[acconfig.h defines.h includes.h] put includes in includes.h and

[openssh.git] / servconf.c

diff --git a/servconf.c b/servconf.c
index 0cb744a1d833e70186eb7d292bddcb82867f2037..8e6ee5bb3e182fd479c47c673bb16588e6fcc754 100644 (file)
--- a/servconf.c
+++ b/servconf.c
@@ -10,7 +10,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: servconf.c,v 1.98 2002/01/22 02:52:41 stevesk Exp $");
+RCSID("$OpenBSD: servconf.c,v 1.105 2002/03/20 19:12:24 stevesk Exp $");
 
 #if defined(KRB4) || defined(KRB5)
 #include <krb.h>
@@ -36,6 +36,8 @@ static void add_one_listen_addr(ServerOptions *, char *, u_short);
 
 /* AF_UNSPEC or AF_INET or AF_INET6 */
 extern int IPv4or6;
+/* Use of privilege separation or not */
+extern int use_privsep;
 
 /* Initializes the server options to their default values. */
 
@@ -63,11 +65,12 @@ initialize_server_options(ServerOptions *options)
        options->print_lastlog = -1;
        options->x11_forwarding = -1;
        options->x11_display_offset = -1;
+       options->x11_use_localhost = -1;
        options->xauth_location = NULL;
        options->strict_modes = -1;
        options->keepalives = -1;
-       options->log_facility = (SyslogFacility) - 1;
-       options->log_level = (LogLevel) - 1;
+       options->log_facility = SYSLOG_FACILITY_NOT_SET;
+       options->log_level = SYSLOG_LEVEL_NOT_SET;
        options->rhosts_authentication = -1;
        options->rhosts_rsa_authentication = -1;
        options->hostbased_authentication = -1;
@@ -104,11 +107,14 @@ initialize_server_options(ServerOptions *options)
        options->max_startups_rate = -1;
        options->max_startups = -1;
        options->banner = NULL;
-       options->reverse_mapping_check = -1;
+       options->verify_reverse_mapping = -1;
        options->client_alive_interval = -1;
        options->client_alive_count_max = -1;
        options->authorized_keys_file = NULL;
        options->authorized_keys_file2 = NULL;
+
+       /* Needs to be accessable in many places */
+       use_privsep = -1;
 }
 
 void
@@ -159,15 +165,17 @@ fill_default_server_options(ServerOptions *options)
                options->x11_forwarding = 0;
        if (options->x11_display_offset == -1)
                options->x11_display_offset = 10;
+       if (options->x11_use_localhost == -1)
+               options->x11_use_localhost = 1;
        if (options->xauth_location == NULL)
                options->xauth_location = _PATH_XAUTH;
        if (options->strict_modes == -1)
                options->strict_modes = 1;
        if (options->keepalives == -1)
                options->keepalives = 1;
-       if (options->log_facility == (SyslogFacility) (-1))
+       if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
                options->log_facility = SYSLOG_FACILITY_AUTH;
-       if (options->log_level == (LogLevel) (-1))
+       if (options->log_level == SYSLOG_LEVEL_NOT_SET)
                options->log_level = SYSLOG_LEVEL_INFO;
        if (options->rhosts_authentication == -1)
                options->rhosts_authentication = 0;
@@ -217,8 +225,8 @@ fill_default_server_options(ServerOptions *options)
                options->max_startups_rate = 100;               /* 100% */
        if (options->max_startups_begin == -1)
                options->max_startups_begin = options->max_startups;
-       if (options->reverse_mapping_check == -1)
-               options->reverse_mapping_check = 0;
+       if (options->verify_reverse_mapping == -1)
+               options->verify_reverse_mapping = 0;
        if (options->client_alive_interval == -1)
                options->client_alive_interval = 0;
        if (options->client_alive_count_max == -1)
@@ -232,6 +240,10 @@ fill_default_server_options(ServerOptions *options)
        }
        if (options->authorized_keys_file == NULL)
                options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;
+
+       /* Turn privilege separation _off_ by default */
+       if (use_privsep == -1)
+               use_privsep = 0;
 }
 
