From d8cb1f184f9acaae02bb4d15ce1e00ffbeeeac88 Mon Sep 17 00:00:00 2001
From: Damien Miller <djm@mindrot.org>
Date: Sun, 10 Feb 2008 22:40:12 +1100
Subject:    - djm@cvs.openbsd.org 2008/02/08 23:24:07      [servconf.c
 servconf.h session.c sftp-server.c sftp.h sshd_config]      [sshd_config.5]  
    add sshd_config ChrootDirectory option to chroot(2) users to a directory  
    and tweak internal sftp server to work with it (no special files in     
 chroot required). ok markus@

---
 servconf.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'servconf.h')

diff --git a/servconf.h b/servconf.h
index 8a5b950ea..81a68be89 100644
--- a/servconf.h
+++ b/servconf.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.h,v 1.80 2007/02/19 10:45:58 dtucker Exp $ */
+/* $OpenBSD: servconf.h,v 1.81 2008/02/08 23:24:08 djm Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -141,6 +141,8 @@ typedef struct {
 	int	permit_tun;
 
 	int	num_permitted_opens;
+
+	char   *chroot_directory;
 }       ServerOptions;
 
 void	 initialize_server_options(ServerOptions *);
-- 
cgit v1.2.3


From 76e95daad1f38e0ba8e7bf0554cadd6e3aaf5235 Mon Sep 17 00:00:00 2001
From: Damien Miller <djm@mindrot.org>
Date: Fri, 7 Mar 2008 18:31:24 +1100
Subject:    - djm@cvs.openbsd.org 2008/02/13 22:38:17      [servconf.h
 session.c sshd.c]      rekey arc4random and OpenSSL RNG in postauth child    
  closefrom fds > 2 before shell/command execution      ok markus@

---
 ChangeLog  |  7 ++++++-
 servconf.h |  5 ++++-
 session.c  |  9 +++++----
 sshd.c     | 13 +++++++++++--
 4 files changed, 26 insertions(+), 8 deletions(-)

(limited to 'servconf.h')

diff --git a/ChangeLog b/ChangeLog
index 2c53b309f..341360d2b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,11 @@
      [ssh.1 sshd.8 sshd_config.5]
      bump Mdocdate for pages committed in "febuary", necessary because
      of a typo in rcs.c;
+   - djm@cvs.openbsd.org 2008/02/13 22:38:17
+     [servconf.h session.c sshd.c]
+     rekey arc4random and OpenSSL RNG in postauth child
+     closefrom fds > 2 before shell/command execution
+     ok markus@
 
 20080302
  - (dtucker) [configure.ac] FreeBSD's glob() doesn't behave the way we expect
@@ -3664,4 +3669,4 @@
    OpenServer 6 and add osr5bigcrypt support so when someone migrates
    passwords between UnixWare and OpenServer they will still work. OK dtucker@
 
-$Id: ChangeLog,v 1.4851 2008/03/07 07:27:58 djm Exp $
+$Id: ChangeLog,v 1.4852 2008/03/07 07:31:24 djm Exp $
diff --git a/servconf.h b/servconf.h
index 81a68be89..5b88067db 100644
--- a/servconf.h
+++ b/servconf.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.h,v 1.81 2008/02/08 23:24:08 djm Exp $ */
+/* $OpenBSD: servconf.h,v 1.82 2008/02/13 22:38:17 djm Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -36,6 +36,9 @@
 
 #define DEFAULT_AUTH_FAIL_MAX	6	/* Default for MaxAuthTries */
 
+/* Magic name for internal sftp-server */
+#define INTERNAL_SFTP_NAME	"internal-sftp"
+
 typedef struct {
 	u_int num_ports;
 	u_int ports_from_cmdline;
diff --git a/session.c b/session.c
index 545e27fb7..589a15a6d 100644
--- a/session.c
+++ b/session.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.c,v 1.227 2008/02/10 10:54:29 djm Exp $ */
+/* $OpenBSD: session.c,v 1.228 2008/02/13 22:38:17 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -94,9 +94,6 @@
 #include <kafs.h>
 #endif
 
-/* Magic name for internal sftp-server */
-#define INTERNAL_SFTP_NAME	"internal-sftp"
-
 /* func */
 
 Session *session_new(void);
@@ -491,6 +488,8 @@ do_exec_no_pty(Session *s, const char *command)
 		cray_init_job(s->pw); /* set up cray jid and tmpdir */
 #endif
 
+		closefrom(STDERR_FILENO + 1);
+
 		/* Do processing for the child (exec command etc). */
 		do_child(s, command);
 		/* NOTREACHED */
@@ -611,6 +610,8 @@ do_exec_pty(Session *s, const char *command)
 # endif
 #endif
 
+		closefrom(STDERR_FILENO + 1);
+
 		/* Do common processing for the child, such as execing the command. */
 		do_child(s, command);
 		/* NOTREACHED */
diff --git a/sshd.c b/sshd.c
index 345ee4315..2920b26cf 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.353 2007/12/31 15:27:04 dtucker Exp $ */
+/* $OpenBSD: sshd.c,v 1.354 2008/02/13 22:38:17 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -585,11 +585,12 @@ privsep_preauth_child(void)
 {
 	u_int32_t rnd[256];
 	gid_t gidset[1];
-	int i;
+	u_int i;
 
 	/* Enable challenge-response authentication for privilege separation */
 	privsep_challenge_enable();
 
+	arc4random_stir();
 	for (i = 0; i < 256; i++)
 		rnd[i] = arc4random();
 	RAND_seed(rnd, sizeof(rnd));
@@ -664,6 +665,9 @@ privsep_preauth(Authctxt *authctxt)
 static void
 privsep_postauth(Authctxt *authctxt)
 {
+	u_int32_t rnd[256];
+	u_int i;
+
 #ifdef DISABLE_FD_PASSING
 	if (1) {
 #else
@@ -695,6 +699,11 @@ privsep_postauth(Authctxt *authctxt)
 	/* Demote the private keys to public keys. */
 	demote_sensitive_data();
 
+	arc4random_stir();
+	for (i = 0; i < 256; i++)
+		rnd[i] = arc4random();
+	RAND_seed(rnd, sizeof(rnd));
+
 	/* Drop privileges */
 	do_setusercontext(authctxt->pw);
 
-- 
cgit v1.2.3


From 4f755cdc05f5c6dee7cb1894f8d3bcaee33443d0 Mon Sep 17 00:00:00 2001
From: Damien Miller <djm@mindrot.org>
Date: Mon, 19 May 2008 14:57:41 +1000
Subject:    - pyr@cvs.openbsd.org 2008/05/07 05:49:37      [servconf.c
 servconf.h session.c sshd_config.5]      Enable the AllowAgentForwarding
 option in sshd_config (global and match      context), to specify if agents
 should be permitted on the server.      As the man page states:      ``Note
 that disabling Agent forwarding does not improve security      unless users
 are also denied shell access, as they can always install      their own
 forwarders.''      ok djm@, ok and a mild frown markus@

---
 ChangeLog     | 11 ++++++++++-
 servconf.c    | 13 +++++++++++--
 servconf.h    |  3 ++-
 session.c     |  7 ++++---
 sshd_config.5 | 13 +++++++++++--
 5 files changed, 38 insertions(+), 9 deletions(-)

(limited to 'servconf.h')

diff --git a/ChangeLog b/ChangeLog
index b7e6098e5..8ee0b0e55 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -43,6 +43,15 @@
      [ssh-keyscan.1 ssh-keyscan.c]
      default to rsa (protocol 2) keys, instead of rsa1 keys; spotted by
      larsnooden AT openoffice.org
+   - pyr@cvs.openbsd.org 2008/05/07 05:49:37
+     [servconf.c servconf.h session.c sshd_config.5]
+     Enable the AllowAgentForwarding option in sshd_config (global and match
+     context), to specify if agents should be permitted on the server.
+     As the man page states:
+     ``Note that disabling Agent forwarding does not improve security
+     unless users are also denied shell access, as they can always install
+     their own forwarders.''
+     ok djm@, ok and a mild frown markus@
 
 20080403
  - (djm) [openbsd-compat/bsd-poll.c] Include stdlib.h to avoid compile-
@@ -3903,4 +3912,4 @@
    OpenServer 6 and add osr5bigcrypt support so when someone migrates
    passwords between UnixWare and OpenServer they will still work. OK dtucker@
 
-$Id: ChangeLog,v 1.4915 2008/05/19 04:56:33 djm Exp $
+$Id: ChangeLog,v 1.4916 2008/05/19 04:57:41 djm Exp $
diff --git a/servconf.c b/servconf.c
index 9add96ca1..e6d49099b 100644
--- a/servconf.c
+++ b/servconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.c,v 1.177 2008/02/10 10:54:28 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.178 2008/05/07 05:49:37 pyr Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -99,6 +99,7 @@ initialize_server_options(ServerOptions *options)
 	options->use_login = -1;
 	options->compression = -1;
 	options->allow_tcp_forwarding = -1;
+	options->allow_agent_forwarding = -1;
 	options->num_allow_users = 0;
 	options->num_deny_users = 0;
 	options->num_allow_groups = 0;
@@ -223,6 +224,8 @@ fill_default_server_options(ServerOptions *options)
 		options->compression = COMP_DELAYED;
 	if (options->allow_tcp_forwarding == -1)
 		options->allow_tcp_forwarding = 1;
+	if (options->allow_agent_forwarding == -1)
+		options->allow_agent_forwarding = 1;
 	if (options->gateway_ports == -1)
 		options->gateway_ports = 0;
 	if (options->max_startups == -1)
@@ -293,7 +296,7 @@ typedef enum {
 	sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
 	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
-	sUsePrivilegeSeparation,
+	sUsePrivilegeSeparation, sAllowAgentForwarding,
 	sDeprecated, sUnsupported
 } ServerOpCodes;
 
