Bug 2957 - servconf.c: parse_multistate: does not allow override?
Summary: servconf.c: parse_multistate: does not allow override?
Status: NEW
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: Miscellaneous (show other bugs)
Version: 7.9p1
Hardware: Other All
: P5 trivial
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-01-23 04:01 AEDT by Steffen (Daode) Nurpmeso
Modified: 2019-01-23 09:10 AEDT (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Steffen (Daode) Nurpmeso 2019-01-23 04:01:22 AEDT
I tried to use JumpHost via my server running AlpineLinux -- these guys set "AllowTcpForwarding no" and i only append all changes in order to make merging after updates (much) easier.

After hours of failed attempts and google-sponsored searches on the boys toilet walls i finally realized that it was the "AllowTcpForwarding yes" that i appended, it will will be recognized only when placed in a "Match User " block, but not at the toplevel.

Looking at servconf.c it seems as if that happens because at parse_mulistate: *intptr is only overridden if it is (still) set to -1, could that be (i have not verified this claim).
If so, then i would hope for either that this restriction is removed (i do not understand it, i think use cases are thinkable), or that at least with -vvvvvvv there would be a warning on "rejecting overwrite of configuration value XY".
Comment 1 Damien Miller 2019-01-23 08:13:34 AEDT
I'm not sure what you're requesting. It might be more clear if you gave an example of your working vs failing configurations.

The configuration is first-match-wins and this isn't limited to parse_multistate. Changing that would literally break the world's working configurations.
Comment 2 Steffen (Daode) Nurpmeso 2019-01-23 09:10:09 AEDT
I have not read the third sentence of the manual page in many years.
Sorry for the noise.

And rereading the report as such.. You have found out what i was talking about, congratulations.

But as a small feature request, just a little -vv or so verbose message that an attempt was made to overwrite a yet existing (explicit) setting would be wonderful.
Also, neither sshd(8) -t nor -T warn about this.  In fact -T warns

  'Match User' in configuration but 'user' not in connection test specification.

when i force the problem, but this message as such i really do not understand.  "steffen" and "web" or both local users.  Hmm.  I think this is unrelated, however.
Thanks!