users >= MAX_ALLOW_USERS)
1170 				fatal("%s line %d: too many allow users.",
1171 				    filename, linenum);
1172 			options->allow_users[options->num_allow_users++] =
1173 			    xstrdup(arg);
1174 		}
1175 		break;
1176 
1177 	case sDenyUsers:
1178 		while ((arg = strdelim(&cp)) && *arg != '\0') {
1179 			if (options->num_deny_users >= MAX_DENY_USERS)
1180 				fatal("%s line %d: too many deny users.",
1181 				    filename, linenum);
1182 			options->deny_users[options->num_deny_users++] =
1183 			    xstrdup(arg);
1184 		}
1185 		break;
1186 
1187 	case sAllowGroups:
1188 		while ((arg = strdelim(&cp)) && *arg != '\0') {
1189 			if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
1190 				fatal("%s line %d: too many allow groups.",
1191 				    filename, linenum);
1192 			options->allow_groups[options->num_allow_groups++] =
1193 			    xstrdup(arg);
1194 		}
1195 		break;
1196 
1197 	case sDenyGroups:
1198 		while ((arg = strdelim(&cp)) && *arg != '\0') {
1199 			if (options->num_deny_groups >= MAX_DENY_GROUPS)
1200 				fatal("%s line %d: too many deny groups.",
1201 				    filename, linenum);
1202 			options->deny_groups[options->num_deny_groups++] = xstrdup(arg);
1203 		}
1204 		break;
1205 
1206 	case sCiphers:
1207 		arg = strdelim(&cp);
1208 		if (!arg || *arg == '\0')
1209 			fatal("%s line %d: Missing argument.", filename, linenum);
1210 		if (!ciphers_valid(arg))
1211 			fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
1212 			    filename, linenum, arg ? arg : "<NONE>");
1213 		if (options->ciphers == NULL)
1214 			options->ciphers = xstrdup(arg);
1215 		break;
1216 
1217 	case sMacs:
1218 		arg = strdelim(&cp);
1219 		if (!arg || *arg == '\0')
1220 			fatal("%s line %d: Missing argument.", filename, linenum);
1221 		if (!mac_valid(arg))
1222 			fatal("%s line %d: Bad SSH2 mac spec '%s'.",
1223 			    filename, linenum, arg ? arg : "<NONE>");
1224 		if (options->macs == NULL)
1225 			options->macs = xstrdup(arg);
1226 		break;
1227 
1228 	case sKexAlgorithms:
1229 		arg = strdelim(&cp);
1230 		if (!arg || *arg == '\0')
1231 			fatal("%s line %d: Missing argument.",
1232 			    filename, linenum);
1233 		if (!kex_names_valid(arg))
1234 			fatal("%s line %d: Bad SSH2 KexAlgorithms '%s'.",
1235 			    filename, linenum, arg ? arg : "<NONE>");
1236 		if (options->kex_algorithms == NULL)
1237 			options->kex_algorithms = xstrdup(arg);
1238 		break;
1239 
1240 	case sProtocol:
1241 		intptr = &options->protocol;
1242 		arg = strdelim(&cp);
1243 		if (!arg || *arg == '\0')
1244 			fatal("%s line %d: Missing argument.", filename, linenum);
1245 		value = proto_spec(arg);
1246 		if (value == SSH_PROTO_UNKNOWN)
1247 			fatal("%s line %d: Bad protocol spec '%s'.",
1248 			    filename, linenum, arg ? arg : "<NONE>");
1249 		if (*intptr == SSH_PROTO_UNKNOWN)
1250 			*intptr = value;
1251 		break;
1252 
1253 	case sSubsystem:
1254 		if (options->num_subsystems >= MAX_SUBSYSTEMS) {
1255 			fatal("%s line %d: too many subsystems defined.",
1256 			    filename, linenum);
1257 		}
1258 		arg = strdelim(&cp);
1259 		if (!arg || *arg == '\0')
1260 			fatal("%s line %d: Missing subsystem name.",
1261 			    filename, linenum);
1262 		if (!*activep) {
