- djm@cvs.openbsd.org 2010/01/30 02:54:53

[openssh.git] / servconf.c

diff --git a/servconf.c b/servconf.c
index f2d414334448efb8fd0befb091d141f7e4d50b72..09296c9cfa3a0a4456833374ceeb33b0d58f2aaf 100644 (file)
--- a/servconf.c
+++ b/servconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.c,v 1.189 2008/11/03 08:59:41 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.202 2010/01/13 03:48:12 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -42,8 +42,8 @@
 #include "channels.h"
 #include "groupaccess.h"
 
-static void add_listen_addr(ServerOptions *, char *, u_short);
-static void add_one_listen_addr(ServerOptions *, char *, u_short);
+static void add_listen_addr(ServerOptions *, char *, int);
+static void add_one_listen_addr(ServerOptions *, char *, int);
 
 /* Use of privilege separation or not */
 extern int use_privsep;
@@ -127,6 +127,7 @@ initialize_server_options(ServerOptions *options)
        options->num_permitted_opens = -1;
        options->adm_forced_command = NULL;
        options->chroot_directory = NULL;
+       options->zero_knowledge_password_authentication = -1;
 }
 
 void
@@ -138,7 +139,7 @@ fill_default_server_options(ServerOptions *options)
 
        /* Standard Options */
        if (options->protocol == SSH_PROTO_UNKNOWN)
-               options->protocol = SSH_PROTO_1|SSH_PROTO_2;
+               options->protocol = SSH_PROTO_2;
        if (options->num_host_key_files == 0) {
                /* fill default hostkeys for protocols */
                if (options->protocol & SSH_PROTO_1)
@@ -258,6 +259,8 @@ fill_default_server_options(ServerOptions *options)
                options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;
        if (options->permit_tun == -1)
                options->permit_tun = SSH_TUNMODE_NO;
+       if (options->zero_knowledge_password_authentication == -1)
+               options->zero_knowledge_password_authentication = 0;
 
        /* Turn privilege separation on by default */
        if (use_privsep == -1)
@@ -302,6 +305,7 @@ typedef enum {
        sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
        sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
        sUsePrivilegeSeparation, sAllowAgentForwarding,
+       sZeroKnowledgePasswordAuthentication,
        sDeprecated, sUnsupported
 } ServerOpCodes;
 
@@ -339,7 +343,7 @@ static struct {
        { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_GLOBAL },
        { "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
        { "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
-       { "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL },  /* alias */
+       { "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
 #ifdef KRB5
        { "kerberosauthentication", sKerberosAuthentication, SSHCFG_ALL },
        { "kerberosorlocalpasswd", sKerberosOrLocalPasswd, SSHCFG_GLOBAL },
@@ -368,6 +372,11 @@ static struct {
        { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
        { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
        { "skeyauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL }, /* alias */
+#ifdef JPAKE
+       { "zeroknowledgepasswordauthentication", sZeroKnowledgePasswordAuthentication, SSHCFG_ALL },
+#else
+       { "zeroknowledgepasswordauthentication", sUnsupported, SSHCFG_ALL },
+#endif
        { "checkmail", sDeprecated, SSHCFG_GLOBAL },
        { "listenaddress", sListenAddress, SSHCFG_GLOBAL },
        { "addressfamily", sAddressFamily, SSHCFG_GLOBAL },
@@ -408,10 +417,10 @@ static struct {
        { "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
        { "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_GLOBAL },
        { "authorizedkeysfile2", sAuthorizedKeysFile2, SSHCFG_GLOBAL },
-       { "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL },
+       { "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL},
        { "acceptenv", sAcceptEnv, SSHCFG_GLOBAL },
        { "permittunnel", sPermitTunnel, SSHCFG_GLOBAL },
-       { "match", sMatch, SSHCFG_ALL },
+       { "match", sMatch, SSHCFG_ALL },
        { "permitopen", sPermitOpen, SSHCFG_ALL },
        { "forcecommand", sForceCommand, SSHCFG_ALL },
        { "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
@@ -450,8 +459,24 @@ parse_token(const char *cp, const char *filename,
        return sBadOption;
 }
 
+char *
+derelativise_path(const char *path)
+{
+       char *expanded, *ret, *cwd;
+
+       expanded = tilde_expand_filename(path, getuid());
+       if (*expanded == '/')
+               return expanded;
+       if ((cwd = getcwd(NULL, 0)) == NULL)
+               fatal("%s: getcwd: %s", __func__, strerror(errno));
+       xasprintf(&ret, "%s/%s", cwd, expanded);
+       xfree(cwd);
+       xfree(expanded);
+       return ret;
+}
+
 static void
-add_listen_addr(ServerOptions *options, char *addr, u_short port)
+add_listen_addr(ServerOptions *options, char *addr, int port)
 {
        u_int i;
 