@@ -379,6 +382,7 @@ static struct {
 	{ "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL },
 	{ "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL },	/* obsolete alias */
 	{ "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
+	{ "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL },
 	{ "allowusers", sAllowUsers, SSHCFG_GLOBAL },
 	{ "denyusers", sDenyUsers, SSHCFG_GLOBAL },
 	{ "allowgroups", sAllowGroups, SSHCFG_GLOBAL },
@@ -1005,6 +1009,10 @@ parse_flag:
 		intptr = &options->allow_tcp_forwarding;
 		goto parse_flag;
 
+	case sAllowAgentForwarding:
+		intptr = &options->allow_agent_forwarding;
+		goto parse_flag;
+
 	case sUsePrivilegeSeparation:
 		intptr = &use_privsep;
 		goto parse_flag;
@@ -1368,6 +1376,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
 	M_CP_INTOPT(permit_root_login);
 
 	M_CP_INTOPT(allow_tcp_forwarding);
+	M_CP_INTOPT(allow_agent_forwarding);
 	M_CP_INTOPT(gateway_ports);
 	M_CP_INTOPT(x11_display_offset);
 	M_CP_INTOPT(x11_forwarding);
diff --git a/servconf.h b/servconf.h
index 5b88067db..aaf87cd18 100644
--- a/servconf.h
+++ b/servconf.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.h,v 1.82 2008/02/13 22:38:17 djm Exp $ */
+/* $OpenBSD: servconf.h,v 1.83 2008/05/07 05:49:37 pyr Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -101,6 +101,7 @@ typedef struct {
 	int     use_login;	/* If true, login(1) is used */
 	int     compression;	/* If true, compression is allowed */
 	int	allow_tcp_forwarding;
+	int	allow_agent_forwarding;
 	u_int num_allow_users;
 	char   *allow_users[MAX_ALLOW_USERS];
 	u_int num_deny_users;
diff --git a/session.c b/session.c
index f2bcfd061..16e455588 100644
--- a/session.c
+++ b/session.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.c,v 1.234 2008/04/18 22:01:33 djm Exp $ */
+/* $OpenBSD: session.c,v 1.235 2008/05/07 05:49:37 pyr Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -335,7 +335,8 @@ do_authenticated1(Authctxt *authctxt)
 			break;
 
 		case SSH_CMSG_AGENT_REQUEST_FORWARDING:
-			if (no_agent_forwarding_flag || compat13) {
+			if (!options.allow_agent_forwarding ||
+			    no_agent_forwarding_flag || compat13) {
 				debug("Authentication agent forwarding not permitted for this authentication.");
 				break;
 			}
@@ -2081,7 +2082,7 @@ session_auth_agent_req(Session *s)
 {
 	static int called = 0;
 	packet_check_eom();
-	if (no_agent_forwarding_flag) {
+	if (no_agent_forwarding_flag || !options.allow_agent_forwarding) {
 		debug("session_auth_agent_req: no_agent_forwarding_flag");
 		return 0;
 	}
diff --git a/sshd_config.5 b/sshd_config.5
index 6edaa9260..b93c801e3 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -34,8 +34,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd_config.5,v 1.87 2008/04/05 02:46:02 djm Exp $
-.Dd $Mdocdate: April 5 2008 $
+.\" $OpenBSD: sshd_config.5,v 1.88 2008/05/07 05:49:37 pyr Exp $
+.Dd $Mdocdate: May 7 2008 $
 .Dt SSHD_CONFIG 5
 .Os
 .Sh NAME
@@ -114,6 +114,15 @@ See
 in
 .Xr ssh_config 5
 for more information on patterns.
+.It Cm AllowAgentForwarding
+Specifies whether
+.Xr ssh-agent 1
+forwarding is permitted.
+The default is
+.Dq yes .
+Note that disabling Agent forwarding does not improve security
+unless users are also denied shell access, as they can always install
+their own forwarders.
 .It Cm AllowTcpForwarding
 Specifies whether TCP forwarding is permitted.
 The default is
-- 
cgit v1.2.3


From 7207f64a23a49a719aad3083c068f50e5034ccb8 Mon Sep 17 00:00:00 2001
From: Damien Miller <djm@mindrot.org>
Date: Mon, 19 May 2008 15:34:50 +1000
Subject:    - djm@cvs.openbsd.org 2008/05/08 12:21:16      [monitor.c
 monitor_wrap.c session.h servconf.c servconf.h session.c]      [sshd_config
 sshd_config.5]      Make the maximum number of sessions run-time controllable
 via      a sshd_config MaxSessions knob. This is useful for disabling     
 login/shell/subsystem access while leaving port-forwarding working     
 (MaxSessions 0), disabling connection multiplexing (MaxSessions 1) or     
 simply increasing the number of allows multiplexed sessions.      Because
 some bozos are sure to configure MaxSessions in excess of the      number of
 available file descriptors in sshd (which, at peak, might be      as many as
 9*MaxSessions), audit sshd to ensure that it doesn't leak fds      on error
 paths, and make it fail gracefully on out-of-fd conditions -      sending
 channel errors instead of than exiting with fatal().      bz#1090;
 MaxSessions config bits and manpage from junyer AT gmail.com      ok markus@

---
 ChangeLog      |  17 ++-
 monitor.c      |   4 +-
 monitor_wrap.c |  22 +++-
 servconf.c     |  21 +++-
 servconf.h     |   4 +-
 session.c      | 382 +++++++++++++++++++++++++++++++++++++++------------------
 session.h      |   4 +-
 sshd_config    |   3 +-
 sshd_config.5  |   7 +-
 9 files changed, 326 insertions(+), 138 deletions(-)

(limited to 'servconf.h')

diff --git a/ChangeLog b/ChangeLog
index 99dbdaf78..5ea4afcac 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -77,6 +77,21 @@
      shouldn't happen in compliant implementations, but it could be
      abused to leak memory.
      ok markus@ (as part of a larger diff)
+   - djm@cvs.openbsd.org 2008/05/08 12:21:16
+     [monitor.c monitor_wrap.c session.h servconf.c servconf.h session.c]
+     [sshd_config sshd_config.5]
+     Make the maximum number of sessions run-time controllable via
+     a sshd_config MaxSessions knob. This is useful for disabling
+     login/shell/subsystem access while leaving port-forwarding working
+     (MaxSessions 0), disabling connection multiplexing (MaxSessions 1) or
+     simply increasing the number of allows multiplexed sessions.
+     Because some bozos are sure to configure MaxSessions in excess of the
+     number of available file descriptors in sshd (which, at peak, might be
+     as many as 9*MaxSessions), audit sshd to ensure that it doesn't leak fds
+     on error paths, and make it fail gracefully on out-of-fd conditions -
+     sending channel errors instead of than exiting with fatal().
+     bz#1090; MaxSessions config bits and manpage from junyer AT gmail.com
+     ok markus@
 
 20080403
  - (djm) [openbsd-compat/bsd-poll.c] Include stdlib.h to avoid compile-
@@ -3937,4 +3952,4 @@
    OpenServer 6 and add osr5bigcrypt support so when someone migrates
    passwords between UnixWare and OpenServer they will still work. OK dtucker@
 
-$Id: ChangeLog,v 1.4922 2008/05/19 05:28:35 djm Exp $
+$Id: ChangeLog,v 1.4923 2008/05/19 05:34:50 djm Exp $
diff --git a/monitor.c b/monitor.c
index 04f6924b6..f872edbb5 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.95 2008/05/08 12:02:23 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.96 2008/05/08 12:21:16 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -1273,7 +1273,7 @@ mm_session_close(Session *s)
 		debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ptyfd);
 		session_pty_cleanup2(s);
 	}
-	s->used = 0;
+	session_unused(s->self);
 }
 
 int
diff --git a/monitor_wrap.c b/monitor_wrap.c
index 72fd5c83c..e65fb1279 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_wrap.c,v 1.61 2008/05/08 12:02:23 djm Exp $ */
+/* $OpenBSD: monitor_wrap.c,v 1.62 2008/05/08 12:21:16 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -666,7 +666,20 @@ mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, size_t namebuflen)
 {
 	Buffer m;
 	char *p, *msg;
-	int success = 0;
+	int success = 0, tmp1 = -1, tmp2 = -1;
+
+	/* Kludge: ensure there are fds free to receive the pty/tty */
+	if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 ||
+	    (tmp2 = dup(pmonitor->m_recvfd)) == -1) {
+		error("%s: cannot allocate fds for pty", __func__);
+		if (tmp1 > 0)
+			close(tmp1);
+		if (tmp2 > 0)
+			close(tmp2);
+		return 0;
+	}
+	close(tmp1);
+	close(tmp2);
 
 	buffer_init(&m);
 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTY, &m);
@@ -711,8 +724,9 @@ mm_session_pty_cleanup2(Session *s)
 	buffer_free(&m);
 
