blob: c706fbf46ab7a95fa0bccc9dcdd812b55a351614 [file] [log] [blame]
markus@openbsd.org1a75d142016-05-04 14:29:58 +00001/* $OpenBSD: readconf.c,v 1.254 2016/05/04 14:29:58 markus Exp $ */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002/*
Damien Miller95def091999-11-25 00:26:21 +11003 * Author: Tatu Ylonen <ylo@cs.hut.fi>
Damien Miller95def091999-11-25 00:26:21 +11004 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * All rights reserved
Damien Miller95def091999-11-25 00:26:21 +11006 * Functions for reading the configuration files.
Damien Miller4af51302000-04-16 11:18:38 +10007 *
Damien Millere4340be2000-09-16 13:29:08 +11008 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
Damien Miller95def091999-11-25 00:26:21 +110013 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100014
15#include "includes.h"
Damien Millerf17883e2006-03-15 11:45:54 +110016
17#include <sys/types.h>
18#include <sys/stat.h>
Damien Miller8ec8c3e2006-07-10 20:35:38 +100019#include <sys/socket.h>
Damien Miller194fd902013-10-15 12:13:05 +110020#include <sys/wait.h>
Damien Miller7acefbb2014-07-18 14:11:24 +100021#include <sys/un.h>
Damien Miller8ec8c3e2006-07-10 20:35:38 +100022
23#include <netinet/in.h>
Damien Miller0dac6fb2010-11-20 15:19:38 +110024#include <netinet/in_systm.h>
25#include <netinet/ip.h>
Darren Tucker0eeafcd2014-01-31 14:18:51 +110026#include <arpa/inet.h>
Damien Millerd4a8b7e1999-10-27 13:42:43 +100027
Damien Millerc7b06362006-03-15 11:53:45 +110028#include <ctype.h>
Darren Tucker39972492006-07-12 22:22:46 +100029#include <errno.h>
Damien Miller194fd902013-10-15 12:13:05 +110030#include <fcntl.h>
deraadt@openbsd.org2ae4f332015-01-16 06:40:12 +000031#include <limits.h>
Damien Millerb8fe89c2006-07-24 14:51:00 +100032#include <netdb.h>
Darren Tuckera3357662014-01-18 00:03:57 +110033#ifdef HAVE_PATHS_H
34# include <paths.h>
35#endif
Damien Miller194fd902013-10-15 12:13:05 +110036#include <pwd.h>
Damien Millerd7834352006-08-05 12:39:39 +100037#include <signal.h>
Damien Millerded319c2006-09-01 15:38:36 +100038#include <stdarg.h>
Damien Millera7a73ee2006-08-05 11:37:59 +100039#include <stdio.h>
Damien Millere3476ed2006-07-24 14:13:33 +100040#include <string.h>
Damien Millere6b3b612006-07-24 14:01:23 +100041#include <unistd.h>
djm@openbsd.orgdc7990b2016-04-15 00:30:19 +000042#ifdef USE_SYSTEM_GLOB
43# include <glob.h>
44#else
45# include "openbsd-compat/glob.h"
46#endif
Darren Tuckere194ba42013-05-16 20:47:31 +100047#ifdef HAVE_UTIL_H
Darren Tuckerb7ee8522013-05-16 20:33:10 +100048#include <util.h>
Darren Tuckere194ba42013-05-16 20:47:31 +100049#endif
djm@openbsd.org957fbce2014-10-08 22:20:25 +000050#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
51# include <vis.h>
52#endif
Damien Millerc7b06362006-03-15 11:53:45 +110053
Damien Millerd4a8b7e1999-10-27 13:42:43 +100054#include "xmalloc.h"
Damien Millerd7834352006-08-05 12:39:39 +100055#include "ssh.h"
Damien Miller78928792000-04-12 20:17:38 +100056#include "compat.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000057#include "cipher.h"
58#include "pathnames.h"
59#include "log.h"
djm@openbsd.org1129dcf2015-01-15 09:40:00 +000060#include "sshkey.h"
Damien Miller7acefbb2014-07-18 14:11:24 +100061#include "misc.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000062#include "readconf.h"
63#include "match.h"
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000064#include "kex.h"
65#include "mac.h"
Damien Miller194fd902013-10-15 12:13:05 +110066#include "uidswap.h"
djm@openbsd.org957fbce2014-10-08 22:20:25 +000067#include "myproposal.h"
djm@openbsd.org56d1c832014-12-21 22:27:55 +000068#include "digest.h"
Damien Millerd4a8b7e1999-10-27 13:42:43 +100069
70/* Format of the configuration file:
71
72 # Configuration data is parsed as follows:
73 # 1. command line options
74 # 2. user-specific file
75 # 3. system-wide file
76 # Any configuration value is only changed the first time it is set.
77 # Thus, host-specific definitions should be at the beginning of the
78 # configuration file, and defaults at the end.
79
80 # Host-specific declarations. These may override anything above. A single
81 # host may match multiple declarations; these are processed in the order
82 # that they are given in.
83
84 Host *.ngs.fi ngs.fi
Ben Lindstrom4daea862002-06-09 20:04:02 +000085 User foo
Damien Millerd4a8b7e1999-10-27 13:42:43 +100086
87 Host fake.com
88 HostName another.host.name.real.org
89 User blaah
90 Port 34289
91 ForwardX11 no
92 ForwardAgent no
93
94 Host books.com
95 RemoteForward 9999 shadows.cs.hut.fi:9999
96 Cipher 3des
97
98 Host fascist.blob.com
99 Port 23123
100 User tylonen
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000101 PasswordAuthentication no
102
103 Host puukko.hut.fi
104 User t35124p
105 ProxyCommand ssh-proxy %h %p
106
107 Host *.fr
Ben Lindstrom4daea862002-06-09 20:04:02 +0000108 PublicKeyAuthentication no
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000109
110 Host *.su
111 Cipher none
112 PasswordAuthentication no
113
Damien Millerd27b9472005-12-13 19:29:02 +1100114 Host vpn.fake.com
115 Tunnel yes
116 TunnelDevice 3
117
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000118 # Defaults for various options
119 Host *
120 ForwardAgent no
Damien Miller0bc1bd82000-11-13 22:57:25 +1100121 ForwardX11 no
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000122 PasswordAuthentication yes
123 RSAAuthentication yes
124 RhostsRSAAuthentication yes
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000125 StrictHostKeyChecking yes
Damien Miller12c150e2003-12-17 16:31:10 +1100126 TcpKeepAlive no
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000127 IdentityFile ~/.ssh/identity
128 Port 22
129 EscapeChar ~
130
131*/
132
djm@openbsd.orgdc7990b2016-04-15 00:30:19 +0000133static int read_config_file_depth(const char *filename, struct passwd *pw,
134 const char *host, const char *original_host, Options *options,
135 int flags, int *activep, int depth);
136static int process_config_line_depth(Options *options, struct passwd *pw,
137 const char *host, const char *original_host, char *line,
138 const char *filename, int linenum, int *activep, int flags, int depth);
139
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000140/* Keyword tokens. */
141
Damien Miller95def091999-11-25 00:26:21 +1100142typedef enum {
143 oBadOption,
djm@openbsd.orgdc7990b2016-04-15 00:30:19 +0000144 oHost, oMatch, oInclude,
Damien Miller1ab6a512010-06-26 10:02:24 +1000145 oForwardAgent, oForwardX11, oForwardX11Trusted, oForwardX11Timeout,
146 oGatewayPorts, oExitOnForwardFailure,
Ben Lindstromcb72e4f2002-06-21 00:41:51 +0000147 oPasswordAuthentication, oRSAAuthentication,
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000148 oChallengeResponseAuthentication, oXAuthLocation,
Damien Miller95def091999-11-25 00:26:21 +1100149 oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
markus@openbsd.orgb02ad1c2016-05-04 12:21:53 +0000150 oCertificateFile, oAddKeysToAgent, oIdentityAgent,
Damien Miller194fd902013-10-15 12:13:05 +1100151 oUser, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
Damien Miller95def091999-11-25 00:26:21 +1100152 oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
153 oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
Damien Miller12c150e2003-12-17 16:31:10 +1100154 oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts,
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000155 oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000156 oPubkeyAuthentication,
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000157 oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
Ben Lindstrom982dbbc2001-04-17 18:11:36 +0000158 oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
Damien Miller7ea845e2010-02-12 09:21:02 +1100159 oHostKeyAlgorithms, oBindAddress, oPKCS11Provider,
Ben Lindstrom4daea862002-06-09 20:04:02 +0000160 oClearAllForwardings, oNoHostAuthenticationForLocalhost,
Damien Millerb78d5eb2003-05-16 11:39:04 +1000161 oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
Darren Tucker0efd1552003-08-26 11:49:55 +1000162 oAddressFamily, oGssAuthentication, oGssDelegateCreds,
Damien Millerbd394c32004-03-08 23:12:36 +1100163 oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
Damien Millere11e1ea2010-08-03 16:04:46 +1000164 oSendEnv, oControlPath, oControlMaster, oControlPersist,
165 oHashKnownHosts,
Damien Millerd27b9472005-12-13 19:29:02 +1100166 oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
markus@openbsd.orga3068632016-01-14 16:17:39 +0000167 oVisualHostKey,
Damien Miller1262b662013-08-21 02:44:24 +1000168 oKexAlgorithms, oIPQoS, oRequestTTY, oIgnoreUnknown, oProxyUseFdpass,
Damien Miller38505592013-10-17 11:48:13 +1100169 oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots,
170 oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs,
djm@openbsd.org5e39a492014-12-04 02:24:32 +0000171 oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys,
djm@openbsd.org46347ed2015-01-30 11:43:14 +0000172 oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes,
markus@openbsd.org3a1638d2015-07-10 06:21:53 +0000173 oPubkeyAcceptedKeyTypes,
Darren Tucker07636982013-05-16 20:30:03 +1000174 oIgnoredUnknownOption, oDeprecated, oUnsupported
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000175} OpCodes;
176
177/* Textual representations of the tokens. */
178
Damien Miller95def091999-11-25 00:26:21 +1100179static struct {
180 const char *name;
181 OpCodes opcode;
182} keywords[] = {
183 { "forwardagent", oForwardAgent },
184 { "forwardx11", oForwardX11 },
Darren Tucker0a118da2003-10-15 15:54:32 +1000185 { "forwardx11trusted", oForwardX11Trusted },
Damien Miller1ab6a512010-06-26 10:02:24 +1000186 { "forwardx11timeout", oForwardX11Timeout },
Darren Tuckere7d4b192006-07-12 22:17:10 +1000187 { "exitonforwardfailure", oExitOnForwardFailure },
Damien Millerd3a18572000-06-07 19:55:44 +1000188 { "xauthlocation", oXAuthLocation },
Damien Miller95def091999-11-25 00:26:21 +1100189 { "gatewayports", oGatewayPorts },
190 { "useprivilegedport", oUsePrivilegedPort },
Darren Tuckerec960f22003-08-13 20:37:05 +1000191 { "rhostsauthentication", oDeprecated },
Damien Miller95def091999-11-25 00:26:21 +1100192 { "passwordauthentication", oPasswordAuthentication },
Damien Miller874d77b2000-10-14 16:23:11 +1100193 { "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
194 { "kbdinteractivedevices", oKbdInteractiveDevices },
Damien Miller95def091999-11-25 00:26:21 +1100195 { "rsaauthentication", oRSAAuthentication },
Damien Miller0bc1bd82000-11-13 22:57:25 +1100196 { "pubkeyauthentication", oPubkeyAuthentication },
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000197 { "dsaauthentication", oPubkeyAuthentication }, /* alias */
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000198 { "rhostsrsaauthentication", oRhostsRSAAuthentication },
Ben Lindstromd69dab32001-04-12 23:36:05 +0000199 { "hostbasedauthentication", oHostbasedAuthentication },
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000200 { "challengeresponseauthentication", oChallengeResponseAuthentication },
201 { "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
202 { "tisauthentication", oChallengeResponseAuthentication }, /* alias */
Damien Millerf9b3feb2003-05-16 11:38:32 +1000203 { "kerberosauthentication", oUnsupported },
204 { "kerberostgtpassing", oUnsupported },
Damien Millerf9b3feb2003-05-16 11:38:32 +1000205 { "afstokenpassing", oUnsupported },
Darren Tucker0efd1552003-08-26 11:49:55 +1000206#if defined(GSSAPI)
207 { "gssapiauthentication", oGssAuthentication },
Darren Tucker0efd1552003-08-26 11:49:55 +1000208 { "gssapidelegatecredentials", oGssDelegateCreds },
209#else
210 { "gssapiauthentication", oUnsupported },
211 { "gssapidelegatecredentials", oUnsupported },
212#endif
Ben Lindstrom4daea862002-06-09 20:04:02 +0000213 { "fallbacktorsh", oDeprecated },
214 { "usersh", oDeprecated },
Damien Miller95def091999-11-25 00:26:21 +1100215 { "identityfile", oIdentityFile },
Damien Miller5bc6aae2009-01-28 16:27:31 +1100216 { "identityfile2", oIdentityFile }, /* obsolete */
Damien Millerbd394c32004-03-08 23:12:36 +1100217 { "identitiesonly", oIdentitiesOnly },
djm@openbsd.org4e44a792015-09-24 06:15:11 +0000218 { "certificatefile", oCertificateFile },
jcs@openbsd.orgf361df42015-11-15 22:26:49 +0000219 { "addkeystoagent", oAddKeysToAgent },
markus@openbsd.orgb02ad1c2016-05-04 12:21:53 +0000220 { "identityagent", oIdentityAgent },
Damien Miller95def091999-11-25 00:26:21 +1100221 { "hostname", oHostName },
Ben Lindstrom4dccfa52000-12-28 16:40:05 +0000222 { "hostkeyalias", oHostKeyAlias },
Damien Miller95def091999-11-25 00:26:21 +1100223 { "proxycommand", oProxyCommand },
224 { "port", oPort },
225 { "cipher", oCipher },
Damien Miller78928792000-04-12 20:17:38 +1000226 { "ciphers", oCiphers },
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000227 { "macs", oMacs },
Damien Miller78928792000-04-12 20:17:38 +1000228 { "protocol", oProtocol },
Damien Miller95def091999-11-25 00:26:21 +1100229 { "remoteforward", oRemoteForward },
230 { "localforward", oLocalForward },
231 { "user", oUser },
232 { "host", oHost },
Damien Miller194fd902013-10-15 12:13:05 +1100233 { "match", oMatch },
Damien Miller95def091999-11-25 00:26:21 +1100234 { "escapechar", oEscapeChar },
Damien Miller95def091999-11-25 00:26:21 +1100235 { "globalknownhostsfile", oGlobalKnownHostsFile },
Damien Miller295ee632011-05-29 21:42:31 +1000236 { "globalknownhostsfile2", oDeprecated },
Damien Miller5bc6aae2009-01-28 16:27:31 +1100237 { "userknownhostsfile", oUserKnownHostsFile },
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000238 { "userknownhostsfile2", oDeprecated },
Damien Miller95def091999-11-25 00:26:21 +1100239 { "connectionattempts", oConnectionAttempts },
240 { "batchmode", oBatchMode },
241 { "checkhostip", oCheckHostIP },
242 { "stricthostkeychecking", oStrictHostKeyChecking },
243 { "compression", oCompression },
244 { "compressionlevel", oCompressionLevel },
Damien Miller12c150e2003-12-17 16:31:10 +1100245 { "tcpkeepalive", oTCPKeepAlive },
246 { "keepalive", oTCPKeepAlive }, /* obsolete */
Damien Miller95def091999-11-25 00:26:21 +1100247 { "numberofpasswordprompts", oNumberOfPasswordPrompts },
Damien Miller95def091999-11-25 00:26:21 +1100248 { "loglevel", oLogLevel },
Ben Lindstrom3bb4f9d2001-04-08 18:30:26 +0000249 { "dynamicforward", oDynamicForward },
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000250 { "preferredauthentications", oPreferredAuthentications },
Ben Lindstrom982dbbc2001-04-17 18:11:36 +0000251 { "hostkeyalgorithms", oHostKeyAlgorithms },
Ben Lindstrome0f88042001-04-30 13:06:24 +0000252 { "bindaddress", oBindAddress },
Damien Miller7ea845e2010-02-12 09:21:02 +1100253#ifdef ENABLE_PKCS11
254 { "smartcarddevice", oPKCS11Provider },
255 { "pkcs11provider", oPKCS11Provider },
Damien Millerf9b3feb2003-05-16 11:38:32 +1000256#else
257 { "smartcarddevice", oUnsupported },
Damien Miller7ea845e2010-02-12 09:21:02 +1100258 { "pkcs11provider", oUnsupported },
Damien Millerf9b3feb2003-05-16 11:38:32 +1000259#endif
Damien Miller9f0f5c62001-12-21 14:45:46 +1100260 { "clearallforwardings", oClearAllForwardings },
Ben Lindstromb6df73b2002-11-09 15:52:31 +0000261 { "enablesshkeysign", oEnableSSHKeysign },
Damien Miller37876e92003-05-15 10:19:46 +1000262 { "verifyhostkeydns", oVerifyHostKeyDNS },
Damien Miller9f0f5c62001-12-21 14:45:46 +1100263 { "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost },
Damien Millera5539d22003-04-09 20:50:06 +1000264 { "rekeylimit", oRekeyLimit },
Damien Millerb78d5eb2003-05-16 11:39:04 +1000265 { "connecttimeout", oConnectTimeout },
Damien Miller20a8f972003-05-18 20:50:30 +1000266 { "addressfamily", oAddressFamily },
Damien Miller509b0102003-12-17 16:33:10 +1100267 { "serveraliveinterval", oServerAliveInterval },
268 { "serveralivecountmax", oServerAliveCountMax },
Darren Tucker46bc0752004-05-02 22:11:30 +1000269 { "sendenv", oSendEnv },
Damien Miller0e220db2004-06-15 10:34:08 +1000270 { "controlpath", oControlPath },
271 { "controlmaster", oControlMaster },
Damien Millere11e1ea2010-08-03 16:04:46 +1000272 { "controlpersist", oControlPersist },
Damien Millere1776152005-03-01 21:47:37 +1100273 { "hashknownhosts", oHashKnownHosts },
djm@openbsd.orgdc7990b2016-04-15 00:30:19 +0000274 { "include", oInclude },
Damien Millerd27b9472005-12-13 19:29:02 +1100275 { "tunnel", oTunnel },
276 { "tunneldevice", oTunnelDevice },
277 { "localcommand", oLocalCommand },
278 { "permitlocalcommand", oPermitLocalCommand },
Damien Miller10288242008-06-30 00:04:03 +1000279 { "visualhostkey", oVisualHostKey },
markus@openbsd.orga3068632016-01-14 16:17:39 +0000280 { "useroaming", oDeprecated },
Damien Millerd5f62bf2010-09-24 22:11:14 +1000281 { "kexalgorithms", oKexAlgorithms },
Damien Miller0dac6fb2010-11-20 15:19:38 +1100282 { "ipqos", oIPQoS },
Damien Miller21771e22011-05-15 08:45:50 +1000283 { "requesttty", oRequestTTY },
Damien Miller1262b662013-08-21 02:44:24 +1000284 { "proxyusefdpass", oProxyUseFdpass },
Damien Miller0faf7472013-10-17 11:47:23 +1100285 { "canonicaldomains", oCanonicalDomains },
Damien Miller38505592013-10-17 11:48:13 +1100286 { "canonicalizefallbacklocal", oCanonicalizeFallbackLocal },
287 { "canonicalizehostname", oCanonicalizeHostname },
288 { "canonicalizemaxdots", oCanonicalizeMaxDots },
289 { "canonicalizepermittedcnames", oCanonicalizePermittedCNAMEs },
Damien Miller7acefbb2014-07-18 14:11:24 +1000290 { "streamlocalbindmask", oStreamLocalBindMask },
291 { "streamlocalbindunlink", oStreamLocalBindUnlink },
djm@openbsd.org5e39a492014-12-04 02:24:32 +0000292 { "revokedhostkeys", oRevokedHostKeys },
djm@openbsd.org56d1c832014-12-21 22:27:55 +0000293 { "fingerprinthash", oFingerprintHash },
djm@openbsd.org8d4f8722015-01-26 03:04:45 +0000294 { "updatehostkeys", oUpdateHostkeys },
djm@openbsd.org46347ed2015-01-30 11:43:14 +0000295 { "hostbasedkeytypes", oHostbasedKeyTypes },
markus@openbsd.org3a1638d2015-07-10 06:21:53 +0000296 { "pubkeyacceptedkeytypes", oPubkeyAcceptedKeyTypes },
Darren Tucker07636982013-05-16 20:30:03 +1000297 { "ignoreunknown", oIgnoreUnknown },
Damien Miller01ed2272008-11-05 16:20:46 +1100298
Ben Lindstrom65366a82001-12-06 16:32:47 +0000299 { NULL, oBadOption }
Damien Miller5ce662a1999-11-11 17:57:39 +1100300};
301
Damien Miller5428f641999-11-25 11:54:57 +1100302/*
303 * Adds a local TCP/IP port forward to options. Never returns if there is an
304 * error.
