openssh bugs - Jan 2019 - [Bug 2957] New: servconf.c: parse_multistate: does not allow override?

https://bugzilla.mindrot.org/show_bug.cgi?id=2957

            Bug ID: 2957
           Summary: servconf.c: parse_multistate: does not allow override?
           Product: Portable OpenSSH
           Version: 7.9p1
          Hardware: Other
                OS: All
            Status: NEW
          Severity: trivial
          Priority: P5
         Component: Miscellaneous
          Assignee: unassigned-bugs at mindrot.org
          Reporter: steffen at sdaoden.eu

I tried to use JumpHost via my server running AlpineLinux -- these guys
set "AllowTcpForwarding no" and i only append all changes in order to
make merging after updates (much) easier.

After hours of failed attempts and google-sponsored searches on the
boys toilet walls i finally realized that it was the
"AllowTcpForwarding yes" that i appended, it will will be recognized
only when placed in a "Match User " block, but not at the toplevel.

Looking at servconf.c it seems as if that happens because at
parse_mulistate: *intptr is only overridden if it is (still) set to -1,
could that be (i have not verified this claim).
If so, then i would hope for either that this restriction is removed (i
do not understand it, i think use cases are thinkable), or that at
least with -vvvvvvv there would be a warning on "rejecting overwrite of
configuration value XY".

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2957

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org

--- Comment #1 from Damien Miller <djm at mindrot.org> ---
I'm not sure what you're requesting. It might be more clear if you gave
an example of your working vs failing configurations.

The configuration is first-match-wins and this isn't limited to
parse_multistate. Changing that would literally break the world's
working configurations.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2957

--- Comment #2 from Steffen (Daode) Nurpmeso <steffen at sdaoden.eu> ---
I have not read the third sentence of the manual page in many years.
Sorry for the noise.

And rereading the report as such.. You have found out what i was
talking about, congratulations.

But as a small feature request, just a little -vv or so verbose message
that an attempt was made to overwrite a yet existing (explicit) setting
would be wonderful.
Also, neither sshd(8) -t nor -T warn about this.  In fact -T warns

  'Match User' in configuration but 'user' not in connection
test
specification.

when i force the problem, but this message as such i really do not
understand.  "steffen" and "web" or both local users.  Hmm. 
I think
this is unrelated, however.
Thanks!

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2957

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |WORKSFORME

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.