blob: 08e168521de4825fff607980628eeefa53781ef9 [file] [log] [blame]
Damien Miller5be9d9e2013-12-07 11:24:01 +11001/* $OpenBSD: readconf.c,v 1.215 2013/12/06 13:39:49 markus Exp $ */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002/*
Damien Miller95def091999-11-25 00:26:21 +11003 * Author: Tatu Ylonen <ylo@cs.hut.fi>
Damien Miller95def091999-11-25 00:26:21 +11004 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * All rights reserved
Damien Miller95def091999-11-25 00:26:21 +11006 * Functions for reading the configuration files.
Damien Miller4af51302000-04-16 11:18:38 +10007 *
Damien Millere4340be2000-09-16 13:29:08 +11008 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
Damien Miller95def091999-11-25 00:26:21 +110013 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100014
15#include "includes.h"
Damien Millerf17883e2006-03-15 11:45:54 +110016
17#include <sys/types.h>
18#include <sys/stat.h>
Damien Miller8ec8c3e2006-07-10 20:35:38 +100019#include <sys/socket.h>
Damien Miller194fd902013-10-15 12:13:05 +110020#include <sys/wait.h>
Damien Miller8ec8c3e2006-07-10 20:35:38 +100021
22#include <netinet/in.h>
Damien Miller0dac6fb2010-11-20 15:19:38 +110023#include <netinet/in_systm.h>
24#include <netinet/ip.h>
Damien Millerd4a8b7e1999-10-27 13:42:43 +100025
Damien Millerc7b06362006-03-15 11:53:45 +110026#include <ctype.h>
Darren Tucker39972492006-07-12 22:22:46 +100027#include <errno.h>
Damien Miller194fd902013-10-15 12:13:05 +110028#include <fcntl.h>
Damien Millerb8fe89c2006-07-24 14:51:00 +100029#include <netdb.h>
Damien Miller194fd902013-10-15 12:13:05 +110030#include <paths.h>
31#include <pwd.h>
Damien Millerd7834352006-08-05 12:39:39 +100032#include <signal.h>
Damien Millerded319c2006-09-01 15:38:36 +100033#include <stdarg.h>
Damien Millera7a73ee2006-08-05 11:37:59 +100034#include <stdio.h>
Damien Millere3476ed2006-07-24 14:13:33 +100035#include <string.h>
Damien Millere6b3b612006-07-24 14:01:23 +100036#include <unistd.h>
Darren Tuckere194ba42013-05-16 20:47:31 +100037#ifdef HAVE_UTIL_H
Darren Tuckerb7ee8522013-05-16 20:33:10 +100038#include <util.h>
Darren Tuckere194ba42013-05-16 20:47:31 +100039#endif
Damien Millerc7b06362006-03-15 11:53:45 +110040
Damien Millerd4a8b7e1999-10-27 13:42:43 +100041#include "xmalloc.h"
Damien Millerd7834352006-08-05 12:39:39 +100042#include "ssh.h"
Damien Miller78928792000-04-12 20:17:38 +100043#include "compat.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000044#include "cipher.h"
45#include "pathnames.h"
46#include "log.h"
Damien Millerd7834352006-08-05 12:39:39 +100047#include "key.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000048#include "readconf.h"
49#include "match.h"
50#include "misc.h"
Damien Millerd7834352006-08-05 12:39:39 +100051#include "buffer.h"
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000052#include "kex.h"
53#include "mac.h"
Damien Miller194fd902013-10-15 12:13:05 +110054#include "uidswap.h"
Damien Millerd4a8b7e1999-10-27 13:42:43 +100055
56/* Format of the configuration file:
57
58 # Configuration data is parsed as follows:
59 # 1. command line options
60 # 2. user-specific file
61 # 3. system-wide file
62 # Any configuration value is only changed the first time it is set.
63 # Thus, host-specific definitions should be at the beginning of the
64 # configuration file, and defaults at the end.
65
66 # Host-specific declarations. These may override anything above. A single
67 # host may match multiple declarations; these are processed in the order
68 # that they are given in.
69
70 Host *.ngs.fi ngs.fi
Ben Lindstrom4daea862002-06-09 20:04:02 +000071 User foo
Damien Millerd4a8b7e1999-10-27 13:42:43 +100072
73 Host fake.com
74 HostName another.host.name.real.org
75 User blaah
76 Port 34289
77 ForwardX11 no
78 ForwardAgent no
79
80 Host books.com
81 RemoteForward 9999 shadows.cs.hut.fi:9999
82 Cipher 3des
83
84 Host fascist.blob.com
85 Port 23123
86 User tylonen
Damien Millerd4a8b7e1999-10-27 13:42:43 +100087 PasswordAuthentication no
88
89 Host puukko.hut.fi
90 User t35124p
91 ProxyCommand ssh-proxy %h %p
92
93 Host *.fr
Ben Lindstrom4daea862002-06-09 20:04:02 +000094 PublicKeyAuthentication no
Damien Millerd4a8b7e1999-10-27 13:42:43 +100095
96 Host *.su
97 Cipher none
98 PasswordAuthentication no
99
Damien Millerd27b9472005-12-13 19:29:02 +1100100 Host vpn.fake.com
101 Tunnel yes
102 TunnelDevice 3
103
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000104 # Defaults for various options
105 Host *
106 ForwardAgent no
Damien Miller0bc1bd82000-11-13 22:57:25 +1100107 ForwardX11 no
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000108 PasswordAuthentication yes
109 RSAAuthentication yes
110 RhostsRSAAuthentication yes
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000111 StrictHostKeyChecking yes
Damien Miller12c150e2003-12-17 16:31:10 +1100112 TcpKeepAlive no
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000113 IdentityFile ~/.ssh/identity
114 Port 22
115 EscapeChar ~
116
117*/
118
119/* Keyword tokens. */
120
Damien Miller95def091999-11-25 00:26:21 +1100121typedef enum {
122 oBadOption,
Damien Miller194fd902013-10-15 12:13:05 +1100123 oHost, oMatch,
Damien Miller1ab6a512010-06-26 10:02:24 +1000124 oForwardAgent, oForwardX11, oForwardX11Trusted, oForwardX11Timeout,
125 oGatewayPorts, oExitOnForwardFailure,
Ben Lindstromcb72e4f2002-06-21 00:41:51 +0000126 oPasswordAuthentication, oRSAAuthentication,
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000127 oChallengeResponseAuthentication, oXAuthLocation,
Damien Miller95def091999-11-25 00:26:21 +1100128 oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
Damien Miller194fd902013-10-15 12:13:05 +1100129 oUser, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
Damien Miller95def091999-11-25 00:26:21 +1100130 oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
131 oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
Damien Miller12c150e2003-12-17 16:31:10 +1100132 oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts,
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000133 oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,
Damien Miller0bc1bd82000-11-13 22:57:25 +1100134 oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000135 oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
Ben Lindstrom982dbbc2001-04-17 18:11:36 +0000136 oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
Damien Miller7ea845e2010-02-12 09:21:02 +1100137 oHostKeyAlgorithms, oBindAddress, oPKCS11Provider,
Ben Lindstrom4daea862002-06-09 20:04:02 +0000138 oClearAllForwardings, oNoHostAuthenticationForLocalhost,
Damien Millerb78d5eb2003-05-16 11:39:04 +1000139 oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
Darren Tucker0efd1552003-08-26 11:49:55 +1000140 oAddressFamily, oGssAuthentication, oGssDelegateCreds,
Damien Millerbd394c32004-03-08 23:12:36 +1100141 oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
Damien Millere11e1ea2010-08-03 16:04:46 +1000142 oSendEnv, oControlPath, oControlMaster, oControlPersist,
143 oHashKnownHosts,
Damien Millerd27b9472005-12-13 19:29:02 +1100144 oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
Darren Tucker7bd98e72010-01-10 10:31:12 +1100145 oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication,
Damien Miller1262b662013-08-21 02:44:24 +1000146 oKexAlgorithms, oIPQoS, oRequestTTY, oIgnoreUnknown, oProxyUseFdpass,
Damien Miller38505592013-10-17 11:48:13 +1100147 oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots,
148 oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs,
Darren Tucker07636982013-05-16 20:30:03 +1000149 oIgnoredUnknownOption, oDeprecated, oUnsupported
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000150} OpCodes;
151
152/* Textual representations of the tokens. */
153
Damien Miller95def091999-11-25 00:26:21 +1100154static struct {
155 const char *name;
156 OpCodes opcode;
157} keywords[] = {
158 { "forwardagent", oForwardAgent },
159 { "forwardx11", oForwardX11 },
Darren Tucker0a118da2003-10-15 15:54:32 +1000160 { "forwardx11trusted", oForwardX11Trusted },
Damien Miller1ab6a512010-06-26 10:02:24 +1000161 { "forwardx11timeout", oForwardX11Timeout },
Darren Tuckere7d4b192006-07-12 22:17:10 +1000162 { "exitonforwardfailure", oExitOnForwardFailure },
Damien Millerd3a18572000-06-07 19:55:44 +1000163 { "xauthlocation", oXAuthLocation },
Damien Miller95def091999-11-25 00:26:21 +1100164 { "gatewayports", oGatewayPorts },
165 { "useprivilegedport", oUsePrivilegedPort },
Darren Tuckerec960f22003-08-13 20:37:05 +1000166 { "rhostsauthentication", oDeprecated },
Damien Miller95def091999-11-25 00:26:21 +1100167 { "passwordauthentication", oPasswordAuthentication },
Damien Miller874d77b2000-10-14 16:23:11 +1100168 { "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
169 { "kbdinteractivedevices", oKbdInteractiveDevices },
Damien Miller95def091999-11-25 00:26:21 +1100170 { "rsaauthentication", oRSAAuthentication },
Damien Miller0bc1bd82000-11-13 22:57:25 +1100171 { "pubkeyauthentication", oPubkeyAuthentication },
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000172 { "dsaauthentication", oPubkeyAuthentication }, /* alias */
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000173 { "rhostsrsaauthentication", oRhostsRSAAuthentication },
Ben Lindstromd69dab32001-04-12 23:36:05 +0000174 { "hostbasedauthentication", oHostbasedAuthentication },
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000175 { "challengeresponseauthentication", oChallengeResponseAuthentication },
176 { "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
177 { "tisauthentication", oChallengeResponseAuthentication }, /* alias */
Damien Millerf9b3feb2003-05-16 11:38:32 +1000178 { "kerberosauthentication", oUnsupported },
179 { "kerberostgtpassing", oUnsupported },
Damien Millerf9b3feb2003-05-16 11:38:32 +1000180 { "afstokenpassing", oUnsupported },
Darren Tucker0efd1552003-08-26 11:49:55 +1000181#if defined(GSSAPI)
182 { "gssapiauthentication", oGssAuthentication },
Darren Tucker0efd1552003-08-26 11:49:55 +1000183 { "gssapidelegatecredentials", oGssDelegateCreds },
184#else
185 { "gssapiauthentication", oUnsupported },
186 { "gssapidelegatecredentials", oUnsupported },
187#endif
Ben Lindstrom4daea862002-06-09 20:04:02 +0000188 { "fallbacktorsh", oDeprecated },
189 { "usersh", oDeprecated },
Damien Miller95def091999-11-25 00:26:21 +1100190 { "identityfile", oIdentityFile },
Damien Miller5bc6aae2009-01-28 16:27:31 +1100191 { "identityfile2", oIdentityFile }, /* obsolete */
Damien Millerbd394c32004-03-08 23:12:36 +1100192 { "identitiesonly", oIdentitiesOnly },
Damien Miller95def091999-11-25 00:26:21 +1100193 { "hostname", oHostName },
Ben Lindstrom4dccfa52000-12-28 16:40:05 +0000194 { "hostkeyalias", oHostKeyAlias },
Damien Miller95def091999-11-25 00:26:21 +1100195 { "proxycommand", oProxyCommand },