 	/* closed dup'ed master */
-	if (close(s->ptymaster) < 0)
-		error("close(s->ptymaster): %s", strerror(errno));
+	if (s->ptymaster != -1 && close(s->ptymaster) < 0)
+		error("close(s->ptymaster/%d): %s",
+		    s->ptymaster, strerror(errno));
 
 	/* unlink pty from session */
 	s->ttyfd = -1;
diff --git a/servconf.c b/servconf.c
index b8a968aa3..94dff1fd6 100644
--- a/servconf.c
+++ b/servconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.c,v 1.179 2008/05/08 12:02:23 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.180 2008/05/08 12:21:16 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -114,6 +114,7 @@ initialize_server_options(ServerOptions *options)
 	options->max_startups_rate = -1;
 	options->max_startups = -1;
 	options->max_authtries = -1;
+	options->max_sessions = -1;
 	options->banner = NULL;
 	options->use_dns = -1;
 	options->client_alive_interval = -1;
@@ -237,6 +238,8 @@ fill_default_server_options(ServerOptions *options)
 		options->max_startups_begin = options->max_startups;
 	if (options->max_authtries == -1)
 		options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
+	if (options->max_sessions == -1)
+		options->max_sessions = DEFAULT_SESSIONS_MAX;
 	if (options->use_dns == -1)
 		options->use_dns = 1;
 	if (options->client_alive_interval == -1)
@@ -291,7 +294,7 @@ typedef enum {
 	sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
 	sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
 	sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
-	sMaxStartups, sMaxAuthTries,
+	sMaxStartups, sMaxAuthTries, sMaxSessions,
 	sBanner, sUseDNS, sHostbasedAuthentication,
 	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
 	sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
@@ -395,6 +398,7 @@ static struct {
 	{ "subsystem", sSubsystem, SSHCFG_GLOBAL },
 	{ "maxstartups", sMaxStartups, SSHCFG_GLOBAL },
 	{ "maxauthtries", sMaxAuthTries, SSHCFG_GLOBAL },
+	{ "maxsessions", sMaxSessions, SSHCFG_ALL },
 	{ "banner", sBanner, SSHCFG_ALL },
 	{ "usedns", sUseDNS, SSHCFG_GLOBAL },
 	{ "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
@@ -695,7 +699,7 @@ process_server_config_line(ServerOptions *options, char *line,
 
 	case sServerKeyBits:
 		intptr = &options->server_key_bits;
-parse_int:
+ parse_int:
 		arg = strdelim(&cp);
 		if (!arg || *arg == '\0')
 			fatal("%s line %d: missing integer value.",
@@ -707,7 +711,7 @@ parse_int:
 
 	case sLoginGraceTime:
 		intptr = &options->login_grace_time;
-parse_time:
+ parse_time:
 		arg = strdelim(&cp);
 		if (!arg || *arg == '\0')
 			fatal("%s line %d: missing time value.",
@@ -776,7 +780,7 @@ parse_time:
 			fatal("%s line %d: too many host keys specified (max %d).",
 			    filename, linenum, MAX_HOSTKEYS);
 		charptr = &options->host_key_files[*intptr];
-parse_filename:
+ parse_filename:
 		arg = strdelim(&cp);
 		if (!arg || *arg == '\0')
 			fatal("%s line %d: missing file name.",
@@ -819,7 +823,7 @@ parse_filename:
 
 	case sIgnoreRhosts:
 		intptr = &options->ignore_rhosts;
-parse_flag:
+ parse_flag:
 		arg = strdelim(&cp);
 		if (!arg || *arg == '\0')
 			fatal("%s line %d: missing yes/no argument.",
@@ -1155,6 +1159,10 @@ parse_flag:
 		intptr = &options->max_authtries;
 		goto parse_int;
 
+	case sMaxSessions:
+		intptr = &options->max_sessions;
+		goto parse_int;
+
 	case sBanner:
 		charptr = &options->banner;
 		goto parse_filename;
@@ -1382,6 +1390,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
 	M_CP_INTOPT(x11_display_offset);
 	M_CP_INTOPT(x11_forwarding);
 	M_CP_INTOPT(x11_use_localhost);
+	M_CP_INTOPT(max_sessions);
 
 	M_CP_STROPT(banner);
 	if (preauth)
diff --git a/servconf.h b/servconf.h
index aaf87cd18..819a028c8 100644
--- a/servconf.h
+++ b/servconf.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.h,v 1.83 2008/05/07 05:49:37 pyr Exp $ */
+/* $OpenBSD: servconf.h,v 1.84 2008/05/08 12:21:16 djm Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -35,6 +35,7 @@
 #define	PERMIT_YES		3
 
 #define DEFAULT_AUTH_FAIL_MAX	6	/* Default for MaxAuthTries */
+#define DEFAULT_SESSIONS_MAX	10	/* Default for MaxSessions */
 
 /* Magic name for internal sftp-server */
 #define INTERNAL_SFTP_NAME	"internal-sftp"
@@ -123,6 +124,7 @@ typedef struct {
 	int	max_startups_rate;
 	int	max_startups;
 	int	max_authtries;
+	int	max_sessions;
 	char   *banner;			/* SSH-2 banner message */
 	int	use_dns;
 	int	client_alive_interval;	/*
diff --git a/session.c b/session.c
index ca04a4532..c8ed25234 100644
--- a/session.c
+++ b/session.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.c,v 1.236 2008/05/08 12:02:23 djm Exp $ */
+/* $OpenBSD: session.c,v 1.237 2008/05/08 12:21:16 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -102,9 +102,9 @@ void	session_set_fds(Session *, int, int, int);
 void	session_pty_cleanup(Session *);
 void	session_proctitle(Session *);
 int	session_setup_x11fwd(Session *);
-void	do_exec_pty(Session *, const char *);
-void	do_exec_no_pty(Session *, const char *);
-void	do_exec(Session *, const char *);
+int	do_exec_pty(Session *, const char *);
+int	do_exec_no_pty(Session *, const char *);
+int	do_exec(Session *, const char *);
 void	do_login(Session *, const char *);
 #ifdef LOGIN_NEEDS_UTMPX
 static void	do_pre_login(Session *s);
@@ -132,8 +132,9 @@ extern Buffer loginmsg;
 const char *original_command = NULL;
 
 /* data */
-#define MAX_SESSIONS 20
-Session	sessions[MAX_SESSIONS];
+static int sessions_first_unused = -1;
+static int sessions_nalloc = 0;
+static Session *sessions = NULL;
 
 #define SUBSYSTEM_NONE		0
 #define SUBSYSTEM_EXT		1
@@ -167,7 +168,7 @@ static int
 auth_input_request_forwarding(struct passwd * pw)
 {
 	Channel *nc;
-	int sock;
+	int sock = -1;
 	struct sockaddr_un sunaddr;
 
 	if (auth_sock_name != NULL) {
@@ -179,43 +180,48 @@ auth_input_request_forwarding(struct passwd * pw)
 	temporarily_use_uid(pw);
 
 	/* Allocate a buffer for the socket name, and format the name. */
-	auth_sock_name = xmalloc(MAXPATHLEN);
-	auth_sock_dir = xmalloc(MAXPATHLEN);
-	strlcpy(auth_sock_dir, "/tmp/ssh-XXXXXXXXXX", MAXPATHLEN);
+	auth_sock_dir = xstrdup("/tmp/ssh-XXXXXXXXXX");
 
 	/* Create private directory for socket */
 	if (mkdtemp(auth_sock_dir) == NULL) {
 		packet_send_debug("Agent forwarding disabled: "
 		    "mkdtemp() failed: %.100s", strerror(errno));
 		restore_uid();
-		xfree(auth_sock_name);
 		xfree(auth_sock_dir);
-		auth_sock_name = NULL;
 		auth_sock_dir = NULL;
-		return 0;
+		goto authsock_err;
 	}
-	snprintf(auth_sock_name, MAXPATHLEN, "%s/agent.%ld",
-		 auth_sock_dir, (long) getpid());
+
+	xasprintf(&auth_sock_name, "%s/agent.%ld",
+	    auth_sock_dir, (long) getpid());
 
 	/* Create the socket. */
 	sock = socket(AF_UNIX, SOCK_STREAM, 0);
-	if (sock < 0)
-		packet_disconnect("socket: %.100s", strerror(errno));
+	if (sock < 0) {
+		error("socket: %.100s", strerror(errno));
+		restore_uid();
+		goto authsock_err;
+	}
 
 	/* Bind it to the name. */
 	memset(&sunaddr, 0, sizeof(sunaddr));
 	sunaddr.sun_family = AF_UNIX;
 	strlcpy(sunaddr.sun_path, auth_sock_name, sizeof(sunaddr.sun_path));
 
-	if (bind(sock, (struct sockaddr *)&sunaddr, sizeof(sunaddr)) < 0)
-		packet_disconnect("bind: %.100s", strerror(errno));
+	if (bind(sock, (struct sockaddr *)&sunaddr, sizeof(sunaddr)) < 0) {
+		error("bind: %.100s", strerror(errno));
+		restore_uid();
+		goto authsock_err;
+	}
 