305 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000306
Damien Miller4af51302000-04-16 11:18:38 +1000307void
Damien Miller7acefbb2014-07-18 14:11:24 +1000308add_local_forward(Options *options, const struct Forward *newfwd)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000309{
Damien Miller7acefbb2014-07-18 14:11:24 +1000310 struct Forward *fwd;
Damien Miller95def091999-11-25 00:26:21 +1100311 extern uid_t original_real_uid;
Darren Tucker5f41f032016-04-08 21:14:13 +1000312 int i;
djm@openbsd.org0ccbd5e2016-04-06 06:42:17 +0000313
Damien Miller7acefbb2014-07-18 14:11:24 +1000314 if (newfwd->listen_port < IPPORT_RESERVED && original_real_uid != 0 &&
315 newfwd->listen_path == NULL)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000316 fatal("Privileged ports can only be forwarded by root.");
djm@openbsd.org0ccbd5e2016-04-06 06:42:17 +0000317 /* Don't add duplicates */
318 for (i = 0; i < options->num_local_forwards; i++) {
319 if (forward_equals(newfwd, options->local_forwards + i))
320 return;
321 }
deraadt@openbsd.org657a5fb2015-04-24 01:36:00 +0000322 options->local_forwards = xreallocarray(options->local_forwards,
Damien Miller232cfb12010-06-26 09:50:30 +1000323 options->num_local_forwards + 1,
324 sizeof(*options->local_forwards));
Damien Miller95def091999-11-25 00:26:21 +1100325 fwd = &options->local_forwards[options->num_local_forwards++];
Damien Millerf91ee4c2005-03-01 21:24:33 +1100326
Damien Miller1a0442f2008-11-05 16:30:06 +1100327 fwd->listen_host = newfwd->listen_host;
Damien Millerf91ee4c2005-03-01 21:24:33 +1100328 fwd->listen_port = newfwd->listen_port;
Damien Miller7acefbb2014-07-18 14:11:24 +1000329 fwd->listen_path = newfwd->listen_path;
Damien Miller1a0442f2008-11-05 16:30:06 +1100330 fwd->connect_host = newfwd->connect_host;
Damien Millerf91ee4c2005-03-01 21:24:33 +1100331 fwd->connect_port = newfwd->connect_port;
Damien Miller7acefbb2014-07-18 14:11:24 +1000332 fwd->connect_path = newfwd->connect_path;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000333}
334
Damien Miller5428f641999-11-25 11:54:57 +1100335/*
336 * Adds a remote TCP/IP port forward to options. Never returns if there is
337 * an error.
338 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000339
Damien Miller4af51302000-04-16 11:18:38 +1000340void
Damien Miller7acefbb2014-07-18 14:11:24 +1000341add_remote_forward(Options *options, const struct Forward *newfwd)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000342{
Damien Miller7acefbb2014-07-18 14:11:24 +1000343 struct Forward *fwd;
djm@openbsd.org0ccbd5e2016-04-06 06:42:17 +0000344 int i;
Damien Miller232cfb12010-06-26 09:50:30 +1000345
djm@openbsd.org0ccbd5e2016-04-06 06:42:17 +0000346 /* Don't add duplicates */
347 for (i = 0; i < options->num_remote_forwards; i++) {
348 if (forward_equals(newfwd, options->remote_forwards + i))
349 return;
350 }
deraadt@openbsd.org657a5fb2015-04-24 01:36:00 +0000351 options->remote_forwards = xreallocarray(options->remote_forwards,
Damien Miller232cfb12010-06-26 09:50:30 +1000352 options->num_remote_forwards + 1,
353 sizeof(*options->remote_forwards));
Damien Miller95def091999-11-25 00:26:21 +1100354 fwd = &options->remote_forwards[options->num_remote_forwards++];
Damien Millerf91ee4c2005-03-01 21:24:33 +1100355
Damien Miller1a0442f2008-11-05 16:30:06 +1100356 fwd->listen_host = newfwd->listen_host;
Damien Millerf91ee4c2005-03-01 21:24:33 +1100357 fwd->listen_port = newfwd->listen_port;
Damien Miller7acefbb2014-07-18 14:11:24 +1000358 fwd->listen_path = newfwd->listen_path;
Damien Miller1a0442f2008-11-05 16:30:06 +1100359 fwd->connect_host = newfwd->connect_host;
Damien Millerf91ee4c2005-03-01 21:24:33 +1100360 fwd->connect_port = newfwd->connect_port;
Damien Miller7acefbb2014-07-18 14:11:24 +1000361 fwd->connect_path = newfwd->connect_path;
Darren Tucker68afb8c2011-10-02 18:59:03 +1100362 fwd->handle = newfwd->handle;
Damien Miller388f6fc2010-05-21 14:57:35 +1000363 fwd->allocated_port = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000364}
365
Ben Lindstrom2b7a0e92001-09-20 00:57:55 +0000366static void
367clear_forwardings(Options *options)
368{
369 int i;
370
Damien Millerf91ee4c2005-03-01 21:24:33 +1100371 for (i = 0; i < options->num_local_forwards; i++) {
Darren Tuckera627d422013-06-02 07:31:17 +1000372 free(options->local_forwards[i].listen_host);
Damien Miller7acefbb2014-07-18 14:11:24 +1000373 free(options->local_forwards[i].listen_path);
Darren Tuckera627d422013-06-02 07:31:17 +1000374 free(options->local_forwards[i].connect_host);
Damien Miller7acefbb2014-07-18 14:11:24 +1000375 free(options->local_forwards[i].connect_path);
Damien Millerf91ee4c2005-03-01 21:24:33 +1100376 }
Damien Miller232cfb12010-06-26 09:50:30 +1000377 if (options->num_local_forwards > 0) {
Darren Tuckera627d422013-06-02 07:31:17 +1000378 free(options->local_forwards);
Damien Miller232cfb12010-06-26 09:50:30 +1000379 options->local_forwards = NULL;
380 }
Ben Lindstrom2b7a0e92001-09-20 00:57:55 +0000381 options->num_local_forwards = 0;
Damien Millerf91ee4c2005-03-01 21:24:33 +1100382 for (i = 0; i < options->num_remote_forwards; i++) {
Darren Tuckera627d422013-06-02 07:31:17 +1000383 free(options->remote_forwards[i].listen_host);
Damien Miller7acefbb2014-07-18 14:11:24 +1000384 free(options->remote_forwards[i].listen_path);
Darren Tuckera627d422013-06-02 07:31:17 +1000385 free(options->remote_forwards[i].connect_host);
Damien Miller7acefbb2014-07-18 14:11:24 +1000386 free(options->remote_forwards[i].connect_path);
Damien Millerf91ee4c2005-03-01 21:24:33 +1100387 }
Damien Miller232cfb12010-06-26 09:50:30 +1000388 if (options->num_remote_forwards > 0) {
Darren Tuckera627d422013-06-02 07:31:17 +1000389 free(options->remote_forwards);
Damien Miller232cfb12010-06-26 09:50:30 +1000390 options->remote_forwards = NULL;
391 }
Ben Lindstrom2b7a0e92001-09-20 00:57:55 +0000392 options->num_remote_forwards = 0;
Damien Miller7b58e802005-12-13 19:33:19 +1100393 options->tun_open = SSH_TUNMODE_NO;
Ben Lindstrom2b7a0e92001-09-20 00:57:55 +0000394}
395
Darren Tucker19104782013-04-05 11:13:08 +1100396void
djm@openbsd.org4e44a792015-09-24 06:15:11 +0000397add_certificate_file(Options *options, const char *path, int userprovided)
398{
399 int i;
400
401 if (options->num_certificate_files >= SSH_MAX_CERTIFICATE_FILES)
402 fatal("Too many certificate files specified (max %d)",
403 SSH_MAX_CERTIFICATE_FILES);
404
405 /* Avoid registering duplicates */
406 for (i = 0; i < options->num_certificate_files; i++) {
407 if (options->certificate_file_userprovided[i] == userprovided &&
408 strcmp(options->certificate_files[i], path) == 0) {
409 debug2("%s: ignoring duplicate key %s", __func__, path);
410 return;
411 }
412 }
413
414 options->certificate_file_userprovided[options->num_certificate_files] =
415 userprovided;
416 options->certificate_files[options->num_certificate_files++] =
417 xstrdup(path);
418}
419
420void
Darren Tucker19104782013-04-05 11:13:08 +1100421add_identity_file(Options *options, const char *dir, const char *filename,
422 int userprovided)
423{
424 char *path;
Damien Miller15271902014-05-15 13:47:56 +1000425 int i;
Darren Tucker19104782013-04-05 11:13:08 +1100426
427 if (options->num_identity_files >= SSH_MAX_IDENTITY_FILES)
428 fatal("Too many identity files specified (max %d)",
429 SSH_MAX_IDENTITY_FILES);
430
431 if (dir == NULL) /* no dir, filename is absolute */
432 path = xstrdup(filename);
433 else
434 (void)xasprintf(&path, "%.100s%.100s", dir, filename);
435
Damien Miller15271902014-05-15 13:47:56 +1000436 /* Avoid registering duplicates */
437 for (i = 0; i < options->num_identity_files; i++) {
438 if (options->identity_file_userprovided[i] == userprovided &&
439 strcmp(options->identity_files[i], path) == 0) {
440 debug2("%s: ignoring duplicate key %s", __func__, path);
441 free(path);
442 return;
443 }
444 }
445
Darren Tucker19104782013-04-05 11:13:08 +1100446 options->identity_file_userprovided[options->num_identity_files] =
447 userprovided;
448 options->identity_files[options->num_identity_files++] = path;
449}
450
Damien Miller194fd902013-10-15 12:13:05 +1100451int
452default_ssh_port(void)
453{
454 static int port;
455 struct servent *sp;
456
457 if (port == 0) {
458 sp = getservbyname(SSH_SERVICE_NAME, "tcp");
459 port = sp ? ntohs(sp->s_port) : SSH_DEFAULT_PORT;
460 }
461 return port;
462}
463
464/*
465 * Execute a command in a shell.
466 * Return its exit status or -1 on abnormal exit.
467 */
468static int
469execute_in_shell(const char *cmd)
470{
dtucker@openbsd.org97e184e2015-10-25 23:14:03 +0000471 char *shell;
Damien Miller194fd902013-10-15 12:13:05 +1100472 pid_t pid;
473 int devnull, status;
474 extern uid_t original_real_uid;
475
476 if ((shell = getenv("SHELL")) == NULL)
477 shell = _PATH_BSHELL;
478
Damien Miller194fd902013-10-15 12:13:05 +1100479 /* Need this to redirect subprocess stdin/out */
480 if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1)
481 fatal("open(/dev/null): %s", strerror(errno));
482
483 debug("Executing command: '%.500s'", cmd);
484
485 /* Fork and execute the command. */
486 if ((pid = fork()) == 0) {
djm@openbsd.orga4aef3e2015-10-27 08:54:52 +0000487 char *argv[4];
Damien Miller194fd902013-10-15 12:13:05 +1100488
489 /* Child. Permanently give up superuser privileges. */
490 permanently_drop_suid(original_real_uid);
491
492 /* Redirect child stdin and stdout. Leave stderr */
493 if (dup2(devnull, STDIN_FILENO) == -1)
494 fatal("dup2: %s", strerror(errno));
495 if (dup2(devnull, STDOUT_FILENO) == -1)
496 fatal("dup2: %s", strerror(errno));
497 if (devnull > STDERR_FILENO)
498 close(devnull);
499 closefrom(STDERR_FILENO + 1);
500
djm@openbsd.orga4aef3e2015-10-27 08:54:52 +0000501 argv[0] = shell;
502 argv[1] = "-c";
503 argv[2] = xstrdup(cmd);
504 argv[3] = NULL;
505
Damien Miller194fd902013-10-15 12:13:05 +1100506 execv(argv[0], argv);
507 error("Unable to execute '%.100s': %s", cmd, strerror(errno));
508 /* Die with signal to make this error apparent to parent. */
509 signal(SIGTERM, SIG_DFL);
510 kill(getpid(), SIGTERM);
511 _exit(1);
512 }
513 /* Parent. */
514 if (pid < 0)
515 fatal("%s: fork: %.100s", __func__, strerror(errno));
516
517 close(devnull);
Damien Miller194fd902013-10-15 12:13:05 +1100518
519 while (waitpid(pid, &status, 0) == -1) {
520 if (errno != EINTR && errno != EAGAIN)
521 fatal("%s: waitpid: %s", __func__, strerror(errno));
522 }
523 if (!WIFEXITED(status)) {
524 error("command '%.100s' exited abnormally", cmd);
525 return -1;
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000526 }
Damien Miller194fd902013-10-15 12:13:05 +1100527 debug3("command returned status %d", WEXITSTATUS(status));
528 return WEXITSTATUS(status);
529}
530
531/*
532 * Parse and execute a Match directive.
533 */
534static int
535match_cfg_line(Options *options, char **condition, struct passwd *pw,
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000536 const char *host_arg, const char *original_host, int post_canon,
537 const char *filename, int linenum)
Damien Miller194fd902013-10-15 12:13:05 +1100538{
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000539 char *arg, *oattrib, *attrib, *cmd, *cp = *condition, *host, *criteria;
Damien Miller084bcd22013-10-23 16:30:51 +1100540 const char *ruser;
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000541 int r, port, this_result, result = 1, attributes = 0, negate;
Damien Miller194fd902013-10-15 12:13:05 +1100542 char thishost[NI_MAXHOST], shorthost[NI_MAXHOST], portstr[NI_MAXSERV];
543
544 /*
545 * Configuration is likely to be incomplete at this point so we
546 * must be prepared to use default values.
547 */
548 port = options->port <= 0 ? default_ssh_port() : options->port;
549 ruser = options->user == NULL ? pw->pw_name : options->user;
djm@openbsd.org5a622842016-02-08 23:40:12 +0000550 if (post_canon) {
551 host = xstrdup(options->hostname);
552 } else if (options->hostname != NULL) {
Damien Millereff5cad2013-10-23 16:31:10 +1100553 /* NB. Please keep in sync with ssh.c:main() */
Damien Miller084bcd22013-10-23 16:30:51 +1100554 host = percent_expand(options->hostname,
555 "h", host_arg, (char *)NULL);
djm@openbsd.org5a622842016-02-08 23:40:12 +0000556 } else {
Damien Miller084bcd22013-10-23 16:30:51 +1100557 host = xstrdup(host_arg);
djm@openbsd.org5a622842016-02-08 23:40:12 +0000558 }
Damien Miller194fd902013-10-15 12:13:05 +1100559
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000560 debug2("checking match for '%s' host %s originally %s",
561 cp, host, original_host);
562 while ((oattrib = attrib = strdelim(&cp)) && *attrib != '\0') {
563 criteria = NULL;
564 this_result = 1;
565 if ((negate = attrib[0] == '!'))
