[openssh.git] / servconf.c

/*
 * 
 * servconf.c
 * 
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * 
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 *                    All rights reserved
 * 
 * Created: Mon Aug 21 15:48:58 1995 ylo
 * 
 */

#include "includes.h"
RCSID("$Id$");

#include "ssh.h"
#include "servconf.h"
#include "xmalloc.h"

/* Initializes the server options to their default values. */

void 
initialize_server_options(ServerOptions *options)
{
	memset(options, 0, sizeof(*options));
	options->port = -1;
	options->listen_addr.s_addr = htonl(INADDR_ANY);
	options->host_key_file = NULL;
	options->server_key_bits = -1;
	options->login_grace_time = -1;
	options->key_regeneration_time = -1;
	options->permit_root_login = -1;
	options->ignore_rhosts = -1;
	options->ignore_user_known_hosts = -1;
	options->print_motd = -1;
	options->check_mail = -1;
	options->x11_forwarding = -1;
	options->x11_display_offset = -1;
	options->strict_modes = -1;
	options->keepalives = -1;
	options->log_facility = (SyslogFacility) - 1;
	options->log_level = (LogLevel) - 1;
	options->rhosts_authentication = -1;
	options->rhosts_rsa_authentication = -1;
	options->rsa_authentication = -1;
#ifdef KRB4
	options->kerberos_authentication = -1;
	options->kerberos_or_local_passwd = -1;
	options->kerberos_ticket_cleanup = -1;
#endif
#ifdef AFS
	options->kerberos_tgt_passing = -1;
	options->afs_token_passing = -1;
#endif
	options->password_authentication = -1;
#ifdef SKEY
	options->skey_authentication = -1;
#endif
	options->permit_empty_passwd = -1;
	options->use_login = -1;
	options->num_allow_users = 0;
	options->num_deny_users = 0;
	options->num_allow_groups = 0;
	options->num_deny_groups = 0;
}

void 
fill_default_server_options(ServerOptions *options)
{
	if (options->port == -1) {
		struct servent *sp;

		sp = getservbyname(SSH_SERVICE_NAME, "tcp");
		if (sp)
			options->port = ntohs(sp->s_port);
		else
			options->port = SSH_DEFAULT_PORT;
		endservent();
	}
	if (options->host_key_file == NULL)
		options->host_key_file = HOST_KEY_FILE;
	if (options->server_key_bits == -1)
		options->server_key_bits = 768;
	if (options->login_grace_time == -1)
		options->login_grace_time = 600;
	if (options->key_regeneration_time == -1)
		options->key_regeneration_time = 3600;
	if (options->permit_root_login == -1)
		options->permit_root_login = 1;			/* yes */
	if (options->ignore_rhosts == -1)
		options->ignore_rhosts = 0;
	if (options->ignore_user_known_hosts == -1)
		options->ignore_user_known_hosts = 0;
	if (options->check_mail == -1)
		options->check_mail = 0;
	if (options->print_motd == -1)
		options->print_motd = 1;
	if (options->x11_forwarding == -1)
		options->x11_forwarding = 1;
	if (options->x11_display_offset == -1)
		options->x11_display_offset = 1;
	if (options->strict_modes == -1)
		options->strict_modes = 1;
	if (options->keepalives == -1)
		options->keepalives = 1;
	if (options->log_facility == (SyslogFacility) (-1))
		options->log_facility = SYSLOG_FACILITY_AUTH;
	if (options->log_level == (LogLevel) (-1))
		options->log_level = SYSLOG_LEVEL_INFO;
	if (options->rhosts_authentication == -1)
		options->rhosts_authentication = 0;
	if (options->rhosts_rsa_authentication == -1)
		options->rhosts_rsa_authentication = 1;
	if (options->rsa_authentication == -1)
		options->rsa_authentication = 1;
#ifdef KRB4
	if (options->kerberos_authentication == -1)
		options->kerberos_authentication = (access(KEYFILE, R_OK) == 0);
	if (options->kerberos_or_local_passwd == -1)
		options->kerberos_or_local_passwd = 1;
	if (options->kerberos_ticket_cleanup == -1)
		options->kerberos_ticket_cleanup = 1;
#endif /* KRB4 */
#ifdef AFS
	if (options->kerberos_tgt_passing == -1)
		options->kerberos_tgt_passing = 0;
	if (options->afs_token_passing == -1)
		options->afs_token_passing = k_hasafs();
#endif /* AFS */
	if (options->password_authentication == -1)
		options->password_authentication = 1;
#ifdef SKEY
	if (options->skey_authentication == -1)
		options->skey_authentication = 1;
#endif
	if (options->permit_empty_passwd == -1)
		options->permit_empty_passwd = 1;
	if (options->use_login == -1)
		options->use_login = 0;
}