@@ -467,7 +492,7 @@ add_listen_addr(ServerOptions *options, char *addr, u_short port)
 }
 
 static void
-add_one_listen_addr(ServerOptions *options, char *addr, u_short port)
+add_one_listen_addr(ServerOptions *options, char *addr, int port)
 {
        struct addrinfo hints, *ai, *aitop;
        char strport[NI_MAXSERV];
@@ -477,7 +502,7 @@ add_one_listen_addr(ServerOptions *options, char *addr, u_short port)
        hints.ai_family = options->address_family;
        hints.ai_socktype = SOCK_STREAM;
        hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
-       snprintf(strport, sizeof strport, "%u", port);
+       snprintf(strport, sizeof strport, "%d", port);
        if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
                fatal("bad addr or host: %s (%s)",
                    addr ? addr : "<NULL>",
@@ -633,7 +658,7 @@ process_server_config_line(ServerOptions *options, char *line,
        SyslogFacility *log_facility_ptr;
        LogLevel *log_level_ptr;
        ServerOpCodes opcode;
-       u_short port;
+       int port;
        u_int i, flags = 0;
        size_t len;
 
@@ -690,7 +715,7 @@ process_server_config_line(ServerOptions *options, char *line,
                        fatal("%s line %d: missing port number.",
                            filename, linenum);
                options->ports[options->num_ports++] = a2port(arg);
-               if (options->ports[options->num_ports-1] == 0)
+               if (options->ports[options->num_ports-1] <= 0)
                        fatal("%s line %d: Badly formatted port number.",
                            filename, linenum);
                break;
@@ -743,7 +768,7 @@ process_server_config_line(ServerOptions *options, char *line,
                p = cleanhostname(p);
                if (arg == NULL)
                        port = 0;
-               else if ((port = a2port(arg)) == 0)
+               else if ((port = a2port(arg)) <= 0)
                        fatal("%s line %d: bad port number", filename, linenum);
 
                add_listen_addr(options, p, port);
@@ -784,7 +809,7 @@ process_server_config_line(ServerOptions *options, char *line,
                        fatal("%s line %d: missing file name.",
                            filename, linenum);
                if (*activep && *charptr == NULL) {
-                       *charptr = tilde_expand_filename(arg, getuid());
+                       *charptr = derelativise_path(arg);
                        /* increase optional counter */
                        if (intptr != NULL)
                                *intptr = *intptr + 1;
@@ -890,6 +915,10 @@ process_server_config_line(ServerOptions *options, char *line,
                intptr = &options->password_authentication;
                goto parse_flag;
 
+       case sZeroKnowledgePasswordAuthentication:
+               intptr = &options->zero_knowledge_password_authentication;
+               goto parse_flag;
+
        case sKbdInteractiveAuthentication:
                intptr = &options->kbd_interactive_authentication;
                goto parse_flag;
@@ -1252,7 +1281,7 @@ process_server_config_line(ServerOptions *options, char *line,
                                fatal("%s line %d: missing host in PermitOpen",
                                    filename, linenum);
                        p = cleanhostname(p);
-                       if (arg == NULL || (port = a2port(arg)) == 0)
+                       if (arg == NULL || (port = a2port(arg)) <= 0)
                                fatal("%s line %d: bad port number in "
                                    "PermitOpen", filename, linenum);
                        if (*activep && n == -1)
@@ -1363,7 +1392,7 @@ parse_server_match_config(ServerOptions *options, const char *user,
 /*
  * Copy any supported values that are set.
  *
- * If the preauth flag is set, we do not bother copying the the string or
+ * If the preauth flag is set, we do not bother copying the string or
  * array values that are not used pre-authentication, because any that we
  * do use must be explictly sent in mm_getpwnamallow().
  */
@@ -1377,6 +1406,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
        M_CP_INTOPT(kerberos_authentication);
        M_CP_INTOPT(hostbased_authentication);
        M_CP_INTOPT(kbd_interactive_authentication);
+       M_CP_INTOPT(zero_knowledge_password_authentication);
        M_CP_INTOPT(permit_root_login);
        M_CP_INTOPT(permit_empty_passwd);
 
@@ -1440,7 +1470,7 @@ fmt_intarg(ServerOpCodes code, int val)
        if (code == sPermitRootLogin) {
                switch (val) {
                case PERMIT_NO_PASSWD:
-                       return "without-passord";
+                       return "without-password";
                case PERMIT_FORCED_ONLY:
                        return "forced-commands-only";
                case PERMIT_YES:
@@ -1578,6 +1608,10 @@ dump_config(ServerOptions *o)
 #ifdef GSSAPI
        dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
        dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
+#endif
+#ifdef JPAKE
+       dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication,
+           o->zero_knowledge_password_authentication);
 #endif
        dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
        dump_cfg_fmtint(sKbdInteractiveAuthentication,
@@ -1608,6 +1642,7 @@ dump_config(ServerOptions *o)
        dump_cfg_string(sAuthorizedKeysFile, o->authorized_keys_file);
        dump_cfg_string(sAuthorizedKeysFile2, o->authorized_keys_file2);
        dump_cfg_string(sForceCommand, o->adm_forced_command);
+       dump_cfg_string(sChrootDirectory, o->chroot_directory);
 
        /* string arguments requiring a lookup */
        dump_cfg_string(sLogLevel, log_level_name(o->log_level));
@@ -1637,7 +1672,5 @@ dump_config(ServerOptions *o)
                }
        dump_cfg_string(sPermitTunnel, s);
 
-       printf("permitopen");
        channel_print_adm_permitted_opens();
-       printf("\n");
 }