566 attrib++;
567 /* criteria "all" and "canonical" have no argument */
Damien Millercf31f382013-10-24 21:02:56 +1100568 if (strcasecmp(attrib, "all") == 0) {
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000569 if (attributes > 1 ||
Damien Millercf31f382013-10-24 21:02:56 +1100570 ((arg = strdelim(&cp)) != NULL && *arg != '\0')) {
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000571 error("%.200s line %d: '%s' cannot be combined "
572 "with other Match attributes",
573 filename, linenum, oattrib);
Damien Millercf31f382013-10-24 21:02:56 +1100574 result = -1;
575 goto out;
576 }
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000577 if (result)
578 result = negate ? 0 : 1;
Damien Millercf31f382013-10-24 21:02:56 +1100579 goto out;
580 }
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000581 attributes++;
582 if (strcasecmp(attrib, "canonical") == 0) {
583 r = !!post_canon; /* force bitmask member to boolean */
584 if (r == (negate ? 1 : 0))
585 this_result = result = 0;
586 debug3("%.200s line %d: %smatched '%s'",
587 filename, linenum,
588 this_result ? "" : "not ", oattrib);
589 continue;
590 }
591 /* All other criteria require an argument */
Damien Miller194fd902013-10-15 12:13:05 +1100592 if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
593 error("Missing Match criteria for %s", attrib);
Damien Miller084bcd22013-10-23 16:30:51 +1100594 result = -1;
595 goto out;
Damien Miller194fd902013-10-15 12:13:05 +1100596 }
Damien Miller194fd902013-10-15 12:13:05 +1100597 if (strcasecmp(attrib, "host") == 0) {
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000598 criteria = xstrdup(host);
djm@openbsd.orge661a862015-05-04 06:10:48 +0000599 r = match_hostname(host, arg) == 1;
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000600 if (r == (negate ? 1 : 0))
601 this_result = result = 0;
Damien Miller194fd902013-10-15 12:13:05 +1100602 } else if (strcasecmp(attrib, "originalhost") == 0) {
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000603 criteria = xstrdup(original_host);
djm@openbsd.orge661a862015-05-04 06:10:48 +0000604 r = match_hostname(original_host, arg) == 1;
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000605 if (r == (negate ? 1 : 0))
606 this_result = result = 0;
Damien Miller194fd902013-10-15 12:13:05 +1100607 } else if (strcasecmp(attrib, "user") == 0) {
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000608 criteria = xstrdup(ruser);
djm@openbsd.orge661a862015-05-04 06:10:48 +0000609 r = match_pattern_list(ruser, arg, 0) == 1;
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000610 if (r == (negate ? 1 : 0))
611 this_result = result = 0;
Damien Miller194fd902013-10-15 12:13:05 +1100612 } else if (strcasecmp(attrib, "localuser") == 0) {
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000613 criteria = xstrdup(pw->pw_name);
djm@openbsd.orge661a862015-05-04 06:10:48 +0000614 r = match_pattern_list(pw->pw_name, arg, 0) == 1;
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000615 if (r == (negate ? 1 : 0))
616 this_result = result = 0;
Damien Miller8a04be72013-10-23 16:29:40 +1100617 } else if (strcasecmp(attrib, "exec") == 0) {
Damien Miller194fd902013-10-15 12:13:05 +1100618 if (gethostname(thishost, sizeof(thishost)) == -1)
619 fatal("gethostname: %s", strerror(errno));
620 strlcpy(shorthost, thishost, sizeof(shorthost));
621 shorthost[strcspn(thishost, ".")] = '\0';
622 snprintf(portstr, sizeof(portstr), "%d", port);
623
624 cmd = percent_expand(arg,
625 "L", shorthost,
626 "d", pw->pw_dir,
627 "h", host,
628 "l", thishost,
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000629 "n", original_host,
Damien Miller194fd902013-10-15 12:13:05 +1100630 "p", portstr,
631 "r", ruser,
632 "u", pw->pw_name,
633 (char *)NULL);
Damien Miller06287802014-02-24 15:56:45 +1100634 if (result != 1) {
635 /* skip execution if prior predicate failed */
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000636 debug3("%.200s line %d: skipped exec "
637 "\"%.100s\"", filename, linenum, cmd);
638 free(cmd);
639 continue;
Damien Miller06287802014-02-24 15:56:45 +1100640 }
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000641 r = execute_in_shell(cmd);
642 if (r == -1) {
643 fatal("%.200s line %d: match exec "
644 "'%.100s' error", filename,
645 linenum, cmd);
646 }
647 criteria = xstrdup(cmd);
Damien Miller194fd902013-10-15 12:13:05 +1100648 free(cmd);
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000649 /* Force exit status to boolean */
650 r = r == 0;
651 if (r == (negate ? 1 : 0))
652 this_result = result = 0;
Damien Miller194fd902013-10-15 12:13:05 +1100653 } else {
654 error("Unsupported Match attribute %s", attrib);
Damien Miller084bcd22013-10-23 16:30:51 +1100655 result = -1;
656 goto out;
Damien Miller194fd902013-10-15 12:13:05 +1100657 }
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000658 debug3("%.200s line %d: %smatched '%s \"%.100s\"' ",
659 filename, linenum, this_result ? "": "not ",
660 oattrib, criteria);
661 free(criteria);
Damien Miller194fd902013-10-15 12:13:05 +1100662 }
Damien Millercf31f382013-10-24 21:02:56 +1100663 if (attributes == 0) {
664 error("One or more attributes required for Match");
665 result = -1;
666 goto out;
667 }
Damien Miller084bcd22013-10-23 16:30:51 +1100668 out:
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000669 if (result != -1)
670 debug2("match %sfound", result ? "" : "not ");
671 *condition = cp;
Damien Miller084bcd22013-10-23 16:30:51 +1100672 free(host);
Damien Miller194fd902013-10-15 12:13:05 +1100673 return result;
674}
675
Damien Miller0faf7472013-10-17 11:47:23 +1100676/* Check and prepare a domain name: removes trailing '.' and lowercases */
677static void
678valid_domain(char *name, const char *filename, int linenum)
679{
680 size_t i, l = strlen(name);
681 u_char c, last = '\0';
682
683 if (l == 0)
684 fatal("%s line %d: empty hostname suffix", filename, linenum);
685 if (!isalpha((u_char)name[0]) && !isdigit((u_char)name[0]))
686 fatal("%s line %d: hostname suffix \"%.100s\" "
687 "starts with invalid character", filename, linenum, name);
688 for (i = 0; i < l; i++) {
689 c = tolower((u_char)name[i]);
690 name[i] = (char)c;
691 if (last == '.' && c == '.')
692 fatal("%s line %d: hostname suffix \"%.100s\" contains "
693 "consecutive separators", filename, linenum, name);
694 if (c != '.' && c != '-' && !isalnum(c) &&
695 c != '_') /* technically invalid, but common */
696 fatal("%s line %d: hostname suffix \"%.100s\" contains "
697 "invalid characters", filename, linenum, name);
698 last = c;
699 }
700 if (name[l - 1] == '.')
701 name[l - 1] = '\0';
702}
703
Damien Miller5428f641999-11-25 11:54:57 +1100704/*
Ben Lindstrom3704c262001-04-02 18:20:03 +0000705 * Returns the number of the token pointed to by cp or oBadOption.
Damien Miller5428f641999-11-25 11:54:57 +1100706 */
Damien Miller4af51302000-04-16 11:18:38 +1000707static OpCodes
Darren Tucker07636982013-05-16 20:30:03 +1000708parse_token(const char *cp, const char *filename, int linenum,
709 const char *ignored_unknown)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000710{
Darren Tucker07636982013-05-16 20:30:03 +1000711 int i;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000712
Damien Miller95def091999-11-25 00:26:21 +1100713 for (i = 0; keywords[i].name; i++)
Darren Tucker07636982013-05-16 20:30:03 +1000714 if (strcmp(cp, keywords[i].name) == 0)
Damien Miller95def091999-11-25 00:26:21 +1100715 return keywords[i].opcode;
djm@openbsd.orge661a862015-05-04 06:10:48 +0000716 if (ignored_unknown != NULL &&
717 match_pattern_list(cp, ignored_unknown, 1) == 1)
Darren Tucker07636982013-05-16 20:30:03 +1000718 return oIgnoredUnknownOption;
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000719 error("%s: line %d: Bad configuration option: %s",
720 filename, linenum, cp);
Damien Miller95def091999-11-25 00:26:21 +1100721 return oBadOption;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000722}
723
Damien Millere9fc72e2013-10-15 12:14:12 +1100724/* Multistate option parsing */
725struct multistate {
726 char *key;
727 int value;
728};
729static const struct multistate multistate_flag[] = {
730 { "true", 1 },
731 { "false", 0 },
732 { "yes", 1 },
733 { "no", 0 },
734 { NULL, -1 }
735};
736static const struct multistate multistate_yesnoask[] = {
737 { "true", 1 },
738 { "false", 0 },
739 { "yes", 1 },
740 { "no", 0 },
741 { "ask", 2 },
742 { NULL, -1 }
743};
jcs@openbsd.orgf361df42015-11-15 22:26:49 +0000744static const struct multistate multistate_yesnoaskconfirm[] = {
745 { "true", 1 },
746 { "false", 0 },
747 { "yes", 1 },
748 { "no", 0 },
749 { "ask", 2 },
750 { "confirm", 3 },
751 { NULL, -1 }
752};
Damien Millere9fc72e2013-10-15 12:14:12 +1100753static const struct multistate multistate_addressfamily[] = {
754 { "inet", AF_INET },
755 { "inet6", AF_INET6 },
756 { "any", AF_UNSPEC },
757 { NULL, -1 }
758};
759static const struct multistate multistate_controlmaster[] = {
760 { "true", SSHCTL_MASTER_YES },
761 { "yes", SSHCTL_MASTER_YES },
762 { "false", SSHCTL_MASTER_NO },
763 { "no", SSHCTL_MASTER_NO },
764 { "auto", SSHCTL_MASTER_AUTO },
765 { "ask", SSHCTL_MASTER_ASK },
766 { "autoask", SSHCTL_MASTER_AUTO_ASK },
767 { NULL, -1 }
768};
769static const struct multistate multistate_tunnel[] = {
770 { "ethernet", SSH_TUNMODE_ETHERNET },
771 { "point-to-point", SSH_TUNMODE_POINTOPOINT },
772 { "true", SSH_TUNMODE_DEFAULT },
773 { "yes", SSH_TUNMODE_DEFAULT },
774 { "false", SSH_TUNMODE_NO },
775 { "no", SSH_TUNMODE_NO },
776 { NULL, -1 }
777};
778static const struct multistate multistate_requesttty[] = {
779 { "true", REQUEST_TTY_YES },
780 { "yes", REQUEST_TTY_YES },
781 { "false", REQUEST_TTY_NO },
782 { "no", REQUEST_TTY_NO },
783 { "force", REQUEST_TTY_FORCE },
784 { "auto", REQUEST_TTY_AUTO },
785 { NULL, -1 }
786};
Damien Miller38505592013-10-17 11:48:13 +1100787static const struct multistate multistate_canonicalizehostname[] = {
Damien Miller0faf7472013-10-17 11:47:23 +1100788 { "true", SSH_CANONICALISE_YES },
789 { "false", SSH_CANONICALISE_NO },
790 { "yes", SSH_CANONICALISE_YES },
791 { "no", SSH_CANONICALISE_NO },
792 { "always", SSH_CANONICALISE_ALWAYS },
793 { NULL, -1 }
794};
Damien Millere9fc72e2013-10-15 12:14:12 +1100795
Damien Miller5428f641999-11-25 11:54:57 +1100796/*
797 * Processes a single option line as used in the configuration files. This
798 * only sets those values that have not already been set.
799 */
Damien Miller2ccf6611999-11-15 15:25:10 +1100800int
Damien Miller194fd902013-10-15 12:13:05 +1100801process_config_line(Options *options, struct passwd *pw, const char *host,
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000802 const char *original_host, char *line, const char *filename,
803 int linenum, int *activep, int flags)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000804{
djm@openbsd.orgdc7990b2016-04-15 00:30:19 +0000805 return process_config_line_depth(options, pw, host, original_host,
806 line, filename, linenum, activep, flags, 0);
807}
808
809#define WHITESPACE " \t\r\n"
810static int
811process_config_line_depth(Options *options, struct passwd *pw, const char *host,
812 const char *original_host, char *line, const char *filename,
813 int linenum, int *activep, int flags, int depth)
814{
Damien Miller295ee632011-05-29 21:42:31 +1000815 char *s, **charptr, *endofnumber, *keyword, *arg, *arg2;
816 char **cpptr, fwdarg[256];
Darren Tucker07636982013-05-16 20:30:03 +1000817 u_int i, *uintptr, max_entries = 0;
djm@openbsd.orgdc7990b2016-04-15 00:30:19 +0000818 int r, oactive, negated, opcode, *intptr, value, value2, cmdline = 0;
Darren Tucker1e44c5d2008-01-01 20:32:26 +1100819 LogLevel *log_level_ptr;
Darren Tucker9113d0c2013-05-16 20:48:14 +1000820 long long val64;
Damien Miller61f08ac2003-02-24 11:56:27 +1100821 size_t len;
Damien Miller7acefbb2014-07-18 14:11:24 +1000822 struct Forward fwd;
Damien Millere9fc72e2013-10-15 12:14:12 +1100823 const struct multistate *multistate_ptr;
Damien Miller0faf7472013-10-17 11:47:23 +1100824 struct allowed_cname *cname;
djm@openbsd.orgdc7990b2016-04-15 00:30:19 +0000825 glob_t gl;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000826
Damien Miller194fd902013-10-15 12:13:05 +1100827 if (activep == NULL) { /* We are processing a command line directive */
828 cmdline = 1;
829 activep = &cmdline;
830 }
831
Damien Millerc652cac2003-05-14 13:40:54 +1000832 /* Strip trailing whitespace */
djm@openbsd.org26e0bcf2015-03-30 00:00:29 +0000833 if ((len = strlen(line)) == 0)
834 return 0;
835 for (len--; len > 0; len--) {
Damien Millerc652cac2003-05-14 13:40:54 +1000836 if (strchr(WHITESPACE, line[len]) == NULL)
837 break;
838 line[len] = '\0';
839 }
840
Damien Millerbe484b52000-07-15 14:14:16 +1000841 s = line;
842 /* Get the keyword. (Each line is supposed to begin with a keyword). */
Damien Miller928b2362006-03-26 13:53:32 +1100843 if ((keyword = strdelim(&s)) == NULL)
844 return 0;
Damien Millerbe484b52000-07-15 14:14:16 +1000845 /* Ignore leading whitespace. */
846 if (*keyword == '\0')
847 keyword = strdelim(&s);
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000848 if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
Damien Miller95def091999-11-25 00:26:21 +1100849 return 0;
Darren Tucker07636982013-05-16 20:30:03 +1000850 /* Match lowercase keyword */
Damien Millere9fc72e2013-10-15 12:14:12 +1100851 lowercase(keyword);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000852
Darren Tucker07636982013-05-16 20:30:03 +1000853 opcode = parse_token(keyword, filename, linenum,
854 options->ignored_unknown);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000855
Damien Miller95def091999-11-25 00:26:21 +1100856 switch (opcode) {
857 case oBadOption:
Damien Miller5428f641999-11-25 11:54:57 +1100858 /* don't panic, but count bad options */
859 return -1;
Damien Miller95def091999-11-25 00:26:21 +1100860 /* NOTREACHED */
Darren Tucker07636982013-05-16 20:30:03 +1000861 case oIgnoredUnknownOption:
862 debug("%s line %d: Ignored unknown option \"%s\"",
863 filename, linenum, keyword);
864 return 0;
Damien Millerb78d5eb2003-05-16 11:39:04 +1000865 case oConnectTimeout:
866 intptr = &options->connection_timeout;
Damien Miller509b0102003-12-17 16:33:10 +1100867parse_time:
Damien Millerb78d5eb2003-05-16 11:39:04 +1000868 arg = strdelim(&s);
869 if (!arg || *arg == '\0')
870 fatal("%s line %d: missing time value.",
871 filename, linenum);
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000872 if (strcmp(arg, "none") == 0)
873 value = -1;
874 else if ((value = convtime(arg)) == -1)
Damien Millerb78d5eb2003-05-16 11:39:04 +1000875 fatal("%s line %d: invalid time value.",
876 filename, linenum);
Darren Tuckera52c5b62007-02-19 22:09:45 +1100877 if (*activep && *intptr == -1)
Damien Millerb78d5eb2003-05-16 11:39:04 +1000878 *intptr = value;
879 break;
880
Damien Miller95def091999-11-25 00:26:21 +1100881 case oForwardAgent:
882 intptr = &options->forward_agent;
Damien Millere9fc72e2013-10-15 12:14:12 +1100883 parse_flag:
884 multistate_ptr = multistate_flag;
885 parse_multistate:
Damien Millerbe484b52000-07-15 14:14:16 +1000886 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +1000887 if (!arg || *arg == '\0')
Damien Millere9fc72e2013-10-15 12:14:12 +1100888 fatal("%s line %d: missing argument.",
889 filename, linenum);
890 value = -1;
891 for (i = 0; multistate_ptr[i].key != NULL; i++) {
892 if (strcasecmp(arg, multistate_ptr[i].key) == 0) {
893 value = multistate_ptr[i].value;
894 break;
895 }
896 }
897 if (value == -1)
898 fatal("%s line %d: unsupported option \"%s\".",
899 filename, linenum, arg);
Damien Miller95def091999-11-25 00:26:21 +1100900 if (*activep && *intptr == -1)
901 *intptr = value;
902 break;
903
904 case oForwardX11:
905 intptr = &options->forward_x11;
906 goto parse_flag;
907
Darren Tucker0a118da2003-10-15 15:54:32 +1000908 case oForwardX11Trusted:
909 intptr = &options->forward_x11_trusted;
910 goto parse_flag;
djm@openbsd.org957fbce2014-10-08 22:20:25 +0000911
Damien Miller1ab6a512010-06-26 10:02:24 +1000912 case oForwardX11Timeout:
913 intptr = &options->forward_x11_timeout;
914 goto parse_time;
Darren Tucker0a118da2003-10-15 15:54:32 +1000915
Damien Miller95def091999-11-25 00:26:21 +1100916 case oGatewayPorts:
Damien Miller7acefbb2014-07-18 14:11:24 +1000917 intptr = &options->fwd_opts.gateway_ports;
Damien Miller95def091999-11-25 00:26:21 +1100918 goto parse_flag;
919
Darren Tuckere7d4b192006-07-12 22:17:10 +1000920 case oExitOnForwardFailure:
921 intptr = &options->exit_on_forward_failure;
922 goto parse_flag;
923
Damien Miller95def091999-11-25 00:26:21 +1100924 case oUsePrivilegedPort:
925 intptr = &options->use_privileged_port;
926 goto parse_flag;
927
Damien Miller95def091999-11-25 00:26:21 +1100928 case oPasswordAuthentication:
929 intptr = &options->password_authentication;
930 goto parse_flag;