#define WHITESPACE " \t\r\n"

/* Keyword tokens. */
typedef enum {
	sBadOption,		/* == unknown option */
	sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
	sPermitRootLogin, sLogFacility, sLogLevel,
	sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication,
#ifdef KRB4
	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
#endif
#ifdef AFS
	sKerberosTgtPassing, sAFSTokenPassing,
#endif
#ifdef SKEY
	sSkeyAuthentication,
#endif
	sPasswordAuthentication, sListenAddress,
	sPrintMotd, sIgnoreRhosts, sX11Forwarding, sX11DisplayOffset,
	sStrictModes, sEmptyPasswd, sRandomSeedFile, sKeepAlives, sCheckMail,
	sUseLogin, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
	sIgnoreUserKnownHosts
} ServerOpCodes;

/* Textual representation of the tokens. */
static struct {
	const char *name;
	ServerOpCodes opcode;
} keywords[] = {
	{ "port", sPort },
	{ "hostkey", sHostKeyFile },
	{ "serverkeybits", sServerKeyBits },
	{ "logingracetime", sLoginGraceTime },
	{ "keyregenerationinterval", sKeyRegenerationTime },
	{ "permitrootlogin", sPermitRootLogin },
	{ "syslogfacility", sLogFacility },
	{ "loglevel", sLogLevel },
	{ "rhostsauthentication", sRhostsAuthentication },
	{ "rhostsrsaauthentication", sRhostsRSAAuthentication },
	{ "rsaauthentication", sRSAAuthentication },
#ifdef KRB4
	{ "kerberosauthentication", sKerberosAuthentication },
	{ "kerberosorlocalpasswd", sKerberosOrLocalPasswd },
	{ "kerberosticketcleanup", sKerberosTicketCleanup },
#endif
#ifdef AFS
	{ "kerberostgtpassing", sKerberosTgtPassing },
	{ "afstokenpassing", sAFSTokenPassing },
#endif
	{ "passwordauthentication", sPasswordAuthentication },
#ifdef SKEY
	{ "skeyauthentication", sSkeyAuthentication },
#endif
	{ "checkmail", sCheckMail },
	{ "listenaddress", sListenAddress },
	{ "printmotd", sPrintMotd },
	{ "ignorerhosts", sIgnoreRhosts },
	{ "ignoreuserknownhosts", sIgnoreUserKnownHosts },
	{ "x11forwarding", sX11Forwarding },
	{ "x11displayoffset", sX11DisplayOffset },
	{ "strictmodes", sStrictModes },
	{ "permitemptypasswords", sEmptyPasswd },
	{ "uselogin", sUseLogin },
	{ "randomseed", sRandomSeedFile },
	{ "keepalive", sKeepAlives },
	{ "allowusers", sAllowUsers },
	{ "denyusers", sDenyUsers },
	{ "allowgroups", sAllowGroups },
	{ "denygroups", sDenyGroups },
	{ NULL, 0 }
};

/* Returns the number of the token pointed to by cp of length len.
   Never returns if the token is not known. */

static ServerOpCodes 
parse_token(const char *cp, const char *filename,
	    int linenum)
{
	unsigned int i;

	for (i = 0; keywords[i].name; i++)
		if (strcmp(cp, keywords[i].name) == 0)
			return keywords[i].opcode;

	fprintf(stderr, "%s: line %d: Bad configuration option: %s\n",
		filename, linenum, cp);
	return sBadOption;
}

/* Reads the server configuration file. */

void 
read_server_config(ServerOptions *options, const char *filename)
{
	FILE *f;
	char line[1024];
	char *cp, **charptr;
	int linenum, *intptr, value;
	int bad_options = 0;
	ServerOpCodes opcode;

	f = fopen(filename, "r");
	if (!f) {
		perror(filename);
		exit(1);
	}
	linenum = 0;
	while (fgets(line, sizeof(line), f)) {
		linenum++;
		cp = line + strspn(line, WHITESPACE);
		if (!*cp || *cp == '#')
			continue;
		cp = strtok(cp, WHITESPACE);
		{
			char *t = cp;
			for (; *t != 0; t++)
				if ('A' <= *t && *t <= 'Z')
					*t = *t - 'A' + 'a';	/* tolower */