196 { "port", oPort },
197 { "cipher", oCipher },
Damien Miller78928792000-04-12 20:17:38 +1000198 { "ciphers", oCiphers },
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000199 { "macs", oMacs },
Damien Miller78928792000-04-12 20:17:38 +1000200 { "protocol", oProtocol },
Damien Miller95def091999-11-25 00:26:21 +1100201 { "remoteforward", oRemoteForward },
202 { "localforward", oLocalForward },
203 { "user", oUser },
204 { "host", oHost },
Damien Miller194fd902013-10-15 12:13:05 +1100205 { "match", oMatch },
Damien Miller95def091999-11-25 00:26:21 +1100206 { "escapechar", oEscapeChar },
Damien Miller95def091999-11-25 00:26:21 +1100207 { "globalknownhostsfile", oGlobalKnownHostsFile },
Damien Miller295ee632011-05-29 21:42:31 +1000208 { "globalknownhostsfile2", oDeprecated },
Damien Miller5bc6aae2009-01-28 16:27:31 +1100209 { "userknownhostsfile", oUserKnownHostsFile },
Damien Miller295ee632011-05-29 21:42:31 +1000210 { "userknownhostsfile2", oDeprecated },
Damien Miller95def091999-11-25 00:26:21 +1100211 { "connectionattempts", oConnectionAttempts },
212 { "batchmode", oBatchMode },
213 { "checkhostip", oCheckHostIP },
214 { "stricthostkeychecking", oStrictHostKeyChecking },
215 { "compression", oCompression },
216 { "compressionlevel", oCompressionLevel },
Damien Miller12c150e2003-12-17 16:31:10 +1100217 { "tcpkeepalive", oTCPKeepAlive },
218 { "keepalive", oTCPKeepAlive }, /* obsolete */
Damien Miller95def091999-11-25 00:26:21 +1100219 { "numberofpasswordprompts", oNumberOfPasswordPrompts },
Damien Miller95def091999-11-25 00:26:21 +1100220 { "loglevel", oLogLevel },
Ben Lindstrom3bb4f9d2001-04-08 18:30:26 +0000221 { "dynamicforward", oDynamicForward },
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000222 { "preferredauthentications", oPreferredAuthentications },
Ben Lindstrom982dbbc2001-04-17 18:11:36 +0000223 { "hostkeyalgorithms", oHostKeyAlgorithms },
Ben Lindstrome0f88042001-04-30 13:06:24 +0000224 { "bindaddress", oBindAddress },
Damien Miller7ea845e2010-02-12 09:21:02 +1100225#ifdef ENABLE_PKCS11
226 { "smartcarddevice", oPKCS11Provider },
227 { "pkcs11provider", oPKCS11Provider },
Damien Millerf9b3feb2003-05-16 11:38:32 +1000228#else
229 { "smartcarddevice", oUnsupported },
Damien Miller7ea845e2010-02-12 09:21:02 +1100230 { "pkcs11provider", oUnsupported },
Damien Millerf9b3feb2003-05-16 11:38:32 +1000231#endif
Damien Miller9f0f5c62001-12-21 14:45:46 +1100232 { "clearallforwardings", oClearAllForwardings },
Ben Lindstromb6df73b2002-11-09 15:52:31 +0000233 { "enablesshkeysign", oEnableSSHKeysign },
Damien Miller37876e92003-05-15 10:19:46 +1000234 { "verifyhostkeydns", oVerifyHostKeyDNS },
Damien Miller9f0f5c62001-12-21 14:45:46 +1100235 { "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost },
Damien Millera5539d22003-04-09 20:50:06 +1000236 { "rekeylimit", oRekeyLimit },
Damien Millerb78d5eb2003-05-16 11:39:04 +1000237 { "connecttimeout", oConnectTimeout },
Damien Miller20a8f972003-05-18 20:50:30 +1000238 { "addressfamily", oAddressFamily },
Damien Miller509b0102003-12-17 16:33:10 +1100239 { "serveraliveinterval", oServerAliveInterval },
240 { "serveralivecountmax", oServerAliveCountMax },
Darren Tucker46bc0752004-05-02 22:11:30 +1000241 { "sendenv", oSendEnv },
Damien Miller0e220db2004-06-15 10:34:08 +1000242 { "controlpath", oControlPath },
243 { "controlmaster", oControlMaster },
Damien Millere11e1ea2010-08-03 16:04:46 +1000244 { "controlpersist", oControlPersist },
Damien Millere1776152005-03-01 21:47:37 +1100245 { "hashknownhosts", oHashKnownHosts },
Damien Millerd27b9472005-12-13 19:29:02 +1100246 { "tunnel", oTunnel },
247 { "tunneldevice", oTunnelDevice },
248 { "localcommand", oLocalCommand },
249 { "permitlocalcommand", oPermitLocalCommand },
Damien Miller10288242008-06-30 00:04:03 +1000250 { "visualhostkey", oVisualHostKey },
Darren Tucker71e4d542009-07-06 07:12:27 +1000251 { "useroaming", oUseRoaming },
Damien Miller01ed2272008-11-05 16:20:46 +1100252#ifdef JPAKE
253 { "zeroknowledgepasswordauthentication",
254 oZeroKnowledgePasswordAuthentication },
255#else
256 { "zeroknowledgepasswordauthentication", oUnsupported },
257#endif
Damien Millerd5f62bf2010-09-24 22:11:14 +1000258 { "kexalgorithms", oKexAlgorithms },
Damien Miller0dac6fb2010-11-20 15:19:38 +1100259 { "ipqos", oIPQoS },
Damien Miller21771e22011-05-15 08:45:50 +1000260 { "requesttty", oRequestTTY },
Damien Miller1262b662013-08-21 02:44:24 +1000261 { "proxyusefdpass", oProxyUseFdpass },
Damien Miller0faf7472013-10-17 11:47:23 +1100262 { "canonicaldomains", oCanonicalDomains },
Damien Miller38505592013-10-17 11:48:13 +1100263 { "canonicalizefallbacklocal", oCanonicalizeFallbackLocal },
264 { "canonicalizehostname", oCanonicalizeHostname },
265 { "canonicalizemaxdots", oCanonicalizeMaxDots },
266 { "canonicalizepermittedcnames", oCanonicalizePermittedCNAMEs },
Darren Tucker07636982013-05-16 20:30:03 +1000267 { "ignoreunknown", oIgnoreUnknown },
Damien Miller01ed2272008-11-05 16:20:46 +1100268
Ben Lindstrom65366a82001-12-06 16:32:47 +0000269 { NULL, oBadOption }
Damien Miller5ce662a1999-11-11 17:57:39 +1100270};
271
Damien Miller5428f641999-11-25 11:54:57 +1100272/*
273 * Adds a local TCP/IP port forward to options. Never returns if there is an
274 * error.
275 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000276
Damien Miller4af51302000-04-16 11:18:38 +1000277void
Damien Millerf91ee4c2005-03-01 21:24:33 +1100278add_local_forward(Options *options, const Forward *newfwd)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000279{
Damien Miller95def091999-11-25 00:26:21 +1100280 Forward *fwd;
Ben Lindstrom99a4e142002-07-09 14:06:40 +0000281#ifndef NO_IPPORT_RESERVED_CONCEPT
Damien Miller95def091999-11-25 00:26:21 +1100282 extern uid_t original_real_uid;
Damien Millerf91ee4c2005-03-01 21:24:33 +1100283 if (newfwd->listen_port < IPPORT_RESERVED && original_real_uid != 0)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +0000284 fatal("Privileged ports can only be forwarded by root.");
Damien Millerbac2d8a2000-09-05 16:13:06 +1100285#endif
Damien Miller232cfb12010-06-26 09:50:30 +1000286 options->local_forwards = xrealloc(options->local_forwards,
287 options->num_local_forwards + 1,
288 sizeof(*options->local_forwards));
Damien Miller95def091999-11-25 00:26:21 +1100289 fwd = &options->local_forwards[options->num_local_forwards++];
Damien Millerf91ee4c2005-03-01 21:24:33 +1100290
Damien Miller1a0442f2008-11-05 16:30:06 +1100291 fwd->listen_host = newfwd->listen_host;
Damien Millerf91ee4c2005-03-01 21:24:33 +1100292 fwd->listen_port = newfwd->listen_port;
Damien Miller1a0442f2008-11-05 16:30:06 +1100293 fwd->connect_host = newfwd->connect_host;
Damien Millerf91ee4c2005-03-01 21:24:33 +1100294 fwd->connect_port = newfwd->connect_port;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000295}
296
Damien Miller5428f641999-11-25 11:54:57 +1100297/*
298 * Adds a remote TCP/IP port forward to options. Never returns if there is
299 * an error.
300 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000301
Damien Miller4af51302000-04-16 11:18:38 +1000302void
Damien Millerf91ee4c2005-03-01 21:24:33 +1100303add_remote_forward(Options *options, const Forward *newfwd)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000304{
Damien Miller95def091999-11-25 00:26:21 +1100305 Forward *fwd;
Damien Miller232cfb12010-06-26 09:50:30 +1000306
307 options->remote_forwards = xrealloc(options->remote_forwards,
308 options->num_remote_forwards + 1,
309 sizeof(*options->remote_forwards));
Damien Miller95def091999-11-25 00:26:21 +1100310 fwd = &options->remote_forwards[options->num_remote_forwards++];
Damien Millerf91ee4c2005-03-01 21:24:33 +1100311
Damien Miller1a0442f2008-11-05 16:30:06 +1100312 fwd->listen_host = newfwd->listen_host;
Damien Millerf91ee4c2005-03-01 21:24:33 +1100313 fwd->listen_port = newfwd->listen_port;
Damien Miller1a0442f2008-11-05 16:30:06 +1100314 fwd->connect_host = newfwd->connect_host;
Damien Millerf91ee4c2005-03-01 21:24:33 +1100315 fwd->connect_port = newfwd->connect_port;
Darren Tucker68afb8c2011-10-02 18:59:03 +1100316 fwd->handle = newfwd->handle;
Damien Miller388f6fc2010-05-21 14:57:35 +1000317 fwd->allocated_port = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000318}
319
Ben Lindstrom2b7a0e92001-09-20 00:57:55 +0000320static void
321clear_forwardings(Options *options)
322{
323 int i;
324
Damien Millerf91ee4c2005-03-01 21:24:33 +1100325 for (i = 0; i < options->num_local_forwards; i++) {
Darren Tuckera627d422013-06-02 07:31:17 +1000326 free(options->local_forwards[i].listen_host);
327 free(options->local_forwards[i].connect_host);
Damien Millerf91ee4c2005-03-01 21:24:33 +1100328 }
Damien Miller232cfb12010-06-26 09:50:30 +1000329 if (options->num_local_forwards > 0) {
Darren Tuckera627d422013-06-02 07:31:17 +1000330 free(options->local_forwards);
Damien Miller232cfb12010-06-26 09:50:30 +1000331 options->local_forwards = NULL;
332 }
Ben Lindstrom2b7a0e92001-09-20 00:57:55 +0000333 options->num_local_forwards = 0;
Damien Millerf91ee4c2005-03-01 21:24:33 +1100334 for (i = 0; i < options->num_remote_forwards; i++) {
Darren Tuckera627d422013-06-02 07:31:17 +1000335 free(options->remote_forwards[i].listen_host);
336 free(options->remote_forwards[i].connect_host);
Damien Millerf91ee4c2005-03-01 21:24:33 +1100337 }
Damien Miller232cfb12010-06-26 09:50:30 +1000338 if (options->num_remote_forwards > 0) {
Darren Tuckera627d422013-06-02 07:31:17 +1000339 free(options->remote_forwards);
Damien Miller232cfb12010-06-26 09:50:30 +1000340 options->remote_forwards = NULL;
341 }
Ben Lindstrom2b7a0e92001-09-20 00:57:55 +0000342 options->num_remote_forwards = 0;
Damien Miller7b58e802005-12-13 19:33:19 +1100343 options->tun_open = SSH_TUNMODE_NO;
Ben Lindstrom2b7a0e92001-09-20 00:57:55 +0000344}
345
Darren Tucker19104782013-04-05 11:13:08 +1100346void
347add_identity_file(Options *options, const char *dir, const char *filename,
348 int userprovided)
349{
350 char *path;
351
352 if (options->num_identity_files >= SSH_MAX_IDENTITY_FILES)
353 fatal("Too many identity files specified (max %d)",
354 SSH_MAX_IDENTITY_FILES);
355
356 if (dir == NULL) /* no dir, filename is absolute */
357 path = xstrdup(filename);
358 else
359 (void)xasprintf(&path, "%.100s%.100s", dir, filename);
360
361 options->identity_file_userprovided[options->num_identity_files] =
362 userprovided;
363 options->identity_files[options->num_identity_files++] = path;
364}
365
Damien Miller194fd902013-10-15 12:13:05 +1100366int
367default_ssh_port(void)
368{
369 static int port;
370 struct servent *sp;
371
372 if (port == 0) {
373 sp = getservbyname(SSH_SERVICE_NAME, "tcp");
374 port = sp ? ntohs(sp->s_port) : SSH_DEFAULT_PORT;
375 }
376 return port;
377}
378
379/*
380 * Execute a command in a shell.
381 * Return its exit status or -1 on abnormal exit.