931
Damien Miller874d77b2000-10-14 16:23:11 +1100932 case oKbdInteractiveAuthentication:
933 intptr = &options->kbd_interactive_authentication;
934 goto parse_flag;
935
936 case oKbdInteractiveDevices:
937 charptr = &options->kbd_interactive_devices;
938 goto parse_string;
939
Damien Miller0bc1bd82000-11-13 22:57:25 +1100940 case oPubkeyAuthentication:
941 intptr = &options->pubkey_authentication;
Damien Millere247cc42000-05-07 12:03:14 +1000942 goto parse_flag;
943
Damien Miller95def091999-11-25 00:26:21 +1100944 case oRSAAuthentication:
945 intptr = &options->rsa_authentication;
946 goto parse_flag;
947
948 case oRhostsRSAAuthentication:
949 intptr = &options->rhosts_rsa_authentication;
950 goto parse_flag;
951
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000952 case oHostbasedAuthentication:
953 intptr = &options->hostbased_authentication;
954 goto parse_flag;
955
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000956 case oChallengeResponseAuthentication:
Ben Lindstrom551ea372001-06-05 18:56:16 +0000957 intptr = &options->challenge_response_authentication;
Damien Miller95def091999-11-25 00:26:21 +1100958 goto parse_flag;
Damien Miller2aa0ab42003-05-15 12:05:28 +1000959
Darren Tucker0efd1552003-08-26 11:49:55 +1000960 case oGssAuthentication:
961 intptr = &options->gss_authentication;
962 goto parse_flag;
963
964 case oGssDelegateCreds:
965 intptr = &options->gss_deleg_creds;
966 goto parse_flag;
967
Damien Miller95def091999-11-25 00:26:21 +1100968 case oBatchMode:
969 intptr = &options->batch_mode;
970 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000971
Damien Miller95def091999-11-25 00:26:21 +1100972 case oCheckHostIP:
973 intptr = &options->check_host_ip;
Damien Miller10288242008-06-30 00:04:03 +1000974 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000975
Damien Miller37876e92003-05-15 10:19:46 +1000976 case oVerifyHostKeyDNS:
977 intptr = &options->verify_host_key_dns;
Damien Millere9fc72e2013-10-15 12:14:12 +1100978 multistate_ptr = multistate_yesnoask;
979 goto parse_multistate;
Damien Miller37876e92003-05-15 10:19:46 +1000980
Damien Miller95def091999-11-25 00:26:21 +1100981 case oStrictHostKeyChecking:
982 intptr = &options->strict_host_key_checking;
Damien Millere9fc72e2013-10-15 12:14:12 +1100983 multistate_ptr = multistate_yesnoask;
984 goto parse_multistate;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000985
Damien Miller95def091999-11-25 00:26:21 +1100986 case oCompression:
987 intptr = &options->compression;
988 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000989
Damien Miller12c150e2003-12-17 16:31:10 +1100990 case oTCPKeepAlive:
991 intptr = &options->tcp_keep_alive;
Damien Miller95def091999-11-25 00:26:21 +1100992 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000993
Ben Lindstrom3cecc9a2001-10-03 17:39:38 +0000994 case oNoHostAuthenticationForLocalhost:
995 intptr = &options->no_host_authentication_for_localhost;
996 goto parse_flag;
997
Damien Miller95def091999-11-25 00:26:21 +1100998 case oNumberOfPasswordPrompts:
999 intptr = &options->number_of_password_prompts;
1000 goto parse_int;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001001
Damien Miller95def091999-11-25 00:26:21 +11001002 case oCompressionLevel:
1003 intptr = &options->compression_level;
1004 goto parse_int;
1005
Damien Millera5539d22003-04-09 20:50:06 +10001006 case oRekeyLimit:
Damien Millera5539d22003-04-09 20:50:06 +10001007 arg = strdelim(&s);
1008 if (!arg || *arg == '\0')
Darren Tuckerc53c2af2013-05-16 20:28:16 +10001009 fatal("%.200s line %d: Missing argument.", filename,
1010 linenum);
1011 if (strcmp(arg, "default") == 0) {
1012 val64 = 0;
1013 } else {
Darren Tuckerb7ee8522013-05-16 20:33:10 +10001014 if (scan_scaled(arg, &val64) == -1)
1015 fatal("%.200s line %d: Bad number '%s': %s",
1016 filename, linenum, arg, strerror(errno));
Darren Tuckerc53c2af2013-05-16 20:28:16 +10001017 if (val64 != 0 && val64 < 16)
1018 fatal("%.200s line %d: RekeyLimit too small",
1019 filename, linenum);
Damien Millera5539d22003-04-09 20:50:06 +10001020 }
Damien Miller3dff1762008-02-10 22:25:52 +11001021 if (*activep && options->rekey_limit == -1)
dtucker@openbsd.org921ff002016-01-29 02:54:45 +00001022 options->rekey_limit = val64;
Darren Tuckerc53c2af2013-05-16 20:28:16 +10001023 if (s != NULL) { /* optional rekey interval present */
1024 if (strcmp(s, "none") == 0) {
1025 (void)strdelim(&s); /* discard */
1026 break;
1027 }
1028 intptr = &options->rekey_interval;
1029 goto parse_time;
1030 }
Damien Millera5539d22003-04-09 20:50:06 +10001031 break;
1032
Damien Miller95def091999-11-25 00:26:21 +11001033 case oIdentityFile:
Damien Millerbe484b52000-07-15 14:14:16 +10001034 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +10001035 if (!arg || *arg == '\0')
Damien Miller95def091999-11-25 00:26:21 +11001036 fatal("%.200s line %d: Missing argument.", filename, linenum);
1037 if (*activep) {
Damien Miller0bc1bd82000-11-13 22:57:25 +11001038 intptr = &options->num_identity_files;
Damien Millereba71ba2000-04-29 23:57:08 +10001039 if (*intptr >= SSH_MAX_IDENTITY_FILES)
Damien Miller95def091999-11-25 00:26:21 +11001040 fatal("%.200s line %d: Too many identity files specified (max %d).",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001041 filename, linenum, SSH_MAX_IDENTITY_FILES);
djm@openbsd.org957fbce2014-10-08 22:20:25 +00001042 add_identity_file(options, NULL,
1043 arg, flags & SSHCONF_USERCONF);
Damien Miller95def091999-11-25 00:26:21 +11001044 }
1045 break;
1046
djm@openbsd.org4e44a792015-09-24 06:15:11 +00001047 case oCertificateFile:
1048 arg = strdelim(&s);
1049 if (!arg || *arg == '\0')
1050 fatal("%.200s line %d: Missing argument.",
1051 filename, linenum);
1052 if (*activep) {
1053 intptr = &options->num_certificate_files;
1054 if (*intptr >= SSH_MAX_CERTIFICATE_FILES) {
1055 fatal("%.200s line %d: Too many certificate "
1056 "files specified (max %d).",
1057 filename, linenum,
1058 SSH_MAX_CERTIFICATE_FILES);
1059 }
1060 add_certificate_file(options, arg,
1061 flags & SSHCONF_USERCONF);
1062 }
1063 break;
1064
Damien Millerd3a18572000-06-07 19:55:44 +10001065 case oXAuthLocation:
1066 charptr=&options->xauth_location;
1067 goto parse_string;
1068
Damien Miller95def091999-11-25 00:26:21 +11001069 case oUser:
1070 charptr = &options->user;
1071parse_string:
Damien Millerbe484b52000-07-15 14:14:16 +10001072 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +10001073 if (!arg || *arg == '\0')
Damien Miller295ee632011-05-29 21:42:31 +10001074 fatal("%.200s line %d: Missing argument.",
1075 filename, linenum);
Damien Miller95def091999-11-25 00:26:21 +11001076 if (*activep && *charptr == NULL)
Damien Miller37023962000-07-11 17:31:38 +10001077 *charptr = xstrdup(arg);
Damien Miller95def091999-11-25 00:26:21 +11001078 break;
1079
1080 case oGlobalKnownHostsFile:
Damien Miller295ee632011-05-29 21:42:31 +10001081 cpptr = (char **)&options->system_hostfiles;
1082 uintptr = &options->num_system_hostfiles;
1083 max_entries = SSH_MAX_HOSTS_FILES;
1084parse_char_array:
1085 if (*activep && *uintptr == 0) {
1086 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1087 if ((*uintptr) >= max_entries)
1088 fatal("%s line %d: "
1089 "too many authorized keys files.",
1090 filename, linenum);
1091 cpptr[(*uintptr)++] = xstrdup(arg);
1092 }
1093 }
1094 return 0;
Damien Miller95def091999-11-25 00:26:21 +11001095
1096 case oUserKnownHostsFile:
Damien Miller295ee632011-05-29 21:42:31 +10001097 cpptr = (char **)&options->user_hostfiles;
1098 uintptr = &options->num_user_hostfiles;
1099 max_entries = SSH_MAX_HOSTS_FILES;
1100 goto parse_char_array;
Damien Millereba71ba2000-04-29 23:57:08 +10001101
Damien Miller95def091999-11-25 00:26:21 +11001102 case oHostName:
1103 charptr = &options->hostname;
1104 goto parse_string;
1105
Ben Lindstrom4dccfa52000-12-28 16:40:05 +00001106 case oHostKeyAlias:
1107 charptr = &options->host_key_alias;
1108 goto parse_string;
1109
Ben Lindstromb9be60a2001-03-11 01:49:19 +00001110 case oPreferredAuthentications:
1111 charptr = &options->preferred_authentications;
1112 goto parse_string;
1113
Ben Lindstrome0f88042001-04-30 13:06:24 +00001114 case oBindAddress:
1115 charptr = &options->bind_address;
1116 goto parse_string;
1117
Damien Miller7ea845e2010-02-12 09:21:02 +11001118 case oPKCS11Provider:
1119 charptr = &options->pkcs11_provider;
Ben Lindstromf7db3bb2001-08-06 21:35:51 +00001120 goto parse_string;
Ben Lindstromae996bf2001-08-06 21:27:53 +00001121
Damien Miller95def091999-11-25 00:26:21 +11001122 case oProxyCommand:
Damien Millerd27b9472005-12-13 19:29:02 +11001123 charptr = &options->proxy_command;
1124parse_command:
Darren Tuckera99c1b72003-06-28 12:40:12 +10001125 if (s == NULL)
1126 fatal("%.200s line %d: Missing argument.", filename, linenum);
Damien Miller61f08ac2003-02-24 11:56:27 +11001127 len = strspn(s, WHITESPACE "=");
Damien Miller95def091999-11-25 00:26:21 +11001128 if (*activep && *charptr == NULL)
Damien Miller61f08ac2003-02-24 11:56:27 +11001129 *charptr = xstrdup(s + len);
Damien Miller95def091999-11-25 00:26:21 +11001130 return 0;
1131
1132 case oPort:
1133 intptr = &options->port;
1134parse_int:
Damien Millerbe484b52000-07-15 14:14:16 +10001135 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +10001136 if (!arg || *arg == '\0')
Damien Miller95def091999-11-25 00:26:21 +11001137 fatal("%.200s line %d: Missing argument.", filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +10001138 if (arg[0] < '0' || arg[0] > '9')
Damien Miller95def091999-11-25 00:26:21 +11001139 fatal("%.200s line %d: Bad number.", filename, linenum);
Damien Miller5428f641999-11-25 11:54:57 +11001140
1141 /* Octal, decimal, or hex format? */
Damien Miller37023962000-07-11 17:31:38 +10001142 value = strtol(arg, &endofnumber, 0);
1143 if (arg == endofnumber)
Damien Miller5428f641999-11-25 11:54:57 +11001144 fatal("%.200s line %d: Bad number.", filename, linenum);
Damien Miller95def091999-11-25 00:26:21 +11001145 if (*activep && *intptr == -1)
1146 *intptr = value;
1147 break;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001148
Damien Miller95def091999-11-25 00:26:21 +11001149 case oConnectionAttempts:
1150 intptr = &options->connection_attempts;
1151 goto parse_int;
Damien Miller5ce662a1999-11-11 17:57:39 +11001152
Damien Miller95def091999-11-25 00:26:21 +11001153 case oCipher:
1154 intptr = &options->cipher;
Damien Millerbe484b52000-07-15 14:14:16 +10001155 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +10001156 if (!arg || *arg == '\0')
Damien Millerb1715dc2000-05-30 13:44:51 +10001157 fatal("%.200s line %d: Missing argument.", filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +10001158 value = cipher_number(arg);
Damien Miller95def091999-11-25 00:26:21 +11001159 if (value == -1)
1160 fatal("%.200s line %d: Bad cipher '%s'.",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001161 filename, linenum, arg ? arg : "<NONE>");
Damien Miller95def091999-11-25 00:26:21 +11001162 if (*activep && *intptr == -1)
1163 *intptr = value;
1164 break;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001165
Damien Miller78928792000-04-12 20:17:38 +10001166 case oCiphers:
Damien Millerbe484b52000-07-15 14:14:16 +10001167 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +10001168 if (!arg || *arg == '\0')
Damien Millerb1715dc2000-05-30 13:44:51 +10001169 fatal("%.200s line %d: Missing argument.", filename, linenum);
djm@openbsd.orgf9eca242015-07-30 00:01:34 +00001170 if (!ciphers_valid(*arg == '+' ? arg + 1 : arg))
Damien Miller30c3d422000-05-09 11:02:59 +10001171 fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001172 filename, linenum, arg ? arg : "<NONE>");
Damien Miller78928792000-04-12 20:17:38 +10001173 if (*activep && options->ciphers == NULL)
Damien Miller37023962000-07-11 17:31:38 +10001174 options->ciphers = xstrdup(arg);
Damien Miller78928792000-04-12 20:17:38 +10001175 break;
1176
Ben Lindstrom06b33aa2001-02-15 03:01:59 +00001177 case oMacs:
1178 arg = strdelim(&s);
1179 if (!arg || *arg == '\0')
1180 fatal("%.200s line %d: Missing argument.", filename, linenum);
djm@openbsd.orgf9eca242015-07-30 00:01:34 +00001181 if (!mac_valid(*arg == '+' ? arg + 1 : arg))
Ben Lindstrom06b33aa2001-02-15 03:01:59 +00001182 fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001183 filename, linenum, arg ? arg : "<NONE>");
Ben Lindstrom06b33aa2001-02-15 03:01:59 +00001184 if (*activep && options->macs == NULL)
1185 options->macs = xstrdup(arg);
1186 break;
1187
Damien Millerd5f62bf2010-09-24 22:11:14 +10001188 case oKexAlgorithms:
1189 arg = strdelim(&s);
1190 if (!arg || *arg == '\0')
1191 fatal("%.200s line %d: Missing argument.",
1192 filename, linenum);
djm@openbsd.orgf9eca242015-07-30 00:01:34 +00001193 if (!kex_names_valid(*arg == '+' ? arg + 1 : arg))
Damien Millerd5f62bf2010-09-24 22:11:14 +10001194 fatal("%.200s line %d: Bad SSH2 KexAlgorithms '%s'.",
1195 filename, linenum, arg ? arg : "<NONE>");
1196 if (*activep && options->kex_algorithms == NULL)
1197 options->kex_algorithms = xstrdup(arg);
1198 break;
1199
Ben Lindstrom982dbbc2001-04-17 18:11:36 +00001200 case oHostKeyAlgorithms:
markus@openbsd.org3a1638d2015-07-10 06:21:53 +00001201 charptr = &options->hostkeyalgorithms;
1202parse_keytypes:
Ben Lindstrom982dbbc2001-04-17 18:11:36 +00001203 arg = strdelim(&s);
1204 if (!arg || *arg == '\0')
markus@openbsd.org3a1638d2015-07-10 06:21:53 +00001205 fatal("%.200s line %d: Missing argument.",
1206 filename, linenum);
djm@openbsd.orgf9eca242015-07-30 00:01:34 +00001207 if (!sshkey_names_valid2(*arg == '+' ? arg + 1 : arg, 1))
markus@openbsd.org3a1638d2015-07-10 06:21:53 +00001208 fatal("%s line %d: Bad key types '%s'.",
1209 filename, linenum, arg ? arg : "<NONE>");
1210 if (*activep && *charptr == NULL)
1211 *charptr = xstrdup(arg);
Ben Lindstrom982dbbc2001-04-17 18:11:36 +00001212 break;
1213
Damien Miller78928792000-04-12 20:17:38 +10001214 case oProtocol:
1215 intptr = &options->protocol;
Damien Millerbe484b52000-07-15 14:14:16 +10001216 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +10001217 if (!arg || *arg == '\0')
Damien Millerb1715dc2000-05-30 13:44:51 +10001218 fatal("%.200s line %d: Missing argument.", filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +10001219 value = proto_spec(arg);
Damien Miller78928792000-04-12 20:17:38 +10001220 if (value == SSH_PROTO_UNKNOWN)
1221 fatal("%.200s line %d: Bad protocol spec '%s'.",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001222 filename, linenum, arg ? arg : "<NONE>");
Damien Miller78928792000-04-12 20:17:38 +10001223 if (*activep && *intptr == SSH_PROTO_UNKNOWN)
1224 *intptr = value;
1225 break;
1226
Damien Miller95def091999-11-25 00:26:21 +11001227 case oLogLevel:
Darren Tucker1e44c5d2008-01-01 20:32:26 +11001228 log_level_ptr = &options->log_level;
Damien Millerbe484b52000-07-15 14:14:16 +10001229 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +10001230 value = log_level_number(arg);
Damien Millerfcd93202002-02-05 12:26:34 +11001231 if (value == SYSLOG_LEVEL_NOT_SET)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +00001232 fatal("%.200s line %d: unsupported log level '%s'",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001233 filename, linenum, arg ? arg : "<NONE>");
Darren Tucker1e44c5d2008-01-01 20:32:26 +11001234 if (*activep && *log_level_ptr == SYSLOG_LEVEL_NOT_SET)
1235 *log_level_ptr = (LogLevel) value;
Damien Miller95def091999-11-25 00:26:21 +11001236 break;
1237
Ben Lindstrom62c25a42001-09-12 18:01:59 +00001238 case oLocalForward:
Damien Miller95def091999-11-25 00:26:21 +11001239 case oRemoteForward:
Damien Millera699d952008-11-03 19:27:34 +11001240 case oDynamicForward:
Damien Millerbe484b52000-07-15 14:14:16 +10001241 arg = strdelim(&s);
Damien Millerf91ee4c2005-03-01 21:24:33 +11001242 if (arg == NULL || *arg == '\0')
Ben Lindstrom62c25a42001-09-12 18:01:59 +00001243 fatal("%.200s line %d: Missing port argument.",
1244 filename, linenum);
Damien Millerf91ee4c2005-03-01 21:24:33 +11001245
Damien Millera699d952008-11-03 19:27:34 +11001246 if (opcode == oLocalForward ||
1247 opcode == oRemoteForward) {
1248 arg2 = strdelim(&s);
1249 if (arg2 == NULL || *arg2 == '\0')
1250 fatal("%.200s line %d: Missing target argument.",
1251 filename, linenum);
Damien Millerf91ee4c2005-03-01 21:24:33 +11001252
Damien Millera699d952008-11-03 19:27:34 +11001253 /* construct a string for parse_forward */
1254 snprintf(fwdarg, sizeof(fwdarg), "%s:%s", arg, arg2);
1255 } else if (opcode == oDynamicForward) {
1256 strlcpy(fwdarg, arg, sizeof(fwdarg));
1257 }
1258
1259 if (parse_forward(&fwd, fwdarg,
Damien Miller4bf648f2009-02-14 16:28:21 +11001260 opcode == oDynamicForward ? 1 : 0,
1261 opcode == oRemoteForward ? 1 : 0) == 0)
Ben Lindstrom62c25a42001-09-12 18:01:59 +00001262 fatal("%.200s line %d: Bad forwarding specification.",
1263 filename, linenum);