		}
		opcode = parse_token(cp, filename, linenum);
		switch (opcode) {
		case sBadOption:
			bad_options++;
			continue;
		case sPort:
			intptr = &options->port;
parse_int:
			cp = strtok(NULL, WHITESPACE);
			if (!cp) {
				fprintf(stderr, "%s line %d: missing integer value.\n",
					filename, linenum);
				exit(1);
			}
			value = atoi(cp);
			if (*intptr == -1)
				*intptr = value;
			break;

		case sServerKeyBits:
			intptr = &options->server_key_bits;
			goto parse_int;

		case sLoginGraceTime:
			intptr = &options->login_grace_time;
			goto parse_int;

		case sKeyRegenerationTime:
			intptr = &options->key_regeneration_time;
			goto parse_int;

		case sListenAddress:
			cp = strtok(NULL, WHITESPACE);
			if (!cp) {
				fprintf(stderr, "%s line %d: missing inet addr.\n",
					filename, linenum);
				exit(1);
			}
			options->listen_addr.s_addr = inet_addr(cp);
			break;

		case sHostKeyFile:
			charptr = &options->host_key_file;
			cp = strtok(NULL, WHITESPACE);
			if (!cp) {
				fprintf(stderr, "%s line %d: missing file name.\n",
					filename, linenum);
				exit(1);
			}
			if (*charptr == NULL)
				*charptr = tilde_expand_filename(cp, getuid());
			break;

		case sRandomSeedFile:
			fprintf(stderr, "%s line %d: \"randomseed\" option is obsolete.\n",
				filename, linenum);
			cp = strtok(NULL, WHITESPACE);
			break;

		case sPermitRootLogin:
			intptr = &options->permit_root_login;
			cp = strtok(NULL, WHITESPACE);
			if (!cp) {
				fprintf(stderr, "%s line %d: missing yes/without-password/no argument.\n",
					filename, linenum);
				exit(1);
			}
			if (strcmp(cp, "without-password") == 0)
				value = 2;
			else if (strcmp(cp, "yes") == 0)
				value = 1;
			else if (strcmp(cp, "no") == 0)
				value = 0;
			else {
				fprintf(stderr, "%s line %d: Bad yes/without-password/no argument: %s\n",
					filename, linenum, cp);
				exit(1);
			}
			if (*intptr == -1)
				*intptr = value;
			break;

		case sIgnoreRhosts:
			intptr = &options->ignore_rhosts;
parse_flag:
			cp = strtok(NULL, WHITESPACE);
			if (!cp) {
				fprintf(stderr, "%s line %d: missing yes/no argument.\n",
					filename, linenum);
				exit(1);
			}
			if (strcmp(cp, "yes") == 0)
				value = 1;
			else if (strcmp(cp, "no") == 0)
				value = 0;
			else {
				fprintf(stderr, "%s line %d: Bad yes/no argument: %s\n",
					filename, linenum, cp);
				exit(1);
			}
			if (*intptr == -1)
				*intptr = value;
			break;

		case sIgnoreUserKnownHosts:
			intptr = &options->ignore_user_known_hosts;
			goto parse_int;

		case sRhostsAuthentication:
			intptr = &options->rhosts_authentication;
			goto parse_flag;

		case sRhostsRSAAuthentication:
			intptr = &options->rhosts_rsa_authentication;
			goto parse_flag;

		case sRSAAuthentication:
			intptr = &options->rsa_authentication;
			goto parse_flag;

#ifdef KRB4
		case sKerberosAuthentication:
			intptr = &options->kerberos_authentication;
			goto parse_flag;

		case sKerberosOrLocalPasswd:
			intptr = &options->kerberos_or_local_passwd;
			goto parse_flag;

		case sKerberosTicketCleanup:
			intptr = &options->kerberos_ticket_cleanup;
			goto parse_flag;
#endif

#ifdef AFS
		case sKerberosTgtPassing:
			intptr = &options->kerberos_tgt_passing;
			goto parse_flag;

		case sAFSTokenPassing:
			intptr = &options->afs_token_passing;
			goto parse_flag;
#endif

		case sPasswordAuthentication:
			intptr = &options->password_authentication;
			goto parse_flag;

		case sCheckMail:
			intptr = &options->check_mail;
			goto parse_flag;

#ifdef SKEY
		case sSkeyAuthentication:
			intptr = &options->skey_authentication;
			goto parse_flag;
#endif

		case sPrintMotd:
			intptr = &options->print_motd;
			goto parse_flag;

		case sX11Forwarding:
			intptr = &options->x11_forwarding;
			goto parse_flag;

		case sX11DisplayOffset:
			intptr = &options->x11_display_offset;
			goto parse_int;

		case sStrictModes:
			intptr = &options->strict_modes;
			goto parse_flag;

		case sKeepAlives:
			intptr = &options->keepalives;
			goto parse_flag;

		case sEmptyPasswd:
			intptr = &options->permit_empty_passwd;
			goto parse_flag;

		case sUseLogin:
			intptr = &options->use_login;
			goto parse_flag;