382 */
383static int
384execute_in_shell(const char *cmd)
385{
386 char *shell, *command_string;
387 pid_t pid;
388 int devnull, status;
389 extern uid_t original_real_uid;
390
391 if ((shell = getenv("SHELL")) == NULL)
392 shell = _PATH_BSHELL;
393
394 /*
395 * Use "exec" to avoid "sh -c" processes on some platforms
396 * (e.g. Solaris)
397 */
398 xasprintf(&command_string, "exec %s", cmd);
399
400 /* Need this to redirect subprocess stdin/out */
401 if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1)
402 fatal("open(/dev/null): %s", strerror(errno));
403
404 debug("Executing command: '%.500s'", cmd);
405
406 /* Fork and execute the command. */
407 if ((pid = fork()) == 0) {
408 char *argv[4];
409
410 /* Child. Permanently give up superuser privileges. */
411 permanently_drop_suid(original_real_uid);
412
413 /* Redirect child stdin and stdout. Leave stderr */
414 if (dup2(devnull, STDIN_FILENO) == -1)
415 fatal("dup2: %s", strerror(errno));
416 if (dup2(devnull, STDOUT_FILENO) == -1)
417 fatal("dup2: %s", strerror(errno));
418 if (devnull > STDERR_FILENO)
419 close(devnull);
420 closefrom(STDERR_FILENO + 1);
421
422 argv[0] = shell;
423 argv[1] = "-c";
424 argv[2] = command_string;
425 argv[3] = NULL;
426
427 execv(argv[0], argv);
428 error("Unable to execute '%.100s': %s", cmd, strerror(errno));
429 /* Die with signal to make this error apparent to parent. */
430 signal(SIGTERM, SIG_DFL);
431 kill(getpid(), SIGTERM);
432 _exit(1);
433 }
434 /* Parent. */
435 if (pid < 0)
436 fatal("%s: fork: %.100s", __func__, strerror(errno));
437
438 close(devnull);
439 free(command_string);
440
441 while (waitpid(pid, &status, 0) == -1) {
442 if (errno != EINTR && errno != EAGAIN)
443 fatal("%s: waitpid: %s", __func__, strerror(errno));
444 }
445 if (!WIFEXITED(status)) {
446 error("command '%.100s' exited abnormally", cmd);
447 return -1;
448 }
449 debug3("command returned status %d", WEXITSTATUS(status));
450 return WEXITSTATUS(status);
451}
452
453/*
454 * Parse and execute a Match directive.
455 */
456static int
457match_cfg_line(Options *options, char **condition, struct passwd *pw,
458 const char *host_arg, const char *filename, int linenum)
459{
Damien Miller084bcd22013-10-23 16:30:51 +1100460 char *arg, *attrib, *cmd, *cp = *condition, *host;
461 const char *ruser;
Damien Millercf31f382013-10-24 21:02:56 +1100462 int r, port, result = 1, attributes = 0;
Damien Miller194fd902013-10-15 12:13:05 +1100463 size_t len;
464 char thishost[NI_MAXHOST], shorthost[NI_MAXHOST], portstr[NI_MAXSERV];
465
466 /*
467 * Configuration is likely to be incomplete at this point so we
468 * must be prepared to use default values.
469 */
470 port = options->port <= 0 ? default_ssh_port() : options->port;
471 ruser = options->user == NULL ? pw->pw_name : options->user;
Damien Miller084bcd22013-10-23 16:30:51 +1100472 if (options->hostname != NULL) {
Damien Millereff5cad2013-10-23 16:31:10 +1100473 /* NB. Please keep in sync with ssh.c:main() */
Damien Miller084bcd22013-10-23 16:30:51 +1100474 host = percent_expand(options->hostname,
475 "h", host_arg, (char *)NULL);
476 } else
477 host = xstrdup(host_arg);
Damien Miller194fd902013-10-15 12:13:05 +1100478
479 debug3("checking match for '%s' host %s", cp, host);
480 while ((attrib = strdelim(&cp)) && *attrib != '\0') {
Damien Millercf31f382013-10-24 21:02:56 +1100481 attributes++;
482 if (strcasecmp(attrib, "all") == 0) {
483 if (attributes != 1 ||
484 ((arg = strdelim(&cp)) != NULL && *arg != '\0')) {
485 error("'all' cannot be combined with other "
486 "Match attributes");
487 result = -1;
488 goto out;
489 }
490 *condition = cp;
491 result = 1;
492 goto out;
493 }
Damien Miller194fd902013-10-15 12:13:05 +1100494 if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
495 error("Missing Match criteria for %s", attrib);
Damien Miller084bcd22013-10-23 16:30:51 +1100496 result = -1;
497 goto out;
Damien Miller194fd902013-10-15 12:13:05 +1100498 }
499 len = strlen(arg);
500 if (strcasecmp(attrib, "host") == 0) {
501 if (match_hostname(host, arg, len) != 1)
502 result = 0;
503 else
504 debug("%.200s line %d: matched 'Host %.100s' ",
505 filename, linenum, host);
506 } else if (strcasecmp(attrib, "originalhost") == 0) {
507 if (match_hostname(host_arg, arg, len) != 1)
508 result = 0;
509 else
510 debug("%.200s line %d: matched "
511 "'OriginalHost %.100s' ",
512 filename, linenum, host_arg);
513 } else if (strcasecmp(attrib, "user") == 0) {
514 if (match_pattern_list(ruser, arg, len, 0) != 1)
515 result = 0;
516 else
517 debug("%.200s line %d: matched 'User %.100s' ",
518 filename, linenum, ruser);
519 } else if (strcasecmp(attrib, "localuser") == 0) {
520 if (match_pattern_list(pw->pw_name, arg, len, 0) != 1)
521 result = 0;
522 else
523 debug("%.200s line %d: matched "
524 "'LocalUser %.100s' ",
525 filename, linenum, pw->pw_name);
Damien Miller8a04be72013-10-23 16:29:40 +1100526 } else if (strcasecmp(attrib, "exec") == 0) {
Damien Miller194fd902013-10-15 12:13:05 +1100527 if (gethostname(thishost, sizeof(thishost)) == -1)
528 fatal("gethostname: %s", strerror(errno));
529 strlcpy(shorthost, thishost, sizeof(shorthost));
530 shorthost[strcspn(thishost, ".")] = '\0';
531 snprintf(portstr, sizeof(portstr), "%d", port);
532
533 cmd = percent_expand(arg,
534 "L", shorthost,
535 "d", pw->pw_dir,
536 "h", host,
537 "l", thishost,
538 "n", host_arg,
539 "p", portstr,
540 "r", ruser,
541 "u", pw->pw_name,
542 (char *)NULL);
543 r = execute_in_shell(cmd);
544 if (r == -1) {
Damien Miller8a04be72013-10-23 16:29:40 +1100545 fatal("%.200s line %d: match exec '%.100s' "
Damien Miller194fd902013-10-15 12:13:05 +1100546 "error", filename, linenum, cmd);
547 } else if (r == 0) {
548 debug("%.200s line %d: matched "
Damien Miller8a04be72013-10-23 16:29:40 +1100549 "'exec \"%.100s\"' ",
Damien Miller194fd902013-10-15 12:13:05 +1100550 filename, linenum, cmd);
551 } else
552 result = 0;
553 free(cmd);
554 } else {
555 error("Unsupported Match attribute %s", attrib);
Damien Miller084bcd22013-10-23 16:30:51 +1100556 result = -1;
557 goto out;
Damien Miller194fd902013-10-15 12:13:05 +1100558 }
559 }
Damien Millercf31f382013-10-24 21:02:56 +1100560 if (attributes == 0) {
561 error("One or more attributes required for Match");
562 result = -1;
563 goto out;
564 }
Damien Miller194fd902013-10-15 12:13:05 +1100565 debug3("match %sfound", result ? "" : "not ");
566 *condition = cp;
Damien Miller084bcd22013-10-23 16:30:51 +1100567 out:
568 free(host);
Damien Miller194fd902013-10-15 12:13:05 +1100569 return result;
570}
571
Damien Miller0faf7472013-10-17 11:47:23 +1100572/* Check and prepare a domain name: removes trailing '.' and lowercases */
573static void
574valid_domain(char *name, const char *filename, int linenum)
575{
576 size_t i, l = strlen(name);
577 u_char c, last = '\0';
578
579 if (l == 0)
580 fatal("%s line %d: empty hostname suffix", filename, linenum);
581 if (!isalpha((u_char)name[0]) && !isdigit((u_char)name[0]))
582 fatal("%s line %d: hostname suffix \"%.100s\" "
583 "starts with invalid character", filename, linenum, name);
584 for (i = 0; i < l; i++) {
585 c = tolower((u_char)name[i]);
586 name[i] = (char)c;
587 if (last == '.' && c == '.')
588 fatal("%s line %d: hostname suffix \"%.100s\" contains "
589 "consecutive separators", filename, linenum, name);
590 if (c != '.' && c != '-' && !isalnum(c) &&
591 c != '_') /* technically invalid, but common */
592 fatal("%s line %d: hostname suffix \"%.100s\" contains "
593 "invalid characters", filename, linenum, name);
594 last = c;
595 }
596 if (name[l - 1] == '.')
597 name[l - 1] = '\0';
598}
599
Damien Miller5428f641999-11-25 11:54:57 +1100600/*
Ben Lindstrom3704c262001-04-02 18:20:03 +0000601 * Returns the number of the token pointed to by cp or oBadOption.
Damien Miller5428f641999-11-25 11:54:57 +1100602 */
Damien Miller4af51302000-04-16 11:18:38 +1000603static OpCodes
Darren Tucker07636982013-05-16 20:30:03 +1000604parse_token(const char *cp, const char *filename, int linenum,
605 const char *ignored_unknown)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000606{
Darren Tucker07636982013-05-16 20:30:03 +1000607 int i;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000608
Damien Miller95def091999-11-25 00:26:21 +1100609 for (i = 0; keywords[i].name; i++)
Darren Tucker07636982013-05-16 20:30:03 +1000610 if (strcmp(cp, keywords[i].name) == 0)
Damien Miller95def091999-11-25 00:26:21 +1100611 return keywords[i].opcode;
Darren Tucker07636982013-05-16 20:30:03 +1000612 if (ignored_unknown != NULL && match_pattern_list(cp, ignored_unknown,
613 strlen(ignored_unknown), 1) == 1)
614 return oIgnoredUnknownOption;
Ben Lindstromb5cdc662001-04-16 02:13:26 +0000615 error("%s: line %d: Bad configuration option: %s",
616 filename, linenum, cp);
Damien Miller95def091999-11-25 00:26:21 +1100617 return oBadOption;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000618}
619
Damien Millere9fc72e2013-10-15 12:14:12 +1100620/* Multistate option parsing */
621struct multistate {
622 char *key;
623 int value;
624};
625static const struct multistate multistate_flag[] = {
626 { "true", 1 },
627 { "false", 0 },
628 { "yes", 1 },
629 { "no", 0 },
630 { NULL, -1 }
631};
632static const struct multistate multistate_yesnoask[] = {
633 { "true", 1 },
634 { "false", 0 },
635 { "yes", 1 },
636 { "no", 0 },
637 { "ask", 2 },
638 { NULL, -1 }
639};
640static const struct multistate multistate_addressfamily[] = {
641 { "inet", AF_INET },
642 { "inet6", AF_INET6 },
643 { "any", AF_UNSPEC },
644 { NULL, -1 }
645};
646static const struct multistate multistate_controlmaster[] = {
647 { "true", SSHCTL_MASTER_YES },
648 { "yes", SSHCTL_MASTER_YES },
649 { "false", SSHCTL_MASTER_NO },
650 { "no", SSHCTL_MASTER_NO },
651 { "auto", SSHCTL_MASTER_AUTO },
652 { "ask", SSHCTL_MASTER_ASK },
653 { "autoask", SSHCTL_MASTER_AUTO_ASK },
654 { NULL, -1 }
655};
656static const struct multistate multistate_tunnel[] = {
657 { "ethernet", SSH_TUNMODE_ETHERNET },
658 { "point-to-point", SSH_TUNMODE_POINTOPOINT },
659 { "true", SSH_TUNMODE_DEFAULT },
660 { "yes", SSH_TUNMODE_DEFAULT },
661 { "false", SSH_TUNMODE_NO },
662 { "no", SSH_TUNMODE_NO },
663 { NULL, -1 }
664};
665static const struct multistate multistate_requesttty[] = {
666 { "true", REQUEST_TTY_YES },
667 { "yes", REQUEST_TTY_YES },
668 { "false", REQUEST_TTY_NO },
669 { "no", REQUEST_TTY_NO },
670 { "force", REQUEST_TTY_FORCE },
671 { "auto", REQUEST_TTY_AUTO },
672 { NULL, -1 }
673};
Damien Miller38505592013-10-17 11:48:13 +1100674static const struct multistate multistate_canonicalizehostname[] = {
Damien Miller0faf7472013-10-17 11:47:23 +1100675 { "true", SSH_CANONICALISE_YES },
676 { "false", SSH_CANONICALISE_NO },
677 { "yes", SSH_CANONICALISE_YES },
678 { "no", SSH_CANONICALISE_NO },
679 { "always", SSH_CANONICALISE_ALWAYS },
680 { NULL, -1 }
681};
Damien Millere9fc72e2013-10-15 12:14:12 +1100682
Damien Miller5428f641999-11-25 11:54:57 +1100683/*
684 * Processes a single option line as used in the configuration files. This
685 * only sets those values that have not already been set.