1263 			arg = strdelim(&cp);
1264 			break;
1265 		}
1266 		for (i = 0; i < options->num_subsystems; i++)
1267 			if (strcmp(arg, options->subsystem_name[i]) == 0)
1268 				fatal("%s line %d: Subsystem '%s' already defined.",
1269 				    filename, linenum, arg);
1270 		options->subsystem_name[options->num_subsystems] = xstrdup(arg);
1271 		arg = strdelim(&cp);
1272 		if (!arg || *arg == '\0')
1273 			fatal("%s line %d: Missing subsystem command.",
1274 			    filename, linenum);
1275 		options->subsystem_command[options->num_subsystems] = xstrdup(arg);
1276 
1277 		/* Collect arguments (separate to executable) */
1278 		p = xstrdup(arg);
1279 		len = strlen(p) + 1;
1280 		while ((arg = strdelim(&cp)) != NULL && *arg != '\0') {
1281 			len += 1 + strlen(arg);
1282 			p = xrealloc(p, 1, len);
1283 			strlcat(p, " ", len);
1284 			strlcat(p, arg, len);
1285 		}
1286 		options->subsystem_args[options->num_subsystems] = p;
1287 		options->num_subsystems++;
1288 		break;
1289 
1290 	case sMaxStartups:
1291 		arg = strdelim(&cp);
1292 		if (!arg || *arg == '\0')
1293 			fatal("%s line %d: Missing MaxStartups spec.",
1294 			    filename, linenum);
1295 		if ((n = sscanf(arg, "%d:%d:%d",
1296 		    &options->max_startups_begin,
1297 		    &options->max_startups_rate,
1298 		    &options->max_startups)) == 3) {
1299 			if (options->max_startups_begin >
1300 			    options->max_startups ||
1301 			    options->max_startups_rate > 100 ||
1302 			    options->max_startups_rate < 1)
1303 				fatal("%s line %d: Illegal MaxStartups spec.",
1304 				    filename, linenum);
1305 		} else if (n != 1)
1306 			fatal("%s line %d: Illegal MaxStartups spec.",
1307 			    filename, linenum);
1308 		else
1309 			options->max_startups = options->max_startups_begin;
1310 		break;
1311 
1312 	case sMaxAuthTries:
1313 		intptr = &options->max_authtries;
1314 		goto parse_int;
1315 
1316 	case sMaxSessions:
1317 		intptr = &options->max_sessions;
1318 		goto parse_int;
1319 
1320 	case sBanner:
1321 		charptr = &options->banner;
1322 		goto parse_filename;
1323 
1324 	/*
1325 	 * These options can contain %X options expanded at
1326 	 * connect time, so that you can specify paths like:
1327 	 *
1328 	 * AuthorizedKeysFile	/etc/ssh_keys/%u
1329 	 */
1330 	case sAuthorizedKeysFile:
1331 		charptr = &options->authorized_keys_file;
1332 		goto parse_tilde_filename;
1333 	case sAuthorizedKeysFile2:
1334 		charptr = &options->authorized_keys_file2;
1335 		goto parse_tilde_filename;
1336 	case sAuthorizedPrincipalsFile:
1337 		charptr = &options->authorized_principals_file;
1338  parse_tilde_filename:
1339 		arg = strdelim(&cp);
1340 		if (!arg || *arg == '\0')
1341 			fatal("%s line %d: missing file name.",
1342 			    filename, linenum);
1343 		if (*activep && *charptr == NULL) {
1344 			*charptr = tilde_expand_filename(arg, getuid());
1345 			/* increase optional counter */
1346 			if (intptr != NULL)
1347 				*intptr = *intptr + 1;
1348 		}
1349 		break;
1350 
1351 	case sClientAliveInterval:
1352 		intptr = &options->client_alive_interval;
1353 		goto parse_time;
1354 
1355 	case sClientAliveCountMax:
1356 		intptr = &options->client_alive_count_max;
1357 		goto parse_int;
1358 