		case sLogFacility:
			intptr = (int *) &options->log_facility;
			cp = strtok(NULL, WHITESPACE);
			value = log_facility_number(cp);
			if (value == (SyslogFacility) - 1)
				fatal("%.200s line %d: unsupported log facility '%s'\n",
				  filename, linenum, cp ? cp : "<NONE>");
			if (*intptr == -1)
				*intptr = (SyslogFacility) value;
			break;

		case sLogLevel:
			intptr = (int *) &options->log_level;
			cp = strtok(NULL, WHITESPACE);
			value = log_level_number(cp);
			if (value == (LogLevel) - 1)
				fatal("%.200s line %d: unsupported log level '%s'\n",
				  filename, linenum, cp ? cp : "<NONE>");
			if (*intptr == -1)
				*intptr = (LogLevel) value;
			break;

		case sAllowUsers:
			while ((cp = strtok(NULL, WHITESPACE))) {
				if (options->num_allow_users >= MAX_ALLOW_USERS) {
					fprintf(stderr, "%s line %d: too many allow users.\n",
						filename, linenum);
					exit(1);
				}
				options->allow_users[options->num_allow_users++] = xstrdup(cp);
			}
			break;

		case sDenyUsers:
			while ((cp = strtok(NULL, WHITESPACE))) {
				if (options->num_deny_users >= MAX_DENY_USERS) {
					fprintf(stderr, "%s line %d: too many deny users.\n",
						filename, linenum);
					exit(1);
				}
				options->deny_users[options->num_deny_users++] = xstrdup(cp);
			}
			break;

		case sAllowGroups:
			while ((cp = strtok(NULL, WHITESPACE))) {
				if (options->num_allow_groups >= MAX_ALLOW_GROUPS) {
					fprintf(stderr, "%s line %d: too many allow groups.\n",
						filename, linenum);
					exit(1);
				}
				options->allow_groups[options->num_allow_groups++] = xstrdup(cp);
			}
			break;

		case sDenyGroups:
			while ((cp = strtok(NULL, WHITESPACE))) {
				if (options->num_deny_groups >= MAX_DENY_GROUPS) {
					fprintf(stderr, "%s line %d: too many deny groups.\n",
						filename, linenum);
					exit(1);
				}
				options->deny_groups[options->num_deny_groups++] = xstrdup(cp);
			}
			break;