 	/* Restore the privileged uid. */
 	restore_uid();
 
 	/* Start listening on the socket. */
-	if (listen(sock, SSH_LISTEN_BACKLOG) < 0)
-		packet_disconnect("listen: %.100s", strerror(errno));
+	if (listen(sock, SSH_LISTEN_BACKLOG) < 0) {
+		error("listen: %.100s", strerror(errno));
+		goto authsock_err;
+	}
 
 	/* Allocate a channel for the authentication agent socket. */
 	nc = channel_new("auth socket",
@@ -224,6 +230,19 @@ auth_input_request_forwarding(struct passwd * pw)
 	    0, "auth socket", 1);
 	strlcpy(nc->path, auth_sock_name, sizeof(nc->path));
 	return 1;
+
+ authsock_err:
+	if (auth_sock_name != NULL)
+		xfree(auth_sock_name);
+	if (auth_sock_dir != NULL) {
+		rmdir(auth_sock_dir);
+		xfree(auth_sock_dir);
+	}
+	if (sock != -1)
+		close(sock);
+	auth_sock_name = NULL;
+	auth_sock_dir = NULL;
+	return 0;
 }
 
 static void
@@ -373,10 +392,14 @@ do_authenticated1(Authctxt *authctxt)
 			if (type == SSH_CMSG_EXEC_CMD) {
 				command = packet_get_string(&dlen);
 				debug("Exec command '%.500s'", command);
-				do_exec(s, command);
+				if (do_exec(s, command) != 0)
+					packet_disconnect(
+					    "command execution failed");
 				xfree(command);
 			} else {
-				do_exec(s, NULL);
+				if (do_exec(s, NULL) != 0)
+					packet_disconnect(
+					    "shell execution failed");
 			}
 			packet_check_eom();
 			session_close(s);
@@ -401,41 +424,84 @@ do_authenticated1(Authctxt *authctxt)
 	}
 }
 
+#define USE_PIPES
 /*
  * This is called to fork and execute a command when we have no tty.  This
  * will call do_child from the child, and server_loop from the parent after
  * setting up file descriptors and such.
  */
-void
+int
 do_exec_no_pty(Session *s, const char *command)
 {
 	pid_t pid;
 
 #ifdef USE_PIPES
 	int pin[2], pout[2], perr[2];
+
 	/* Allocate pipes for communicating with the program. */
-	if (pipe(pin) < 0 || pipe(pout) < 0 || pipe(perr) < 0)
-		packet_disconnect("Could not create pipes: %.100s",
-				  strerror(errno));
-#else /* USE_PIPES */
+	if (pipe(pin) < 0) {
+		error("%s: pipe in: %.100s", __func__, strerror(errno));
+		return -1;
+	}
+	if (pipe(pout) < 0) {
+		error("%s: pipe out: %.100s", __func__, strerror(errno));
+		close(pin[0]);
+		close(pin[1]);
+		return -1;
+	}
+	if (pipe(perr) < 0) {
+		error("%s: pipe err: %.100s", __func__, strerror(errno));
+		close(pin[0]);
+		close(pin[1]);
+		close(pout[0]);
+		close(pout[1]);
+		return -1;
+	}
+#else
 	int inout[2], err[2];
+
 	/* Uses socket pairs to communicate with the program. */
-	if (socketpair(AF_UNIX, SOCK_STREAM, 0, inout) < 0 ||
-	    socketpair(AF_UNIX, SOCK_STREAM, 0, err) < 0)
-		packet_disconnect("Could not create socket pairs: %.100s",
-				  strerror(errno));
-#endif /* USE_PIPES */
+	if (socketpair(AF_UNIX, SOCK_STREAM, 0, inout) < 0) {
+		error("%s: socketpair #1: %.100s", __func__, strerror(errno));
+		return -1;
+	}
+	if (socketpair(AF_UNIX, SOCK_STREAM, 0, err) < 0) {
+		error("%s: socketpair #2: %.100s", __func__, strerror(errno));
+		close(inout[0]);
+		close(inout[1]);
+		return -1;
+	}
+#endif
+
 	if (s == NULL)
 		fatal("do_exec_no_pty: no session");
 
 	session_proctitle(s);
 
 	/* Fork the child. */
-	if ((pid = fork()) == 0) {
+	switch ((pid = fork())) {
+	case -1:
+		error("%s: fork: %.100s", __func__, strerror(errno));
+#ifdef USE_PIPES
+		close(pin[0]);
+		close(pin[1]);
+		close(pout[0]);
+		close(pout[1]);
+		close(perr[0]);
+		close(perr[1]);
+#else
+		close(inout[0]);
+		close(inout[1]);
+		close(err[0]);
+		close(err[1]);
+#endif
+		return -1;
+	case 0:
 		is_child = 1;
 
 		/* Child.  Reinitialize the log since the pid has changed. */
-		log_init(__progname, options.log_level, options.log_facility, log_stderr);
+		log_init(__progname, options.log_level,
+		    options.log_facility, log_stderr);
 
 		/*
 		 * Create a new session and process group since the 4.4BSD
@@ -465,7 +531,7 @@ do_exec_no_pty(Session *s, const char *command)
 		if (dup2(perr[1], 2) < 0)
 			perror("dup2 stderr");
 		close(perr[1]);
-#else /* USE_PIPES */
+#else
 		/*
 		 * Redirect stdin, stdout, and stderr.  Stdin and stdout will
 		 * use the same socket, as some programs (particularly rdist)
@@ -475,11 +541,14 @@ do_exec_no_pty(Session *s, const char *command)
 		close(err[1]);
 		if (dup2(inout[0], 0) < 0)	/* stdin */
 			perror("dup2 stdin");
-		if (dup2(inout[0], 1) < 0)	/* stdout.  Note: same socket as stdin. */
+		if (dup2(inout[0], 1) < 0)	/* stdout (same as stdin) */
 			perror("dup2 stdout");
+		close(inout[0]);
 		if (dup2(err[0], 2) < 0)	/* stderr */
 			perror("dup2 stderr");
-#endif /* USE_PIPES */
+		close(err[0]);
+#endif
+
 
 #ifdef _UNICOS
 		cray_init_job(s->pw); /* set up cray jid and tmpdir */
@@ -488,7 +557,10 @@ do_exec_no_pty(Session *s, const char *command)
 		/* Do processing for the child (exec command etc). */
 		do_child(s, command);
 		/* NOTREACHED */
+	default:
+		break;
 	}
+
 #ifdef _UNICOS
 	signal(WJSIGNAL, cray_job_termination_handler);
 #endif /* _UNICOS */
@@ -496,11 +568,18 @@ do_exec_no_pty(Session *s, const char *command)
 	if (is_winnt)
 		cygwin_set_impersonation_token(INVALID_HANDLE_VALUE);
 #endif
-	if (pid < 0)
-		packet_disconnect("fork failed: %.100s", strerror(errno));
+
 	s->pid = pid;
 	/* Set interactive/non-interactive mode. */
 	packet_set_interactive(s->display != NULL);
+
+	/*
+	 * Clear loginmsg, since it's the child's responsibility to display
+	 * it to the user, otherwise multiple sessions may accumulate
+	 * multiple copies of the login messages.
+	 */
+	buffer_clear(&loginmsg);
+
 #ifdef USE_PIPES
 	/* We are the parent.  Close the child sides of the pipes. */
 	close(pin[0]);
@@ -518,29 +597,26 @@ do_exec_no_pty(Session *s, const char *command)
 		server_loop(pid, pin[1], pout[0], perr[0]);
 		/* server_loop has closed pin[1], pout[0], and perr[0]. */
 	}
-#else /* USE_PIPES */
+#else
 	/* We are the parent.  Close the child sides of the socket pairs. */
 	close(inout[0]);
 	close(err[0]);
 
-	/*
-	 * Clear loginmsg, since it's the child's responsibility to display
-	 * it to the user, otherwise multiple sessions may accumulate
-	 * multiple copies of the login messages.
-	 */
-	buffer_clear(&loginmsg);
-
 	/*
 	 * Enter the interactive session.  Note: server_loop must be able to
 	 * handle the case that fdin and fdout are the same.
 	 */
 	if (compat20) {
-		session_set_fds(s, inout[1], inout[1], s->is_subsystem ? -1 : err[1]);
+		session_set_fds(s, inout[1], inout[1],
+		    s->is_subsystem ? -1 : err[1]);
+		if (s->is_subsystem)
+			close(err[1]);
 	} else {
 		server_loop(pid, inout[1], inout[1], err[1]);
 		/* server_loop has closed inout[1] and err[1]. */
 	}
-#endif /* USE_PIPES */
+#endif
+	return 0;
 }
 
 /*
@@ -549,7 +625,7 @@ do_exec_no_pty(Session *s, const char *command)
  * setting up file descriptors, controlling tty, updating wtmp, utmp,
  * lastlog, and other such operations.
  */
-void
+int
 do_exec_pty(Session *s, const char *command)
 {
 	int fdout, ptyfd, ttyfd, ptymaster;
@@ -560,12 +636,46 @@ do_exec_pty(Session *s, const char *command)
 	ptyfd = s->ptyfd;
 	ttyfd = s->ttyfd;
 