686 */
Damien Miller61f08ac2003-02-24 11:56:27 +1100687#define WHITESPACE " \t\r\n"
Damien Miller2ccf6611999-11-15 15:25:10 +1100688int
Damien Miller194fd902013-10-15 12:13:05 +1100689process_config_line(Options *options, struct passwd *pw, const char *host,
690 char *line, const char *filename, int linenum, int *activep, int userconfig)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000691{
Damien Miller295ee632011-05-29 21:42:31 +1000692 char *s, **charptr, *endofnumber, *keyword, *arg, *arg2;
693 char **cpptr, fwdarg[256];
Darren Tucker07636982013-05-16 20:30:03 +1000694 u_int i, *uintptr, max_entries = 0;
Damien Miller194fd902013-10-15 12:13:05 +1100695 int negated, opcode, *intptr, value, value2, cmdline = 0;
Darren Tucker1e44c5d2008-01-01 20:32:26 +1100696 LogLevel *log_level_ptr;
Darren Tucker9113d0c2013-05-16 20:48:14 +1000697 long long val64;
Damien Miller61f08ac2003-02-24 11:56:27 +1100698 size_t len;
Damien Millerf91ee4c2005-03-01 21:24:33 +1100699 Forward fwd;
Damien Millere9fc72e2013-10-15 12:14:12 +1100700 const struct multistate *multistate_ptr;
Damien Miller0faf7472013-10-17 11:47:23 +1100701 struct allowed_cname *cname;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000702
Damien Miller194fd902013-10-15 12:13:05 +1100703 if (activep == NULL) { /* We are processing a command line directive */
704 cmdline = 1;
705 activep = &cmdline;
706 }
707
Damien Millerc652cac2003-05-14 13:40:54 +1000708 /* Strip trailing whitespace */
Darren Tucker47eede72005-03-14 23:08:12 +1100709 for (len = strlen(line) - 1; len > 0; len--) {
Damien Millerc652cac2003-05-14 13:40:54 +1000710 if (strchr(WHITESPACE, line[len]) == NULL)
711 break;
712 line[len] = '\0';
713 }
714
Damien Millerbe484b52000-07-15 14:14:16 +1000715 s = line;
716 /* Get the keyword. (Each line is supposed to begin with a keyword). */
Damien Miller928b2362006-03-26 13:53:32 +1100717 if ((keyword = strdelim(&s)) == NULL)
718 return 0;
Damien Millerbe484b52000-07-15 14:14:16 +1000719 /* Ignore leading whitespace. */
720 if (*keyword == '\0')
721 keyword = strdelim(&s);
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000722 if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
Damien Miller95def091999-11-25 00:26:21 +1100723 return 0;
Darren Tucker07636982013-05-16 20:30:03 +1000724 /* Match lowercase keyword */
Damien Millere9fc72e2013-10-15 12:14:12 +1100725 lowercase(keyword);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000726
Darren Tucker07636982013-05-16 20:30:03 +1000727 opcode = parse_token(keyword, filename, linenum,
728 options->ignored_unknown);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000729
Damien Miller95def091999-11-25 00:26:21 +1100730 switch (opcode) {
731 case oBadOption:
Damien Miller5428f641999-11-25 11:54:57 +1100732 /* don't panic, but count bad options */
733 return -1;
Damien Miller95def091999-11-25 00:26:21 +1100734 /* NOTREACHED */
Darren Tucker07636982013-05-16 20:30:03 +1000735 case oIgnoredUnknownOption:
736 debug("%s line %d: Ignored unknown option \"%s\"",
737 filename, linenum, keyword);
738 return 0;
Damien Millerb78d5eb2003-05-16 11:39:04 +1000739 case oConnectTimeout:
740 intptr = &options->connection_timeout;
Damien Miller509b0102003-12-17 16:33:10 +1100741parse_time:
Damien Millerb78d5eb2003-05-16 11:39:04 +1000742 arg = strdelim(&s);
743 if (!arg || *arg == '\0')
744 fatal("%s line %d: missing time value.",
745 filename, linenum);
746 if ((value = convtime(arg)) == -1)
747 fatal("%s line %d: invalid time value.",
748 filename, linenum);
Darren Tuckera52c5b62007-02-19 22:09:45 +1100749 if (*activep && *intptr == -1)
Damien Millerb78d5eb2003-05-16 11:39:04 +1000750 *intptr = value;
751 break;
752
Damien Miller95def091999-11-25 00:26:21 +1100753 case oForwardAgent:
754 intptr = &options->forward_agent;
Damien Millere9fc72e2013-10-15 12:14:12 +1100755 parse_flag:
756 multistate_ptr = multistate_flag;
757 parse_multistate:
Damien Millerbe484b52000-07-15 14:14:16 +1000758 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +1000759 if (!arg || *arg == '\0')
Damien Millere9fc72e2013-10-15 12:14:12 +1100760 fatal("%s line %d: missing argument.",
761 filename, linenum);
762 value = -1;
763 for (i = 0; multistate_ptr[i].key != NULL; i++) {
764 if (strcasecmp(arg, multistate_ptr[i].key) == 0) {
765 value = multistate_ptr[i].value;
766 break;
767 }
768 }
769 if (value == -1)
770 fatal("%s line %d: unsupported option \"%s\".",
771 filename, linenum, arg);
Damien Miller95def091999-11-25 00:26:21 +1100772 if (*activep && *intptr == -1)
773 *intptr = value;
774 break;
775
776 case oForwardX11:
777 intptr = &options->forward_x11;
778 goto parse_flag;
779
Darren Tucker0a118da2003-10-15 15:54:32 +1000780 case oForwardX11Trusted:
781 intptr = &options->forward_x11_trusted;
782 goto parse_flag;
Damien Miller1ab6a512010-06-26 10:02:24 +1000783
784 case oForwardX11Timeout:
785 intptr = &options->forward_x11_timeout;
786 goto parse_time;
Darren Tucker0a118da2003-10-15 15:54:32 +1000787
Damien Miller95def091999-11-25 00:26:21 +1100788 case oGatewayPorts:
789 intptr = &options->gateway_ports;
790 goto parse_flag;
791
Darren Tuckere7d4b192006-07-12 22:17:10 +1000792 case oExitOnForwardFailure:
793 intptr = &options->exit_on_forward_failure;
794 goto parse_flag;
795
Damien Miller95def091999-11-25 00:26:21 +1100796 case oUsePrivilegedPort:
797 intptr = &options->use_privileged_port;
798 goto parse_flag;
799
Damien Miller95def091999-11-25 00:26:21 +1100800 case oPasswordAuthentication:
801 intptr = &options->password_authentication;
802 goto parse_flag;
803
Damien Miller01ed2272008-11-05 16:20:46 +1100804 case oZeroKnowledgePasswordAuthentication:
805 intptr = &options->zero_knowledge_password_authentication;
806 goto parse_flag;
807
Damien Miller874d77b2000-10-14 16:23:11 +1100808 case oKbdInteractiveAuthentication:
809 intptr = &options->kbd_interactive_authentication;
810 goto parse_flag;
811
812 case oKbdInteractiveDevices:
813 charptr = &options->kbd_interactive_devices;
814 goto parse_string;
815
Damien Miller0bc1bd82000-11-13 22:57:25 +1100816 case oPubkeyAuthentication:
817 intptr = &options->pubkey_authentication;
Damien Millere247cc42000-05-07 12:03:14 +1000818 goto parse_flag;
819
Damien Miller95def091999-11-25 00:26:21 +1100820 case oRSAAuthentication:
821 intptr = &options->rsa_authentication;
822 goto parse_flag;
823
824 case oRhostsRSAAuthentication:
825 intptr = &options->rhosts_rsa_authentication;
826 goto parse_flag;
827
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000828 case oHostbasedAuthentication:
829 intptr = &options->hostbased_authentication;
830 goto parse_flag;
831
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000832 case oChallengeResponseAuthentication:
Ben Lindstrom551ea372001-06-05 18:56:16 +0000833 intptr = &options->challenge_response_authentication;
Damien Miller95def091999-11-25 00:26:21 +1100834 goto parse_flag;
Damien Miller2aa0ab42003-05-15 12:05:28 +1000835
Darren Tucker0efd1552003-08-26 11:49:55 +1000836 case oGssAuthentication:
837 intptr = &options->gss_authentication;
838 goto parse_flag;
839
840 case oGssDelegateCreds:
841 intptr = &options->gss_deleg_creds;
842 goto parse_flag;
843
Damien Miller95def091999-11-25 00:26:21 +1100844 case oBatchMode:
845 intptr = &options->batch_mode;
846 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000847
Damien Miller95def091999-11-25 00:26:21 +1100848 case oCheckHostIP:
849 intptr = &options->check_host_ip;
Damien Miller10288242008-06-30 00:04:03 +1000850 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000851
Damien Miller37876e92003-05-15 10:19:46 +1000852 case oVerifyHostKeyDNS:
853 intptr = &options->verify_host_key_dns;
Damien Millere9fc72e2013-10-15 12:14:12 +1100854 multistate_ptr = multistate_yesnoask;
855 goto parse_multistate;
Damien Miller37876e92003-05-15 10:19:46 +1000856
Damien Miller95def091999-11-25 00:26:21 +1100857 case oStrictHostKeyChecking:
858 intptr = &options->strict_host_key_checking;
Damien Millere9fc72e2013-10-15 12:14:12 +1100859 multistate_ptr = multistate_yesnoask;
860 goto parse_multistate;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000861
Damien Miller95def091999-11-25 00:26:21 +1100862 case oCompression:
863 intptr = &options->compression;
864 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000865
Damien Miller12c150e2003-12-17 16:31:10 +1100866 case oTCPKeepAlive:
867 intptr = &options->tcp_keep_alive;
Damien Miller95def091999-11-25 00:26:21 +1100868 goto parse_flag;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000869
Ben Lindstrom3cecc9a2001-10-03 17:39:38 +0000870 case oNoHostAuthenticationForLocalhost:
871 intptr = &options->no_host_authentication_for_localhost;
872 goto parse_flag;
873
Damien Miller95def091999-11-25 00:26:21 +1100874 case oNumberOfPasswordPrompts:
875 intptr = &options->number_of_password_prompts;
876 goto parse_int;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000877
Damien Miller95def091999-11-25 00:26:21 +1100878 case oCompressionLevel:
879 intptr = &options->compression_level;
880 goto parse_int;
881
Damien Millera5539d22003-04-09 20:50:06 +1000882 case oRekeyLimit:
Damien Millera5539d22003-04-09 20:50:06 +1000883 arg = strdelim(&s);
884 if (!arg || *arg == '\0')
Darren Tuckerc53c2af2013-05-16 20:28:16 +1000885 fatal("%.200s line %d: Missing argument.", filename,
886 linenum);
887 if (strcmp(arg, "default") == 0) {
888 val64 = 0;
889 } else {
Darren Tuckerb7ee8522013-05-16 20:33:10 +1000890 if (scan_scaled(arg, &val64) == -1)
891 fatal("%.200s line %d: Bad number '%s': %s",
892 filename, linenum, arg, strerror(errno));
893 /* check for too-large or too-small limits */
894 if (val64 > UINT_MAX)
Darren Tuckerc53c2af2013-05-16 20:28:16 +1000895 fatal("%.200s line %d: RekeyLimit too large",
896 filename, linenum);
897 if (val64 != 0 && val64 < 16)
898 fatal("%.200s line %d: RekeyLimit too small",
899 filename, linenum);
Damien Millera5539d22003-04-09 20:50:06 +1000900 }
Damien Miller3dff1762008-02-10 22:25:52 +1100901 if (*activep && options->rekey_limit == -1)
902 options->rekey_limit = (u_int32_t)val64;
Darren Tuckerc53c2af2013-05-16 20:28:16 +1000903 if (s != NULL) { /* optional rekey interval present */
904 if (strcmp(s, "none") == 0) {
905 (void)strdelim(&s); /* discard */
906 break;
907 }
908 intptr = &options->rekey_interval;
909 goto parse_time;
910 }
Damien Millera5539d22003-04-09 20:50:06 +1000911 break;
912
Damien Miller95def091999-11-25 00:26:21 +1100913 case oIdentityFile:
Damien Millerbe484b52000-07-15 14:14:16 +1000914 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +1000915 if (!arg || *arg == '\0')
Damien Miller95def091999-11-25 00:26:21 +1100916 fatal("%.200s line %d: Missing argument.", filename, linenum);
917 if (*activep) {
Damien Miller0bc1bd82000-11-13 22:57:25 +1100918 intptr = &options->num_identity_files;
Damien Millereba71ba2000-04-29 23:57:08 +1000919 if (*intptr >= SSH_MAX_IDENTITY_FILES)
Damien Miller95def091999-11-25 00:26:21 +1100920 fatal("%.200s line %d: Too many identity files specified (max %d).",
Damien Miller9f0f5c62001-12-21 14:45:46 +1100921 filename, linenum, SSH_MAX_IDENTITY_FILES);
Darren Tuckeraefa3682013-04-05 11:18:35 +1100922 add_identity_file(options, NULL, arg, userconfig);
Damien Miller95def091999-11-25 00:26:21 +1100923 }
924 break;
925
