Compose sshd_config Match blocks per keyword - #1186
Open
ejohnstown wants to merge 2 commits into
Open
Conversation
OpenSSH resolves sshd_config one keyword at a time, scanning every Match block that applies. wolfSSHD_GetUserConf returns the first matching block whole, so a setting made only in a later matching block is dropped. - add test_GetUserConfMatchOverlapCompose, covering a user matched by both a Match User and a Match Group block, in either order - add sshd_match_overlap_test.sh, the same case against a live daemon, where the group block's ForceCommand is the setting that goes missing - both fail until per keyword composition lands, so the unit test runs last and the script stays commented out of run_all_sshd_tests.sh
wolfSSHD_GetUserConf returned the first matching Match block whole, so a keyword named only in a later matching block was dropped and the outcome depended on the order the blocks were written. - track in a new setMask which keywords a node set itself, so a value inherited from the globals can be told from one the block named, with a compile time check that no option tag shifts out of the mask - resolve into a fresh config seeded from the globals, letting every matching block contribute the keywords no earlier block claimed - the resolved config now belongs to the caller, so wolfsshd and the auth paths free it and the tests compare values rather than node identity - put sshd_match_overlap_test.sh back in the suite Issue: ZD-22324
ejohnstown
force-pushed
the
match-block
branch
from
August 21, 2026 16:27
7eefef0 to
a405baf
Compare
wolfSSL-Fenrir-bot
approved these changes
Aug 21, 2026
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1186
Scan targets checked: wolfssh-bugs, wolfssh-src
No new issues found in the changed files. ✅
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
wolfSSHD_GetUserConf()returned the first matching Match block whole, so a keyword set only in a later matching block was dropped and the result depended on the order blocks appear in the file. OpenSSH resolves one keyword at a time across every applicable block.setMaskwhich keywords it set itself, so an inherited value can be told from one the block named. Compile-time check that no option tag shifts out of the mask.wolfSSHD_GetUserConf()now resolves into a fresh config seeded from the globals; every matching block contributes the keywords no earlier block claimed.wolfsshd.cand the auth paths free it; unit tests compare values, not node identity.test_GetUserConfMatchOverlapCompose(user matched by both aMatch Userand aMatch Groupblock, in either order) andsshd_match_overlap_test.sh, the same case against a live daemon. Both fail before the fix.Issue: ZD-22324