Damien Millerf91ee4c2005-03-01 21:24:33 +11001264
Ben Lindstrom62c25a42001-09-12 18:01:59 +00001265 if (*activep) {
Damien Millera699d952008-11-03 19:27:34 +11001266 if (opcode == oLocalForward ||
1267 opcode == oDynamicForward)
Damien Millerf91ee4c2005-03-01 21:24:33 +11001268 add_local_forward(options, &fwd);
Ben Lindstrom62c25a42001-09-12 18:01:59 +00001269 else if (opcode == oRemoteForward)
Damien Millerf91ee4c2005-03-01 21:24:33 +11001270 add_remote_forward(options, &fwd);
Ben Lindstrom62c25a42001-09-12 18:01:59 +00001271 }
Damien Miller95def091999-11-25 00:26:21 +11001272 break;
1273
Ben Lindstrom2b7a0e92001-09-20 00:57:55 +00001274 case oClearAllForwardings:
1275 intptr = &options->clear_forwardings;
1276 goto parse_flag;
1277
Damien Miller95def091999-11-25 00:26:21 +11001278 case oHost:
Damien Miller194fd902013-10-15 12:13:05 +11001279 if (cmdline)
1280 fatal("Host directive not supported as a command-line "
1281 "option");
Damien Miller95def091999-11-25 00:26:21 +11001282 *activep = 0;
Damien Millerfe924212011-05-15 08:44:45 +10001283 arg2 = NULL;
1284 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
djm@openbsd.orgdc7990b2016-04-15 00:30:19 +00001285 if ((flags & SSHCONF_NEVERMATCH) != 0)
1286 break;
Damien Millerfe924212011-05-15 08:44:45 +10001287 negated = *arg == '!';
1288 if (negated)
1289 arg++;
Damien Miller37023962000-07-11 17:31:38 +10001290 if (match_pattern(host, arg)) {
Damien Millerfe924212011-05-15 08:44:45 +10001291 if (negated) {
1292 debug("%.200s line %d: Skipping Host "
1293 "block because of negated match "
1294 "for %.100s", filename, linenum,
1295 arg);
1296 *activep = 0;
1297 break;
1298 }
1299 if (!*activep)
1300 arg2 = arg; /* logged below */
Damien Miller95def091999-11-25 00:26:21 +11001301 *activep = 1;
Damien Miller95def091999-11-25 00:26:21 +11001302 }
Damien Millerfe924212011-05-15 08:44:45 +10001303 }
1304 if (*activep)
1305 debug("%.200s line %d: Applying options for %.100s",
1306 filename, linenum, arg2);
Damien Millerbe484b52000-07-15 14:14:16 +10001307 /* Avoid garbage check below, as strdelim is done. */
Damien Miller95def091999-11-25 00:26:21 +11001308 return 0;
1309
Damien Miller194fd902013-10-15 12:13:05 +11001310 case oMatch:
1311 if (cmdline)
1312 fatal("Host directive not supported as a command-line "
1313 "option");
djm@openbsd.org957fbce2014-10-08 22:20:25 +00001314 value = match_cfg_line(options, &s, pw, host, original_host,
1315 flags & SSHCONF_POSTCANON, filename, linenum);
Damien Miller194fd902013-10-15 12:13:05 +11001316 if (value < 0)
1317 fatal("%.200s line %d: Bad Match condition", filename,
1318 linenum);
djm@openbsd.orgdc7990b2016-04-15 00:30:19 +00001319 *activep = (flags & SSHCONF_NEVERMATCH) ? 0 : value;
Damien Miller194fd902013-10-15 12:13:05 +11001320 break;
1321
Damien Miller95def091999-11-25 00:26:21 +11001322 case oEscapeChar:
1323 intptr = &options->escape_char;
Damien Millerbe484b52000-07-15 14:14:16 +10001324 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +10001325 if (!arg || *arg == '\0')
Damien Miller95def091999-11-25 00:26:21 +11001326 fatal("%.200s line %d: Missing argument.", filename, linenum);
djm@openbsd.org08823322015-05-22 04:45:52 +00001327 if (strcmp(arg, "none") == 0)
1328 value = SSH_ESCAPECHAR_NONE;
1329 else if (arg[1] == '\0')
1330 value = (u_char) arg[0];
1331 else if (arg[0] == '^' && arg[2] == 0 &&
Ben Lindstrom46c16222000-12-22 01:43:59 +00001332 (u_char) arg[1] >= 64 && (u_char) arg[1] < 128)
1333 value = (u_char) arg[1] & 31;
Damien Miller95def091999-11-25 00:26:21 +11001334 else {
1335 fatal("%.200s line %d: Bad escape character.",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001336 filename, linenum);
Damien Miller95def091999-11-25 00:26:21 +11001337 /* NOTREACHED */
1338 value = 0; /* Avoid compiler warning. */
1339 }
1340 if (*activep && *intptr == -1)
1341 *intptr = value;
1342 break;
1343
Damien Miller20a8f972003-05-18 20:50:30 +10001344 case oAddressFamily:
Darren Tucker0a4f04b2003-07-03 20:37:47 +10001345 intptr = &options->address_family;
Damien Millere9fc72e2013-10-15 12:14:12 +11001346 multistate_ptr = multistate_addressfamily;
1347 goto parse_multistate;
Damien Miller20a8f972003-05-18 20:50:30 +10001348
Ben Lindstromb6df73b2002-11-09 15:52:31 +00001349 case oEnableSSHKeysign:
1350 intptr = &options->enable_ssh_keysign;
1351 goto parse_flag;
1352
Damien Millerbd394c32004-03-08 23:12:36 +11001353 case oIdentitiesOnly:
1354 intptr = &options->identities_only;
1355 goto parse_flag;
1356
Damien Miller509b0102003-12-17 16:33:10 +11001357 case oServerAliveInterval:
1358 intptr = &options->server_alive_interval;
1359 goto parse_time;
1360
1361 case oServerAliveCountMax:
1362 intptr = &options->server_alive_count_max;
1363 goto parse_int;
1364
Darren Tucker46bc0752004-05-02 22:11:30 +10001365 case oSendEnv:
1366 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1367 if (strchr(arg, '=') != NULL)
1368 fatal("%s line %d: Invalid environment name.",
1369 filename, linenum);
Damien Millerf8e7acc2005-03-05 11:22:50 +11001370 if (!*activep)
1371 continue;
Darren Tucker46bc0752004-05-02 22:11:30 +10001372 if (options->num_send_env >= MAX_SEND_ENV)
1373 fatal("%s line %d: too many send env.",
1374 filename, linenum);
1375 options->send_env[options->num_send_env++] =
1376 xstrdup(arg);
1377 }
1378 break;
1379
Damien Miller0e220db2004-06-15 10:34:08 +10001380 case oControlPath:
1381 charptr = &options->control_path;
1382 goto parse_string;
1383
1384 case oControlMaster:
1385 intptr = &options->control_master;
Damien Millere9fc72e2013-10-15 12:14:12 +11001386 multistate_ptr = multistate_controlmaster;
1387 goto parse_multistate;
Damien Miller0e220db2004-06-15 10:34:08 +10001388
Damien Millere11e1ea2010-08-03 16:04:46 +10001389 case oControlPersist:
1390 /* no/false/yes/true, or a time spec */
1391 intptr = &options->control_persist;
1392 arg = strdelim(&s);
1393 if (!arg || *arg == '\0')
1394 fatal("%.200s line %d: Missing ControlPersist"
1395 " argument.", filename, linenum);
1396 value = 0;
1397 value2 = 0; /* timeout */
1398 if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
1399 value = 0;
1400 else if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
1401 value = 1;
1402 else if ((value2 = convtime(arg)) >= 0)
1403 value = 1;
1404 else
1405 fatal("%.200s line %d: Bad ControlPersist argument.",
1406 filename, linenum);
1407 if (*activep && *intptr == -1) {
1408 *intptr = value;
1409 options->control_persist_timeout = value2;
1410 }
1411 break;
1412
Damien Millere1776152005-03-01 21:47:37 +11001413 case oHashKnownHosts:
1414 intptr = &options->hash_known_hosts;
1415 goto parse_flag;
1416
Damien Millerd27b9472005-12-13 19:29:02 +11001417 case oTunnel:
1418 intptr = &options->tun_open;
Damien Millere9fc72e2013-10-15 12:14:12 +11001419 multistate_ptr = multistate_tunnel;
1420 goto parse_multistate;
Damien Millerd27b9472005-12-13 19:29:02 +11001421
1422 case oTunnelDevice:
1423 arg = strdelim(&s);
1424 if (!arg || *arg == '\0')
1425 fatal("%.200s line %d: Missing argument.", filename, linenum);
1426 value = a2tun(arg, &value2);
Damien Miller7b58e802005-12-13 19:33:19 +11001427 if (value == SSH_TUNID_ERR)
Damien Millerd27b9472005-12-13 19:29:02 +11001428 fatal("%.200s line %d: Bad tun device.", filename, linenum);
1429 if (*activep) {
1430 options->tun_local = value;
1431 options->tun_remote = value2;
1432 }
1433 break;
1434
1435 case oLocalCommand:
1436 charptr = &options->local_command;
1437 goto parse_command;
1438
1439 case oPermitLocalCommand:
1440 intptr = &options->permit_local_command;
1441 goto parse_flag;
1442
Damien Miller10288242008-06-30 00:04:03 +10001443 case oVisualHostKey:
1444 intptr = &options->visual_host_key;
1445 goto parse_flag;
1446
djm@openbsd.orgdc7990b2016-04-15 00:30:19 +00001447 case oInclude:
1448 if (cmdline)
1449 fatal("Include directive not supported as a "
1450 "command-line option");
1451 value = 0;
1452 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1453 /*
1454 * Ensure all paths are anchored. User configuration
1455 * files may begin with '~/' but system configurations
1456 * must not. If the path is relative, then treat it
1457 * as living in ~/.ssh for user configurations or
1458 * /etc/ssh for system ones.
1459 */
1460 if (*arg == '~' && (flags & SSHCONF_USERCONF) == 0)
1461 fatal("%.200s line %d: bad include path %s.",
1462 filename, linenum, arg);
1463 if (*arg != '/' && *arg != '~') {
1464 xasprintf(&arg2, "%s/%s",
1465 (flags & SSHCONF_USERCONF) ?
1466 "~/" _PATH_SSH_USER_DIR : SSHDIR, arg);
1467 } else
1468 arg2 = xstrdup(arg);
1469 memset(&gl, 0, sizeof(gl));
1470 r = glob(arg2, GLOB_TILDE, NULL, &gl);
1471 if (r == GLOB_NOMATCH) {
1472 debug("%.200s line %d: include %s matched no "
1473 "files",filename, linenum, arg2);
1474 continue;
1475 } else if (r != 0 || gl.gl_pathc < 0)
1476 fatal("%.200s line %d: glob failed for %s.",
1477 filename, linenum, arg2);
1478 free(arg2);
1479 oactive = *activep;
1480 for (i = 0; i < (u_int)gl.gl_pathc; i++) {
1481 debug3("%.200s line %d: Including file %s "
1482 "depth %d%s", filename, linenum,
1483 gl.gl_pathv[i], depth,
1484 oactive ? "" : " (parse only)");
1485 r = read_config_file_depth(gl.gl_pathv[i],
1486 pw, host, original_host, options,
1487 flags | SSHCONF_CHECKPERM |
1488 (oactive ? 0 : SSHCONF_NEVERMATCH),
1489 activep, depth + 1);
1490 /*
1491 * don't let Match in includes clobber the
1492 * containing file's Match state.
1493 */
1494 *activep = oactive;
1495 if (r != 1)
1496 value = -1;
1497 }
1498 globfree(&gl);
1499 }
1500 if (value != 0)
1501 return value;
1502 break;
1503
Damien Miller0dac6fb2010-11-20 15:19:38 +11001504 case oIPQoS:
1505 arg = strdelim(&s);
1506 if ((value = parse_ipqos(arg)) == -1)
1507 fatal("%s line %d: Bad IPQoS value: %s",
1508 filename, linenum, arg);
1509 arg = strdelim(&s);
1510 if (arg == NULL)
1511 value2 = value;
1512 else if ((value2 = parse_ipqos(arg)) == -1)
1513 fatal("%s line %d: Bad IPQoS value: %s",
1514 filename, linenum, arg);
1515 if (*activep) {
1516 options->ip_qos_interactive = value;
1517 options->ip_qos_bulk = value2;
1518 }
1519 break;
1520
Damien Miller21771e22011-05-15 08:45:50 +10001521 case oRequestTTY:
Damien Miller21771e22011-05-15 08:45:50 +10001522 intptr = &options->request_tty;
Damien Millere9fc72e2013-10-15 12:14:12 +11001523 multistate_ptr = multistate_requesttty;
1524 goto parse_multistate;
Damien Miller21771e22011-05-15 08:45:50 +10001525
Darren Tucker07636982013-05-16 20:30:03 +10001526 case oIgnoreUnknown:
1527 charptr = &options->ignored_unknown;
1528 goto parse_string;
1529
Damien Miller1262b662013-08-21 02:44:24 +10001530 case oProxyUseFdpass:
1531 intptr = &options->proxy_use_fdpass;
1532 goto parse_flag;
1533
Damien Miller0faf7472013-10-17 11:47:23 +11001534 case oCanonicalDomains:
1535 value = options->num_canonical_domains != 0;
1536 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1537 valid_domain(arg, filename, linenum);
1538 if (!*activep || value)
1539 continue;
1540 if (options->num_canonical_domains >= MAX_CANON_DOMAINS)
1541 fatal("%s line %d: too many hostname suffixes.",
1542 filename, linenum);
1543 options->canonical_domains[
1544 options->num_canonical_domains++] = xstrdup(arg);
1545 }
1546 break;
1547
Damien Miller38505592013-10-17 11:48:13 +11001548 case oCanonicalizePermittedCNAMEs:
Damien Miller0faf7472013-10-17 11:47:23 +11001549 value = options->num_permitted_cnames != 0;
1550 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1551 /* Either '*' for everything or 'list:list' */
1552 if (strcmp(arg, "*") == 0)
1553 arg2 = arg;
1554 else {
1555 lowercase(arg);
1556 if ((arg2 = strchr(arg, ':')) == NULL ||
1557 arg2[1] == '\0') {
1558 fatal("%s line %d: "
1559 "Invalid permitted CNAME \"%s\"",
1560 filename, linenum, arg);
1561 }
1562 *arg2 = '\0';
1563 arg2++;
1564 }
1565 if (!*activep || value)
1566 continue;
1567 if (options->num_permitted_cnames >= MAX_CANON_DOMAINS)
1568 fatal("%s line %d: too many permitted CNAMEs.",
1569 filename, linenum);
1570 cname = options->permitted_cnames +
1571 options->num_permitted_cnames++;
1572 cname->source_list = xstrdup(arg);
1573 cname->target_list = xstrdup(arg2);
1574 }
1575 break;
1576
Damien Miller38505592013-10-17 11:48:13 +11001577 case oCanonicalizeHostname:
1578 intptr = &options->canonicalize_hostname;
1579 multistate_ptr = multistate_canonicalizehostname;
Damien Miller0faf7472013-10-17 11:47:23 +11001580 goto parse_multistate;
1581
Damien Miller38505592013-10-17 11:48:13 +11001582 case oCanonicalizeMaxDots:
1583 intptr = &options->canonicalize_max_dots;
Damien Miller0faf7472013-10-17 11:47:23 +11001584 goto parse_int;
1585
Damien Miller38505592013-10-17 11:48:13 +11001586 case oCanonicalizeFallbackLocal:
1587 intptr = &options->canonicalize_fallback_local;
Damien Miller0faf7472013-10-17 11:47:23 +11001588 goto parse_flag;
1589
Damien Miller7acefbb2014-07-18 14:11:24 +10001590 case oStreamLocalBindMask:
1591 arg = strdelim(&s);
1592 if (!arg || *arg == '\0')
1593 fatal("%.200s line %d: Missing StreamLocalBindMask argument.", filename, linenum);
1594 /* Parse mode in octal format */
1595 value = strtol(arg, &endofnumber, 8);
1596 if (arg == endofnumber || value < 0 || value > 0777)
1597 fatal("%.200s line %d: Bad mask.", filename, linenum);
1598 options->fwd_opts.streamlocal_bind_mask = (mode_t)value;
1599 break;
1600
1601 case oStreamLocalBindUnlink:
1602 intptr = &options->fwd_opts.streamlocal_bind_unlink;
1603 goto parse_flag;
1604
djm@openbsd.org5e39a492014-12-04 02:24:32 +00001605 case oRevokedHostKeys:
1606 charptr = &options->revoked_host_keys;
1607 goto parse_string;
1608
djm@openbsd.org56d1c832014-12-21 22:27:55 +00001609 case oFingerprintHash:
djm@openbsd.orge752c6d2015-01-08 13:44:36 +00001610 intptr = &options->fingerprint_hash;
djm@openbsd.org56d1c832014-12-21 22:27:55 +00001611 arg = strdelim(&s);
1612 if (!arg || *arg == '\0')
1613 fatal("%.200s line %d: Missing argument.",
1614 filename, linenum);
1615 if ((value = ssh_digest_alg_by_name(arg)) == -1)
1616 fatal("%.200s line %d: Invalid hash algorithm \"%s\".",
1617 filename, linenum, arg);
djm@openbsd.orge752c6d2015-01-08 13:44:36 +00001618 if (*activep && *intptr == -1)
1619 *intptr = value;
djm@openbsd.org56d1c832014-12-21 22:27:55 +00001620 break;
1621
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00001622 case oUpdateHostkeys:
1623 intptr = &options->update_hostkeys;
djm@openbsd.org523463a2015-02-16 22:13:32 +00001624 multistate_ptr = multistate_yesnoask;
1625 goto parse_multistate;
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00001626
djm@openbsd.org46347ed2015-01-30 11:43:14 +00001627 case oHostbasedKeyTypes:
1628 charptr = &options->hostbased_key_types;
markus@openbsd.org3a1638d2015-07-10 06:21:53 +00001629 goto parse_keytypes;
1630
1631 case oPubkeyAcceptedKeyTypes:
1632 charptr = &options->pubkey_key_types;
1633 goto parse_keytypes;
djm@openbsd.org46347ed2015-01-30 11:43:14 +00001634
jcs@openbsd.orgf361df42015-11-15 22:26:49 +00001635 case oAddKeysToAgent:
1636 intptr = &options->add_keys_to_agent;
1637 multistate_ptr = multistate_yesnoaskconfirm;
1638 goto parse_multistate;
1639
markus@openbsd.orgb02ad1c2016-05-04 12:21:53 +00001640 case oIdentityAgent:
1641 charptr = &options->identity_agent;
1642 goto parse_string;
1643
Ben Lindstrom4daea862002-06-09 20:04:02 +00001644 case oDeprecated:
Ben Lindstrom2e17b082002-06-09 20:13:27 +00001645 debug("%s line %d: Deprecated option \"%s\"",
Ben Lindstrom4daea862002-06-09 20:04:02 +00001646 filename, linenum, keyword);
Ben Lindstrom2e17b082002-06-09 20:13:27 +00001647 return 0;
Ben Lindstrom4daea862002-06-09 20:04:02 +00001648
Damien Millerf9b3feb2003-05-16 11:38:32 +10001649 case oUnsupported:
1650 error("%s line %d: Unsupported option \"%s\"",
1651 filename, linenum, keyword);
1652 return 0;
1653
Damien Miller95def091999-11-25 00:26:21 +11001654 default:
djm@openbsd.org957fbce2014-10-08 22:20:25 +00001655 fatal("%s: Unimplemented opcode %d", __func__, opcode);
Damien Miller95def091999-11-25 00:26:21 +11001656 }
1657
1658 /* Check that there is no garbage at end of line. */
Ben Lindstrom226cfa02001-01-22 05:34:40 +00001659 if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
Damien Miller37023962000-07-11 17:31:38 +10001660 fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
Damien Miller0dc1bef2005-07-17 17:22:45 +10001661 filename, linenum, arg);
Damien Miller37023962000-07-11 17:31:38 +10001662 }
Damien Miller95def091999-11-25 00:26:21 +11001663 return 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001664}
1665
Damien Miller5428f641999-11-25 11:54:57 +11001666/*
1667 * Reads the config file and modifies the options accordingly. Options
1668 * should already be initialized before this call. This never returns if
Ben Lindstromedc0cf22001-09-12 18:32:20 +00001669 * there is an error. If the file does not exist, this returns 0.