		default:
			fprintf(stderr, "%s line %d: Missing handler for opcode %s (%d)\n",
				filename, linenum, cp, opcode);
			exit(1);
		}
		if (strtok(NULL, WHITESPACE) != NULL) {
			fprintf(stderr, "%s line %d: garbage at end of line.\n",
				filename, linenum);
			exit(1);
		}
	}
	fclose(f);
	if (bad_options > 0) {
		fprintf(stderr, "%s: terminating, %d bad configuration options\n",
			filename, bad_options);
		exit(1);
	}
}
Commit	Line	Data
8efc0c15	1	/*
5260325f	2	*
	3	* servconf.c
	4	*
	5	* Author: Tatu Ylonen <ylo@cs.hut.fi>
	6	*
	7	* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
	8	* All rights reserved
	9	*
	10	* Created: Mon Aug 21 15:48:58 1995 ylo
	11	*
	12	*/
8efc0c15	13
	14	#include "includes.h"
	15	RCSID("$Id$");
	16
	17	#include "ssh.h"
	18	#include "servconf.h"
	19	#include "xmalloc.h"
	20
	21	/* Initializes the server options to their default values. */
	22
5260325f	23	void
5260325f	24	initialize_server_options(ServerOptions *options)
8efc0c15	25	{
5260325f	26	memset(options, 0, sizeof(*options));
	27	options->port = -1;
	28	options->listen_addr.s_addr = htonl(INADDR_ANY);
	29	options->host_key_file = NULL;
	30	options->server_key_bits = -1;
	31	options->login_grace_time = -1;
	32	options->key_regeneration_time = -1;
	33	options->permit_root_login = -1;
	34	options->ignore_rhosts = -1;
	35	options->ignore_user_known_hosts = -1;
	36	options->print_motd = -1;
	37	options->check_mail = -1;
	38	options->x11_forwarding = -1;
	39	options->x11_display_offset = -1;
	40	options->strict_modes = -1;
	41	options->keepalives = -1;
	42	options->log_facility = (SyslogFacility) - 1;
	43	options->log_level = (LogLevel) - 1;
	44	options->rhosts_authentication = -1;
	45	options->rhosts_rsa_authentication = -1;
	46	options->rsa_authentication = -1;
8efc0c15	47	#ifdef KRB4
5260325f	48	options->kerberos_authentication = -1;
	49	options->kerberos_or_local_passwd = -1;
	50	options->kerberos_ticket_cleanup = -1;
8efc0c15	51	#endif
8efc0c15	52	#ifdef AFS
5260325f	53	options->kerberos_tgt_passing = -1;
5260325f	54	options->afs_token_passing = -1;
8efc0c15	55	#endif
5260325f	56	options->password_authentication = -1;
8efc0c15	57	#ifdef SKEY
5260325f	58	options->skey_authentication = -1;
8efc0c15	59	#endif
5260325f	60	options->permit_empty_passwd = -1;
	61	options->use_login = -1;
	62	options->num_allow_users = 0;
	63	options->num_deny_users = 0;
	64	options->num_allow_groups = 0;
	65	options->num_deny_groups = 0;
8efc0c15	66	}
8efc0c15	67
5260325f	68	void
5260325f	69	fill_default_server_options(ServerOptions *options)
8efc0c15	70	{
5260325f	71	if (options->port == -1) {
	72	struct servent *sp;
	73
	74	sp = getservbyname(SSH_SERVICE_NAME, "tcp");
	75	if (sp)
	76	options->port = ntohs(sp->s_port);
	77	else
	78	options->port = SSH_DEFAULT_PORT;
	79	endservent();
	80	}
	81	if (options->host_key_file == NULL)
	82	options->host_key_file = HOST_KEY_FILE;
	83	if (options->server_key_bits == -1)
	84	options->server_key_bits = 768;
	85	if (options->login_grace_time == -1)
	86	options->login_grace_time = 600;
	87	if (options->key_regeneration_time == -1)
	88	options->key_regeneration_time = 3600;
	89	if (options->permit_root_login == -1)
	90	options->permit_root_login = 1; /* yes */
	91	if (options->ignore_rhosts == -1)
	92	options->ignore_rhosts = 0;
	93	if (options->ignore_user_known_hosts == -1)
	94	options->ignore_user_known_hosts = 0;
	95	if (options->check_mail == -1)
	96	options->check_mail = 0;
	97	if (options->print_motd == -1)
	98	options->print_motd = 1;
	99	if (options->x11_forwarding == -1)
	100	options->x11_forwarding = 1;
	101	if (options->x11_display_offset == -1)
	102	options->x11_display_offset = 1;
	103	if (options->strict_modes == -1)
	104	options->strict_modes = 1;
	105	if (options->keepalives == -1)
	106	options->keepalives = 1;
	107	if (options->log_facility == (SyslogFacility) (-1))
	108	options->log_facility = SYSLOG_FACILITY_AUTH;
	109	if (options->log_level == (LogLevel) (-1))
	110	options->log_level = SYSLOG_LEVEL_INFO;
	111	if (options->rhosts_authentication == -1)
	112	options->rhosts_authentication = 0;
	113	if (options->rhosts_rsa_authentication == -1)
	114	options->rhosts_rsa_authentication = 1;
