1 files changed, 52 insertions, 8 deletions

diff --git a/servconf.c b/servconf.c
index 8ca9695a2..a98b30938 100644
--- a/servconf.c
+++ b/servconf.c
@@ -1,5 +1,5 @@
 
-/* $OpenBSD: servconf.c,v 1.285 2016/02/17 05:29:04 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.292 2016/06/23 05:17:51 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -390,6 +390,14 @@ fill_default_server_options(ServerOptions *options)
                 CLEAR_ON_NONE(options->host_cert_files[i]);
 #undef CLEAR_ON_NONE
 
+        /* Similar handling for AuthenticationMethods=any */
+        if (options->num_auth_methods == 1 &&
+            strcmp(options->auth_methods[0], "any") == 0) {
+                free(options->auth_methods[0]);
+                options->auth_methods[0] = NULL;
+                options->num_auth_methods = 0;
+        }
+
 #ifndef HAVE_MMAP
         if (use_privsep && options->compression == 1) {
                 error("This platform does not support both privilege "
@@ -727,14 +735,15 @@ process_queued_listen_addrs(ServerOptions *options)
 struct connection_info *
 get_connection_info(int populate, int use_dns)
 {
+        struct ssh *ssh = active_state; /* XXX */
         static struct connection_info ci;
 
         if (!populate)
                 return &ci;
-        ci.host = get_canonical_hostname(use_dns);
-        ci.address = get_remote_ipaddr();
-        ci.laddress = get_local_ipaddr(packet_get_connection_in());
-        ci.lport = get_local_port();
+        ci.host = auth_get_canonical_hostname(ssh, use_dns);
+        ci.address = ssh_remote_ipaddr(ssh);
+        ci.laddress = ssh_local_ipaddr(ssh);
+        ci.lport = ssh_local_port(ssh);
         return &ci;
 }
 
@@ -1832,21 +1841,41 @@ process_server_config_line(ServerOptions *options, char *line,
 
         case sAuthenticationMethods:
                 if (options->num_auth_methods == 0) {
+                        value = 0; /* seen "any" pseudo-method */
+                        value2 = 0; /* sucessfully parsed any method */
                         while ((arg = strdelim(&cp)) && *arg != '\0') {
                                 if (options->num_auth_methods >=
                                     MAX_AUTH_METHODS)
                                         fatal("%s line %d: "
                                             "too many authentication methods.",
                                             filename, linenum);
-                                if (auth2_methods_valid(arg, 0) != 0)
+                                if (strcmp(arg, "any") == 0) {
+                                        if (options->num_auth_methods > 0) {
+                                                fatal("%s line %d: \"any\" "
+                                                    "must appear alone in "
+                                                    "AuthenticationMethods",
+                                                    filename, linenum);
+                                        }
+                                        value = 1;
+                                } else if (value) {
+                                        fatal("%s line %d: \"any\" must appear "
+                                            "alone in AuthenticationMethods",
+                                            filename, linenum);
+                                } else if (auth2_methods_valid(arg, 0) != 0) {
                                         fatal("%s line %d: invalid "
                                             "authentication method list.",
                                             filename, linenum);
+                                }
+                                value2 = 1;
                                 if (!*activep)
                                         continue;
                                 options->auth_methods[
                                     options->num_auth_methods++] = xstrdup(arg);
                         }
+                        if (value2 == 0) {
+                                fatal("%s line %d: no AuthenticationMethods "
+                                    "specified", filename, linenum);
+                        }
                 }
                 return 0;
 
@@ -2026,6 +2055,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
         M_CP_INTOPT(allow_agent_forwarding);
         M_CP_INTOPT(permit_tun);
         M_CP_INTOPT(fwd_opts.gateway_ports);
+        M_CP_INTOPT(fwd_opts.streamlocal_bind_unlink);
         M_CP_INTOPT(x11_display_offset);
         M_CP_INTOPT(x11_forwarding);
         M_CP_INTOPT(x11_use_localhost);
@@ -2038,6 +2068,16 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
         M_CP_INTOPT(rekey_limit);
         M_CP_INTOPT(rekey_interval);
 
+        /*
+         * The bind_mask is a mode_t that may be unsigned, so we can't use
+         * M_CP_INTOPT - it does a signed comparison that causes compiler
+         * warnings.
+         */
+        if (src->fwd_opts.streamlocal_bind_mask != (mode_t)-1) {
+                dst->fwd_opts.streamlocal_bind_mask =
+                    src->fwd_opts.streamlocal_bind_mask;
+        }
+
         /* M_CP_STROPT and M_CP_STRARRAYOPT should not appear before here */
 #define M_CP_STROPT(n) do {\
         if (src->n != NULL && dst->n != src->n) { \
@@ -2091,7 +2131,8 @@ parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
 
         debug2("%s: config %s len %d", __func__, filename, buffer_len(conf));
 
-        obuf = cbuf = xstrdup(buffer_ptr(conf));
+        if ((obuf = cbuf = sshbuf_dup_string(conf)) == NULL)
+                fatal("%s: sshbuf_dup_string failed", __func__);
         active = connectinfo ? 0 : 1;
         linenum = 1;
         while ((cp = strsep(&cbuf, "\n")) != NULL) {
@@ -2215,11 +2256,13 @@ dump_cfg_strarray_oneline(ServerOpCodes code, u_int count, char **vals)
 {
         u_int i;
 
-        if (count <= 0)
+        if (count <= 0 && code != sAuthenticationMethods)
                 return;
         printf("%s", lookup_opcode_name(code));
         for (i = 0; i < count; i++)
                 printf(" %s",  vals[i]);
+        if (code == sAuthenticationMethods && count == 0)
+                printf(" any");
         printf("\n");
 }
 
@@ -2327,6 +2370,7 @@ dump_config(ServerOptions *o)
         dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
         dump_cfg_fmtint(sAllowAgentForwarding, o->allow_agent_forwarding);
         dump_cfg_fmtint(sAllowStreamLocalForwarding, o->allow_streamlocal_forwarding);
+        dump_cfg_fmtint(sStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink);
         dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
         dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);