+	/*
+	 * Create another descriptor of the pty master side for use as the
+	 * standard input.  We could use the original descriptor, but this
+	 * simplifies code in server_loop.  The descriptor is bidirectional.
+	 * Do this before forking (and cleanup in the child) so as to
+	 * detect and gracefully fail out-of-fd conditions.
+	 */
+	if ((fdout = dup(ptyfd)) < 0) {
+		error("%s: dup #1: %s", __func__, strerror(errno));
+		close(ttyfd);
+		close(ptyfd);
+		return -1;
+	}
+	/* we keep a reference to the pty master */
+	if ((ptymaster = dup(ptyfd)) < 0) {
+		error("%s: dup #2: %s", __func__, strerror(errno));
+		close(ttyfd);
+		close(ptyfd);
+		close(fdout);
+		return -1;
+	}
+
 	/* Fork the child. */
-	if ((pid = fork()) == 0) {
+	switch ((pid = fork())) {
+	case -1:
+		error("%s: fork: %.100s", __func__, strerror(errno));
+		close(fdout);
+		close(ptymaster);
+		close(ttyfd);
+		close(ptyfd);
+		return -1;
+	case 0:
 		is_child = 1;
 
+		close(fdout);
+		close(ptymaster);
+
 		/* Child.  Reinitialize the log because the pid has changed. */
-		log_init(__progname, options.log_level, options.log_facility, log_stderr);
+		log_init(__progname, options.log_level,
+		    options.log_facility, log_stderr);
 		/* Close the master side of the pseudo tty. */
 		close(ptyfd);
 
@@ -596,11 +706,16 @@ do_exec_pty(Session *s, const char *command)
 			do_pre_login(s);
 # endif
 #endif
-
-		/* Do common processing for the child, such as execing the command. */
-		do_child(s, command);
-		/* NOTREACHED */
+		/*
+		 * Do common processing for the child, such as execing
+		 * the command.
+		 */
+ 		do_child(s, command);
+ 		/* NOTREACHED */
+	default:
+		break;
 	}
+
 #ifdef _UNICOS
 	signal(WJSIGNAL, cray_job_termination_handler);
 #endif /* _UNICOS */
@@ -608,29 +723,14 @@ do_exec_pty(Session *s, const char *command)
 	if (is_winnt)
 		cygwin_set_impersonation_token(INVALID_HANDLE_VALUE);
 #endif
-	if (pid < 0)
-		packet_disconnect("fork failed: %.100s", strerror(errno));
+
 	s->pid = pid;
 
 	/* Parent.  Close the slave side of the pseudo tty. */
 	close(ttyfd);
 
-	/*
-	 * Create another descriptor of the pty master side for use as the
-	 * standard input.  We could use the original descriptor, but this
-	 * simplifies code in server_loop.  The descriptor is bidirectional.
-	 */
-	fdout = dup(ptyfd);
-	if (fdout < 0)
-		packet_disconnect("dup #1 failed: %.100s", strerror(errno));
-
-	/* we keep a reference to the pty master */
-	ptymaster = dup(ptyfd);
-	if (ptymaster < 0)
-		packet_disconnect("dup #2 failed: %.100s", strerror(errno));
-	s->ptymaster = ptymaster;
-
 	/* Enter interactive session. */
+	s->ptymaster = ptymaster;
 	packet_set_interactive(1);
 	if (compat20) {
 		session_set_fds(s, ptyfd, fdout, -1);
@@ -638,6 +738,7 @@ do_exec_pty(Session *s, const char *command)
 		server_loop(pid, ptyfd, fdout, -1);
 		/* server_loop _has_ closed ptyfd and fdout. */
 	}
+	return 0;
 }
 
 #ifdef LOGIN_NEEDS_UTMPX
@@ -672,9 +773,11 @@ do_pre_login(Session *s)
  * This is called to fork and execute a command.  If another command is
  * to be forced, execute that instead.
  */
-void
+int
 do_exec(Session *s, const char *command)
 {
+	int ret;
+
 	if (options.adm_forced_command) {
 		original_command = command;
 		command = options.adm_forced_command;
@@ -705,9 +808,9 @@ do_exec(Session *s, const char *command)
 	}
 #endif
 	if (s->ttyfd != -1)
-		do_exec_pty(s, command);
+		ret = do_exec_pty(s, command);
 	else
-		do_exec_no_pty(s, command);
+		ret = do_exec_no_pty(s, command);
 
 	original_command = NULL;
 
@@ -717,6 +820,8 @@ do_exec(Session *s, const char *command)
 	 * multiple copies of the login messages.
 	 */
 	buffer_clear(&loginmsg);
+
+	return ret;
 }
 
 /* administrative, login(1)-like work */
@@ -1740,43 +1845,79 @@ do_child(Session *s, const char *command)
 	exit(1);
 }
 
+void
+session_unused(int id)
+{
+	debug3("%s: session id %d unused", __func__, id);
+	if (id >= options.max_sessions ||
+	    id >= sessions_nalloc) {
+		fatal("%s: insane session id %d (max %d nalloc %d)",
+		    __func__, id, options.max_sessions, sessions_nalloc);
+	}
+	bzero(&sessions[id], sizeof(*sessions));
+	sessions[id].self = id;
+	sessions[id].used = 0;
+	sessions[id].chanid = -1;
+	sessions[id].ptyfd = -1;
+	sessions[id].ttyfd = -1;
+	sessions[id].ptymaster = -1;
+	sessions[id].x11_chanids = NULL;
+	sessions[id].next_unused = sessions_first_unused;
+	sessions_first_unused = id;
+}
+
 Session *
 session_new(void)
 {
-	int i;
-	static int did_init = 0;
-	if (!did_init) {
-		debug("session_new: init");
-		for (i = 0; i < MAX_SESSIONS; i++) {
-			sessions[i].used = 0;
+	Session *s, *tmp;
+
+	if (sessions_first_unused == -1) {
+		if (sessions_nalloc >= options.max_sessions)
+			return NULL;
+		debug2("%s: allocate (allocated %d max %d)",
+		    __func__, sessions_nalloc, options.max_sessions);
+		tmp = xrealloc(sessions, sessions_nalloc + 1,
+		    sizeof(*sessions));
+		if (tmp == NULL) {
+			error("%s: cannot allocate %d sessions",
+			    __func__, sessions_nalloc + 1);
+			return NULL;
 		}
-		did_init = 1;
+		sessions = tmp;
+		session_unused(sessions_nalloc++);
 	}
-	for (i = 0; i < MAX_SESSIONS; i++) {
-		Session *s = &sessions[i];
-		if (! s->used) {
-			memset(s, 0, sizeof(*s));
-			s->chanid = -1;
-			s->ptyfd = -1;
-			s->ttyfd = -1;
-			s->used = 1;
-			s->self = i;
-			s->x11_chanids = NULL;
-			debug("session_new: session %d", i);
-			return s;
-		}
+
+	if (sessions_first_unused >= sessions_nalloc ||
+	    sessions_first_unused < 0) {
+		fatal("%s: insane first_unused %d max %d nalloc %d",
+		    __func__, sessions_first_unused, options.max_sessions,
+		    sessions_nalloc);
 	}
-	return NULL;
+
+	s = &sessions[sessions_first_unused];
+	if (s->used) {
+		fatal("%s: session %d already used",
+		    __func__, sessions_first_unused);
+	}
+	sessions_first_unused = s->next_unused;
+	s->used = 1;
+	s->next_unused = -1;
+	debug("session_new: session %d", s->self);
+
+	return s;
 }
 
 static void
 session_dump(void)
 {
 	int i;
-	for (i = 0; i < MAX_SESSIONS; i++) {
+	for (i = 0; i < sessions_nalloc; i++) {
 		Session *s = &sessions[i];
-		debug("dump: used %d session %d %p channel %d pid %ld",
+
+		debug("dump: used %d next_unused %d session %d %p "
+		    "channel %d pid %ld",
 		    s->used,
+		    s->next_unused,
 		    s->self,
 		    s,
 		    s->chanid,
@@ -1806,7 +1947,7 @@ Session *
 session_by_tty(char *tty)
 {
 	int i;
-	for (i = 0; i < MAX_SESSIONS; i++) {
+	for (i = 0; i < sessions_nalloc; i++) {
 		Session *s = &sessions[i];
 		if (s->used && s->ttyfd != -1 && strcmp(s->tty, tty) == 0) {
 			debug("session_by_tty: session %d tty %s", i, tty);
@@ -1822,10 +1963,11 @@ static Session *
 session_by_channel(int id)
 {
 	int i;
-	for (i = 0; i < MAX_SESSIONS; i++) {
+	for (i = 0; i < sessions_nalloc; i++) {
 		Session *s = &sessions[i];
 		if (s->used && s->chanid == id) {
-			debug("session_by_channel: session %d channel %d", i, id);
+			debug("session_by_channel: session %d channel %d",
+			    i, id);
 			return s;
 		}
 	}
@@ -1839,7 +1981,7 @@ session_by_x11_channel(int id)
 {
 	int i, j;
 
-	for (i = 0; i < MAX_SESSIONS; i++) {
+	for (i = 0; i < sessions_nalloc; i++) {
 		Session *s = &sessions[i];
 
 		if (s->x11_chanids == NULL || !s->used)
@@ -1862,7 +2004,7 @@ session_by_pid(pid_t pid)
 {
 	int i;
 	debug("session_by_pid: pid %ld", (long)pid);
-	for (i = 0; i < MAX_SESSIONS; i++) {
+	for (i = 0; i < sessions_nalloc; i++) {
 		Session *s = &sessions[i];
 		if (s->used && s->pid == pid)
 			return s;
@@ -1918,7 +2060,8 @@ session_pty_req(Session *s)
 