	115	if (options->rsa_authentication == -1)
	116	options->rsa_authentication = 1;
8efc0c15	117	#ifdef KRB4
5260325f	118	if (options->kerberos_authentication == -1)
	119	options->kerberos_authentication = (access(KEYFILE, R_OK) == 0);
	120	if (options->kerberos_or_local_passwd == -1)
	121	options->kerberos_or_local_passwd = 1;
	122	if (options->kerberos_ticket_cleanup == -1)
	123	options->kerberos_ticket_cleanup = 1;
8efc0c15	124	#endif /* KRB4 */
8efc0c15	125	#ifdef AFS
5260325f	126	if (options->kerberos_tgt_passing == -1)
	127	options->kerberos_tgt_passing = 0;
	128	if (options->afs_token_passing == -1)
	129	options->afs_token_passing = k_hasafs();
8efc0c15	130	#endif /* AFS */
5260325f	131	if (options->password_authentication == -1)
5260325f	132	options->password_authentication = 1;
8efc0c15	133	#ifdef SKEY
5260325f	134	if (options->skey_authentication == -1)
5260325f	135	options->skey_authentication = 1;
8efc0c15	136	#endif
5260325f	137	if (options->permit_empty_passwd == -1)
	138	options->permit_empty_passwd = 1;
	139	if (options->use_login == -1)
	140	options->use_login = 0;
8efc0c15	141	}
	142
	143	#define WHITESPACE " \t\r\n"
	144
	145	/* Keyword tokens. */
5260325f	146	typedef enum {
	147	sBadOption, /* == unknown option */
	148	sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
	149	sPermitRootLogin, sLogFacility, sLogLevel,
	150	sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication,
8efc0c15	151	#ifdef KRB4
5260325f	152	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
8efc0c15	153	#endif
8efc0c15	154	#ifdef AFS
5260325f	155	sKerberosTgtPassing, sAFSTokenPassing,
8efc0c15	156	#endif
8efc0c15	157	#ifdef SKEY
5260325f	158	sSkeyAuthentication,
8efc0c15	159	#endif
5260325f	160	sPasswordAuthentication, sListenAddress,
	161	sPrintMotd, sIgnoreRhosts, sX11Forwarding, sX11DisplayOffset,
	162	sStrictModes, sEmptyPasswd, sRandomSeedFile, sKeepAlives, sCheckMail,
	163	sUseLogin, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
	164	sIgnoreUserKnownHosts
8efc0c15	165	} ServerOpCodes;
	166
	167	/* Textual representation of the tokens. */
5260325f	168	static struct {
	169	const char *name;
	170	ServerOpCodes opcode;
	171	} keywords[] = {
	172	{ "port", sPort },
	173	{ "hostkey", sHostKeyFile },
	174	{ "serverkeybits", sServerKeyBits },
	175	{ "logingracetime", sLoginGraceTime },
	176	{ "keyregenerationinterval", sKeyRegenerationTime },
	177	{ "permitrootlogin", sPermitRootLogin },
	178	{ "syslogfacility", sLogFacility },
	179	{ "loglevel", sLogLevel },
	180	{ "rhostsauthentication", sRhostsAuthentication },
	181	{ "rhostsrsaauthentication", sRhostsRSAAuthentication },
	182	{ "rsaauthentication", sRSAAuthentication },
8efc0c15	183	#ifdef KRB4
5260325f	184	{ "kerberosauthentication", sKerberosAuthentication },
	185	{ "kerberosorlocalpasswd", sKerberosOrLocalPasswd },
	186	{ "kerberosticketcleanup", sKerberosTicketCleanup },
8efc0c15	187	#endif
8efc0c15	188	#ifdef AFS
5260325f	189	{ "kerberostgtpassing", sKerberosTgtPassing },
5260325f	190	{ "afstokenpassing", sAFSTokenPassing },
8efc0c15	191	#endif
5260325f	192	{ "passwordauthentication", sPasswordAuthentication },
8efc0c15	193	#ifdef SKEY
5260325f	194	{ "skeyauthentication", sSkeyAuthentication },
8efc0c15	195	#endif
5260325f	196	{ "checkmail", sCheckMail },
	197	{ "listenaddress", sListenAddress },
	198	{ "printmotd", sPrintMotd },
	199	{ "ignorerhosts", sIgnoreRhosts },
	200	{ "ignoreuserknownhosts", sIgnoreUserKnownHosts },
	201	{ "x11forwarding", sX11Forwarding },
	202	{ "x11displayoffset", sX11DisplayOffset },
	203	{ "strictmodes", sStrictModes },
	204	{ "permitemptypasswords", sEmptyPasswd },
	205	{ "uselogin", sUseLogin },
	206	{ "randomseed", sRandomSeedFile },
	207	{ "keepalive", sKeepAlives },
	208	{ "allowusers", sAllowUsers },
	209	{ "denyusers", sDenyUsers },
	210	{ "allowgroups", sAllowGroups },
	211	{ "denygroups", sDenyGroups },
	212	{ NULL, 0 }
8efc0c15	213	};
8efc0c15	214
8efc0c15	215	/* Returns the number of the token pointed to by cp of length len.
	216	Never returns if the token is not known. */
	217
5260325f	218	static ServerOpCodes
	219	parse_token(const char cp, const char filename,