1359 	case sAcceptEnv:
1360 		while ((arg = strdelim(&cp)) && *arg != '\0') {
1361 			if (strchr(arg, '=') != NULL)
1362 				fatal("%s line %d: Invalid environment name.",
1363 				    filename, linenum);
1364 			if (options->num_accept_env >= MAX_ACCEPT_ENV)
1365 				fatal("%s line %d: too many allow env.",
1366 				    filename, linenum);
1367 			if (!*activep)
1368 				break;
1369 			options->accept_env[options->num_accept_env++] =
1370 			    xstrdup(arg);
1371 		}
1372 		break;
1373 
1374 	case sPermitTunnel:
1375 		intptr = &options->permit_tun;
1376 		arg = strdelim(&cp);
1377 		if (!arg || *arg == '\0')
1378 			fatal("%s line %d: Missing yes/point-to-point/"
1379 			    "ethernet/no argument.", filename, linenum);
1380 		value = -1;
1381 		for (i = 0; tunmode_desc[i].val != -1; i++)
1382 			if (strcmp(tunmode_desc[i].text, arg) == 0) {
1383 				value = tunmode_desc[i].val;
1384 				break;
1385 			}
1386 		if (value == -1)
1387 			fatal("%s line %d: Bad yes/point-to-point/ethernet/"
1388 			    "no argument: %s", filename, linenum, arg);
1389 		if (*intptr == -1)
1390 			*intptr = value;
1391 		break;
1392 
1393 	case sMatch:
1394 		if (cmdline)
1395 			fatal("Match directive not supported as a command-line "
1396 			   "option");
1397 		value = match_cfg_line(&cp, linenum, user, host, address);
1398 		if (value < 0)
1399 			fatal("%s line %d: Bad Match condition", filename,
1400 			    linenum);
1401 		*activep = value;
1402 		break;
1403 
1404 	case sPermitOpen:
1405 		arg = strdelim(&cp);
1406 		if (!arg || *arg == '\0')
1407 			fatal("%s line %d: missing PermitOpen specification",
1408 			    filename, linenum);
1409 		n = options->num_permitted_opens;	/* modified later */
1410 		if (strcmp(arg, "any") == 0) {
1411 			if (*activep && n == -1) {
1412 				channel_clear_adm_permitted_opens();
1413 				options->num_permitted_opens = 0;
1414 			}
1415 			break;
1416 		}
1417 		if (*activep && n == -1)
1418 			channel_clear_adm_permitted_opens();
1419 		for (; arg != NULL && *arg != '\0'; arg = strdelim(&cp)) {
1420 			p = hpdelim(&arg);
1421 			if (p == NULL)
1422 				fatal("%s line %d: missing host in PermitOpen",
1423 				    filename, linenum);
1424 			p = cleanhostname(p);
1425 			if (arg == NULL || (port = a2port(arg)) <= 0)
1426 				fatal("%s line %d: bad port number in "
1427 				    "PermitOpen", filename, linenum);
1428 			if (*activep && n == -1)
1429 				options->num_permitted_opens =
1430 				    channel_add_adm_permitted_opens(p, port);
1431 		}
1432 		break;
1433 
1434 	case sForceCommand:
1435 		if (cp == NULL)
1436 			fatal("%.200s line %d: Missing argument.", filename,
1437 			    linenum);
1438 		len = strspn(cp, WHITESPACE);
1439 		if (*activep && options->adm_forced_command == NULL)
1440 			options->adm_forced_command = xstrdup(cp + len);
1441 		return 0;
1442 
1443 	case sChrootDirectory:
1444 		charptr = &options->chroot_directory;
1445 
1446 		arg = strdelim(&cp);
1447 		if (!arg || *arg == '\0')
1448 			fatal("%s line %d: missing file name.",
1449 			    filename, linenum);
1450 		if (*activep && *charptr == NULL)
1451 			*charptr = xstrdup(arg);
1452 		break;
1453 
1454 	case sVersionAddendum:
1455                 ssh_version_set_addendum(strtok(cp, "\n"));
1456                 do {
1457                         arg = strdelim(&cp);
1458                 } while (arg != NULL && *arg != '\0');
1459 		break;
1460 	case sTrustedUserCAKeys:
1461 		charptr = &options->trusted_user_ca_keys;
1462 		goto parse_filename;
1463 
1464 	case sRevokedKeys:
1465 		charptr = &options->revoked_keys_file;
1466 		goto parse_filename;
1467 
1468 	case sIPQoS:
1469 		arg = strdelim(&cp);
1470 		if ((value = parse_ipqos(arg)) == -1)
1471 			fatal("%s line %d: Bad IPQoS value: %s",
1472 			    filename, linenum, arg);
1473 		arg = strdelim(&cp);
1474 		if (arg == NULL)
1475 			value2 = value;
1476 		else if ((value2 = parse_ipqos(arg)) == -1)
1477 			fatal("%s line %d: Bad IPQoS value: %s",
1478 			    filename, linenum, arg);
1479 		if (*activep) {
1480 			options->ip_qos_interactive = value;
1481 			options->ip_qos_bulk = value2;
1482 		}
1483 		break;
1484 
1485 	case sDeprecated:
1486 		logit("%s line %d: Deprecated option %s",
1487 		    filename, linenum, arg);
1488 		while (arg)
1489 		    arg = strdelim(&cp);
1490 		break;
1491 
1492 	case sUnsupported:
1493 		logit("%s line %d: Unsupported option %s",
1494 		    filename, linenum, arg);
1495 		while (arg)
1496 		    arg = strdelim(&cp);
1497 		break;
1498 
1499 	default:
1500 		fatal("%s line %d: Missing handler for opcode %s (%d)",
1501 		    filename, linenum, arg, opcode);
1502 	}
1503 	if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
1504 		fatal("%s line %d: garbage at end of line; \"%.200s\".",
1505 		    filename, linenum, arg);
1506 	return 0;
1507 }
1508 
1509 /* Reads the server configuration file. */
1510 
1511 void
1512 load_server_config(const char *filename, Buffer *conf)
1513 {
1514 	char line[1024], *cp;
1515 	FILE *f;
1516 
1517 	debug2("%s: filename %s", __func__, filename);
1518 	if ((f = fopen(filename, "r")) == NULL) {
1519 		perror(filename);
1520 		exit(1);
1521 	}
1522 	buffer_clear(conf);
1523 	while (fgets(line, sizeof(line), f)) {
1524 		/*
1525 		 * Trim out comments and strip whitespace
1526 		 * NB - preserve newlines, they are needed to reproduce
1527 		 * line numbers later for error messages
1528 		 */
1529 		if ((cp = strchr(line, '#')) != NULL)
1530 			memcpy(cp, "\n", 2);
1531 		cp = line + strspn(line, " \t\r");
1532 
1533 		buffer_append(conf, cp, strlen(cp));
1534 	}
1535 	buffer_append(conf, "\0", 1);
1536 	fclose(f);
1537 	debug2("%s: done config len = %d", __func__, buffer_len(conf));
1538 }
1539 
1540 void
1541 parse_server_match_config(ServerOptions *options, const char *user,
1542     const char *host, const char *address)
1543 {
1544 	ServerOptions mo;
1545 
1546 	initialize_server_options(&mo);
1547 	parse_server_config(&mo, "reprocess config", &cfg, user, host, address);
1548 	copy_set_server_options(options, &mo, 0);
1549 }
1550 
1551 /* Helper macros */
1552 #define M_CP_INTOPT(n) do {\
1553 	if (src->n != -1) \
1554 		dst->n = src->n; \
1555 } while (0)
1556 #define M_CP_STROPT(n) do {\
1557 	if (src->n != NULL) { \
1558 		if (dst->n != NULL) \
1559 			xfree(dst->n); \
1560 		dst->n = src->n; \
1561 	} \
1562 } while(0)
1563 
1564 /*
1565  * Copy any supported values that are set.