 	/* Allocate a pty and open it. */
 	debug("Allocating pty.");
-	if (!PRIVSEP(pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty)))) {
+	if (!PRIVSEP(pty_allocate(&s->ptyfd, &s->ttyfd, s->tty,
+	    sizeof(s->tty)))) {
 		if (s->term)
 			xfree(s->term);
 		s->term = NULL;
@@ -1971,8 +2114,7 @@ session_subsystem_req(Session *s)
 				s->is_subsystem = SUBSYSTEM_EXT;
 			}
 			debug("subsystem: exec() %s", cmd);
-			do_exec(s, cmd);
-			success = 1;
+			success = do_exec(s, cmd) == 0;
 			break;
 		}
 	}
@@ -2015,19 +2157,19 @@ static int
 session_shell_req(Session *s)
 {
 	packet_check_eom();
-	do_exec(s, NULL);
-	return 1;
+	return do_exec(s, NULL) == 0;
 }
 
 static int
 session_exec_req(Session *s)
 {
-	u_int len;
+	u_int len, success;
+
 	char *command = packet_get_string(&len);
 	packet_check_eom();
-	do_exec(s, command);
+	success = do_exec(s, command) == 0;
 	xfree(command);
-	return 1;
+	return success;
 }
 
 static int
@@ -2037,8 +2179,7 @@ session_break_req(Session *s)
 	packet_get_int();	/* ignored */
 	packet_check_eom();
 
-	if (s->ttyfd == -1 ||
-	    tcsendbreak(s->ttyfd, 0) < 0)
+	if (s->ttyfd == -1 || tcsendbreak(s->ttyfd, 0) < 0)
 		return 0;
 	return 1;
 }
@@ -2185,8 +2326,9 @@ session_pty_cleanup2(Session *s)
 	 * the pty cleanup, so that another process doesn't get this pty
 	 * while we're still cleaning up.
 	 */
-	if (close(s->ptymaster) < 0)
-		error("close(s->ptymaster/%d): %s", s->ptymaster, strerror(errno));
+	if (s->ptymaster != -1 && close(s->ptymaster) < 0)
+		error("close(s->ptymaster/%d): %s",
+		    s->ptymaster, strerror(errno));
 
 	/* unlink pty from session */
 	s->ttyfd = -1;
@@ -2346,7 +2488,6 @@ session_close(Session *s)
 		xfree(s->auth_data);
 	if (s->auth_proto)
 		xfree(s->auth_proto);
-	s->used = 0;
 	if (s->env != NULL) {
 		for (i = 0; i < s->num_env; i++) {
 			xfree(s->env[i].name);
@@ -2355,6 +2496,7 @@ session_close(Session *s)
 		xfree(s->env);
 	}
 	session_proctitle(s);
+	session_unused(s->self);
 }
 
 void
@@ -2418,7 +2560,7 @@ void
 session_destroy_all(void (*closefunc)(Session *))
 {
 	int i;
-	for (i = 0; i < MAX_SESSIONS; i++) {
+	for (i = 0; i < sessions_nalloc; i++) {
 		Session *s = &sessions[i];
 		if (s->used) {
 			if (closefunc != NULL)
@@ -2437,7 +2579,7 @@ session_tty_list(void)
 	char *cp;
 
 	buf[0] = '\0';
-	for (i = 0; i < MAX_SESSIONS; i++) {
+	for (i = 0; i < sessions_nalloc; i++) {
 		Session *s = &sessions[i];
 		if (s->used && s->ttyfd != -1) {
 
diff --git a/session.h b/session.h
index ee9338e4f..cbb8e3a32 100644
--- a/session.h
+++ b/session.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.h,v 1.29 2006/08/03 03:34:42 deraadt Exp $ */
+/* $OpenBSD: session.h,v 1.30 2008/05/08 12:21:16 djm Exp $ */
 
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -31,6 +31,7 @@ typedef struct Session Session;
 struct Session {
 	int	used;
 	int	self;
+	int	next_unused;
 	struct passwd *pw;
 	Authctxt *authctxt;
 	pid_t	pid;
@@ -65,6 +66,7 @@ void	 do_authenticated(Authctxt *);
 void	 do_cleanup(Authctxt *);
 
 int	 session_open(Authctxt *, int);
+void	 session_unused(int);
 int	 session_input_channel_req(Channel *, const char *);
 void	 session_close_by_pid(pid_t, int);
 void	 session_close_by_channel(int, void *);
diff --git a/sshd_config b/sshd_config
index 1f97a9dcc..c5ee7c8a4 100644
--- a/sshd_config
+++ b/sshd_config
@@ -1,4 +1,4 @@
-#	$OpenBSD: sshd_config,v 1.78 2008/05/07 06:43:35 pyr Exp $
+#	$OpenBSD: sshd_config,v 1.79 2008/05/08 12:21:16 djm Exp $
 
 # This is the sshd server system-wide configuration file.  See
 # sshd_config(5) for more information.
@@ -41,6 +41,7 @@ Protocol 2
 #PermitRootLogin yes
 #StrictModes yes
 #MaxAuthTries 6
+#MaxSessions 10
 
 #RSAAuthentication yes
 #PubkeyAuthentication yes
diff --git a/sshd_config.5 b/sshd_config.5
index 99b5621e7..0d8c140bf 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -34,8 +34,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd_config.5,v 1.89 2008/05/07 08:00:14 jmc Exp $
-.Dd $Mdocdate: May 19 2008 $
+.\" $OpenBSD: sshd_config.5,v 1.90 2008/05/08 12:21:16 djm Exp $
+.Dd $Mdocdate: May 8 2008 $
 .Dt SSHD_CONFIG 5
 .Os
 .Sh NAME
@@ -594,6 +594,9 @@ connection.
 Once the number of failures reaches half this value,
 additional failures are logged.
 The default is 6.
+.It Cm MaxSessions
+Specifies the maximum number of open sessions permitted per network connection.
+The default is 10.
 .It Cm MaxStartups
 Specifies the maximum number of concurrent unauthenticated connections to the
 SSH daemon.
-- 
cgit v1.2.3


From e7140f20cb2da1456e6080059eef54cf0f3533f2 Mon Sep 17 00:00:00 2001
From: Darren Tucker <dtucker@zip.com.au>
Date: Tue, 10 Jun 2008 23:01:51 +1000
Subject:    - dtucker@cvs.openbsd.org 2008/06/10 04:50:25      [sshd.c
 channels.h channels.c log.c servconf.c log.h servconf.h sshd.8]      Add
 extended test mode (-T) and connection parameters for test mode (-C).      -T
 causes sshd to write its effective configuration to stdout and exit.      -C
 causes any relevant Match rules to be applied before output.  The     
 combination allows tesing of the parser and config files.  ok deraadt djm

---
 ChangeLog  |   8 +-
 channels.c |  13 +++-
 channels.h |   3 +-
 log.c      |  24 +++++-
 log.h      |   6 +-
 servconf.c | 241 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++---
 servconf.h |   3 +-
 sshd.8     |  34 ++++++++-
 sshd.c     |  47 +++++++++++-
 9 files changed, 355 insertions(+), 24 deletions(-)

(limited to 'servconf.h')

diff --git a/ChangeLog b/ChangeLog
index e16603175..3c2cc2168 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -12,6 +12,12 @@
    - djm@cvs.openbsd.org 2008/06/10 04:17:46
      [sshd_config.5]
      better reference for pattern-list
+   - dtucker@cvs.openbsd.org 2008/06/10 04:50:25
+     [sshd.c channels.h channels.c log.c servconf.c log.h servconf.h sshd.8]
+     Add extended test mode (-T) and connection parameters for test mode (-C).
+     -T causes sshd to write its effective configuration to stdout and exit.
+     -C causes any relevant Match rules to be applied before output.  The
+     combination allows tesing of the parser and config files.  ok deraadt djm
 
 20080609
  - (dtucker) OpenBSD CVS Sync
@@ -4098,4 +4104,4 @@
    OpenServer 6 and add osr5bigcrypt support so when someone migrates
    passwords between UnixWare and OpenServer they will still work. OK dtucker@
 
-$Id: ChangeLog,v 1.4950 2008/06/10 12:59:53 dtucker Exp $
+$Id: ChangeLog,v 1.4951 2008/06/10 13:01:51 dtucker Exp $
diff --git a/channels.c b/channels.c
index 99b23d75f..6808d3a05 100644
--- a/channels.c
+++ b/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.277 2008/05/09 16:17:51 markus Exp $ */
+/* $OpenBSD: channels.c,v 1.278 2008/06/10 04:50:25 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -2784,6 +2784,17 @@ channel_clear_adm_permitted_opens(void)
 	num_adm_permitted_opens = 0;
 }
 