Damien Millerd3a18572000-06-07 19:55:44 +1000926 case oXAuthLocation:
927 charptr=&options->xauth_location;
928 goto parse_string;
929
Damien Miller95def091999-11-25 00:26:21 +1100930 case oUser:
931 charptr = &options->user;
932parse_string:
Damien Millerbe484b52000-07-15 14:14:16 +1000933 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +1000934 if (!arg || *arg == '\0')
Damien Miller295ee632011-05-29 21:42:31 +1000935 fatal("%.200s line %d: Missing argument.",
936 filename, linenum);
Damien Miller95def091999-11-25 00:26:21 +1100937 if (*activep && *charptr == NULL)
Damien Miller37023962000-07-11 17:31:38 +1000938 *charptr = xstrdup(arg);
Damien Miller95def091999-11-25 00:26:21 +1100939 break;
940
941 case oGlobalKnownHostsFile:
Damien Miller295ee632011-05-29 21:42:31 +1000942 cpptr = (char **)&options->system_hostfiles;
943 uintptr = &options->num_system_hostfiles;
944 max_entries = SSH_MAX_HOSTS_FILES;
945parse_char_array:
946 if (*activep && *uintptr == 0) {
947 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
948 if ((*uintptr) >= max_entries)
949 fatal("%s line %d: "
950 "too many authorized keys files.",
951 filename, linenum);
952 cpptr[(*uintptr)++] = xstrdup(arg);
953 }
954 }
955 return 0;
Damien Miller95def091999-11-25 00:26:21 +1100956
957 case oUserKnownHostsFile:
Damien Miller295ee632011-05-29 21:42:31 +1000958 cpptr = (char **)&options->user_hostfiles;
959 uintptr = &options->num_user_hostfiles;
960 max_entries = SSH_MAX_HOSTS_FILES;
961 goto parse_char_array;
Damien Millereba71ba2000-04-29 23:57:08 +1000962
Damien Miller95def091999-11-25 00:26:21 +1100963 case oHostName:
964 charptr = &options->hostname;
965 goto parse_string;
966
Ben Lindstrom4dccfa52000-12-28 16:40:05 +0000967 case oHostKeyAlias:
968 charptr = &options->host_key_alias;
969 goto parse_string;
970
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000971 case oPreferredAuthentications:
972 charptr = &options->preferred_authentications;
973 goto parse_string;
974
Ben Lindstrome0f88042001-04-30 13:06:24 +0000975 case oBindAddress:
976 charptr = &options->bind_address;
977 goto parse_string;
978
Damien Miller7ea845e2010-02-12 09:21:02 +1100979 case oPKCS11Provider:
980 charptr = &options->pkcs11_provider;
Ben Lindstromf7db3bb2001-08-06 21:35:51 +0000981 goto parse_string;
Ben Lindstromae996bf2001-08-06 21:27:53 +0000982
Damien Miller95def091999-11-25 00:26:21 +1100983 case oProxyCommand:
Damien Millerd27b9472005-12-13 19:29:02 +1100984 charptr = &options->proxy_command;
985parse_command:
Darren Tuckera99c1b72003-06-28 12:40:12 +1000986 if (s == NULL)
987 fatal("%.200s line %d: Missing argument.", filename, linenum);
Damien Miller61f08ac2003-02-24 11:56:27 +1100988 len = strspn(s, WHITESPACE "=");
Damien Miller95def091999-11-25 00:26:21 +1100989 if (*activep && *charptr == NULL)
Damien Miller61f08ac2003-02-24 11:56:27 +1100990 *charptr = xstrdup(s + len);
Damien Miller95def091999-11-25 00:26:21 +1100991 return 0;
992
993 case oPort:
994 intptr = &options->port;
995parse_int:
Damien Millerbe484b52000-07-15 14:14:16 +1000996 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +1000997 if (!arg || *arg == '\0')
Damien Miller95def091999-11-25 00:26:21 +1100998 fatal("%.200s line %d: Missing argument.", filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +1000999 if (arg[0] < '0' || arg[0] > '9')
Damien Miller95def091999-11-25 00:26:21 +11001000 fatal("%.200s line %d: Bad number.", filename, linenum);
Damien Miller5428f641999-11-25 11:54:57 +11001001
1002 /* Octal, decimal, or hex format? */
Damien Miller37023962000-07-11 17:31:38 +10001003 value = strtol(arg, &endofnumber, 0);
1004 if (arg == endofnumber)
Damien Miller5428f641999-11-25 11:54:57 +11001005 fatal("%.200s line %d: Bad number.", filename, linenum);
Damien Miller95def091999-11-25 00:26:21 +11001006 if (*activep && *intptr == -1)
1007 *intptr = value;
1008 break;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001009
Damien Miller95def091999-11-25 00:26:21 +11001010 case oConnectionAttempts:
1011 intptr = &options->connection_attempts;
1012 goto parse_int;
Damien Miller5ce662a1999-11-11 17:57:39 +11001013
Damien Miller95def091999-11-25 00:26:21 +11001014 case oCipher:
1015 intptr = &options->cipher;
Damien Millerbe484b52000-07-15 14:14:16 +10001016 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +10001017 if (!arg || *arg == '\0')
Damien Millerb1715dc2000-05-30 13:44:51 +10001018 fatal("%.200s line %d: Missing argument.", filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +10001019 value = cipher_number(arg);
Damien Miller95def091999-11-25 00:26:21 +11001020 if (value == -1)
1021 fatal("%.200s line %d: Bad cipher '%s'.",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001022 filename, linenum, arg ? arg : "<NONE>");
Damien Miller95def091999-11-25 00:26:21 +11001023 if (*activep && *intptr == -1)
1024 *intptr = value;
1025 break;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001026
Damien Miller78928792000-04-12 20:17:38 +10001027 case oCiphers:
Damien Millerbe484b52000-07-15 14:14:16 +10001028 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +10001029 if (!arg || *arg == '\0')
Damien Millerb1715dc2000-05-30 13:44:51 +10001030 fatal("%.200s line %d: Missing argument.", filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +10001031 if (!ciphers_valid(arg))
Damien Miller30c3d422000-05-09 11:02:59 +10001032 fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001033 filename, linenum, arg ? arg : "<NONE>");
Damien Miller78928792000-04-12 20:17:38 +10001034 if (*activep && options->ciphers == NULL)
Damien Miller37023962000-07-11 17:31:38 +10001035 options->ciphers = xstrdup(arg);
Damien Miller78928792000-04-12 20:17:38 +10001036 break;
1037
Ben Lindstrom06b33aa2001-02-15 03:01:59 +00001038 case oMacs:
1039 arg = strdelim(&s);
1040 if (!arg || *arg == '\0')
1041 fatal("%.200s line %d: Missing argument.", filename, linenum);
1042 if (!mac_valid(arg))
1043 fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001044 filename, linenum, arg ? arg : "<NONE>");
Ben Lindstrom06b33aa2001-02-15 03:01:59 +00001045 if (*activep && options->macs == NULL)
1046 options->macs = xstrdup(arg);
1047 break;
1048
Damien Millerd5f62bf2010-09-24 22:11:14 +10001049 case oKexAlgorithms:
1050 arg = strdelim(&s);
1051 if (!arg || *arg == '\0')
1052 fatal("%.200s line %d: Missing argument.",
1053 filename, linenum);
1054 if (!kex_names_valid(arg))
1055 fatal("%.200s line %d: Bad SSH2 KexAlgorithms '%s'.",
1056 filename, linenum, arg ? arg : "<NONE>");
1057 if (*activep && options->kex_algorithms == NULL)
1058 options->kex_algorithms = xstrdup(arg);
1059 break;
1060
Ben Lindstrom982dbbc2001-04-17 18:11:36 +00001061 case oHostKeyAlgorithms:
1062 arg = strdelim(&s);
1063 if (!arg || *arg == '\0')
1064 fatal("%.200s line %d: Missing argument.", filename, linenum);
1065 if (!key_names_valid2(arg))
1066 fatal("%.200s line %d: Bad protocol 2 host key algorithms '%s'.",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001067 filename, linenum, arg ? arg : "<NONE>");
Ben Lindstrom982dbbc2001-04-17 18:11:36 +00001068 if (*activep && options->hostkeyalgorithms == NULL)
1069 options->hostkeyalgorithms = xstrdup(arg);
1070 break;
1071
Damien Miller78928792000-04-12 20:17:38 +10001072 case oProtocol:
1073 intptr = &options->protocol;
Damien Millerbe484b52000-07-15 14:14:16 +10001074 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +10001075 if (!arg || *arg == '\0')
Damien Millerb1715dc2000-05-30 13:44:51 +10001076 fatal("%.200s line %d: Missing argument.", filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +10001077 value = proto_spec(arg);
Damien Miller78928792000-04-12 20:17:38 +10001078 if (value == SSH_PROTO_UNKNOWN)
1079 fatal("%.200s line %d: Bad protocol spec '%s'.",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001080 filename, linenum, arg ? arg : "<NONE>");
Damien Miller78928792000-04-12 20:17:38 +10001081 if (*activep && *intptr == SSH_PROTO_UNKNOWN)
1082 *intptr = value;
1083 break;
1084
Damien Miller95def091999-11-25 00:26:21 +11001085 case oLogLevel:
Darren Tucker1e44c5d2008-01-01 20:32:26 +11001086 log_level_ptr = &options->log_level;
Damien Millerbe484b52000-07-15 14:14:16 +10001087 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +10001088 value = log_level_number(arg);
Damien Millerfcd93202002-02-05 12:26:34 +11001089 if (value == SYSLOG_LEVEL_NOT_SET)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +00001090 fatal("%.200s line %d: unsupported log level '%s'",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001091 filename, linenum, arg ? arg : "<NONE>");
Darren Tucker1e44c5d2008-01-01 20:32:26 +11001092 if (*activep && *log_level_ptr == SYSLOG_LEVEL_NOT_SET)
1093 *log_level_ptr = (LogLevel) value;
Damien Miller95def091999-11-25 00:26:21 +11001094 break;
1095
Ben Lindstrom62c25a42001-09-12 18:01:59 +00001096 case oLocalForward:
Damien Miller95def091999-11-25 00:26:21 +11001097 case oRemoteForward:
Damien Millera699d952008-11-03 19:27:34 +11001098 case oDynamicForward:
Damien Millerbe484b52000-07-15 14:14:16 +10001099 arg = strdelim(&s);
Damien Millerf91ee4c2005-03-01 21:24:33 +11001100 if (arg == NULL || *arg == '\0')
Ben Lindstrom62c25a42001-09-12 18:01:59 +00001101 fatal("%.200s line %d: Missing port argument.",
1102 filename, linenum);
Damien Millerf91ee4c2005-03-01 21:24:33 +11001103
Damien Millera699d952008-11-03 19:27:34 +11001104 if (opcode == oLocalForward ||
1105 opcode == oRemoteForward) {
1106 arg2 = strdelim(&s);
1107 if (arg2 == NULL || *arg2 == '\0')
1108 fatal("%.200s line %d: Missing target argument.",
1109 filename, linenum);
Damien Millerf91ee4c2005-03-01 21:24:33 +11001110
Damien Millera699d952008-11-03 19:27:34 +11001111 /* construct a string for parse_forward */
1112 snprintf(fwdarg, sizeof(fwdarg), "%s:%s", arg, arg2);
1113 } else if (opcode == oDynamicForward) {
1114 strlcpy(fwdarg, arg, sizeof(fwdarg));
1115 }
1116
1117 if (parse_forward(&fwd, fwdarg,
Damien Miller4bf648f2009-02-14 16:28:21 +11001118 opcode == oDynamicForward ? 1 : 0,
1119 opcode == oRemoteForward ? 1 : 0) == 0)
Ben Lindstrom62c25a42001-09-12 18:01:59 +00001120 fatal("%.200s line %d: Bad forwarding specification.",
1121 filename, linenum);
Damien Millerf91ee4c2005-03-01 21:24:33 +11001122
Ben Lindstrom62c25a42001-09-12 18:01:59 +00001123 if (*activep) {
Damien Millera699d952008-11-03 19:27:34 +11001124 if (opcode == oLocalForward ||
1125 opcode == oDynamicForward)
Damien Millerf91ee4c2005-03-01 21:24:33 +11001126 add_local_forward(options, &fwd);
Ben Lindstrom62c25a42001-09-12 18:01:59 +00001127 else if (opcode == oRemoteForward)
Damien Millerf91ee4c2005-03-01 21:24:33 +11001128 add_remote_forward(options, &fwd);
Ben Lindstrom62c25a42001-09-12 18:01:59 +00001129 }
Damien Miller95def091999-11-25 00:26:21 +11001130 break;
1131
Ben Lindstrom2b7a0e92001-09-20 00:57:55 +00001132 case oClearAllForwardings:
1133 intptr = &options->clear_forwardings;
1134 goto parse_flag;
1135
Damien Miller95def091999-11-25 00:26:21 +11001136 case oHost:
Damien Miller194fd902013-10-15 12:13:05 +11001137 if (cmdline)
1138 fatal("Host directive not supported as a command-line "
1139 "option");
Damien Miller95def091999-11-25 00:26:21 +11001140 *activep = 0;
Damien Millerfe924212011-05-15 08:44:45 +10001141 arg2 = NULL;
