Weirdnesses with the sshd_config Include directive

[M Rubon]

I wanted to understand the sshd_config Include command, so I tried
some examples.  I don't understand what I am seeing.

Config file and include file are as follows.

#  includeA.conf  include file
DenyUsers include.should.be.always    #tracing
Ciphers 3des-cbc
Match user xyz
     DenyUsers include.match.user.xyz       #tracing
# end  includeA.conf

#  main.conf
HostKey /tmp/test_rsa_hostkey
DenyUsers main.before.include.always         #tracing
Include /tmp/includeA.conf
DenyUsers main.after.include.maybe       # depending on semantics of include
Match user xyz
   DenyUsers main.match.user.xyz         #tracing
# end  main.conf


$ sshd -T -f main.conf -h /tmp/test_rsa_hostkey -C user=bigblue | grep
-e deny -e ciph
ciphers 3des-cbc
denyusers main.before.include.always
denyusers include.should.be.always
denyusers main.after.include.maybe

Run with -C user=bigblue (or none specified) I get decent looking
output which is traced by the DenyUsers.  It seems to suggest
the scope of the include file's Match statement is only to the end of
the include file.  Is that correct?  (This is what I was originally trying
to test)

But triggering the match statements does not work so well.

$ sshd -T -f main.conf -h /tmp/test_rsa_hostkey -C user=xyz | grep -e
deny -e ciph
ciphers 3des-cbc
denyusers include.match.user.xyz
denyusers main.match.user.xyz

When I rerun it with -C user=xyz (to trigger the Match), I see only
the conditional denyuser lines, and no longer see the three "always
present".denyusers lines from the previous example.  But why?  Note
the include file always properly sets the Ciphers value.


I see the same behaviour if I use AllowGroups for tracing instead of
DenyUsers.  I see the same behaviour on OpenSSH_9.6p1 and
OpenSSH_10.2p1

Am I misunderstanding how Match or -C user= works?

M