[buildpkg.sh.in] Last minute fix didn't make it in the .in file. :-(

[openssh.git] / servconf.c

diff --git a/servconf.c b/servconf.c
index 09fdbf42416d4d18020d0a986ea5d84832cf66c6..ef86516519e3fea282b44429a32158a2f62e72ae 100644 (file)
--- a/servconf.c
+++ b/servconf.c
@@ -10,7 +10,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: servconf.c,v 1.124 2003/08/13 08:46:30 markus Exp $");
+RCSID("$OpenBSD: servconf.c,v 1.133 2004/05/23 23:59:53 dtucker Exp $");
 
 #include "ssh.h"
 #include "log.h"
@@ -18,7 +18,6 @@ RCSID("$OpenBSD: servconf.c,v 1.124 2003/08/13 08:46:30 markus Exp $");
 #include "xmalloc.h"
 #include "compat.h"
 #include "pathnames.h"
-#include "tildexpand.h"
 #include "misc.h"
 #include "cipher.h"
 #include "kex.h"
@@ -61,7 +60,7 @@ initialize_server_options(ServerOptions *options)
        options->x11_use_localhost = -1;
        options->xauth_location = NULL;
        options->strict_modes = -1;
-       options->keepalives = -1;
+       options->tcp_keep_alive = -1;
        options->log_facility = SYSLOG_FACILITY_NOT_SET;
        options->log_level = SYSLOG_LEVEL_NOT_SET;
        options->rhosts_rsa_authentication = -1;
@@ -72,7 +71,9 @@ initialize_server_options(ServerOptions *options)
        options->kerberos_authentication = -1;
        options->kerberos_or_local_passwd = -1;
        options->kerberos_ticket_cleanup = -1;
-       options->kerberos_tgt_passing = -1;
+       options->kerberos_get_afs_token = -1;
+       options->gss_authentication=-1;
+       options->gss_cleanup_creds = -1;
        options->password_authentication = -1;
        options->kbd_interactive_authentication = -1;
        options->challenge_response_authentication = -1;
@@ -93,12 +94,14 @@ initialize_server_options(ServerOptions *options)
        options->max_startups_begin = -1;
        options->max_startups_rate = -1;
        options->max_startups = -1;
+       options->max_authtries = -1;
        options->banner = NULL;
        options->use_dns = -1;
        options->client_alive_interval = -1;
        options->client_alive_count_max = -1;
        options->authorized_keys_file = NULL;
        options->authorized_keys_file2 = NULL;
+       options->num_accept_env = 0;
 
        /* Needs to be accessable in many places */
        use_privsep = -1;
@@ -109,7 +112,7 @@ fill_default_server_options(ServerOptions *options)
 {
        /* Portable-specific options */
        if (options->use_pam == -1)
-               options->use_pam = 1;
+               options->use_pam = 0;
 