	220	int linenum)
8efc0c15	221	{
5260325f	222	unsigned int i;
8efc0c15	223
5260325f	224	for (i = 0; keywords[i].name; i++)
	225	if (strcmp(cp, keywords[i].name) == 0)
	226	return keywords[i].opcode;
8efc0c15	227
5260325f	228	fprintf(stderr, "%s: line %d: Bad configuration option: %s\n",
	229	filename, linenum, cp);
	230	return sBadOption;
8efc0c15	231	}
	232
	233	/* Reads the server configuration file. */
	234
5260325f	235	void
5260325f	236	read_server_config(ServerOptions options, const char filename)
8efc0c15	237	{
5260325f	238	FILE *f;
	239	char line[1024];
	240	char cp, *charptr;
	241	int linenum, *intptr, value;
	242	int bad_options = 0;
	243	ServerOpCodes opcode;
	244
	245	f = fopen(filename, "r");
	246	if (!f) {
	247	perror(filename);
8efc0c15	248	exit(1);
5260325f	249	}
	250	linenum = 0;
	251	while (fgets(line, sizeof(line), f)) {
	252	linenum++;
	253	cp = line + strspn(line, WHITESPACE);
	254	if (!cp \|\| cp == '#')
	255	continue;
	256	cp = strtok(cp, WHITESPACE);
	257	{
	258	char *t = cp;
	259	for (; *t != 0; t++)
	260	if ('A' <= t && t <= 'Z')
	261	t = t - 'A' + 'a'; /* tolower */
	262
	263	}
	264	opcode = parse_token(cp, filename, linenum);
	265	switch (opcode) {
	266	case sBadOption:
	267	bad_options++;
	268	continue;
	269	case sPort:
	270	intptr = &options->port;
	271	parse_int:
	272	cp = strtok(NULL, WHITESPACE);
	273	if (!cp) {
	274	fprintf(stderr, "%s line %d: missing integer value.\n",
	275	filename, linenum);
	276	exit(1);
	277	}
	278	value = atoi(cp);
	279	if (*intptr == -1)
	280	*intptr = value;
	281	break;
	282
	283	case sServerKeyBits:
	284	intptr = &options->server_key_bits;
	285	goto parse_int;
	286
	287	case sLoginGraceTime:
	288	intptr = &options->login_grace_time;
	289	goto parse_int;
	290
	291	case sKeyRegenerationTime:
	292	intptr = &options->key_regeneration_time;
	293	goto parse_int;
	294
	295	case sListenAddress:
	296	cp = strtok(NULL, WHITESPACE);
	297	if (!cp) {
	298	fprintf(stderr, "%s line %d: missing inet addr.\n",
	299	filename, linenum);
	300	exit(1);
	301	}
	302	options->listen_addr.s_addr = inet_addr(cp);
	303	break;
	304
	305	case sHostKeyFile:
	306	charptr = &options->host_key_file;
	307	cp = strtok(NULL, WHITESPACE);
	308	if (!cp) {
	309	fprintf(stderr, "%s line %d: missing file name.\n",
	310	filename, linenum);
	311	exit(1);
	312	}
313	if (*charptr == NULL)
314	*charptr = tilde_expand_filename(cp, getuid());
315	break;
316
317	case sRandomSeedFile:
318	fprintf(stderr, "%s line %d: \"randomseed\" option is obsolete.\n",
319	filename, linenum);
320	cp = strtok(NULL, WHITESPACE);
321	break;
322
323	case sPermitRootLogin:
324	intptr = &options->permit_root_login;
325	cp = strtok(NULL, WHITESPACE);
326	if (!cp) {
327	fprintf(stderr, "%s line %d: missing yes/without-password/no argument.\n",
328	filename, linenum);
329	exit(1);
330	}
331	if (strcmp(cp, "without-password") == 0)
332	value = 2;
333	else if (strcmp(cp, "yes") == 0)
334	value = 1;
335	else if (strcmp(cp, "no") == 0)
336	value = 0;
337	else {
338	fprintf(stderr, "%s line %d: Bad yes/without-password/no argument: %s\n",
339	filename, linenum, cp);
340	exit(1);
341	}
342	if (*intptr == -1)
343	*intptr = value;
344	break;
345
346	case sIgnoreRhosts:
347	intptr = &options->ignore_rhosts;
348	parse_flag:
349	cp = strtok(NULL, WHITESPACE);
350	if (!cp) {
351	fprintf(stderr, "%s line %d: missing yes/no argument.\n",
352	filename, linenum);
353	exit(1);
354	}
355	if (strcmp(cp, "yes") == 0)
356	value = 1;
357	else if (strcmp(cp, "no") == 0)
358	value = 0;
359	else {
360	fprintf(stderr, "%s line %d: Bad yes/no argument: %s\n",
361	filename, linenum, cp);
362	exit(1);
363	}
364	if (*intptr == -1)
365	*intptr = value;
366	break;
367
368	case sIgnoreUserKnownHosts:
369	intptr = &options->ignore_user_known_hosts;
370	goto parse_int;
371
372	case sRhostsAuthentication:
373	intptr = &options->rhosts_authentication;
374	goto parse_flag;
375
376	case sRhostsRSAAuthentication:
377	intptr = &options->rhosts_rsa_authentication;
378	goto parse_flag;
379
380	case sRSAAuthentication:
381	intptr = &options->rsa_authentication;
382	goto parse_flag;
383
8efc0c15	384	#ifdef KRB4
5260325f	385	case sKerberosAuthentication:
