upstream commit

Support "none" as an argument for sshd_config
 ForceCommand and ChrootDirectory. Useful inside Match blocks to override a
 global default. bz#2486 ok dtucker@

Upstream-ID: 7ef478d6592bc7db5c7376fc33b4443e63dccfa5

2 files changed, 18 insertions, 3 deletions

diff --git a/servconf.c b/servconf.c
index 17cb094c7..19c68e2d7 100644
--- a/servconf.c
+++ b/servconf.c
@@ -1,5 +1,5 @@
 
-/* $OpenBSD: servconf.c,v 1.282 2015/10/29 08:05:01 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.283 2015/11/13 04:38:06 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -373,6 +373,8 @@ fill_default_server_options(ServerOptions *options)
         CLEAR_ON_NONE(options->trusted_user_ca_keys);
         CLEAR_ON_NONE(options->revoked_keys_file);
         CLEAR_ON_NONE(options->authorized_principals_file);
+        CLEAR_ON_NONE(options->adm_forced_command);
+        CLEAR_ON_NONE(options->chroot_directory);
         for (i = 0; i < options->num_host_key_files; i++)
                 CLEAR_ON_NONE(options->host_key_files[i]);
         for (i = 0; i < options->num_host_cert_files; i++)
@@ -2034,8 +2036,17 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
         if (preauth)
                 return;
 
+        /* These options may be "none" to clear a global setting */
         M_CP_STROPT(adm_forced_command);
+        if (option_clear_or_none(dst->adm_forced_command)) {
+                free(dst->adm_forced_command);
+                dst->adm_forced_command = NULL;
+        }
         M_CP_STROPT(chroot_directory);
+        if (option_clear_or_none(dst->chroot_directory)) {
+                free(dst->chroot_directory);
+                dst->chroot_directory = NULL;
+        }
 }
 
 #undef M_CP_INTOPT
diff --git a/sshd_config.5 b/sshd_config.5
index 3eb1bb8e0..d94c5f5c0 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -33,7 +33,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd_config.5,v 1.214 2015/11/13 02:57:46 djm Exp $
+.\" $OpenBSD: sshd_config.5,v 1.215 2015/11/13 04:38:06 djm Exp $
 .Dd $Mdocdate: November 13 2015 $
 .Dt SSHD_CONFIG 5
 .Os
@@ -432,7 +432,9 @@ Misconfiguration can lead to unsafe environments which
 .Xr sshd 8
 cannot detect.
 .Pp
-The default is not to
+The default is
+.Dq none ,
+indicating not to
 .Xr chroot 2 .
 .It Cm Ciphers
 Specifies the ciphers allowed for protocol version 2.
@@ -599,6 +601,8 @@ Specifying a command of
 will force the use of an in-process sftp server that requires no support
 files when used with
 .Cm ChrootDirectory .
+The default is
+.Dq none .
 .It Cm GatewayPorts
 Specifies whether remote hosts are allowed to connect to ports
 forwarded for the client.