[Bug 4019] New: SyslogFacility in a nonmatching Host or Match block affects other destinations

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=4019

            Bug ID: 4019
           Summary: SyslogFacility in a nonmatching Host or Match block
                    affects other destinations
           Product: Portable OpenSSH
           Version: 10.5p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: major
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: khush2792001 at gmail.com

The client configuration parser applies `SyslogFacility` even when its
enclosing `Host` or `Match` block does not match the destination.

For example:

```console
$ cat > config <<'EOF'
Host nomatch
    SyslogFacility LOCAL1
EOF
$ ssh -G -F config localhost | grep '^syslogfacility '
syslogfacility LOCAL1
```

Because `nomatch` does not match `localhost`, the expected result is
the default:

```text
syslogfacility USER
```

A nonmatching `Match` block behaves the same way:

```console
$ cat > config <<'EOF'
Match host nomatch
    SyslogFacility LOCAL1
EOF
$ ssh -G -F config localhost | grep '^syslogfacility '
syslogfacility LOCAL1
```

The adjacent `LogLevel` option correctly respects the block condition:

```console
$ cat > config <<'EOF'
Host nomatch
    LogLevel DEBUG3
EOF
$ ssh -G -F config localhost | grep '^loglevel '
loglevel INFO
```

In `readconf.c`, the `oLogFacility` case checks whether the destination
field is unset but omits the `*activep` check used by `oLogLevel`.
Consequently, the first `SyslogFacility` anywhere in the file wins,
including one inside an unrelated host stanza, and later matching
declarations cannot correct it.

Expected: assign `SyslogFacility` only when `*activep` is true and the
field remains unset.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.