Bug 2957

Summary:	servconf.c: parse_multistate: does not allow override?
Product:	Portable OpenSSH	Reporter:	Steffen (Daode) Nurpmeso <steffen>
Component:	Miscellaneous	Assignee:	Assigned to nobody <unassigned-bugs>
Status:	NEW ---
Severity:	trivial	CC:	djm
Priority:	P5
Version:	7.9p1
Hardware:	Other
OS:	All

Description Steffen (Daode) Nurpmeso 2019-01-23 04:01:22 AEDT

I tried to use JumpHost via my server running AlpineLinux -- these guys set "AllowTcpForwarding no" and i only append all changes in order to make merging after updates (much) easier.

After hours of failed attempts and google-sponsored searches on the boys toilet walls i finally realized that it was the "AllowTcpForwarding yes" that i appended, it will will be recognized only when placed in a "Match User " block, but not at the toplevel.

Looking at servconf.c it seems as if that happens because at parse_mulistate: *intptr is only overridden if it is (still) set to -1, could that be (i have not verified this claim).
If so, then i would hope for either that this restriction is removed (i do not understand it, i think use cases are thinkable), or that at least with -vvvvvvv there would be a warning on "rejecting overwrite of configuration value XY".

Comment 1 Damien Miller 2019-01-23 08:13:34 AEDT

I'm not sure what you're requesting. It might be more clear if you gave an example of your working vs failing configurations.

The configuration is first-match-wins and this isn't limited to parse_multistate. Changing that would literally break the world's working configurations.

Comment 2 Steffen (Daode) Nurpmeso 2019-01-23 09:10:09 AEDT

I have not read the third sentence of the manual page in many years.
Sorry for the noise.

And rereading the report as such.. You have found out what i was talking about, congratulations.

But as a small feature request, just a little -vv or so verbose message that an attempt was made to overwrite a yet existing (explicit) setting would be wonderful.
Also, neither sshd(8) -t nor -T warn about this.  In fact -T warns

  'Match User' in configuration but 'user' not in connection test specification.

when i force the problem, but this message as such i really do not understand.  "steffen" and "web" or both local users.  Hmm.  I think this is unrelated, however.
Thanks!