Damien Miller5428f641999-11-25 11:54:57 +11001670 */
Ben Lindstromedc0cf22001-09-12 18:32:20 +00001671int
Damien Miller194fd902013-10-15 12:13:05 +11001672read_config_file(const char *filename, struct passwd *pw, const char *host,
djm@openbsd.org957fbce2014-10-08 22:20:25 +00001673 const char *original_host, Options *options, int flags)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001674{
djm@openbsd.orgdc7990b2016-04-15 00:30:19 +00001675 int active = 1;
1676
1677 return read_config_file_depth(filename, pw, host, original_host,
1678 options, flags, &active, 0);
1679}
1680
1681#define READCONF_MAX_DEPTH 16
1682static int
1683read_config_file_depth(const char *filename, struct passwd *pw,
1684 const char *host, const char *original_host, Options *options,
1685 int flags, int *activep, int depth)
1686{
Damien Miller95def091999-11-25 00:26:21 +11001687 FILE *f;
1688 char line[1024];
djm@openbsd.orgdc7990b2016-04-15 00:30:19 +00001689 int linenum;
Damien Miller95def091999-11-25 00:26:21 +11001690 int bad_options = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001691
djm@openbsd.orgdc7990b2016-04-15 00:30:19 +00001692 if (depth < 0 || depth > READCONF_MAX_DEPTH)
1693 fatal("Too many recursive configuration includes");
1694
Damien Miller57a44762004-04-20 20:11:57 +10001695 if ((f = fopen(filename, "r")) == NULL)
Ben Lindstromedc0cf22001-09-12 18:32:20 +00001696 return 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001697
Darren Tuckeraefa3682013-04-05 11:18:35 +11001698 if (flags & SSHCONF_CHECKPERM) {
Damien Miller57a44762004-04-20 20:11:57 +10001699 struct stat sb;
Darren Tuckerfc959702004-07-17 16:12:08 +10001700
Damien Miller33793852004-06-15 10:27:55 +10001701 if (fstat(fileno(f), &sb) == -1)
Damien Miller57a44762004-04-20 20:11:57 +10001702 fatal("fstat %s: %s", filename, strerror(errno));
Damien Miller57a44762004-04-20 20:11:57 +10001703 if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
Damien Miller33793852004-06-15 10:27:55 +10001704 (sb.st_mode & 022) != 0))
Damien Miller57a44762004-04-20 20:11:57 +10001705 fatal("Bad owner or permissions on %s", filename);
Damien Miller57a44762004-04-20 20:11:57 +10001706 }
1707
Damien Miller95def091999-11-25 00:26:21 +11001708 debug("Reading configuration data %.200s", filename);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001709
Damien Miller5428f641999-11-25 11:54:57 +11001710 /*
1711 * Mark that we are now processing the options. This flag is turned
1712 * on/off by Host specifications.
1713 */
Damien Miller95def091999-11-25 00:26:21 +11001714 linenum = 0;
1715 while (fgets(line, sizeof(line), f)) {
1716 /* Update line number counter. */
1717 linenum++;
djm@openbsd.orgdc7990b2016-04-15 00:30:19 +00001718 if (process_config_line_depth(options, pw, host, original_host,
1719 line, filename, linenum, activep, flags, depth) != 0)
Damien Miller95def091999-11-25 00:26:21 +11001720 bad_options++;
1721 }
1722 fclose(f);
1723 if (bad_options > 0)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +00001724 fatal("%s: terminating, %d bad configuration options",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001725 filename, bad_options);
Ben Lindstromedc0cf22001-09-12 18:32:20 +00001726 return 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001727}
1728
Damien Miller13f97b22014-02-24 15:57:55 +11001729/* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
1730int
1731option_clear_or_none(const char *o)
1732{
1733 return o == NULL || strcasecmp(o, "none") == 0;
1734}
1735
Damien Miller5428f641999-11-25 11:54:57 +11001736/*
1737 * Initializes options to special values that indicate that they have not yet
1738 * been set. Read_config_file will only set options with this value. Options
1739 * are processed in the following order: command line, user config file,
1740 * system config file. Last, fill_default_options is called.
1741 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001742
Damien Miller4af51302000-04-16 11:18:38 +10001743void
Damien Miller95def091999-11-25 00:26:21 +11001744initialize_options(Options * options)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001745{
Damien Miller95def091999-11-25 00:26:21 +11001746 memset(options, 'X', sizeof(*options));
1747 options->forward_agent = -1;
1748 options->forward_x11 = -1;
Darren Tucker0a118da2003-10-15 15:54:32 +10001749 options->forward_x11_trusted = -1;
Damien Miller1ab6a512010-06-26 10:02:24 +10001750 options->forward_x11_timeout = -1;
Darren Tuckere7d4b192006-07-12 22:17:10 +10001751 options->exit_on_forward_failure = -1;
Damien Millerd3a18572000-06-07 19:55:44 +10001752 options->xauth_location = NULL;
Damien Miller7acefbb2014-07-18 14:11:24 +10001753 options->fwd_opts.gateway_ports = -1;
1754 options->fwd_opts.streamlocal_bind_mask = (mode_t)-1;
1755 options->fwd_opts.streamlocal_bind_unlink = -1;
Damien Miller95def091999-11-25 00:26:21 +11001756 options->use_privileged_port = -1;
Damien Miller95def091999-11-25 00:26:21 +11001757 options->rsa_authentication = -1;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001758 options->pubkey_authentication = -1;
Ben Lindstrom551ea372001-06-05 18:56:16 +00001759 options->challenge_response_authentication = -1;
Darren Tucker0efd1552003-08-26 11:49:55 +10001760 options->gss_authentication = -1;
1761 options->gss_deleg_creds = -1;
Damien Miller95def091999-11-25 00:26:21 +11001762 options->password_authentication = -1;
Damien Miller874d77b2000-10-14 16:23:11 +11001763 options->kbd_interactive_authentication = -1;
1764 options->kbd_interactive_devices = NULL;
Damien Miller95def091999-11-25 00:26:21 +11001765 options->rhosts_rsa_authentication = -1;
Ben Lindstrom5eabda32001-04-12 23:34:34 +00001766 options->hostbased_authentication = -1;
Damien Miller95def091999-11-25 00:26:21 +11001767 options->batch_mode = -1;
1768 options->check_host_ip = -1;
1769 options->strict_host_key_checking = -1;
1770 options->compression = -1;
Damien Miller12c150e2003-12-17 16:31:10 +11001771 options->tcp_keep_alive = -1;
Damien Miller95def091999-11-25 00:26:21 +11001772 options->compression_level = -1;
1773 options->port = -1;
Darren Tucker0a4f04b2003-07-03 20:37:47 +10001774 options->address_family = -1;
Damien Miller95def091999-11-25 00:26:21 +11001775 options->connection_attempts = -1;
Damien Millerb78d5eb2003-05-16 11:39:04 +10001776 options->connection_timeout = -1;
Damien Miller95def091999-11-25 00:26:21 +11001777 options->number_of_password_prompts = -1;
1778 options->cipher = -1;
Damien Miller78928792000-04-12 20:17:38 +10001779 options->ciphers = NULL;
Ben Lindstrom06b33aa2001-02-15 03:01:59 +00001780 options->macs = NULL;
Damien Millerd5f62bf2010-09-24 22:11:14 +10001781 options->kex_algorithms = NULL;
Ben Lindstrom982dbbc2001-04-17 18:11:36 +00001782 options->hostkeyalgorithms = NULL;
Damien Miller78928792000-04-12 20:17:38 +10001783 options->protocol = SSH_PROTO_UNKNOWN;
Damien Miller95def091999-11-25 00:26:21 +11001784 options->num_identity_files = 0;
djm@openbsd.org4e44a792015-09-24 06:15:11 +00001785 options->num_certificate_files = 0;
Damien Miller95def091999-11-25 00:26:21 +11001786 options->hostname = NULL;
Ben Lindstrom4dccfa52000-12-28 16:40:05 +00001787 options->host_key_alias = NULL;
Damien Miller95def091999-11-25 00:26:21 +11001788 options->proxy_command = NULL;
1789 options->user = NULL;
1790 options->escape_char = -1;
Damien Miller295ee632011-05-29 21:42:31 +10001791 options->num_system_hostfiles = 0;
1792 options->num_user_hostfiles = 0;
Damien Miller232cfb12010-06-26 09:50:30 +10001793 options->local_forwards = NULL;
Damien Miller95def091999-11-25 00:26:21 +11001794 options->num_local_forwards = 0;
Damien Miller232cfb12010-06-26 09:50:30 +10001795 options->remote_forwards = NULL;
Damien Miller95def091999-11-25 00:26:21 +11001796 options->num_remote_forwards = 0;
Ben Lindstrom2b7a0e92001-09-20 00:57:55 +00001797 options->clear_forwardings = -1;
Damien Millerfcd93202002-02-05 12:26:34 +11001798 options->log_level = SYSLOG_LEVEL_NOT_SET;
Ben Lindstromb9be60a2001-03-11 01:49:19 +00001799 options->preferred_authentications = NULL;
Ben Lindstrome0f88042001-04-30 13:06:24 +00001800 options->bind_address = NULL;
Damien Miller7ea845e2010-02-12 09:21:02 +11001801 options->pkcs11_provider = NULL;
Ben Lindstromb6df73b2002-11-09 15:52:31 +00001802 options->enable_ssh_keysign = - 1;
Ben Lindstrom3cecc9a2001-10-03 17:39:38 +00001803 options->no_host_authentication_for_localhost = - 1;
Damien Millerbd394c32004-03-08 23:12:36 +11001804 options->identities_only = - 1;
Damien Millera5539d22003-04-09 20:50:06 +10001805 options->rekey_limit = - 1;
Darren Tuckerc53c2af2013-05-16 20:28:16 +10001806 options->rekey_interval = -1;
Damien Miller37876e92003-05-15 10:19:46 +10001807 options->verify_host_key_dns = -1;
Damien Miller509b0102003-12-17 16:33:10 +11001808 options->server_alive_interval = -1;
1809 options->server_alive_count_max = -1;
Darren Tucker46bc0752004-05-02 22:11:30 +10001810 options->num_send_env = 0;
Damien Miller0e220db2004-06-15 10:34:08 +10001811 options->control_path = NULL;
1812 options->control_master = -1;
Damien Millere11e1ea2010-08-03 16:04:46 +10001813 options->control_persist = -1;
1814 options->control_persist_timeout = 0;
Damien Millere1776152005-03-01 21:47:37 +11001815 options->hash_known_hosts = -1;
Damien Millerd27b9472005-12-13 19:29:02 +11001816 options->tun_open = -1;
1817 options->tun_local = -1;
1818 options->tun_remote = -1;
1819 options->local_command = NULL;
1820 options->permit_local_command = -1;
jcs@openbsd.orgf361df42015-11-15 22:26:49 +00001821 options->add_keys_to_agent = -1;
markus@openbsd.orgb02ad1c2016-05-04 12:21:53 +00001822 options->identity_agent = NULL;
Damien Miller10288242008-06-30 00:04:03 +10001823 options->visual_host_key = -1;
Damien Miller0dac6fb2010-11-20 15:19:38 +11001824 options->ip_qos_interactive = -1;
1825 options->ip_qos_bulk = -1;
Damien Miller21771e22011-05-15 08:45:50 +10001826 options->request_tty = -1;
Damien Miller1262b662013-08-21 02:44:24 +10001827 options->proxy_use_fdpass = -1;
Darren Tucker07636982013-05-16 20:30:03 +10001828 options->ignored_unknown = NULL;
Damien Miller0faf7472013-10-17 11:47:23 +11001829 options->num_canonical_domains = 0;
1830 options->num_permitted_cnames = 0;
Damien Miller38505592013-10-17 11:48:13 +11001831 options->canonicalize_max_dots = -1;
1832 options->canonicalize_fallback_local = -1;
1833 options->canonicalize_hostname = -1;
djm@openbsd.org5e39a492014-12-04 02:24:32 +00001834 options->revoked_host_keys = NULL;
djm@openbsd.org56d1c832014-12-21 22:27:55 +00001835 options->fingerprint_hash = -1;
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00001836 options->update_hostkeys = -1;
djm@openbsd.org46347ed2015-01-30 11:43:14 +00001837 options->hostbased_key_types = NULL;
markus@openbsd.org3a1638d2015-07-10 06:21:53 +00001838 options->pubkey_key_types = NULL;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001839}
1840
Damien Miller5428f641999-11-25 11:54:57 +11001841/*
Damien Miller13f97b22014-02-24 15:57:55 +11001842 * A petite version of fill_default_options() that just fills the options
1843 * needed for hostname canonicalization to proceed.
1844 */
1845void
1846fill_default_options_for_canonicalization(Options *options)
1847{
1848 if (options->canonicalize_max_dots == -1)
1849 options->canonicalize_max_dots = 1;
1850 if (options->canonicalize_fallback_local == -1)
1851 options->canonicalize_fallback_local = 1;
1852 if (options->canonicalize_hostname == -1)
1853 options->canonicalize_hostname = SSH_CANONICALISE_NO;
1854}
1855
1856/*
Damien Miller5428f641999-11-25 11:54:57 +11001857 * Called after processing other sources of option data, this fills those
1858 * options for which no value has been specified with their default values.