1566  *
1567  * If the preauth flag is set, we do not bother copying the string or
1568  * array values that are not used pre-authentication, because any that we
1569  * do use must be explictly sent in mm_getpwnamallow().
1570  */
1571 void
1572 copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
1573 {
1574 	M_CP_INTOPT(password_authentication);
1575 	M_CP_INTOPT(gss_authentication);
1576 	M_CP_INTOPT(rsa_authentication);
1577 	M_CP_INTOPT(pubkey_authentication);
1578 	M_CP_INTOPT(kerberos_authentication);
1579 	M_CP_INTOPT(hostbased_authentication);
1580 	M_CP_INTOPT(hostbased_uses_name_from_packet_only);
1581 	M_CP_INTOPT(kbd_interactive_authentication);
1582 	M_CP_INTOPT(zero_knowledge_password_authentication);
1583 	M_CP_INTOPT(permit_root_login);
1584 	M_CP_INTOPT(permit_empty_passwd);
1585 
1586 	M_CP_INTOPT(allow_tcp_forwarding);
1587 	M_CP_INTOPT(allow_agent_forwarding);
1588 	M_CP_INTOPT(permit_tun);
1589 	M_CP_INTOPT(gateway_ports);
1590 	M_CP_INTOPT(x11_display_offset);
1591 	M_CP_INTOPT(x11_forwarding);
1592 	M_CP_INTOPT(x11_use_localhost);
1593 	M_CP_INTOPT(max_sessions);
1594 	M_CP_INTOPT(max_authtries);
1595 	M_CP_INTOPT(ip_qos_interactive);
1596 	M_CP_INTOPT(ip_qos_bulk);
1597 
1598 	M_CP_STROPT(banner);
1599 	if (preauth)
1600 		return;
1601 	M_CP_STROPT(adm_forced_command);
1602 	M_CP_STROPT(chroot_directory);
1603 	M_CP_STROPT(trusted_user_ca_keys);
1604 	M_CP_STROPT(revoked_keys_file);
1605 	M_CP_STROPT(authorized_keys_file);
1606 	M_CP_STROPT(authorized_keys_file2);
1607 	M_CP_STROPT(authorized_principals_file);
1608 }
1609 
1610 #undef M_CP_INTOPT
1611 #undef M_CP_STROPT
1612 
1613 void
1614 parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
1615     const char *user, const char *host, const char *address)
1616 {
1617 	int active, linenum, bad_options = 0;
1618 	char *cp, *obuf, *cbuf;
1619 
1620 	debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
1621 
1622 	obuf = cbuf = xstrdup(buffer_ptr(conf));
1623 	active = user ? 0 : 1;
1624 	linenum = 1;
1625 	while ((cp = strsep(&cbuf, "\n")) != NULL) {
1626 		if (process_server_config_line(options, cp, filename,
1627 		    linenum++, &active, user, host, address) != 0)
1628 			bad_options++;
1629 	}
1630 	xfree(obuf);
1631 	if (bad_options > 0)
1632 		fatal("%s: terminating, %d bad configuration options",
1633 		    filename, bad_options);
1634 }
1635 
1636 static const char *
1637 fmt_intarg(ServerOpCodes code, int val)
1638 {
1639 	if (code == sAddressFamily) {
1640 		switch (val) {
1641 		case AF_INET:
1642 			return "inet";
1643 		case AF_INET6:
1644 			return "inet6";
1645 		case AF_UNSPEC:
1646 			return "any";
1647 		default:
1648 			return "UNKNOWN";
1649 		}
1650 	}
1651 	if (code == sPermitRootLogin) {
1652 		switch (val) {
1653 		case PERMIT_NO_PASSWD:
1654 			return "without-password";
1655 		case PERMIT_FORCED_ONLY:
1656 			return "forced-commands-only";
1657 		case PERMIT_YES:
1658 			return "yes";
1659 		}
1660 	}
1661 	if (code == sProtocol) {
1662 		switch (val) {
1663 		case SSH_PROTO_1:
1664 			return "1";
1665 		case SSH_PROTO_2:
1666 			return "2";
1667 		case (SSH_PROTO_1|SSH_PROTO_2):
1668 			return "2,1";
1669 		default:
1670 			return "UNKNOWN";
1671 		}
1672 	}
1673 	if (code == sGatewayPorts && val == 2)
1674 		return "clientspecified";
1675 	if (code == sCompression && val == COMP_DELAYED)
1676 		return "delayed";
1677 	switch (val) {
1678 	case -1:
1679 		return "unset";
1680 	case 0:
1681 		return "no";
1682 	case 1:
1683 		return "yes";
1684 	}