1142 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1143 negated = *arg == '!';
1144 if (negated)
1145 arg++;
Damien Miller37023962000-07-11 17:31:38 +10001146 if (match_pattern(host, arg)) {
Damien Millerfe924212011-05-15 08:44:45 +10001147 if (negated) {
1148 debug("%.200s line %d: Skipping Host "
1149 "block because of negated match "
1150 "for %.100s", filename, linenum,
1151 arg);
1152 *activep = 0;
1153 break;
1154 }
1155 if (!*activep)
1156 arg2 = arg; /* logged below */
Damien Miller95def091999-11-25 00:26:21 +11001157 *activep = 1;
Damien Miller95def091999-11-25 00:26:21 +11001158 }
Damien Millerfe924212011-05-15 08:44:45 +10001159 }
1160 if (*activep)
1161 debug("%.200s line %d: Applying options for %.100s",
1162 filename, linenum, arg2);
Damien Millerbe484b52000-07-15 14:14:16 +10001163 /* Avoid garbage check below, as strdelim is done. */
Damien Miller95def091999-11-25 00:26:21 +11001164 return 0;
1165
Damien Miller194fd902013-10-15 12:13:05 +11001166 case oMatch:
1167 if (cmdline)
1168 fatal("Host directive not supported as a command-line "
1169 "option");
1170 value = match_cfg_line(options, &s, pw, host,
1171 filename, linenum);
1172 if (value < 0)
1173 fatal("%.200s line %d: Bad Match condition", filename,
1174 linenum);
1175 *activep = value;
1176 break;
1177
Damien Miller95def091999-11-25 00:26:21 +11001178 case oEscapeChar:
1179 intptr = &options->escape_char;
Damien Millerbe484b52000-07-15 14:14:16 +10001180 arg = strdelim(&s);
Damien Miller37023962000-07-11 17:31:38 +10001181 if (!arg || *arg == '\0')
Damien Miller95def091999-11-25 00:26:21 +11001182 fatal("%.200s line %d: Missing argument.", filename, linenum);
Damien Miller37023962000-07-11 17:31:38 +10001183 if (arg[0] == '^' && arg[2] == 0 &&
Ben Lindstrom46c16222000-12-22 01:43:59 +00001184 (u_char) arg[1] >= 64 && (u_char) arg[1] < 128)
1185 value = (u_char) arg[1] & 31;
Damien Miller37023962000-07-11 17:31:38 +10001186 else if (strlen(arg) == 1)
Ben Lindstrom46c16222000-12-22 01:43:59 +00001187 value = (u_char) arg[0];
Damien Miller37023962000-07-11 17:31:38 +10001188 else if (strcmp(arg, "none") == 0)
Ben Lindstrom2b1f71b2001-06-05 20:32:21 +00001189 value = SSH_ESCAPECHAR_NONE;
Damien Miller95def091999-11-25 00:26:21 +11001190 else {
1191 fatal("%.200s line %d: Bad escape character.",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001192 filename, linenum);
Damien Miller95def091999-11-25 00:26:21 +11001193 /* NOTREACHED */
1194 value = 0; /* Avoid compiler warning. */
1195 }
1196 if (*activep && *intptr == -1)
1197 *intptr = value;
1198 break;
1199
Damien Miller20a8f972003-05-18 20:50:30 +10001200 case oAddressFamily:
Darren Tucker0a4f04b2003-07-03 20:37:47 +10001201 intptr = &options->address_family;
Damien Millere9fc72e2013-10-15 12:14:12 +11001202 multistate_ptr = multistate_addressfamily;
1203 goto parse_multistate;
Damien Miller20a8f972003-05-18 20:50:30 +10001204
Ben Lindstromb6df73b2002-11-09 15:52:31 +00001205 case oEnableSSHKeysign:
1206 intptr = &options->enable_ssh_keysign;
1207 goto parse_flag;
1208
Damien Millerbd394c32004-03-08 23:12:36 +11001209 case oIdentitiesOnly:
1210 intptr = &options->identities_only;
1211 goto parse_flag;
1212
Damien Miller509b0102003-12-17 16:33:10 +11001213 case oServerAliveInterval:
1214 intptr = &options->server_alive_interval;
1215 goto parse_time;
1216
1217 case oServerAliveCountMax:
1218 intptr = &options->server_alive_count_max;
1219 goto parse_int;
1220
Darren Tucker46bc0752004-05-02 22:11:30 +10001221 case oSendEnv:
1222 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1223 if (strchr(arg, '=') != NULL)
1224 fatal("%s line %d: Invalid environment name.",
1225 filename, linenum);
Damien Millerf8e7acc2005-03-05 11:22:50 +11001226 if (!*activep)
1227 continue;
Darren Tucker46bc0752004-05-02 22:11:30 +10001228 if (options->num_send_env >= MAX_SEND_ENV)
1229 fatal("%s line %d: too many send env.",
1230 filename, linenum);
1231 options->send_env[options->num_send_env++] =
1232 xstrdup(arg);
1233 }
1234 break;
1235
Damien Miller0e220db2004-06-15 10:34:08 +10001236 case oControlPath:
1237 charptr = &options->control_path;
1238 goto parse_string;
1239
1240 case oControlMaster:
1241 intptr = &options->control_master;
Damien Millere9fc72e2013-10-15 12:14:12 +11001242 multistate_ptr = multistate_controlmaster;
1243 goto parse_multistate;
Damien Miller0e220db2004-06-15 10:34:08 +10001244
Damien Millere11e1ea2010-08-03 16:04:46 +10001245 case oControlPersist:
1246 /* no/false/yes/true, or a time spec */
1247 intptr = &options->control_persist;
1248 arg = strdelim(&s);
1249 if (!arg || *arg == '\0')
1250 fatal("%.200s line %d: Missing ControlPersist"
1251 " argument.", filename, linenum);
1252 value = 0;
1253 value2 = 0; /* timeout */
1254 if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
1255 value = 0;
1256 else if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
1257 value = 1;
1258 else if ((value2 = convtime(arg)) >= 0)
1259 value = 1;
1260 else
1261 fatal("%.200s line %d: Bad ControlPersist argument.",
1262 filename, linenum);
1263 if (*activep && *intptr == -1) {
1264 *intptr = value;
1265 options->control_persist_timeout = value2;
1266 }
1267 break;
1268
Damien Millere1776152005-03-01 21:47:37 +11001269 case oHashKnownHosts:
1270 intptr = &options->hash_known_hosts;
1271 goto parse_flag;
1272
Damien Millerd27b9472005-12-13 19:29:02 +11001273 case oTunnel:
1274 intptr = &options->tun_open;
Damien Millere9fc72e2013-10-15 12:14:12 +11001275 multistate_ptr = multistate_tunnel;
1276 goto parse_multistate;
Damien Millerd27b9472005-12-13 19:29:02 +11001277
1278 case oTunnelDevice:
1279 arg = strdelim(&s);
1280 if (!arg || *arg == '\0')
1281 fatal("%.200s line %d: Missing argument.", filename, linenum);
1282 value = a2tun(arg, &value2);
Damien Miller7b58e802005-12-13 19:33:19 +11001283 if (value == SSH_TUNID_ERR)
Damien Millerd27b9472005-12-13 19:29:02 +11001284 fatal("%.200s line %d: Bad tun device.", filename, linenum);
1285 if (*activep) {
1286 options->tun_local = value;
1287 options->tun_remote = value2;
1288 }
1289 break;
1290
1291 case oLocalCommand:
1292 charptr = &options->local_command;
1293 goto parse_command;
1294
1295 case oPermitLocalCommand:
1296 intptr = &options->permit_local_command;
1297 goto parse_flag;
1298
Damien Miller10288242008-06-30 00:04:03 +10001299 case oVisualHostKey:
1300 intptr = &options->visual_host_key;
1301 goto parse_flag;
1302
Damien Miller0dac6fb2010-11-20 15:19:38 +11001303 case oIPQoS:
1304 arg = strdelim(&s);
1305 if ((value = parse_ipqos(arg)) == -1)
1306 fatal("%s line %d: Bad IPQoS value: %s",
1307 filename, linenum, arg);
1308 arg = strdelim(&s);
1309 if (arg == NULL)
1310 value2 = value;
1311 else if ((value2 = parse_ipqos(arg)) == -1)
1312 fatal("%s line %d: Bad IPQoS value: %s",
1313 filename, linenum, arg);
1314 if (*activep) {
1315 options->ip_qos_interactive = value;
1316 options->ip_qos_bulk = value2;
1317 }
1318 break;
1319
Darren Tucker71e4d542009-07-06 07:12:27 +10001320 case oUseRoaming:
1321 intptr = &options->use_roaming;
1322 goto parse_flag;
1323
Damien Miller21771e22011-05-15 08:45:50 +10001324 case oRequestTTY:
Damien Miller21771e22011-05-15 08:45:50 +10001325 intptr = &options->request_tty;
Damien Millere9fc72e2013-10-15 12:14:12 +11001326 multistate_ptr = multistate_requesttty;
1327 goto parse_multistate;
Damien Miller21771e22011-05-15 08:45:50 +10001328
Darren Tucker07636982013-05-16 20:30:03 +10001329 case oIgnoreUnknown:
1330 charptr = &options->ignored_unknown;
1331 goto parse_string;
1332
Damien Miller1262b662013-08-21 02:44:24 +10001333 case oProxyUseFdpass:
1334 intptr = &options->proxy_use_fdpass;
1335 goto parse_flag;
1336
Damien Miller0faf7472013-10-17 11:47:23 +11001337 case oCanonicalDomains:
1338 value = options->num_canonical_domains != 0;
1339 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1340 valid_domain(arg, filename, linenum);
1341 if (!*activep || value)
1342 continue;
1343 if (options->num_canonical_domains >= MAX_CANON_DOMAINS)
1344 fatal("%s line %d: too many hostname suffixes.",
1345 filename, linenum);
1346 options->canonical_domains[
1347 options->num_canonical_domains++] = xstrdup(arg);
1348 }
1349 break;
1350
Damien Miller38505592013-10-17 11:48:13 +11001351 case oCanonicalizePermittedCNAMEs:
Damien Miller0faf7472013-10-17 11:47:23 +11001352 value = options->num_permitted_cnames != 0;
1353 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1354 /* Either '*' for everything or 'list:list' */
1355 if (strcmp(arg, "*") == 0)
1356 arg2 = arg;
1357 else {
1358 lowercase(arg);
1359 if ((arg2 = strchr(arg, ':')) == NULL ||
1360 arg2[1] == '\0') {
1361 fatal("%s line %d: "
1362 "Invalid permitted CNAME \"%s\"",
1363 filename, linenum, arg);
1364 }
1365 *arg2 = '\0';
1366 arg2++;
1367 }
1368 if (!*activep || value)
1369 continue;
1370 if (options->num_permitted_cnames >= MAX_CANON_DOMAINS)
1371 fatal("%s line %d: too many permitted CNAMEs.",
1372 filename, linenum);
1373 cname = options->permitted_cnames +
1374 options->num_permitted_cnames++;
1375 cname->source_list = xstrdup(arg);
1376 cname->target_list = xstrdup(arg2);
1377 }
1378 break;
1379
Damien Miller38505592013-10-17 11:48:13 +11001380 case oCanonicalizeHostname:
1381 intptr = &options->canonicalize_hostname;
1382 multistate_ptr = multistate_canonicalizehostname;
Damien Miller0faf7472013-10-17 11:47:23 +11001383 goto parse_multistate;
1384
Damien Miller38505592013-10-17 11:48:13 +11001385 case oCanonicalizeMaxDots:
1386 intptr = &options->canonicalize_max_dots;
Damien Miller0faf7472013-10-17 11:47:23 +11001387 goto parse_int;
1388
Damien Miller38505592013-10-17 11:48:13 +11001389 case oCanonicalizeFallbackLocal:
1390 intptr = &options->canonicalize_fallback_local;
Damien Miller0faf7472013-10-17 11:47:23 +11001391 goto parse_flag;
1392
Ben Lindstrom4daea862002-06-09 20:04:02 +00001393 case oDeprecated:
Ben Lindstrom2e17b082002-06-09 20:13:27 +00001394 debug("%s line %d: Deprecated option \"%s\"",
Ben Lindstrom4daea862002-06-09 20:04:02 +00001395 filename, linenum, keyword);
Ben Lindstrom2e17b082002-06-09 20:13:27 +00001396 return 0;
Ben Lindstrom4daea862002-06-09 20:04:02 +00001397
Damien Millerf9b3feb2003-05-16 11:38:32 +10001398 case oUnsupported:
1399 error("%s line %d: Unsupported option \"%s\"",
1400 filename, linenum, keyword);
1401 return 0;
1402
Damien Miller95def091999-11-25 00:26:21 +11001403 default:
1404 fatal("process_config_line: Unimplemented opcode %d", opcode);
1405 }
1406
1407 /* Check that there is no garbage at end of line. */
Ben Lindstrom226cfa02001-01-22 05:34:40 +00001408 if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
Damien Miller37023962000-07-11 17:31:38 +10001409 fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
Damien Miller0dc1bef2005-07-17 17:22:45 +10001410 filename, linenum, arg);
Damien Miller37023962000-07-11 17:31:38 +10001411 }
Damien Miller95def091999-11-25 00:26:21 +11001412 return 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001413}
1414
1415
Damien Miller5428f641999-11-25 11:54:57 +11001416/*
1417 * Reads the config file and modifies the options accordingly. Options
1418 * should already be initialized before this call. This never returns if
Ben Lindstromedc0cf22001-09-12 18:32:20 +00001419 * there is an error. If the file does not exist, this returns 0.