        /* Standard Options */
        if (options->protocol == SSH_PROTO_UNKNOWN)
@@ -158,8 +161,8 @@ fill_default_server_options(ServerOptions *options)
                options->xauth_location = _PATH_XAUTH;
        if (options->strict_modes == -1)
                options->strict_modes = 1;
-       if (options->keepalives == -1)
-               options->keepalives = 1;
+       if (options->tcp_keep_alive == -1)
+               options->tcp_keep_alive = 1;
        if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
                options->log_facility = SYSLOG_FACILITY_AUTH;
        if (options->log_level == SYSLOG_LEVEL_NOT_SET)
@@ -180,8 +183,12 @@ fill_default_server_options(ServerOptions *options)
                options->kerberos_or_local_passwd = 1;
        if (options->kerberos_ticket_cleanup == -1)
                options->kerberos_ticket_cleanup = 1;
-       if (options->kerberos_tgt_passing == -1)
-               options->kerberos_tgt_passing = 0;
+       if (options->kerberos_get_afs_token == -1)
+               options->kerberos_get_afs_token = 0;
+       if (options->gss_authentication == -1)
+               options->gss_authentication = 0;
+       if (options->gss_cleanup_creds == -1)
+               options->gss_cleanup_creds = 1;
        if (options->password_authentication == -1)
                options->password_authentication = 1;
        if (options->kbd_interactive_authentication == -1)
@@ -206,6 +213,8 @@ fill_default_server_options(ServerOptions *options)
                options->max_startups_rate = 100;               /* 100% */
        if (options->max_startups_begin == -1)
                options->max_startups_begin = options->max_startups;
+       if (options->max_authtries == -1)
+               options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
        if (options->use_dns == -1)
                options->use_dns = 1;
        if (options->client_alive_interval == -1)
@@ -247,18 +256,21 @@ typedef enum {
        sPermitRootLogin, sLogFacility, sLogLevel,
        sRhostsRSAAuthentication, sRSAAuthentication,
        sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
+       sKerberosGetAFSToken,
        sKerberosTgtPassing, sChallengeResponseAuthentication,
        sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress,
        sPrintMotd, sPrintLastLog, sIgnoreRhosts,
        sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
-       sStrictModes, sEmptyPasswd, sKeepAlives,
+       sStrictModes, sEmptyPasswd, sTCPKeepAlive,
        sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
        sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
        sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
-       sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, sMaxStartups,
+       sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
+       sMaxStartups, sMaxAuthTries,
        sBanner, sUseDNS, sHostbasedAuthentication,
        sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
        sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
+       sGssAuthentication, sGssCleanupCreds, sAcceptEnv,
        sUsePrivilegeSeparation,
        sDeprecated, sUnsupported
 } ServerOpCodes;
@@ -297,14 +309,26 @@ static struct {
        { "kerberosauthentication", sKerberosAuthentication },
        { "kerberosorlocalpasswd", sKerberosOrLocalPasswd },
        { "kerberosticketcleanup", sKerberosTicketCleanup },
-       { "kerberostgtpassing", sKerberosTgtPassing },
+#ifdef USE_AFS
+       { "kerberosgetafstoken", sKerberosGetAFSToken },
+#else
+       { "kerberosgetafstoken", sUnsupported },
+#endif
 #else
        { "kerberosauthentication", sUnsupported },
        { "kerberosorlocalpasswd", sUnsupported },
        { "kerberosticketcleanup", sUnsupported },
-       { "kerberostgtpassing", sUnsupported },
+       { "kerberosgetafstoken", sUnsupported },
 #endif
+       { "kerberostgtpassing", sUnsupported },
        { "afstokenpassing", sUnsupported },
+#ifdef GSSAPI
+       { "gssapiauthentication", sGssAuthentication },
+       { "gssapicleanupcredentials", sGssCleanupCreds },
+#else
+       { "gssapiauthentication", sUnsupported },
+       { "gssapicleanupcredentials", sUnsupported },
+#endif
        { "passwordauthentication", sPasswordAuthentication },
        { "kbdinteractiveauthentication", sKbdInteractiveAuthentication },
        { "challengeresponseauthentication", sChallengeResponseAuthentication },
@@ -324,7 +348,8 @@ static struct {
        { "permituserenvironment", sPermitUserEnvironment },
        { "uselogin", sUseLogin },
        { "compression", sCompression },
-       { "keepalive", sKeepAlives },
+       { "tcpkeepalive", sTCPKeepAlive },
+       { "keepalive", sTCPKeepAlive },                         /* obsolete alias */
        { "allowtcpforwarding", sAllowTcpForwarding },
        { "allowusers", sAllowUsers },
        { "denyusers", sDenyUsers },
@@ -336,6 +361,7 @@ static struct {
        { "gatewayports", sGatewayPorts },
        { "subsystem", sSubsystem },
        { "maxstartups", sMaxStartups },
+       { "maxauthtries", sMaxAuthTries },
        { "banner", sBanner },
        { "usedns", sUseDNS },
        { "verifyreversemapping", sDeprecated },
@@ -345,6 +371,7 @@ static struct {
        { "authorizedkeysfile", sAuthorizedKeysFile },
        { "authorizedkeysfile2", sAuthorizedKeysFile2 },
        { "useprivilegeseparation", sUsePrivilegeSeparation},
+       { "acceptenv", sAcceptEnv },
        { NULL, sBadOption }
 };
 
@@ -619,8 +646,16 @@ parse_flag:
                intptr = &options->kerberos_ticket_cleanup;
                goto parse_flag;
 
-       case sKerberosTgtPassing:
-               intptr = &options->kerberos_tgt_passing;
+       case sKerberosGetAFSToken:
+               intptr = &options->kerberos_get_afs_token;
+               goto parse_flag;
+
+       case sGssAuthentication:
+               intptr = &options->gss_authentication;
+               goto parse_flag;
+
+       case sGssCleanupCreds:
+               intptr = &options->gss_cleanup_creds;
                goto parse_flag;
 
        case sPasswordAuthentication:
@@ -663,8 +698,8 @@ parse_flag:
                intptr = &options->strict_modes;
                goto parse_flag;
 
-       case sKeepAlives:
-               intptr = &options->keepalives;
+       case sTCPKeepAlive:
+               intptr = &options->tcp_keep_alive;
                goto parse_flag;
 
        case sEmptyPasswd:
@@ -839,6 +874,10 @@ parse_flag:
                        options->max_startups = options->max_startups_begin;
                break;
 
+       case sMaxAuthTries:
+               intptr = &options->max_authtries;
+               goto parse_int;
+
        case sBanner:
                charptr = &options->banner;
                goto parse_filename;
@@ -863,6 +902,19 @@ parse_flag:
                intptr = &options->client_alive_count_max;
                goto parse_int;
 
+       case sAcceptEnv:
+               while ((arg = strdelim(&cp)) && *arg != '\0') {
+                       if (strchr(arg, '=') != NULL)
+                               fatal("%s line %d: Invalid environment name.",
+                                   filename, linenum);
+                       if (options->num_accept_env >= MAX_ACCEPT_ENV)
+                               fatal("%s line %d: too many allow env.",
+                                   filename, linenum);
+                       options->accept_env[options->num_accept_env++] =
+                           xstrdup(arg);
+               }
+               break;
+
        case sDeprecated:
                logit("%s line %d: Deprecated option %s",
                    filename, linenum, arg);