1859 */
Damien Miller4af51302000-04-16 11:18:38 +10001860void
Damien Miller95def091999-11-25 00:26:21 +11001861fill_default_options(Options * options)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001862{
Damien Miller95def091999-11-25 00:26:21 +11001863 if (options->forward_agent == -1)
Damien Millerb1715dc2000-05-30 13:44:51 +10001864 options->forward_agent = 0;
Damien Miller95def091999-11-25 00:26:21 +11001865 if (options->forward_x11 == -1)
Damien Miller98c7ad62000-03-09 21:27:49 +11001866 options->forward_x11 = 0;
Darren Tucker0a118da2003-10-15 15:54:32 +10001867 if (options->forward_x11_trusted == -1)
1868 options->forward_x11_trusted = 0;
Damien Miller1ab6a512010-06-26 10:02:24 +10001869 if (options->forward_x11_timeout == -1)
1870 options->forward_x11_timeout = 1200;
Darren Tuckere7d4b192006-07-12 22:17:10 +10001871 if (options->exit_on_forward_failure == -1)
1872 options->exit_on_forward_failure = 0;
Damien Millerd3a18572000-06-07 19:55:44 +10001873 if (options->xauth_location == NULL)
Ben Lindstrom1bf11f62001-06-09 01:48:01 +00001874 options->xauth_location = _PATH_XAUTH;
Damien Miller7acefbb2014-07-18 14:11:24 +10001875 if (options->fwd_opts.gateway_ports == -1)
1876 options->fwd_opts.gateway_ports = 0;
1877 if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
1878 options->fwd_opts.streamlocal_bind_mask = 0177;
1879 if (options->fwd_opts.streamlocal_bind_unlink == -1)
1880 options->fwd_opts.streamlocal_bind_unlink = 0;
Damien Miller95def091999-11-25 00:26:21 +11001881 if (options->use_privileged_port == -1)
Ben Lindstromcebc8582001-03-08 03:39:10 +00001882 options->use_privileged_port = 0;
Damien Miller95def091999-11-25 00:26:21 +11001883 if (options->rsa_authentication == -1)
1884 options->rsa_authentication = 1;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001885 if (options->pubkey_authentication == -1)
1886 options->pubkey_authentication = 1;
Ben Lindstrom551ea372001-06-05 18:56:16 +00001887 if (options->challenge_response_authentication == -1)
Ben Lindstrom0076d752001-08-06 20:53:26 +00001888 options->challenge_response_authentication = 1;
Darren Tucker0efd1552003-08-26 11:49:55 +10001889 if (options->gss_authentication == -1)
Darren Tuckera044f472003-10-15 15:52:03 +10001890 options->gss_authentication = 0;
Darren Tucker0efd1552003-08-26 11:49:55 +10001891 if (options->gss_deleg_creds == -1)
1892 options->gss_deleg_creds = 0;
Damien Miller95def091999-11-25 00:26:21 +11001893 if (options->password_authentication == -1)
1894 options->password_authentication = 1;
Damien Miller874d77b2000-10-14 16:23:11 +11001895 if (options->kbd_interactive_authentication == -1)
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +00001896 options->kbd_interactive_authentication = 1;
Damien Miller95def091999-11-25 00:26:21 +11001897 if (options->rhosts_rsa_authentication == -1)
Ben Lindstrom2bf82762002-06-11 15:53:05 +00001898 options->rhosts_rsa_authentication = 0;
Ben Lindstrom5eabda32001-04-12 23:34:34 +00001899 if (options->hostbased_authentication == -1)
1900 options->hostbased_authentication = 0;
Damien Miller95def091999-11-25 00:26:21 +11001901 if (options->batch_mode == -1)
1902 options->batch_mode = 0;
1903 if (options->check_host_ip == -1)
1904 options->check_host_ip = 1;
1905 if (options->strict_host_key_checking == -1)
1906 options->strict_host_key_checking = 2; /* 2 is default */
1907 if (options->compression == -1)
1908 options->compression = 0;
Damien Miller12c150e2003-12-17 16:31:10 +11001909 if (options->tcp_keep_alive == -1)
1910 options->tcp_keep_alive = 1;
Damien Miller95def091999-11-25 00:26:21 +11001911 if (options->compression_level == -1)
1912 options->compression_level = 6;
1913 if (options->port == -1)
1914 options->port = 0; /* Filled in ssh_connect. */
Darren Tucker0a4f04b2003-07-03 20:37:47 +10001915 if (options->address_family == -1)
1916 options->address_family = AF_UNSPEC;
Damien Miller95def091999-11-25 00:26:21 +11001917 if (options->connection_attempts == -1)
Ben Lindstromf9cedb92001-08-06 21:07:11 +00001918 options->connection_attempts = 1;
Damien Miller95def091999-11-25 00:26:21 +11001919 if (options->number_of_password_prompts == -1)
1920 options->number_of_password_prompts = 3;
1921 /* Selected in ssh_login(). */
1922 if (options->cipher == -1)
1923 options->cipher = SSH_CIPHER_NOT_SET;
Ben Lindstrom982dbbc2001-04-17 18:11:36 +00001924 /* options->hostkeyalgorithms, default set in myproposals.h */
Damien Miller78928792000-04-12 20:17:38 +10001925 if (options->protocol == SSH_PROTO_UNKNOWN)
Darren Tuckerbad50762009-10-11 21:51:08 +11001926 options->protocol = SSH_PROTO_2;
jcs@openbsd.orgf361df42015-11-15 22:26:49 +00001927 if (options->add_keys_to_agent == -1)
1928 options->add_keys_to_agent = 0;
Damien Miller95def091999-11-25 00:26:21 +11001929 if (options->num_identity_files == 0) {
Damien Miller0bc1bd82000-11-13 22:57:25 +11001930 if (options->protocol & SSH_PROTO_1) {
Darren Tucker19104782013-04-05 11:13:08 +11001931 add_identity_file(options, "~/",
1932 _PATH_SSH_CLIENT_IDENTITY, 0);
Damien Miller0bc1bd82000-11-13 22:57:25 +11001933 }
1934 if (options->protocol & SSH_PROTO_2) {
Darren Tucker19104782013-04-05 11:13:08 +11001935 add_identity_file(options, "~/",
1936 _PATH_SSH_CLIENT_ID_RSA, 0);
1937 add_identity_file(options, "~/",
1938 _PATH_SSH_CLIENT_ID_DSA, 0);
Damien Miller6af914a2010-09-10 11:39:26 +10001939#ifdef OPENSSL_HAS_ECC
Darren Tucker19104782013-04-05 11:13:08 +11001940 add_identity_file(options, "~/",
1941 _PATH_SSH_CLIENT_ID_ECDSA, 0);
Damien Miller6af914a2010-09-10 11:39:26 +10001942#endif
Damien Miller5be9d9e2013-12-07 11:24:01 +11001943 add_identity_file(options, "~/",
1944 _PATH_SSH_CLIENT_ID_ED25519, 0);
Damien Miller0bc1bd82000-11-13 22:57:25 +11001945 }
Damien Millereba71ba2000-04-29 23:57:08 +10001946 }
Damien Miller95def091999-11-25 00:26:21 +11001947 if (options->escape_char == -1)
1948 options->escape_char = '~';
Damien Miller295ee632011-05-29 21:42:31 +10001949 if (options->num_system_hostfiles == 0) {
1950 options->system_hostfiles[options->num_system_hostfiles++] =
1951 xstrdup(_PATH_SSH_SYSTEM_HOSTFILE);
1952 options->system_hostfiles[options->num_system_hostfiles++] =
1953 xstrdup(_PATH_SSH_SYSTEM_HOSTFILE2);
1954 }
1955 if (options->num_user_hostfiles == 0) {
1956 options->user_hostfiles[options->num_user_hostfiles++] =
1957 xstrdup(_PATH_SSH_USER_HOSTFILE);
1958 options->user_hostfiles[options->num_user_hostfiles++] =
1959 xstrdup(_PATH_SSH_USER_HOSTFILE2);
1960 }
Damien Millerfcd93202002-02-05 12:26:34 +11001961 if (options->log_level == SYSLOG_LEVEL_NOT_SET)
Ben Lindstromdb65e8f2001-01-19 04:26:52 +00001962 options->log_level = SYSLOG_LEVEL_INFO;
Ben Lindstrom2b7a0e92001-09-20 00:57:55 +00001963 if (options->clear_forwardings == 1)
1964 clear_forwardings(options);
Ben Lindstrom3cecc9a2001-10-03 17:39:38 +00001965 if (options->no_host_authentication_for_localhost == - 1)
1966 options->no_host_authentication_for_localhost = 0;
Damien Millerbd394c32004-03-08 23:12:36 +11001967 if (options->identities_only == -1)
1968 options->identities_only = 0;
Ben Lindstromb6df73b2002-11-09 15:52:31 +00001969 if (options->enable_ssh_keysign == -1)
1970 options->enable_ssh_keysign = 0;
Damien Millera5539d22003-04-09 20:50:06 +10001971 if (options->rekey_limit == -1)
1972 options->rekey_limit = 0;
Darren Tuckerc53c2af2013-05-16 20:28:16 +10001973 if (options->rekey_interval == -1)
1974 options->rekey_interval = 0;
Damien Miller37876e92003-05-15 10:19:46 +10001975 if (options->verify_host_key_dns == -1)
1976 options->verify_host_key_dns = 0;
Damien Miller509b0102003-12-17 16:33:10 +11001977 if (options->server_alive_interval == -1)
1978 options->server_alive_interval = 0;
1979 if (options->server_alive_count_max == -1)
1980 options->server_alive_count_max = 3;
Damien Miller0e220db2004-06-15 10:34:08 +10001981 if (options->control_master == -1)
1982 options->control_master = 0;
Damien Millere11e1ea2010-08-03 16:04:46 +10001983 if (options->control_persist == -1) {
1984 options->control_persist = 0;
1985 options->control_persist_timeout = 0;
1986 }
Damien Millere1776152005-03-01 21:47:37 +11001987 if (options->hash_known_hosts == -1)
1988 options->hash_known_hosts = 0;
Damien Millerd27b9472005-12-13 19:29:02 +11001989 if (options->tun_open == -1)
Damien Miller7b58e802005-12-13 19:33:19 +11001990 options->tun_open = SSH_TUNMODE_NO;
1991 if (options->tun_local == -1)
1992 options->tun_local = SSH_TUNID_ANY;
1993 if (options->tun_remote == -1)
1994 options->tun_remote = SSH_TUNID_ANY;
Damien Millerd27b9472005-12-13 19:29:02 +11001995 if (options->permit_local_command == -1)
1996 options->permit_local_command = 0;
Damien Miller10288242008-06-30 00:04:03 +10001997 if (options->visual_host_key == -1)
1998 options->visual_host_key = 0;
Damien Miller0dac6fb2010-11-20 15:19:38 +11001999 if (options->ip_qos_interactive == -1)
2000 options->ip_qos_interactive = IPTOS_LOWDELAY;
2001 if (options->ip_qos_bulk == -1)
2002 options->ip_qos_bulk = IPTOS_THROUGHPUT;
Damien Miller21771e22011-05-15 08:45:50 +10002003 if (options->request_tty == -1)
2004 options->request_tty = REQUEST_TTY_AUTO;
Damien Miller1262b662013-08-21 02:44:24 +10002005 if (options->proxy_use_fdpass == -1)
2006 options->proxy_use_fdpass = 0;
Damien Miller38505592013-10-17 11:48:13 +11002007 if (options->canonicalize_max_dots == -1)
2008 options->canonicalize_max_dots = 1;
2009 if (options->canonicalize_fallback_local == -1)
2010 options->canonicalize_fallback_local = 1;
2011 if (options->canonicalize_hostname == -1)
2012 options->canonicalize_hostname = SSH_CANONICALISE_NO;
djm@openbsd.org56d1c832014-12-21 22:27:55 +00002013 if (options->fingerprint_hash == -1)
2014 options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002015 if (options->update_hostkeys == -1)
djm@openbsd.org15ad7502015-02-02 07:41:40 +00002016 options->update_hostkeys = 0;
djm@openbsd.orgf9eca242015-07-30 00:01:34 +00002017 if (kex_assemble_names(KEX_CLIENT_ENCRYPT, &options->ciphers) != 0 ||
2018 kex_assemble_names(KEX_CLIENT_MAC, &options->macs) != 0 ||
2019 kex_assemble_names(KEX_CLIENT_KEX, &options->kex_algorithms) != 0 ||
2020 kex_assemble_names(KEX_DEFAULT_PK_ALG,
2021 &options->hostbased_key_types) != 0 ||
2022 kex_assemble_names(KEX_DEFAULT_PK_ALG,
2023 &options->pubkey_key_types) != 0)
2024 fatal("%s: kex_assemble_names failed", __func__);
djm@openbsd.org56d1c832014-12-21 22:27:55 +00002025
Damien Millere9fc72e2013-10-15 12:14:12 +11002026#define CLEAR_ON_NONE(v) \
2027 do { \
Damien Miller13f97b22014-02-24 15:57:55 +11002028 if (option_clear_or_none(v)) { \
Damien Millere9fc72e2013-10-15 12:14:12 +11002029 free(v); \
2030 v = NULL; \
2031 } \
2032 } while(0)
2033 CLEAR_ON_NONE(options->local_command);
2034 CLEAR_ON_NONE(options->proxy_command);
2035 CLEAR_ON_NONE(options->control_path);
djm@openbsd.org5e39a492014-12-04 02:24:32 +00002036 CLEAR_ON_NONE(options->revoked_host_keys);
markus@openbsd.org1a75d142016-05-04 14:29:58 +00002037 /* options->identity_agent distinguishes NULL from 'none' */
Damien Miller95def091999-11-25 00:26:21 +11002038 /* options->user will be set in the main program if appropriate */
2039 /* options->hostname will be set in the main program if appropriate */
Ben Lindstrom4dccfa52000-12-28 16:40:05 +00002040 /* options->host_key_alias should not be set by default */
Ben Lindstromb9be60a2001-03-11 01:49:19 +00002041 /* options->preferred_authentications will be set in ssh */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002042}
Damien Millerf91ee4c2005-03-01 21:24:33 +11002043
Damien Miller7acefbb2014-07-18 14:11:24 +10002044struct fwdarg {
2045 char *arg;
2046 int ispath;
2047};
2048
2049/*
2050 * parse_fwd_field
2051 * parses the next field in a port forwarding specification.
2052 * sets fwd to the parsed field and advances p past the colon
2053 * or sets it to NULL at end of string.
2054 * returns 0 on success, else non-zero.
2055 */
2056static int
2057parse_fwd_field(char **p, struct fwdarg *fwd)
2058{
2059 char *ep, *cp = *p;
2060 int ispath = 0;
2061
2062 if (*cp == '\0') {
2063 *p = NULL;
2064 return -1; /* end of string */
2065 }
2066
2067 /*
2068 * A field escaped with square brackets is used literally.
2069 * XXX - allow ']' to be escaped via backslash?
2070 */
2071 if (*cp == '[') {
2072 /* find matching ']' */
2073 for (ep = cp + 1; *ep != ']' && *ep != '\0'; ep++) {
2074 if (*ep == '/')
2075 ispath = 1;
2076 }
2077 /* no matching ']' or not at end of field. */
2078 if (ep[0] != ']' || (ep[1] != ':' && ep[1] != '\0'))
2079 return -1;
2080 /* NUL terminate the field and advance p past the colon */
2081 *ep++ = '\0';
2082 if (*ep != '\0')
2083 *ep++ = '\0';
2084 fwd->arg = cp + 1;
2085 fwd->ispath = ispath;
2086 *p = ep;
2087 return 0;
2088 }
2089
2090 for (cp = *p; *cp != '\0'; cp++) {
2091 switch (*cp) {
2092 case '\\':
2093 memmove(cp, cp + 1, strlen(cp + 1) + 1);
djm@openbsd.org78c2a4f2015-06-26 05:13:20 +00002094 if (*cp == '\0')
2095 return -1;
Damien Miller7acefbb2014-07-18 14:11:24 +10002096 break;
2097 case '/':
2098 ispath = 1;
2099 break;
2100 case ':':
2101 *cp++ = '\0';
2102 goto done;
2103 }
2104 }
2105done:
2106 fwd->arg = *p;
2107 fwd->ispath = ispath;
2108 *p = cp;
2109 return 0;
2110}
2111
Damien Millerf91ee4c2005-03-01 21:24:33 +11002112/*
2113 * parse_forward
2114 * parses a string containing a port forwarding specification of the form:
Damien Millera699d952008-11-03 19:27:34 +11002115 * dynamicfwd == 0
Damien Miller7acefbb2014-07-18 14:11:24 +10002116 * [listenhost:]listenport|listenpath:connecthost:connectport|connectpath
2117 * listenpath:connectpath
Damien Millera699d952008-11-03 19:27:34 +11002118 * dynamicfwd == 1
2119 * [listenhost:]listenport
Damien Millerf91ee4c2005-03-01 21:24:33 +11002120 * returns number of arguments parsed or zero on error
2121 */
2122int
Damien Miller7acefbb2014-07-18 14:11:24 +10002123parse_forward(struct Forward *fwd, const char *fwdspec, int dynamicfwd, int remotefwd)
Damien Millerf91ee4c2005-03-01 21:24:33 +11002124{
Damien Miller7acefbb2014-07-18 14:11:24 +10002125 struct fwdarg fwdargs[4];
2126 char *p, *cp;
Damien Millerf91ee4c2005-03-01 21:24:33 +11002127 int i;
Damien Millerf91ee4c2005-03-01 21:24:33 +11002128
Damien Miller7acefbb2014-07-18 14:11:24 +10002129 memset(fwd, 0, sizeof(*fwd));
2130 memset(fwdargs, 0, sizeof(fwdargs));
Damien Millerf91ee4c2005-03-01 21:24:33 +11002131
2132 cp = p = xstrdup(fwdspec);
2133
2134 /* skip leading spaces */
Damien Millerfdb23062013-11-21 13:57:15 +11002135 while (isspace((u_char)*cp))
Damien Millerf91ee4c2005-03-01 21:24:33 +11002136 cp++;
2137
Damien Miller7acefbb2014-07-18 14:11:24 +10002138 for (i = 0; i < 4; ++i) {
2139 if (parse_fwd_field(&cp, &fwdargs[i]) != 0)
Damien Millerf91ee4c2005-03-01 21:24:33 +11002140 break;
Damien Miller7acefbb2014-07-18 14:11:24 +10002141 }
Damien Millerf91ee4c2005-03-01 21:24:33 +11002142
Damien Millerf4b39532008-11-03 19:28:21 +11002143 /* Check for trailing garbage */
Damien Miller7acefbb2014-07-18 14:11:24 +10002144 if (cp != NULL && *cp != '\0') {
Damien Millerf91ee4c2005-03-01 21:24:33 +11002145 i = 0; /* failure */
Damien Miller7acefbb2014-07-18 14:11:24 +10002146 }
Damien Millerf91ee4c2005-03-01 21:24:33 +11002147
2148 switch (i) {
Damien Millera699d952008-11-03 19:27:34 +11002149 case 1:
Damien Miller7acefbb2014-07-18 14:11:24 +10002150 if (fwdargs[0].ispath) {
2151 fwd->listen_path = xstrdup(fwdargs[0].arg);
2152 fwd->listen_port = PORT_STREAMLOCAL;
2153 } else {
2154 fwd->listen_host = NULL;
2155 fwd->listen_port = a2port(fwdargs[0].arg);
2156 }
Damien Millera699d952008-11-03 19:27:34 +11002157 fwd->connect_host = xstrdup("socks");
2158 break;
2159
2160 case 2:
Damien Miller7acefbb2014-07-18 14:11:24 +10002161 if (fwdargs[0].ispath && fwdargs[1].ispath) {
2162 fwd->listen_path = xstrdup(fwdargs[0].arg);