1685 	return "UNKNOWN";
1686 }
1687 
1688 static const char *
1689 lookup_opcode_name(ServerOpCodes code)
1690 {
1691 	u_int i;
1692 
1693 	for (i = 0; keywords[i].name != NULL; i++)
1694 		if (keywords[i].opcode == code)
1695 			return(keywords[i].name);
1696 	return "UNKNOWN";
1697 }
1698 
1699 static void
1700 dump_cfg_int(ServerOpCodes code, int val)
1701 {
1702 	printf("%s %d\n", lookup_opcode_name(code), val);
1703 }
1704 
1705 static void
1706 dump_cfg_fmtint(ServerOpCodes code, int val)
1707 {
1708 	printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
1709 }
1710 
1711 static void
1712 dump_cfg_string(ServerOpCodes code, const char *val)
1713 {
1714 	if (val == NULL)
1715 		return;
1716 	printf("%s %s\n", lookup_opcode_name(code), val);
1717 }
1718 
1719 static void
1720 dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals)
1721 {
1722 	u_int i;
1723 
1724 	for (i = 0; i < count; i++)
1725 		printf("%s %s\n", lookup_opcode_name(code),  vals[i]);
1726 }
1727 
1728 void
1729 dump_config(ServerOptions *o)
1730 {
1731 	u_int i;
1732 	int ret;
1733 	struct addrinfo *ai;
1734 	char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL;
1735 
1736 	/* these are usually at the top of the config */
1737 	for (i = 0; i < o->num_ports; i++)
1738 		printf("port %d\n", o->ports[i]);
1739 	dump_cfg_fmtint(sProtocol, o->protocol);
1740 	dump_cfg_fmtint(sAddressFamily, o->address_family);
1741 
1742 	/* ListenAddress must be after Port */
1743 	for (ai = o->listen_addrs; ai; ai = ai->ai_next) {
1744 		if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr,
1745 		    sizeof(addr), port, sizeof(port),
1746 		    NI_NUMERICHOST|NI_NUMERICSERV)) != 0) {
1747 			error("getnameinfo failed: %.100s",
1748 			    (ret != EAI_SYSTEM) ? gai_strerror(ret) :
1749 			    strerror(errno));
1750 		} else {
1751 			if (ai->ai_family == AF_INET6)
1752 				printf("listenaddress [%s]:%s\n", addr, port);
1753 			else
1754 				printf("listenaddress %s:%s\n", addr, port);
1755 		}
1756 	}
1757 
1758 	/* integer arguments */
1759 #ifdef USE_PAM
1760 	dump_cfg_int(sUsePAM, o->use_pam);
1761 #endif
1762 	dump_cfg_int(sServerKeyBits, o->server_key_bits);
1763 	dump_cfg_int(sLoginGraceTime, o->login_grace_time);
1764 	dump_cfg_int(sKeyRegenerationTime, o->key_regeneration_time);
1765 	dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
1766 	dump_cfg_int(sMaxAuthTries, o->max_authtries);
1767 	dump_cfg_int(sMaxSessions, o->max_sessions);
1768 	dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
1769 	dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max);
1770 
1771 	/* formatted integer arguments */
1772 	dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login);
1773 	dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts);
1774 	dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts);
1775 	dump_cfg_fmtint(sRhostsRSAAuthentication, o->rhosts_rsa_authentication);
1776 	dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication);
1777 	dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly,
1778 	    o->hostbased_uses_name_from_packet_only);
1779 	dump_cfg_fmtint(sRSAAuthentication, o->rsa_authentication);
1780 	dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication);
1781 #ifdef KRB5
1782 	dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication);
1783 	dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd);
1784 	dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup);
1785 # ifdef USE_AFS
1786 	dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