	386	intptr = &options->kerberos_authentication;
	387	goto parse_flag;
	388
	389	case sKerberosOrLocalPasswd:
	390	intptr = &options->kerberos_or_local_passwd;
	391	goto parse_flag;
	392
	393	case sKerberosTicketCleanup:
	394	intptr = &options->kerberos_ticket_cleanup;
	395	goto parse_flag;
8efc0c15	396	#endif
5260325f	397
8efc0c15	398	#ifdef AFS
5260325f	399	case sKerberosTgtPassing:
	400	intptr = &options->kerberos_tgt_passing;
	401	goto parse_flag;
8efc0c15	402
5260325f	403	case sAFSTokenPassing:
	404	intptr = &options->afs_token_passing;
	405	goto parse_flag;
8efc0c15	406	#endif
8efc0c15	407
5260325f	408	case sPasswordAuthentication:
	409	intptr = &options->password_authentication;
	410	goto parse_flag;
8efc0c15	411
5260325f	412	case sCheckMail:
	413	intptr = &options->check_mail;
	414	goto parse_flag;
8efc0c15	415
8efc0c15	416	#ifdef SKEY
5260325f	417	case sSkeyAuthentication:
	418	intptr = &options->skey_authentication;
	419	goto parse_flag;
8efc0c15	420	#endif
8efc0c15	421
5260325f	422	case sPrintMotd:
	423	intptr = &options->print_motd;
	424	goto parse_flag;
	425
	426	case sX11Forwarding:
	427	intptr = &options->x11_forwarding;
	428	goto parse_flag;
	429
	430	case sX11DisplayOffset:
	431	intptr = &options->x11_display_offset;
	432	goto parse_int;
	433
	434	case sStrictModes:
	435	intptr = &options->strict_modes;
	436	goto parse_flag;
	437
	438	case sKeepAlives:
	439	intptr = &options->keepalives;
	440	goto parse_flag;
	441
	442	case sEmptyPasswd:
	443	intptr = &options->permit_empty_passwd;
	444	goto parse_flag;
	445
	446	case sUseLogin:
	447	intptr = &options->use_login;
	448	goto parse_flag;
	449
	450	case sLogFacility:
	451	intptr = (int *) &options->log_facility;
	452	cp = strtok(NULL, WHITESPACE);
	453	value = log_facility_number(cp);
	454	if (value == (SyslogFacility) - 1)
	455	fatal("%.200s line %d: unsupported log facility '%s'\n",
	456	filename, linenum, cp ? cp : "<NONE>");
	457	if (*intptr == -1)
	458	*intptr = (SyslogFacility) value;
	459	break;
	460
	461	case sLogLevel:
	462	intptr = (int *) &options->log_level;
	463	cp = strtok(NULL, WHITESPACE);
	464	value = log_level_number(cp);
	465	if (value == (LogLevel) - 1)
	466	fatal("%.200s line %d: unsupported log level '%s'\n",
	467	filename, linenum, cp ? cp : "<NONE>");
	468	if (*intptr == -1)
	469	*intptr = (LogLevel) value;
	470	break;
	471
	472	case sAllowUsers:
	473	while ((cp = strtok(NULL, WHITESPACE))) {
	474	if (options->num_allow_users >= MAX_ALLOW_USERS) {
	475	fprintf(stderr, "%s line %d: too many allow users.\n",
	476	filename, linenum);
	477	exit(1);
	478	}
	479	options->allow_users[options->num_allow_users++] = xstrdup(cp);
	480	}
	481	break;
	482
	483	case sDenyUsers:
	484	while ((cp = strtok(NULL, WHITESPACE))) {
	485	if (options->num_deny_users >= MAX_DENY_USERS) {
486	fprintf(stderr, "%s line %d: too many deny users.\n",
487	filename, linenum);
488	exit(1);
489	}
490	options->deny_users[options->num_deny_users++] = xstrdup(cp);
491	}
492	break;
493
494	case sAllowGroups:
495	while ((cp = strtok(NULL, WHITESPACE))) {
496	if (options->num_allow_groups >= MAX_ALLOW_GROUPS) {
497	fprintf(stderr, "%s line %d: too many allow groups.\n",
498	filename, linenum);
499	exit(1);
500	}
501	options->allow_groups[options->num_allow_groups++] = xstrdup(cp);
502	}
503	break;
504
505	case sDenyGroups:
506	while ((cp = strtok(NULL, WHITESPACE))) {
507	if (options->num_deny_groups >= MAX_DENY_GROUPS) {
508	fprintf(stderr, "%s line %d: too many deny groups.\n",
509	filename, linenum);
510	exit(1);
511	}
512	options->deny_groups[options->num_deny_groups++] = xstrdup(cp);
513	}
514	break;
515
516	default:
517	fprintf(stderr, "%s line %d: Missing handler for opcode %s (%d)\n",
518	filename, linenum, cp, opcode);
519	exit(1);
8efc0c15	520	}
5260325f	521	if (strtok(NULL, WHITESPACE) != NULL) {
	522	fprintf(stderr, "%s line %d: garbage at end of line.\n",
	523	filename, linenum);
	524	exit(1);
8efc0c15	525	}
8efc0c15	526	}
5260325f	527	fclose(f);
	528	if (bad_options > 0) {
	529	fprintf(stderr, "%s: terminating, %d bad configuration options\n",
	530	filename, bad_options);
	531	exit(1);
8efc0c15	532	}
8efc0c15	533	}