Damien Miller5428f641999-11-25 11:54:57 +11001420 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001421
Ben Lindstromedc0cf22001-09-12 18:32:20 +00001422int
Damien Miller194fd902013-10-15 12:13:05 +11001423read_config_file(const char *filename, struct passwd *pw, const char *host,
1424 Options *options, int flags)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001425{
Damien Miller95def091999-11-25 00:26:21 +11001426 FILE *f;
1427 char line[1024];
1428 int active, linenum;
1429 int bad_options = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001430
Damien Miller57a44762004-04-20 20:11:57 +10001431 if ((f = fopen(filename, "r")) == NULL)
Ben Lindstromedc0cf22001-09-12 18:32:20 +00001432 return 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001433
Darren Tuckeraefa3682013-04-05 11:18:35 +11001434 if (flags & SSHCONF_CHECKPERM) {
Damien Miller57a44762004-04-20 20:11:57 +10001435 struct stat sb;
Darren Tuckerfc959702004-07-17 16:12:08 +10001436
Damien Miller33793852004-06-15 10:27:55 +10001437 if (fstat(fileno(f), &sb) == -1)
Damien Miller57a44762004-04-20 20:11:57 +10001438 fatal("fstat %s: %s", filename, strerror(errno));
Damien Miller57a44762004-04-20 20:11:57 +10001439 if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
Damien Miller33793852004-06-15 10:27:55 +10001440 (sb.st_mode & 022) != 0))
Damien Miller57a44762004-04-20 20:11:57 +10001441 fatal("Bad owner or permissions on %s", filename);
Damien Miller57a44762004-04-20 20:11:57 +10001442 }
1443
Damien Miller95def091999-11-25 00:26:21 +11001444 debug("Reading configuration data %.200s", filename);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001445
Damien Miller5428f641999-11-25 11:54:57 +11001446 /*
1447 * Mark that we are now processing the options. This flag is turned
1448 * on/off by Host specifications.
1449 */
Damien Miller95def091999-11-25 00:26:21 +11001450 active = 1;
1451 linenum = 0;
1452 while (fgets(line, sizeof(line), f)) {
1453 /* Update line number counter. */
1454 linenum++;
Damien Miller194fd902013-10-15 12:13:05 +11001455 if (process_config_line(options, pw, host, line, filename,
1456 linenum, &active, flags & SSHCONF_USERCONF) != 0)
Damien Miller95def091999-11-25 00:26:21 +11001457 bad_options++;
1458 }
1459 fclose(f);
1460 if (bad_options > 0)
Ben Lindstrom6df8ef42001-03-05 07:47:23 +00001461 fatal("%s: terminating, %d bad configuration options",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001462 filename, bad_options);
Ben Lindstromedc0cf22001-09-12 18:32:20 +00001463 return 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001464}
1465
Damien Miller5428f641999-11-25 11:54:57 +11001466/*
1467 * Initializes options to special values that indicate that they have not yet
1468 * been set. Read_config_file will only set options with this value. Options
1469 * are processed in the following order: command line, user config file,
1470 * system config file. Last, fill_default_options is called.
1471 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001472
Damien Miller4af51302000-04-16 11:18:38 +10001473void
Damien Miller95def091999-11-25 00:26:21 +11001474initialize_options(Options * options)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001475{
Damien Miller95def091999-11-25 00:26:21 +11001476 memset(options, 'X', sizeof(*options));
1477 options->forward_agent = -1;
1478 options->forward_x11 = -1;
Darren Tucker0a118da2003-10-15 15:54:32 +10001479 options->forward_x11_trusted = -1;
Damien Miller1ab6a512010-06-26 10:02:24 +10001480 options->forward_x11_timeout = -1;
Darren Tuckere7d4b192006-07-12 22:17:10 +10001481 options->exit_on_forward_failure = -1;
Damien Millerd3a18572000-06-07 19:55:44 +10001482 options->xauth_location = NULL;
Damien Miller95def091999-11-25 00:26:21 +11001483 options->gateway_ports = -1;
1484 options->use_privileged_port = -1;
Damien Miller95def091999-11-25 00:26:21 +11001485 options->rsa_authentication = -1;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001486 options->pubkey_authentication = -1;
Ben Lindstrom551ea372001-06-05 18:56:16 +00001487 options->challenge_response_authentication = -1;
Darren Tucker0efd1552003-08-26 11:49:55 +10001488 options->gss_authentication = -1;
1489 options->gss_deleg_creds = -1;
Damien Miller95def091999-11-25 00:26:21 +11001490 options->password_authentication = -1;
Damien Miller874d77b2000-10-14 16:23:11 +11001491 options->kbd_interactive_authentication = -1;
1492 options->kbd_interactive_devices = NULL;
Damien Miller95def091999-11-25 00:26:21 +11001493 options->rhosts_rsa_authentication = -1;
Ben Lindstrom5eabda32001-04-12 23:34:34 +00001494 options->hostbased_authentication = -1;
Damien Miller95def091999-11-25 00:26:21 +11001495 options->batch_mode = -1;
1496 options->check_host_ip = -1;
1497 options->strict_host_key_checking = -1;
1498 options->compression = -1;
Damien Miller12c150e2003-12-17 16:31:10 +11001499 options->tcp_keep_alive = -1;
Damien Miller95def091999-11-25 00:26:21 +11001500 options->compression_level = -1;
1501 options->port = -1;
Darren Tucker0a4f04b2003-07-03 20:37:47 +10001502 options->address_family = -1;
Damien Miller95def091999-11-25 00:26:21 +11001503 options->connection_attempts = -1;
Damien Millerb78d5eb2003-05-16 11:39:04 +10001504 options->connection_timeout = -1;
Damien Miller95def091999-11-25 00:26:21 +11001505 options->number_of_password_prompts = -1;
1506 options->cipher = -1;
Damien Miller78928792000-04-12 20:17:38 +10001507 options->ciphers = NULL;
Ben Lindstrom06b33aa2001-02-15 03:01:59 +00001508 options->macs = NULL;
Damien Millerd5f62bf2010-09-24 22:11:14 +10001509 options->kex_algorithms = NULL;
Ben Lindstrom982dbbc2001-04-17 18:11:36 +00001510 options->hostkeyalgorithms = NULL;
Damien Miller78928792000-04-12 20:17:38 +10001511 options->protocol = SSH_PROTO_UNKNOWN;
Damien Miller95def091999-11-25 00:26:21 +11001512 options->num_identity_files = 0;
1513 options->hostname = NULL;
Ben Lindstrom4dccfa52000-12-28 16:40:05 +00001514 options->host_key_alias = NULL;
Damien Miller95def091999-11-25 00:26:21 +11001515 options->proxy_command = NULL;
1516 options->user = NULL;
1517 options->escape_char = -1;
Damien Miller295ee632011-05-29 21:42:31 +10001518 options->num_system_hostfiles = 0;
1519 options->num_user_hostfiles = 0;
Damien Miller232cfb12010-06-26 09:50:30 +10001520 options->local_forwards = NULL;
Damien Miller95def091999-11-25 00:26:21 +11001521 options->num_local_forwards = 0;
Damien Miller232cfb12010-06-26 09:50:30 +10001522 options->remote_forwards = NULL;
Damien Miller95def091999-11-25 00:26:21 +11001523 options->num_remote_forwards = 0;
Ben Lindstrom2b7a0e92001-09-20 00:57:55 +00001524 options->clear_forwardings = -1;
Damien Millerfcd93202002-02-05 12:26:34 +11001525 options->log_level = SYSLOG_LEVEL_NOT_SET;
Ben Lindstromb9be60a2001-03-11 01:49:19 +00001526 options->preferred_authentications = NULL;
Ben Lindstrome0f88042001-04-30 13:06:24 +00001527 options->bind_address = NULL;
Damien Miller7ea845e2010-02-12 09:21:02 +11001528 options->pkcs11_provider = NULL;
Ben Lindstromb6df73b2002-11-09 15:52:31 +00001529 options->enable_ssh_keysign = - 1;
Ben Lindstrom3cecc9a2001-10-03 17:39:38 +00001530 options->no_host_authentication_for_localhost = - 1;
Damien Millerbd394c32004-03-08 23:12:36 +11001531 options->identities_only = - 1;
Damien Millera5539d22003-04-09 20:50:06 +10001532 options->rekey_limit = - 1;
Darren Tuckerc53c2af2013-05-16 20:28:16 +10001533 options->rekey_interval = -1;
Damien Miller37876e92003-05-15 10:19:46 +10001534 options->verify_host_key_dns = -1;
Damien Miller509b0102003-12-17 16:33:10 +11001535 options->server_alive_interval = -1;
1536 options->server_alive_count_max = -1;
Darren Tucker46bc0752004-05-02 22:11:30 +10001537 options->num_send_env = 0;
Damien Miller0e220db2004-06-15 10:34:08 +10001538 options->control_path = NULL;
1539 options->control_master = -1;
Damien Millere11e1ea2010-08-03 16:04:46 +10001540 options->control_persist = -1;
1541 options->control_persist_timeout = 0;
Damien Millere1776152005-03-01 21:47:37 +11001542 options->hash_known_hosts = -1;
Damien Millerd27b9472005-12-13 19:29:02 +11001543 options->tun_open = -1;
1544 options->tun_local = -1;
1545 options->tun_remote = -1;
1546 options->local_command = NULL;
1547 options->permit_local_command = -1;
Darren Tucker71e4d542009-07-06 07:12:27 +10001548 options->use_roaming = -1;
Damien Miller10288242008-06-30 00:04:03 +10001549 options->visual_host_key = -1;
Damien Miller01ed2272008-11-05 16:20:46 +11001550 options->zero_knowledge_password_authentication = -1;
Damien Miller0dac6fb2010-11-20 15:19:38 +11001551 options->ip_qos_interactive = -1;
1552 options->ip_qos_bulk = -1;
Damien Miller21771e22011-05-15 08:45:50 +10001553 options->request_tty = -1;
Damien Miller1262b662013-08-21 02:44:24 +10001554 options->proxy_use_fdpass = -1;
Darren Tucker07636982013-05-16 20:30:03 +10001555 options->ignored_unknown = NULL;
Damien Miller0faf7472013-10-17 11:47:23 +11001556 options->num_canonical_domains = 0;
1557 options->num_permitted_cnames = 0;
Damien Miller38505592013-10-17 11:48:13 +11001558 options->canonicalize_max_dots = -1;
1559 options->canonicalize_fallback_local = -1;
1560 options->canonicalize_hostname = -1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001561}
1562
Damien Miller5428f641999-11-25 11:54:57 +11001563/*
1564 * Called after processing other sources of option data, this fills those
1565 * options for which no value has been specified with their default values.