+void
+channel_print_adm_permitted_opens(void)
+{
+	static int i;
+
+	for (i = 0; i < num_adm_permitted_opens; i++)
+		if (permitted_adm_opens[i].host_to_connect != NULL)
+			printf(" %s:%d", permitted_adm_opens[i].host_to_connect,
+			    permitted_adm_opens[i].port_to_connect);
+}
+
 /* Try to start non-blocking connect to next host in cctx list */
 static int
 connect_next(struct channel_connect *cctx)
diff --git a/channels.h b/channels.h
index ec2435df0..dc1f483ed 100644
--- a/channels.h
+++ b/channels.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.h,v 1.92 2008/05/09 16:21:13 markus Exp $ */
+/* $OpenBSD: channels.h,v 1.93 2008/06/10 04:50:25 dtucker Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -235,6 +235,7 @@ void	 channel_add_permitted_opens(char *, int);
 int	 channel_add_adm_permitted_opens(char *, int);
 void	 channel_clear_permitted_opens(void);
 void	 channel_clear_adm_permitted_opens(void);
+void 	 channel_print_adm_permitted_opens(void);
 int      channel_input_port_forward_request(int, int);
 Channel	*channel_connect_to(const char *, u_short, char *, char *);
 Channel	*channel_connect_by_listen_address(u_short, char *, char *);
diff --git a/log.c b/log.c
index fae5b043f..4a8239b93 100644
--- a/log.c
+++ b/log.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: log.c,v 1.40 2007/05/17 07:50:31 djm Exp $ */
+/* $OpenBSD: log.c,v 1.41 2008/06/10 04:50:25 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -114,6 +114,17 @@ log_facility_number(char *name)
 	return SYSLOG_FACILITY_NOT_SET;
 }
 
+const char *
+log_facility_name(SyslogFacility facility)
+{
+	u_int i;
+
+	for (i = 0;  log_facilities[i].name; i++)
+		if (log_facilities[i].val == facility)
+			return log_facilities[i].name;
+	return NULL;
+}
+
 LogLevel
 log_level_number(char *name)
 {
@@ -126,6 +137,17 @@ log_level_number(char *name)
 	return SYSLOG_LEVEL_NOT_SET;
 }
 
+const char *
+log_level_name(LogLevel level)
+{
+	u_int i;
+
+	for (i = 0; log_levels[i].name != NULL; i++)
+		if (log_levels[i].val == level)
+			return log_levels[i].name;
+	return NULL;
+}
+
 /* Error messages that should be logged. */
 
 void
diff --git a/log.h b/log.h
index 7a8c57079..fa0996ad5 100644
--- a/log.h
+++ b/log.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: log.h,v 1.15 2006/08/18 09:13:25 deraadt Exp $ */
+/* $OpenBSD: log.h,v 1.16 2008/06/10 04:50:25 dtucker Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -49,7 +49,9 @@ typedef enum {
 void     log_init(char *, LogLevel, SyslogFacility, int);
 
 SyslogFacility	log_facility_number(char *);
-LogLevel log_level_number(char *);
+const char * 	log_facility_name(SyslogFacility);
+LogLevel	log_level_number(char *);
+const char *	log_level_name(LogLevel);
 
 void     fatal(const char *, ...) __dead __attribute__((format(printf, 1, 2)));
 void     error(const char *, ...) __attribute__((format(printf, 1, 2)));
diff --git a/servconf.c b/servconf.c
index 07a201034..63704fb33 100644
--- a/servconf.c
+++ b/servconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.c,v 1.181 2008/06/10 03:57:27 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.182 2008/06/10 04:50:25 dtucker Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -23,6 +23,7 @@
 #include <signal.h>
 #include <unistd.h>
 #include <stdarg.h>
+#include <errno.h>
 
 #include "openbsd-compat/sys-queue.h"
 #include "xmalloc.h"
@@ -417,6 +418,17 @@ static struct {
 	{ NULL, sBadOption, 0 }
 };
 
+static struct {
+	int val;
+	char *text;
+} tunmode_desc[] = {
+	{ SSH_TUNMODE_NO, "no" },
+	{ SSH_TUNMODE_POINTOPOINT, "point-to-point" },
+	{ SSH_TUNMODE_ETHERNET, "ethernet" },
+	{ SSH_TUNMODE_YES, "yes" },
+	{ -1, NULL }
+};
+
 /*
  * Returns the number of the token pointed to by cp or sBadOption.
  */
@@ -1211,16 +1223,13 @@ process_server_config_line(ServerOptions *options, char *line,
 		if (!arg || *arg == '\0')
 			fatal("%s line %d: Missing yes/point-to-point/"
 			    "ethernet/no argument.", filename, linenum);
-		value = 0;	/* silence compiler */
-		if (strcasecmp(arg, "ethernet") == 0)
-			value = SSH_TUNMODE_ETHERNET;
-		else if (strcasecmp(arg, "point-to-point") == 0)
-			value = SSH_TUNMODE_POINTOPOINT;
-		else if (strcasecmp(arg, "yes") == 0)
-			value = SSH_TUNMODE_YES;
-		else if (strcasecmp(arg, "no") == 0)
-			value = SSH_TUNMODE_NO;
-		else
+		value = -1;
+		for (i = 0; tunmode_desc[i].val != -1; i++)
+			if (strcmp(tunmode_desc[i].text, arg) == 0) {
+				value = tunmode_desc[i].val;
+				break;
+			}
+		if (value == -1)
 			fatal("%s line %d: Bad yes/point-to-point/ethernet/"
 			    "no argument: %s", filename, linenum, arg);
 		if (*intptr == -1)
@@ -1426,3 +1435,213 @@ parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
 		fatal("%s: terminating, %d bad configuration options",
 		    filename, bad_options);
 }
+
+static const char *
+fmt_intarg(ServerOpCodes code, int val)
+{
+	if (code == sAddressFamily) {
+		switch (val) {
+		case AF_INET:
+			return "inet";
+		case AF_INET6:
+			return "inet6";
+		case AF_UNSPEC:
+			return "any";
+		default:
+			return "UNKNOWN";
+		}
+	}
+	if (code == sPermitRootLogin) {
+		switch (val) {
+		case PERMIT_NO_PASSWD:
+			return "without-passord";
+		case PERMIT_FORCED_ONLY:
+			return "forced-commands-only";
+		case PERMIT_YES:
+			return "yes";
+		}
+	}
+	if (code == sProtocol) {
+		switch (val) {
+		case SSH_PROTO_1:
+			return "1";
+		case SSH_PROTO_2:
+			return "2";
+		case (SSH_PROTO_1|SSH_PROTO_2):
+			return "2,1";
+		default:
+			return "UNKNOWN";
+		}
+	}
+	if (code == sGatewayPorts && val == 2)
+		return "clientspecified";
+	if (code == sCompression && val == COMP_DELAYED)
+		return "delayed";
+	switch (val) {
+	case -1:
+		return "unset";
+	case 0:
+		return "no";
+	case 1:
+		return "yes";
+	}
+	return "UNKNOWN";
+}
+
+static const char *
+lookup_opcode_name(ServerOpCodes code)
+{
+	u_int i;
+
+	for (i = 0; keywords[i].name != NULL; i++)
+		if (keywords[i].opcode == code)
+			return(keywords[i].name);
+	return "UNKNOWN";
+}
+
+static void
+dump_cfg_int(ServerOpCodes code, int val)
+{
+	printf("%s %d\n", lookup_opcode_name(code), val);
+}
+
+static void
+dump_cfg_fmtint(ServerOpCodes code, int val)
+{
+	printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
+}
+
+static void
+dump_cfg_string(ServerOpCodes code, const char *val)
+{
+	if (val == NULL)
+		return;
+	printf("%s %s\n", lookup_opcode_name(code), val);
+}
+
+static void
+dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals)
+{
+	u_int i;
+
+	for (i = 0; i < count; i++)
+		printf("%s %s\n", lookup_opcode_name(code),  vals[i]);
+}
+
+void
+dump_config(ServerOptions *o)
+{
+	u_int i;
+	int ret;
+	struct addrinfo *ai;
+	char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL;
+
+	/* these are usually at the top of the config */
+	for (i = 0; i < o->num_ports; i++)
+		printf("port %d\n", o->ports[i]);
+	dump_cfg_fmtint(sProtocol, o->protocol);
+	dump_cfg_fmtint(sAddressFamily, o->address_family);
+
+	/* ListenAddress must be after Port */
+	for (ai = o->listen_addrs; ai; ai = ai->ai_next) {
+		if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr,
+		    sizeof(addr), port, sizeof(port),
+		    NI_NUMERICHOST|NI_NUMERICSERV)) != 0) {
+			error("getnameinfo failed: %.100s",
+			    (ret != EAI_SYSTEM) ? gai_strerror(ret) :
+			    strerror(errno));
+		} else {
+			if (ai->ai_family == AF_INET6)
+				printf("listenaddress [%s]:%s\n", addr, port);
+			else
+				printf("listenaddress %s:%s\n", addr, port);
+		}
+	}
+
+	/* integer arguments */
+	dump_cfg_int(sServerKeyBits, o->server_key_bits);
+	dump_cfg_int(sLoginGraceTime, o->login_grace_time);
+	dump_cfg_int(sKeyRegenerationTime, o->key_regeneration_time);
+	dump_cfg_int(sX11DisplayOffset, o->x11_display_offset);
+	dump_cfg_int(sMaxAuthTries, o->max_authtries);
+	dump_cfg_int(sClientAliveInterval, o->client_alive_interval);
+	dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max);
+
+	/* formatted integer arguments */
+	dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login);
+	dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts);
+	dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts);
+	dump_cfg_fmtint(sRhostsRSAAuthentication, o->rhosts_rsa_authentication);
+	dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication);
+	dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly,
+	    o->hostbased_uses_name_from_packet_only);
+	dump_cfg_fmtint(sRSAAuthentication, o->rsa_authentication);
+	dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication);
+	dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication);
+	dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd);
+	dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup);
+	dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token);
+	dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
+	dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
+	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
+	dump_cfg_fmtint(sKbdInteractiveAuthentication,
+	    o->kbd_interactive_authentication);
+	dump_cfg_fmtint(sChallengeResponseAuthentication,
+	    o->challenge_response_authentication);
+	dump_cfg_fmtint(sPrintMotd, o->print_motd);
+	dump_cfg_fmtint(sPrintLastLog, o->print_lastlog);
+	dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding);
+	dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
+	dump_cfg_fmtint(sStrictModes, o->strict_modes);
+	dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
+	dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd);
+	dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env);
+	dump_cfg_fmtint(sUseLogin, o->use_login);
+	dump_cfg_fmtint(sCompression, o->compression);
+	dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
+	dump_cfg_fmtint(sUseDNS, o->use_dns);
+	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
+	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
+
+	/* string arguments */
+	dump_cfg_string(sPidFile, o->pid_file);
+	dump_cfg_string(sXAuthLocation, o->xauth_location);
+	dump_cfg_string(sCiphers, o->ciphers);
+	dump_cfg_string(sMacs, o->macs);
+	dump_cfg_string(sBanner, o->banner);
+	dump_cfg_string(sAuthorizedKeysFile, o->authorized_keys_file);
+	dump_cfg_string(sAuthorizedKeysFile2, o->authorized_keys_file2);
+	dump_cfg_string(sForceCommand, o->adm_forced_command);
+
+	/* string arguments requiring a lookup */
+	dump_cfg_string(sLogLevel, log_level_name(o->log_level));
+	dump_cfg_string(sLogFacility, log_facility_name(o->log_facility));
+
+	/* string array arguments */
+	dump_cfg_strarray(sHostKeyFile, o->num_host_key_files,
+	     o->host_key_files);
+	dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users);
+	dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users);
+	dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups);
+	dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups);
+	dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env);
+
+	/* other arguments */
+	for (i = 0; i < o->num_subsystems; i++)
+		printf("subsystem %s %s\n", o->subsystem_name[i],
+		    o->subsystem_args[i]);
+
+	printf("maxstartups %d:%d:%d\n", o->max_startups_begin,
+	    o->max_startups_rate, o->max_startups);
+
+	for (i = 0; tunmode_desc[i].val != -1; i++)
+		if (tunmode_desc[i].val == o->permit_tun) {
+			s = tunmode_desc[i].text;
+			break;
+		}
+	dump_cfg_string(sPermitTunnel, s);
+
+	printf("permitopen");
+	channel_print_adm_permitted_opens();
+	printf("\n");
+}
diff --git a/servconf.h b/servconf.h
index 819a028c8..40ac64f13 100644
--- a/servconf.h
+++ b/servconf.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.h,v 1.84 2008/05/08 12:21:16 djm Exp $ */
+/* $OpenBSD: servconf.h,v 1.85 2008/06/10 04:50:25 dtucker Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -161,5 +161,6 @@ void	 parse_server_config(ServerOptions *, const char *, Buffer *,
 void	 parse_server_match_config(ServerOptions *, const char *, const char *,
 	     const char *);
 void	 copy_set_server_options(ServerOptions *, ServerOptions *, int);
+void	 dump_config(ServerOptions *);
 
