* New upstream release (http://www.openssh.com/txt/release-5.6):

  - Added a ControlPersist option to ssh_config(5) that automatically
    starts a background ssh(1) multiplex master when connecting.  This
    connection can stay alive indefinitely, or can be set to automatically
    close after a user-specified duration of inactivity (closes: #335697,
    #350898, #454787, #500573, #550262).
  - Support AuthorizedKeysFile, AuthorizedPrincipalsFile,
    HostbasedUsesNameFromPacketOnly, and PermitTunnel in sshd_config(5)
    Match blocks (closes: #549858).
  - sftp(1): fix ls in working directories that contain globbing
    characters in their pathnames (LP: #530714).

1 files changed, 22 insertions, 9 deletions

diff --git a/servconf.c b/servconf.c
index d42dd527b..c843c97c5 100644
--- a/servconf.c
+++ b/servconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.c,v 1.207 2010/03/25 23:38:28 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.209 2010/06/22 04:22:59 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -135,6 +135,7 @@ initialize_server_options(ServerOptions *options)
         options->zero_knowledge_password_authentication = -1;
         options->revoked_keys_file = NULL;
         options->trusted_user_ca_keys = NULL;
+        options->authorized_principals_file = NULL;
         options->debian_banner = -1;
 }
 
@@ -327,7 +328,7 @@ typedef enum {
         sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
         sUsePrivilegeSeparation, sAllowAgentForwarding,
         sZeroKnowledgePasswordAuthentication, sHostCertificate,
-        sRevokedKeys, sTrustedUserCAKeys,
+        sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
         sDebianBanner,
         sDeprecated, sUnsupported
 } ServerOpCodes;
@@ -363,7 +364,7 @@ static struct {
         { "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL },
         { "rhostsrsaauthentication", sRhostsRSAAuthentication, SSHCFG_ALL },
         { "hostbasedauthentication", sHostbasedAuthentication, SSHCFG_ALL },
-        { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_GLOBAL },
+        { "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly, SSHCFG_ALL },
         { "rsaauthentication", sRSAAuthentication, SSHCFG_ALL },
         { "pubkeyauthentication", sPubkeyAuthentication, SSHCFG_ALL },
         { "dsaauthentication", sPubkeyAuthentication, SSHCFG_GLOBAL }, /* alias */
@@ -449,11 +450,11 @@ static struct {
         { "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
         { "clientaliveinterval", sClientAliveInterval, SSHCFG_GLOBAL },
         { "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
-        { "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_GLOBAL },
-        { "authorizedkeysfile2", sAuthorizedKeysFile2, SSHCFG_GLOBAL },
+        { "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_ALL },
+        { "authorizedkeysfile2", sAuthorizedKeysFile2, SSHCFG_ALL },
         { "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL},
         { "acceptenv", sAcceptEnv, SSHCFG_GLOBAL },
-        { "permittunnel", sPermitTunnel, SSHCFG_GLOBAL },
+        { "permittunnel", sPermitTunnel, SSHCFG_ALL },
         { "match", sMatch, SSHCFG_ALL },
         { "permitopen", sPermitOpen, SSHCFG_ALL },
         { "forcecommand", sForceCommand, SSHCFG_ALL },
@@ -461,6 +462,7 @@ static struct {
         { "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
         { "revokedkeys", sRevokedKeys, SSHCFG_ALL },
         { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
+        { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
         { "debianbanner", sDebianBanner, SSHCFG_GLOBAL },
         { NULL, sBadOption, 0 }
 };
@@ -1264,10 +1266,14 @@ process_server_config_line(ServerOptions *options, char *line,
          * AuthorizedKeysFile   /etc/ssh_keys/%u
          */
         case sAuthorizedKeysFile:
+                charptr = &options->authorized_keys_file;
+                goto parse_tilde_filename;
         case sAuthorizedKeysFile2:
-                charptr = (opcode == sAuthorizedKeysFile) ?
-                    &options->authorized_keys_file :
-                    &options->authorized_keys_file2;
+                charptr = &options->authorized_keys_file2;
+                goto parse_tilde_filename;
+        case sAuthorizedPrincipalsFile:
+                charptr = &options->authorized_principals_file;
+ parse_tilde_filename:
                 arg = strdelim(&cp);
                 if (!arg || *arg == '\0')
                         fatal("%s line %d: missing file name.",
@@ -1490,6 +1496,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
         M_CP_INTOPT(pubkey_authentication);
         M_CP_INTOPT(kerberos_authentication);
         M_CP_INTOPT(hostbased_authentication);
+        M_CP_INTOPT(hostbased_uses_name_from_packet_only);
         M_CP_INTOPT(kbd_interactive_authentication);
         M_CP_INTOPT(zero_knowledge_password_authentication);
         M_CP_INTOPT(permit_root_login);
@@ -1497,6 +1504,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
 
         M_CP_INTOPT(allow_tcp_forwarding);
         M_CP_INTOPT(allow_agent_forwarding);
+        M_CP_INTOPT(permit_tun);
         M_CP_INTOPT(gateway_ports);
         M_CP_INTOPT(x11_display_offset);
         M_CP_INTOPT(x11_forwarding);
@@ -1511,6 +1519,9 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
         M_CP_STROPT(chroot_directory);
         M_CP_STROPT(trusted_user_ca_keys);
         M_CP_STROPT(revoked_keys_file);
+        M_CP_STROPT(authorized_keys_file);
+        M_CP_STROPT(authorized_keys_file2);
+        M_CP_STROPT(authorized_principals_file);
 }
 
 #undef M_CP_INTOPT
@@ -1736,6 +1747,8 @@ dump_config(ServerOptions *o)
         dump_cfg_string(sChrootDirectory, o->chroot_directory);
         dump_cfg_string(sTrustedUserCAKeys, o->trusted_user_ca_keys);
         dump_cfg_string(sRevokedKeys, o->revoked_keys_file);
+        dump_cfg_string(sAuthorizedPrincipalsFile,
+            o->authorized_principals_file);
 
         /* string arguments requiring a lookup */
         dump_cfg_string(sLogLevel, log_level_name(o->log_level));