 /* Keyword tokens. */
@@ -255,15 +267,16 @@ typedef enum {
        sChallengeResponseAuthentication,
        sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress,
        sPrintMotd, sPrintLastLog, sIgnoreRhosts,
-       sX11Forwarding, sX11DisplayOffset,
+       sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
        sStrictModes, sEmptyPasswd, sKeepAlives,
        sUseLogin, sAllowTcpForwarding,
        sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
        sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
        sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, sMaxStartups,
-       sBanner, sReverseMappingCheck, sHostbasedAuthentication,
+       sBanner, sVerifyReverseMapping, sHostbasedAuthentication,
        sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
        sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
+       sUsePrivilegeSeparation,
        sDeprecated
 } ServerOpCodes;
 
@@ -315,6 +328,7 @@ static struct {
        { "ignoreuserknownhosts", sIgnoreUserKnownHosts },
        { "x11forwarding", sX11Forwarding },
        { "x11displayoffset", sX11DisplayOffset },
+       { "x11uselocalhost", sX11UseLocalhost },
        { "xauthlocation", sXAuthLocation },
        { "strictmodes", sStrictModes },
        { "permitemptypasswords", sEmptyPasswd },
@@ -332,11 +346,13 @@ static struct {
        { "subsystem", sSubsystem },
        { "maxstartups", sMaxStartups },
        { "banner", sBanner },
-       { "reversemappingcheck", sReverseMappingCheck },
+       { "verifyreversemapping", sVerifyReverseMapping },
+       { "reversemappingcheck", sVerifyReverseMapping },
        { "clientaliveinterval", sClientAliveInterval },
        { "clientalivecountmax", sClientAliveCountMax },
        { "authorizedkeysfile", sAuthorizedKeysFile },
        { "authorizedkeysfile2", sAuthorizedKeysFile2 },
+       { "useprivilegeseparation", sUsePrivilegeSeparation},
        { NULL, sBadOption }
 };
 
@@ -655,6 +671,10 @@ parse_flag:
                intptr = &options->x11_display_offset;
                goto parse_int;
 
+       case sX11UseLocalhost:
+               intptr = &options->x11_use_localhost;
+               goto parse_flag;
+
        case sXAuthLocation:
                charptr = &options->xauth_location;
                goto parse_filename;
@@ -679,15 +699,15 @@ parse_flag:
                intptr = &options->gateway_ports;
                goto parse_flag;
 
-       case sReverseMappingCheck:
-               intptr = &options->reverse_mapping_check;
+       case sVerifyReverseMapping:
+               intptr = &options->verify_reverse_mapping;
                goto parse_flag;
 
        case sLogFacility:
                intptr = (int *) &options->log_facility;
                arg = strdelim(&cp);
                value = log_facility_number(arg);
-               if (value == (SyslogFacility) - 1)
+               if (value == SYSLOG_FACILITY_NOT_SET)
                        fatal("%.200s line %d: unsupported log facility '%s'",
                            filename, linenum, arg ? arg : "<NONE>");
                if (*intptr == -1)
@@ -698,7 +718,7 @@ parse_flag:
                intptr = (int *) &options->log_level;
                arg = strdelim(&cp);
                value = log_level_number(arg);
-               if (value == (LogLevel) - 1)
+               if (value == SYSLOG_LEVEL_NOT_SET)
                        fatal("%.200s line %d: unsupported log level '%s'",
                            filename, linenum, arg ? arg : "<NONE>");
                if (*intptr == -1)
@@ -709,6 +729,10 @@ parse_flag:
                intptr = &options->allow_tcp_forwarding;
                goto parse_flag;
 
+       case sUsePrivilegeSeparation:
+               intptr = &use_privsep;
+               goto parse_flag;
+
        case sAllowUsers:
                while ((arg = strdelim(&cp)) && *arg != '\0') {
                        if (options->num_allow_users >= MAX_ALLOW_USERS)