 #endif				/* SERVCONF_H */
diff --git a/sshd.8 b/sshd.8
index 750d64c3e..7274d0928 100644
--- a/sshd.8
+++ b/sshd.8
@@ -34,8 +34,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd.8,v 1.241 2008/03/27 22:37:57 jmc Exp $
-.Dd $Mdocdate: March 27 2008 $
+.\" $OpenBSD: sshd.8,v 1.242 2008/06/10 04:50:25 dtucker Exp $
+.Dd $Mdocdate: June 10 2008 $
 .Dt SSHD 8
 .Os
 .Sh NAME
@@ -44,8 +44,9 @@
 .Sh SYNOPSIS
 .Nm sshd
 .Bk -words
-.Op Fl 46Ddeiqt
+.Op Fl 46DTdeiqt
 .Op Fl b Ar bits
+.Op Fl C Ar connection_spec
 .Op Fl f Ar config_file
 .Op Fl g Ar login_grace_time
 .Op Fl h Ar host_key_file
@@ -197,6 +198,33 @@ Only check the validity of the configuration file and sanity of the keys.
 This is useful for updating
 .Nm
 reliably as configuration options may change.
+.It Fl T
+Extended test mode.
+Check the validity of the configuration file, output the effective configuration
+to stdout and then exit.
+Optionally,
+.Cm Match
+rules may be applied by specifying the connection parameters using one or more
+.Fl C
+options.
+.It Fl C
+Specify the connection parameters to use for the the
+.Fl T
+extended test mode.
+If provided, any
+.Cm Match
+directives in the configuration file
+that would apply to the specified user, host and address will be set before
+the configuration is written to standard output.
+The connection parameters are supplied as keyword=value pairs.
+The keywords are
+.Dq user ,
+.Dq host
+and 
+.Dq addr
+All are required and may be supplied in any order, either with multiple
+.Fl C
+options or as a comma-separated list.
 .It Fl u Ar len
 This option is used to specify the size of the field
 in the
diff --git a/sshd.c b/sshd.c
index aefbaaa42..ccff65d06 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.357 2008/05/08 12:02:23 djm Exp $ */
+/* $OpenBSD: sshd.c,v 1.358 2008/06/10 04:50:25 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1240,8 +1240,9 @@ main(int ac, char **av)
 	int opt, i, on = 1;
 	int sock_in = -1, sock_out = -1, newsock = -1;
 	const char *remote_ip;
+	char *test_user = NULL, *test_host = NULL, *test_addr = NULL;
 	int remote_port;
-	char *line;
+	char *line, *p, *cp;
 	int config_s[2] = { -1 , -1 };
 	Key *key;
 	Authctxt *authctxt;
@@ -1276,7 +1277,7 @@ main(int ac, char **av)
 	initialize_server_options(&options);
 
 	/* Parse command-line arguments. */
-	while ((opt = getopt(ac, av, "f:p:b:k:h:g:u:o:dDeiqrtQR46")) != -1) {
+	while ((opt = getopt(ac, av, "f:p:b:k:h:g:u:o:C:dDeiqrtQRT46")) != -1) {
 		switch (opt) {
 		case '4':
 			options.address_family = AF_INET;
@@ -1354,6 +1355,25 @@ main(int ac, char **av)
 		case 't':
 			test_flag = 1;
 			break;
+		case 'T':
+			test_flag = 2;
+			break;
+		case 'C':
+			cp = optarg;
+			while ((p = strsep(&cp, ",")) && *p != '\0') {
+				if (strncmp(p, "addr=", 5) == 0)
+					test_addr = xstrdup(p + 5);
+				else if (strncmp(p, "host=", 5) == 0)
+					test_host = xstrdup(p + 5);
+				else if (strncmp(p, "user=", 5) == 0)
+					test_user = xstrdup(p + 5);
+				else {
+					fprintf(stderr, "Invalid test "
+					    "mode specification %s\n", p);
+					exit(1);
+				}
+			}
+			break;
 		case 'u':
 			utmp_len = (u_int)strtonum(optarg, 0, MAXHOSTNAMELEN+1, NULL);
 			if (utmp_len > MAXHOSTNAMELEN) {
@@ -1415,6 +1435,20 @@ main(int ac, char **av)
 	sensitive_data.have_ssh1_key = 0;
 	sensitive_data.have_ssh2_key = 0;
 
+	/*
+	 * If we're doing an extended config test, make sure we have all of
+	 * the parameters we need.  If we're not doing an extended test,
+	 * do not silently ignore connection test params.
+	 */
+	if (test_flag >= 2 && (test_user != NULL || test_host != NULL || test_addr != NULL)
+	    && (test_user == NULL || test_host == NULL || test_addr == NULL))
+		fatal("user, host and addr are all required when testing "
+		   "Match configs");
+	if (test_flag < 2 && (test_user != NULL || test_host != NULL ||
+	    test_addr != NULL))
+		fatal("Config test connection parameter (-C) provided without "
+		   "test mode (-T)");
+
 	/* Fetch our configuration */
 	buffer_init(&cfg);
 	if (rexeced_flag)
@@ -1543,6 +1577,13 @@ main(int ac, char **av)
 			    "world-writable.", _PATH_PRIVSEP_CHROOT_DIR);
 	}
 
+	if (test_flag > 1) {
+		if (test_user != NULL && test_addr != NULL && test_host != NULL)
+			parse_server_match_config(&options, test_user,
+			    test_host, test_addr);
+		dump_config(&options);
+	}
+
 	/* Configuration looks good, so exit if in test mode. */
 	if (test_flag)
 		exit(0);
-- 
cgit v1.2.3