1787 # endif
1788 #endif
1789 #ifdef GSSAPI
1790 	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
1791 	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
1792 #endif
1793 #ifdef JPAKE
1794 	dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication,
1795 	    o->zero_knowledge_password_authentication);
1796 #endif
1797 	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
1798 	dump_cfg_fmtint(sKbdInteractiveAuthentication,
1799 	    o->kbd_interactive_authentication);
1800 	dump_cfg_fmtint(sChallengeResponseAuthentication,
1801 	    o->challenge_response_authentication);
1802 	dump_cfg_fmtint(sPrintMotd, o->print_motd);
1803 	dump_cfg_fmtint(sPrintLastLog, o->print_lastlog);
1804 	dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding);
1805 	dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
1806 	dump_cfg_fmtint(sStrictModes, o->strict_modes);
1807 	dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
1808 	dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
1809 	dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
1810 	dump_cfg_fmtint(sUseLogin, o->use_login);
1811 	dump_cfg_fmtint(sCompression, o->compression);
1812 	dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
1813 	dump_cfg_fmtint(sUseDNS, o->use_dns);
1814 	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
1815 	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
1816 
1817 	/* string arguments */
1818 	dump_cfg_string(sPidFile, o->pid_file);
1819 	dump_cfg_string(sXAuthLocation, o->xauth_location);
1820 	dump_cfg_string(sCiphers, o->ciphers);
1821 	dump_cfg_string(sMacs, o->macs);
1822 	dump_cfg_string(sBanner, o->banner);
1823 	dump_cfg_string(sAuthorizedKeysFile, o->authorized_keys_file);
1824 	dump_cfg_string(sAuthorizedKeysFile2, o->authorized_keys_file2);
1825 	dump_cfg_string(sForceCommand, o->adm_forced_command);
1826 	dump_cfg_string(sChrootDirectory, o->chroot_directory);
1827 	dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
1828 	dump_cfg_string(sRevokedKeys, o->revoked_keys_file);
1829 	dump_cfg_string(sAuthorizedPrincipalsFile,
1830 	    o->authorized_principals_file);
1831 
1832 	/* string arguments requiring a lookup */
1833 	dump_cfg_string(sLogLevel, log_level_name(o->log_level));
1834 	dump_cfg_string(sLogFacility, log_facility_name(o->log_facility));
1835 
1836 	/* string array arguments */
1837 	dump_cfg_strarray(sHostKeyFile, o->num_host_key_files,
1838 	     o->host_key_files);
1839 	dump_cfg_strarray(sHostKeyFile, o->num_host_cert_files,
1840 	     o->host_cert_files);
1841 	dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users);
1842 	dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users);
1843 	dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups);
1844 	dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups);
1845 	dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env);
1846 
1847 	/* other arguments */
1848 	for (i = 0; i < o->num_subsystems; i++)
1849 		printf("subsystem %s %s\n", o->subsystem_name[i],
1850 		    o->subsystem_args[i]);
1851 
1852 	printf("maxstartups %d:%d:%d\n", o->max_startups_begin,
1853 	    o->max_startups_rate, o->max_startups);
1854 
1855 	for (i = 0; tunmode_desc[i].val != -1; i++)
1856 		if (tunmode_desc[i].val == o->permit_tun) {
1857 			s = tunmode_desc[i].text;
1858 			break;
1859 		}
1860 	dump_cfg_string(sPermitTunnel, s);
1861 
1862 	printf("ipqos 0x%02x 0x%02x\n", o->ip_qos_interactive, o->ip_qos_bulk);
1863 
1864 	channel_print_adm_permitted_opens();
1865 }
1866