2163 fwd->listen_port = PORT_STREAMLOCAL;
2164 fwd->connect_path = xstrdup(fwdargs[1].arg);
2165 fwd->connect_port = PORT_STREAMLOCAL;
2166 } else if (fwdargs[1].ispath) {
2167 fwd->listen_host = NULL;
2168 fwd->listen_port = a2port(fwdargs[0].arg);
2169 fwd->connect_path = xstrdup(fwdargs[1].arg);
2170 fwd->connect_port = PORT_STREAMLOCAL;
2171 } else {
2172 fwd->listen_host = xstrdup(fwdargs[0].arg);
2173 fwd->listen_port = a2port(fwdargs[1].arg);
2174 fwd->connect_host = xstrdup("socks");
2175 }
Damien Millera699d952008-11-03 19:27:34 +11002176 break;
2177
Damien Millerf91ee4c2005-03-01 21:24:33 +11002178 case 3:
Damien Miller7acefbb2014-07-18 14:11:24 +10002179 if (fwdargs[0].ispath) {
2180 fwd->listen_path = xstrdup(fwdargs[0].arg);
2181 fwd->listen_port = PORT_STREAMLOCAL;
2182 fwd->connect_host = xstrdup(fwdargs[1].arg);
2183 fwd->connect_port = a2port(fwdargs[2].arg);
2184 } else if (fwdargs[2].ispath) {
2185 fwd->listen_host = xstrdup(fwdargs[0].arg);
2186 fwd->listen_port = a2port(fwdargs[1].arg);
2187 fwd->connect_path = xstrdup(fwdargs[2].arg);
2188 fwd->connect_port = PORT_STREAMLOCAL;
2189 } else {
2190 fwd->listen_host = NULL;
2191 fwd->listen_port = a2port(fwdargs[0].arg);
2192 fwd->connect_host = xstrdup(fwdargs[1].arg);
2193 fwd->connect_port = a2port(fwdargs[2].arg);
2194 }
Damien Millerf91ee4c2005-03-01 21:24:33 +11002195 break;
2196
2197 case 4:
Damien Miller7acefbb2014-07-18 14:11:24 +10002198 fwd->listen_host = xstrdup(fwdargs[0].arg);
2199 fwd->listen_port = a2port(fwdargs[1].arg);
2200 fwd->connect_host = xstrdup(fwdargs[2].arg);
2201 fwd->connect_port = a2port(fwdargs[3].arg);
Damien Millerf91ee4c2005-03-01 21:24:33 +11002202 break;
2203 default:
2204 i = 0; /* failure */
2205 }
2206
Darren Tuckera627d422013-06-02 07:31:17 +10002207 free(p);
Damien Millerf91ee4c2005-03-01 21:24:33 +11002208
Damien Millera699d952008-11-03 19:27:34 +11002209 if (dynamicfwd) {
2210 if (!(i == 1 || i == 2))
2211 goto fail_free;
2212 } else {
Damien Miller7acefbb2014-07-18 14:11:24 +10002213 if (!(i == 3 || i == 4)) {
2214 if (fwd->connect_path == NULL &&
2215 fwd->listen_path == NULL)
2216 goto fail_free;
2217 }
2218 if (fwd->connect_port <= 0 && fwd->connect_path == NULL)
Damien Millera699d952008-11-03 19:27:34 +11002219 goto fail_free;
2220 }
2221
Damien Miller7acefbb2014-07-18 14:11:24 +10002222 if ((fwd->listen_port < 0 && fwd->listen_path == NULL) ||
2223 (!remotefwd && fwd->listen_port == 0))
Damien Millerf91ee4c2005-03-01 21:24:33 +11002224 goto fail_free;
Damien Millerf91ee4c2005-03-01 21:24:33 +11002225 if (fwd->connect_host != NULL &&
2226 strlen(fwd->connect_host) >= NI_MAXHOST)
2227 goto fail_free;
Damien Miller7acefbb2014-07-18 14:11:24 +10002228 /* XXX - if connecting to a remote socket, max sun len may not match this host */
2229 if (fwd->connect_path != NULL &&
2230 strlen(fwd->connect_path) >= PATH_MAX_SUN)
2231 goto fail_free;
Damien Miller4bf648f2009-02-14 16:28:21 +11002232 if (fwd->listen_host != NULL &&
2233 strlen(fwd->listen_host) >= NI_MAXHOST)
2234 goto fail_free;
Damien Miller7acefbb2014-07-18 14:11:24 +10002235 if (fwd->listen_path != NULL &&
2236 strlen(fwd->listen_path) >= PATH_MAX_SUN)
2237 goto fail_free;
Damien Millerf91ee4c2005-03-01 21:24:33 +11002238
2239 return (i);
2240
2241 fail_free:
Darren Tuckera627d422013-06-02 07:31:17 +10002242 free(fwd->connect_host);
2243 fwd->connect_host = NULL;
Damien Miller7acefbb2014-07-18 14:11:24 +10002244 free(fwd->connect_path);
2245 fwd->connect_path = NULL;
Darren Tuckera627d422013-06-02 07:31:17 +10002246 free(fwd->listen_host);
2247 fwd->listen_host = NULL;
Damien Miller7acefbb2014-07-18 14:11:24 +10002248 free(fwd->listen_path);
2249 fwd->listen_path = NULL;
Damien Millerf91ee4c2005-03-01 21:24:33 +11002250 return (0);
2251}
djm@openbsd.org957fbce2014-10-08 22:20:25 +00002252
2253/* XXX the following is a near-vebatim copy from servconf.c; refactor */
2254static const char *
2255fmt_multistate_int(int val, const struct multistate *m)
2256{
2257 u_int i;
2258
2259 for (i = 0; m[i].key != NULL; i++) {
2260 if (m[i].value == val)
2261 return m[i].key;
2262 }
2263 return "UNKNOWN";
2264}
2265
2266static const char *
2267fmt_intarg(OpCodes code, int val)
2268{
2269 if (val == -1)
2270 return "unset";
2271 switch (code) {
2272 case oAddressFamily:
2273 return fmt_multistate_int(val, multistate_addressfamily);
2274 case oVerifyHostKeyDNS:
2275 case oStrictHostKeyChecking:
djm@openbsd.org523463a2015-02-16 22:13:32 +00002276 case oUpdateHostkeys:
djm@openbsd.org957fbce2014-10-08 22:20:25 +00002277 return fmt_multistate_int(val, multistate_yesnoask);
2278 case oControlMaster:
2279 return fmt_multistate_int(val, multistate_controlmaster);
2280 case oTunnel:
2281 return fmt_multistate_int(val, multistate_tunnel);
2282 case oRequestTTY:
2283 return fmt_multistate_int(val, multistate_requesttty);
2284 case oCanonicalizeHostname:
2285 return fmt_multistate_int(val, multistate_canonicalizehostname);
djm@openbsd.org56d1c832014-12-21 22:27:55 +00002286 case oFingerprintHash:
2287 return ssh_digest_alg_name(val);
djm@openbsd.org957fbce2014-10-08 22:20:25 +00002288 case oProtocol:
2289 switch (val) {
2290 case SSH_PROTO_1:
2291 return "1";
2292 case SSH_PROTO_2:
2293 return "2";
2294 case (SSH_PROTO_1|SSH_PROTO_2):
2295 return "2,1";
2296 default:
2297 return "UNKNOWN";
2298 }
2299 default:
2300 switch (val) {
2301 case 0:
2302 return "no";
2303 case 1:
2304 return "yes";
2305 default:
2306 return "UNKNOWN";
2307 }
2308 }
2309}
2310
2311static const char *
2312lookup_opcode_name(OpCodes code)
2313{
2314 u_int i;
2315
2316 for (i = 0; keywords[i].name != NULL; i++)
2317 if (keywords[i].opcode == code)
2318 return(keywords[i].name);
2319 return "UNKNOWN";
2320}
2321
2322static void
2323dump_cfg_int(OpCodes code, int val)
2324{
2325 printf("%s %d\n", lookup_opcode_name(code), val);
2326}
2327
2328static void
2329dump_cfg_fmtint(OpCodes code, int val)
2330{
2331 printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
2332}
2333
2334static void
2335dump_cfg_string(OpCodes code, const char *val)
2336{
2337 if (val == NULL)
2338 return;
2339 printf("%s %s\n", lookup_opcode_name(code), val);
2340}
2341
2342static void
2343dump_cfg_strarray(OpCodes code, u_int count, char **vals)
2344{
2345 u_int i;
2346
2347 for (i = 0; i < count; i++)
2348 printf("%s %s\n", lookup_opcode_name(code), vals[i]);
2349}
2350
2351static void
2352dump_cfg_strarray_oneline(OpCodes code, u_int count, char **vals)
2353{
2354 u_int i;
2355
2356 printf("%s", lookup_opcode_name(code));
2357 for (i = 0; i < count; i++)
2358 printf(" %s", vals[i]);
2359 printf("\n");
2360}
2361
2362static void
2363dump_cfg_forwards(OpCodes code, u_int count, const struct Forward *fwds)
2364{
2365 const struct Forward *fwd;
2366 u_int i;
2367
2368 /* oDynamicForward */
2369 for (i = 0; i < count; i++) {
2370 fwd = &fwds[i];
2371 if (code == oDynamicForward &&
2372 strcmp(fwd->connect_host, "socks") != 0)
2373 continue;
2374 if (code == oLocalForward &&
2375 strcmp(fwd->connect_host, "socks") == 0)
2376 continue;
2377 printf("%s", lookup_opcode_name(code));
2378 if (fwd->listen_port == PORT_STREAMLOCAL)
2379 printf(" %s", fwd->listen_path);
2380 else if (fwd->listen_host == NULL)
2381 printf(" %d", fwd->listen_port);
2382 else {
2383 printf(" [%s]:%d",
2384 fwd->listen_host, fwd->listen_port);
2385 }
2386 if (code != oDynamicForward) {
2387 if (fwd->connect_port == PORT_STREAMLOCAL)
2388 printf(" %s", fwd->connect_path);
2389 else if (fwd->connect_host == NULL)
2390 printf(" %d", fwd->connect_port);
2391 else {
2392 printf(" [%s]:%d",
2393 fwd->connect_host, fwd->connect_port);
2394 }
2395 }
2396 printf("\n");
2397 }
2398}
2399
2400void
2401dump_client_config(Options *o, const char *host)
2402{
2403 int i;
2404 char vbuf[5];
2405
djm@openbsd.org60a92472015-08-21 23:53:08 +00002406 /* This is normally prepared in ssh_kex2 */
2407 if (kex_assemble_names(KEX_DEFAULT_PK_ALG, &o->hostkeyalgorithms) != 0)
2408 fatal("%s: kex_assemble_names failed", __func__);
2409
djm@openbsd.org957fbce2014-10-08 22:20:25 +00002410 /* Most interesting options first: user, host, port */
2411 dump_cfg_string(oUser, o->user);
2412 dump_cfg_string(oHostName, host);
2413 dump_cfg_int(oPort, o->port);
2414
2415 /* Flag options */
2416 dump_cfg_fmtint(oAddressFamily, o->address_family);
2417 dump_cfg_fmtint(oBatchMode, o->batch_mode);
2418 dump_cfg_fmtint(oCanonicalizeFallbackLocal, o->canonicalize_fallback_local);
2419 dump_cfg_fmtint(oCanonicalizeHostname, o->canonicalize_hostname);
2420 dump_cfg_fmtint(oChallengeResponseAuthentication, o->challenge_response_authentication);
2421 dump_cfg_fmtint(oCheckHostIP, o->check_host_ip);
2422 dump_cfg_fmtint(oCompression, o->compression);
2423 dump_cfg_fmtint(oControlMaster, o->control_master);
2424 dump_cfg_fmtint(oEnableSSHKeysign, o->enable_ssh_keysign);
2425 dump_cfg_fmtint(oExitOnForwardFailure, o->exit_on_forward_failure);
djm@openbsd.org56d1c832014-12-21 22:27:55 +00002426 dump_cfg_fmtint(oFingerprintHash, o->fingerprint_hash);
djm@openbsd.org957fbce2014-10-08 22:20:25 +00002427 dump_cfg_fmtint(oForwardAgent, o->forward_agent);
2428 dump_cfg_fmtint(oForwardX11, o->forward_x11);
2429 dump_cfg_fmtint(oForwardX11Trusted, o->forward_x11_trusted);
2430 dump_cfg_fmtint(oGatewayPorts, o->fwd_opts.gateway_ports);
2431#ifdef GSSAPI
2432 dump_cfg_fmtint(oGssAuthentication, o->gss_authentication);
2433 dump_cfg_fmtint(oGssDelegateCreds, o->gss_deleg_creds);
2434#endif /* GSSAPI */
2435 dump_cfg_fmtint(oHashKnownHosts, o->hash_known_hosts);
2436 dump_cfg_fmtint(oHostbasedAuthentication, o->hostbased_authentication);
2437 dump_cfg_fmtint(oIdentitiesOnly, o->identities_only);
2438 dump_cfg_fmtint(oKbdInteractiveAuthentication, o->kbd_interactive_authentication);
2439 dump_cfg_fmtint(oNoHostAuthenticationForLocalhost, o->no_host_authentication_for_localhost);
2440 dump_cfg_fmtint(oPasswordAuthentication, o->password_authentication);
2441 dump_cfg_fmtint(oPermitLocalCommand, o->permit_local_command);
2442 dump_cfg_fmtint(oProtocol, o->protocol);
2443 dump_cfg_fmtint(oProxyUseFdpass, o->proxy_use_fdpass);
2444 dump_cfg_fmtint(oPubkeyAuthentication, o->pubkey_authentication);
2445 dump_cfg_fmtint(oRequestTTY, o->request_tty);
2446 dump_cfg_fmtint(oRhostsRSAAuthentication, o->rhosts_rsa_authentication);
2447 dump_cfg_fmtint(oRSAAuthentication, o->rsa_authentication);
2448 dump_cfg_fmtint(oStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink);
2449 dump_cfg_fmtint(oStrictHostKeyChecking, o->strict_host_key_checking);
2450 dump_cfg_fmtint(oTCPKeepAlive, o->tcp_keep_alive);
2451 dump_cfg_fmtint(oTunnel, o->tun_open);
2452 dump_cfg_fmtint(oUsePrivilegedPort, o->use_privileged_port);
2453 dump_cfg_fmtint(oVerifyHostKeyDNS, o->verify_host_key_dns);
2454 dump_cfg_fmtint(oVisualHostKey, o->visual_host_key);
djm@openbsd.org8d4f8722015-01-26 03:04:45 +00002455 dump_cfg_fmtint(oUpdateHostkeys, o->update_hostkeys);
djm@openbsd.org957fbce2014-10-08 22:20:25 +00002456
2457 /* Integer options */
2458 dump_cfg_int(oCanonicalizeMaxDots, o->canonicalize_max_dots);
2459 dump_cfg_int(oCompressionLevel, o->compression_level);
2460 dump_cfg_int(oConnectionAttempts, o->connection_attempts);
2461 dump_cfg_int(oForwardX11Timeout, o->forward_x11_timeout);
2462 dump_cfg_int(oNumberOfPasswordPrompts, o->number_of_password_prompts);
2463 dump_cfg_int(oServerAliveCountMax, o->server_alive_count_max);
2464 dump_cfg_int(oServerAliveInterval, o->server_alive_interval);
2465
2466 /* String options */
2467 dump_cfg_string(oBindAddress, o->bind_address);
2468 dump_cfg_string(oCiphers, o->ciphers ? o->ciphers : KEX_CLIENT_ENCRYPT);
2469 dump_cfg_string(oControlPath, o->control_path);
djm@openbsd.org60a92472015-08-21 23:53:08 +00002470 dump_cfg_string(oHostKeyAlgorithms, o->hostkeyalgorithms);
djm@openbsd.org957fbce2014-10-08 22:20:25 +00002471 dump_cfg_string(oHostKeyAlias, o->host_key_alias);
djm@openbsd.org46347ed2015-01-30 11:43:14 +00002472 dump_cfg_string(oHostbasedKeyTypes, o->hostbased_key_types);
markus@openbsd.orgb02ad1c2016-05-04 12:21:53 +00002473 dump_cfg_string(oIdentityAgent, o->identity_agent);
djm@openbsd.org957fbce2014-10-08 22:20:25 +00002474 dump_cfg_string(oKbdInteractiveDevices, o->kbd_interactive_devices);
2475 dump_cfg_string(oKexAlgorithms, o->kex_algorithms ? o->kex_algorithms : KEX_CLIENT_KEX);
2476 dump_cfg_string(oLocalCommand, o->local_command);
2477 dump_cfg_string(oLogLevel, log_level_name(o->log_level));
2478 dump_cfg_string(oMacs, o->macs ? o->macs : KEX_CLIENT_MAC);
2479 dump_cfg_string(oPKCS11Provider, o->pkcs11_provider);
2480 dump_cfg_string(oPreferredAuthentications, o->preferred_authentications);
2481 dump_cfg_string(oProxyCommand, o->proxy_command);
djm@openbsd.org0c46bbe2015-10-07 15:59:12 +00002482 dump_cfg_string(oPubkeyAcceptedKeyTypes, o->pubkey_key_types);
djm@openbsd.org5e39a492014-12-04 02:24:32 +00002483 dump_cfg_string(oRevokedHostKeys, o->revoked_host_keys);
djm@openbsd.org46347ed2015-01-30 11:43:14 +00002484 dump_cfg_string(oXAuthLocation, o->xauth_location);
djm@openbsd.org957fbce2014-10-08 22:20:25 +00002485
djm@openbsd.org46347ed2015-01-30 11:43:14 +00002486 /* Forwards */
djm@openbsd.org957fbce2014-10-08 22:20:25 +00002487 dump_cfg_forwards(oDynamicForward, o->num_local_forwards, o->local_forwards);
2488 dump_cfg_forwards(oLocalForward, o->num_local_forwards, o->local_forwards);
2489 dump_cfg_forwards(oRemoteForward, o->num_remote_forwards, o->remote_forwards);
2490
2491 /* String array options */
2492 dump_cfg_strarray(oIdentityFile, o->num_identity_files, o->identity_files);
2493 dump_cfg_strarray_oneline(oCanonicalDomains, o->num_canonical_domains, o->canonical_domains);
2494 dump_cfg_strarray_oneline(oGlobalKnownHostsFile, o->num_system_hostfiles, o->system_hostfiles);
2495 dump_cfg_strarray_oneline(oUserKnownHostsFile, o->num_user_hostfiles, o->user_hostfiles);
2496 dump_cfg_strarray(oSendEnv, o->num_send_env, o->send_env);
2497
2498 /* Special cases */
2499
2500 /* oConnectTimeout */
2501 if (o->connection_timeout == -1)
2502 printf("connecttimeout none\n");
2503 else
2504 dump_cfg_int(oConnectTimeout, o->connection_timeout);
2505
2506 /* oTunnelDevice */
2507 printf("tunneldevice");
2508 if (o->tun_local == SSH_TUNID_ANY)
2509 printf(" any");
2510 else
2511 printf(" %d", o->tun_local);
2512 if (o->tun_remote == SSH_TUNID_ANY)
2513 printf(":any");
2514 else
2515 printf(":%d", o->tun_remote);
2516 printf("\n");
2517
2518 /* oCanonicalizePermittedCNAMEs */
2519 if ( o->num_permitted_cnames > 0) {
2520 printf("canonicalizePermittedcnames");
2521 for (i = 0; i < o->num_permitted_cnames; i++) {
2522 printf(" %s:%s", o->permitted_cnames[i].source_list,
2523 o->permitted_cnames[i].target_list);
2524 }
2525 printf("\n");
2526 }
2527
2528 /* oCipher */
2529 if (o->cipher != SSH_CIPHER_NOT_SET)
2530 printf("Cipher %s\n", cipher_name(o->cipher));
2531
2532 /* oControlPersist */
2533 if (o->control_persist == 0 || o->control_persist_timeout == 0)
2534 dump_cfg_fmtint(oControlPersist, o->control_persist);
2535 else
2536 dump_cfg_int(oControlPersist, o->control_persist_timeout);
2537
2538 /* oEscapeChar */
2539 if (o->escape_char == SSH_ESCAPECHAR_NONE)
2540 printf("escapechar none\n");
2541 else {
2542 vis(vbuf, o->escape_char, VIS_WHITE, 0);
2543 printf("escapechar %s\n", vbuf);
2544 }
2545
2546 /* oIPQoS */
2547 printf("ipqos %s ", iptos2str(o->ip_qos_interactive));
2548 printf("%s\n", iptos2str(o->ip_qos_bulk));
2549
2550 /* oRekeyLimit */
dtucker@openbsd.org921ff002016-01-29 02:54:45 +00002551 printf("rekeylimit %llu %d\n",
2552 (unsigned long long)o->rekey_limit, o->rekey_interval);
djm@openbsd.org957fbce2014-10-08 22:20:25 +00002553
2554 /* oStreamLocalBindMask */
2555 printf("streamlocalbindmask 0%o\n",
2556 o->fwd_opts.streamlocal_bind_mask);
2557}