1566 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001567
Damien Miller4af51302000-04-16 11:18:38 +10001568void
Damien Miller95def091999-11-25 00:26:21 +11001569fill_default_options(Options * options)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001570{
Damien Miller95def091999-11-25 00:26:21 +11001571 if (options->forward_agent == -1)
Damien Millerb1715dc2000-05-30 13:44:51 +10001572 options->forward_agent = 0;
Damien Miller95def091999-11-25 00:26:21 +11001573 if (options->forward_x11 == -1)
Damien Miller98c7ad62000-03-09 21:27:49 +11001574 options->forward_x11 = 0;
Darren Tucker0a118da2003-10-15 15:54:32 +10001575 if (options->forward_x11_trusted == -1)
1576 options->forward_x11_trusted = 0;
Damien Miller1ab6a512010-06-26 10:02:24 +10001577 if (options->forward_x11_timeout == -1)
1578 options->forward_x11_timeout = 1200;
Darren Tuckere7d4b192006-07-12 22:17:10 +10001579 if (options->exit_on_forward_failure == -1)
1580 options->exit_on_forward_failure = 0;
Damien Millerd3a18572000-06-07 19:55:44 +10001581 if (options->xauth_location == NULL)
Ben Lindstrom1bf11f62001-06-09 01:48:01 +00001582 options->xauth_location = _PATH_XAUTH;
Damien Miller95def091999-11-25 00:26:21 +11001583 if (options->gateway_ports == -1)
1584 options->gateway_ports = 0;
1585 if (options->use_privileged_port == -1)
Ben Lindstromcebc8582001-03-08 03:39:10 +00001586 options->use_privileged_port = 0;
Damien Miller95def091999-11-25 00:26:21 +11001587 if (options->rsa_authentication == -1)
1588 options->rsa_authentication = 1;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001589 if (options->pubkey_authentication == -1)
1590 options->pubkey_authentication = 1;
Ben Lindstrom551ea372001-06-05 18:56:16 +00001591 if (options->challenge_response_authentication == -1)
Ben Lindstrom0076d752001-08-06 20:53:26 +00001592 options->challenge_response_authentication = 1;
Darren Tucker0efd1552003-08-26 11:49:55 +10001593 if (options->gss_authentication == -1)
Darren Tuckera044f472003-10-15 15:52:03 +10001594 options->gss_authentication = 0;
Darren Tucker0efd1552003-08-26 11:49:55 +10001595 if (options->gss_deleg_creds == -1)
1596 options->gss_deleg_creds = 0;
Damien Miller95def091999-11-25 00:26:21 +11001597 if (options->password_authentication == -1)
1598 options->password_authentication = 1;
Damien Miller874d77b2000-10-14 16:23:11 +11001599 if (options->kbd_interactive_authentication == -1)
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +00001600 options->kbd_interactive_authentication = 1;
Damien Miller95def091999-11-25 00:26:21 +11001601 if (options->rhosts_rsa_authentication == -1)
Ben Lindstrom2bf82762002-06-11 15:53:05 +00001602 options->rhosts_rsa_authentication = 0;
Ben Lindstrom5eabda32001-04-12 23:34:34 +00001603 if (options->hostbased_authentication == -1)
1604 options->hostbased_authentication = 0;
Damien Miller95def091999-11-25 00:26:21 +11001605 if (options->batch_mode == -1)
1606 options->batch_mode = 0;
1607 if (options->check_host_ip == -1)
1608 options->check_host_ip = 1;
1609 if (options->strict_host_key_checking == -1)
1610 options->strict_host_key_checking = 2; /* 2 is default */
1611 if (options->compression == -1)
1612 options->compression = 0;
Damien Miller12c150e2003-12-17 16:31:10 +11001613 if (options->tcp_keep_alive == -1)
1614 options->tcp_keep_alive = 1;
Damien Miller95def091999-11-25 00:26:21 +11001615 if (options->compression_level == -1)
1616 options->compression_level = 6;
1617 if (options->port == -1)
1618 options->port = 0; /* Filled in ssh_connect. */
Darren Tucker0a4f04b2003-07-03 20:37:47 +10001619 if (options->address_family == -1)
1620 options->address_family = AF_UNSPEC;
Damien Miller95def091999-11-25 00:26:21 +11001621 if (options->connection_attempts == -1)
Ben Lindstromf9cedb92001-08-06 21:07:11 +00001622 options->connection_attempts = 1;
Damien Miller95def091999-11-25 00:26:21 +11001623 if (options->number_of_password_prompts == -1)
1624 options->number_of_password_prompts = 3;
1625 /* Selected in ssh_login(). */
1626 if (options->cipher == -1)
1627 options->cipher = SSH_CIPHER_NOT_SET;
Damien Miller30c3d422000-05-09 11:02:59 +10001628 /* options->ciphers, default set in myproposals.h */
Ben Lindstrom06b33aa2001-02-15 03:01:59 +00001629 /* options->macs, default set in myproposals.h */
Damien Millerd5f62bf2010-09-24 22:11:14 +10001630 /* options->kex_algorithms, default set in myproposals.h */
Ben Lindstrom982dbbc2001-04-17 18:11:36 +00001631 /* options->hostkeyalgorithms, default set in myproposals.h */
Damien Miller78928792000-04-12 20:17:38 +10001632 if (options->protocol == SSH_PROTO_UNKNOWN)
Darren Tuckerbad50762009-10-11 21:51:08 +11001633 options->protocol = SSH_PROTO_2;
Damien Miller95def091999-11-25 00:26:21 +11001634 if (options->num_identity_files == 0) {
Damien Miller0bc1bd82000-11-13 22:57:25 +11001635 if (options->protocol & SSH_PROTO_1) {
Darren Tucker19104782013-04-05 11:13:08 +11001636 add_identity_file(options, "~/",
1637 _PATH_SSH_CLIENT_IDENTITY, 0);
Damien Miller0bc1bd82000-11-13 22:57:25 +11001638 }
1639 if (options->protocol & SSH_PROTO_2) {
Darren Tucker19104782013-04-05 11:13:08 +11001640 add_identity_file(options, "~/",
1641 _PATH_SSH_CLIENT_ID_RSA, 0);
1642 add_identity_file(options, "~/",
1643 _PATH_SSH_CLIENT_ID_DSA, 0);
Damien Miller6af914a2010-09-10 11:39:26 +10001644#ifdef OPENSSL_HAS_ECC
Darren Tucker19104782013-04-05 11:13:08 +11001645 add_identity_file(options, "~/",
1646 _PATH_SSH_CLIENT_ID_ECDSA, 0);
Damien Miller6af914a2010-09-10 11:39:26 +10001647#endif
Damien Miller5be9d9e2013-12-07 11:24:01 +11001648 add_identity_file(options, "~/",
1649 _PATH_SSH_CLIENT_ID_ED25519, 0);
Damien Miller0bc1bd82000-11-13 22:57:25 +11001650 }
Damien Millereba71ba2000-04-29 23:57:08 +10001651 }
Damien Miller95def091999-11-25 00:26:21 +11001652 if (options->escape_char == -1)
1653 options->escape_char = '~';
Damien Miller295ee632011-05-29 21:42:31 +10001654 if (options->num_system_hostfiles == 0) {
1655 options->system_hostfiles[options->num_system_hostfiles++] =
1656 xstrdup(_PATH_SSH_SYSTEM_HOSTFILE);
1657 options->system_hostfiles[options->num_system_hostfiles++] =
1658 xstrdup(_PATH_SSH_SYSTEM_HOSTFILE2);
1659 }
1660 if (options->num_user_hostfiles == 0) {
1661 options->user_hostfiles[options->num_user_hostfiles++] =
1662 xstrdup(_PATH_SSH_USER_HOSTFILE);
1663 options->user_hostfiles[options->num_user_hostfiles++] =
1664 xstrdup(_PATH_SSH_USER_HOSTFILE2);
1665 }
Damien Millerfcd93202002-02-05 12:26:34 +11001666 if (options->log_level == SYSLOG_LEVEL_NOT_SET)
Ben Lindstromdb65e8f2001-01-19 04:26:52 +00001667 options->log_level = SYSLOG_LEVEL_INFO;
Ben Lindstrom2b7a0e92001-09-20 00:57:55 +00001668 if (options->clear_forwardings == 1)
1669 clear_forwardings(options);
Ben Lindstrom3cecc9a2001-10-03 17:39:38 +00001670 if (options->no_host_authentication_for_localhost == - 1)
1671 options->no_host_authentication_for_localhost = 0;
Damien Millerbd394c32004-03-08 23:12:36 +11001672 if (options->identities_only == -1)
1673 options->identities_only = 0;
Ben Lindstromb6df73b2002-11-09 15:52:31 +00001674 if (options->enable_ssh_keysign == -1)
1675 options->enable_ssh_keysign = 0;
Damien Millera5539d22003-04-09 20:50:06 +10001676 if (options->rekey_limit == -1)
1677 options->rekey_limit = 0;
Darren Tuckerc53c2af2013-05-16 20:28:16 +10001678 if (options->rekey_interval == -1)
1679 options->rekey_interval = 0;
Damien Miller37876e92003-05-15 10:19:46 +10001680 if (options->verify_host_key_dns == -1)
1681 options->verify_host_key_dns = 0;
Damien Miller509b0102003-12-17 16:33:10 +11001682 if (options->server_alive_interval == -1)
1683 options->server_alive_interval = 0;
1684 if (options->server_alive_count_max == -1)
1685 options->server_alive_count_max = 3;
Damien Miller0e220db2004-06-15 10:34:08 +10001686 if (options->control_master == -1)
1687 options->control_master = 0;
Damien Millere11e1ea2010-08-03 16:04:46 +10001688 if (options->control_persist == -1) {
1689 options->control_persist = 0;
1690 options->control_persist_timeout = 0;
1691 }
Damien Millere1776152005-03-01 21:47:37 +11001692 if (options->hash_known_hosts == -1)
1693 options->hash_known_hosts = 0;
Damien Millerd27b9472005-12-13 19:29:02 +11001694 if (options->tun_open == -1)
Damien Miller7b58e802005-12-13 19:33:19 +11001695 options->tun_open = SSH_TUNMODE_NO;
1696 if (options->tun_local == -1)
1697 options->tun_local = SSH_TUNID_ANY;
1698 if (options->tun_remote == -1)
1699 options->tun_remote = SSH_TUNID_ANY;
Damien Millerd27b9472005-12-13 19:29:02 +11001700 if (options->permit_local_command == -1)
1701 options->permit_local_command = 0;
Darren Tucker71e4d542009-07-06 07:12:27 +10001702 if (options->use_roaming == -1)
1703 options->use_roaming = 1;
Damien Miller10288242008-06-30 00:04:03 +10001704 if (options->visual_host_key == -1)
1705 options->visual_host_key = 0;
Damien Miller01ed2272008-11-05 16:20:46 +11001706 if (options->zero_knowledge_password_authentication == -1)
1707 options->zero_knowledge_password_authentication = 0;
Damien Miller0dac6fb2010-11-20 15:19:38 +11001708 if (options->ip_qos_interactive == -1)
1709 options->ip_qos_interactive = IPTOS_LOWDELAY;
1710 if (options->ip_qos_bulk == -1)
1711 options->ip_qos_bulk = IPTOS_THROUGHPUT;
Damien Miller21771e22011-05-15 08:45:50 +10001712 if (options->request_tty == -1)
1713 options->request_tty = REQUEST_TTY_AUTO;
Damien Miller1262b662013-08-21 02:44:24 +10001714 if (options->proxy_use_fdpass == -1)
1715 options->proxy_use_fdpass = 0;
Damien Miller38505592013-10-17 11:48:13 +11001716 if (options->canonicalize_max_dots == -1)
1717 options->canonicalize_max_dots = 1;
1718 if (options->canonicalize_fallback_local == -1)
1719 options->canonicalize_fallback_local = 1;
1720 if (options->canonicalize_hostname == -1)
1721 options->canonicalize_hostname = SSH_CANONICALISE_NO;
Damien Millere9fc72e2013-10-15 12:14:12 +11001722#define CLEAR_ON_NONE(v) \
1723 do { \
1724 if (v != NULL && strcasecmp(v, "none") == 0) { \
1725 free(v); \
1726 v = NULL; \
1727 } \
1728 } while(0)
1729 CLEAR_ON_NONE(options->local_command);
1730 CLEAR_ON_NONE(options->proxy_command);
1731 CLEAR_ON_NONE(options->control_path);
Damien Miller95def091999-11-25 00:26:21 +11001732 /* options->user will be set in the main program if appropriate */
1733 /* options->hostname will be set in the main program if appropriate */
Ben Lindstrom4dccfa52000-12-28 16:40:05 +00001734 /* options->host_key_alias should not be set by default */
Ben Lindstromb9be60a2001-03-11 01:49:19 +00001735 /* options->preferred_authentications will be set in ssh */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001736}
Damien Millerf91ee4c2005-03-01 21:24:33 +11001737
1738/*
1739 * parse_forward
1740 * parses a string containing a port forwarding specification of the form:
Damien Millera699d952008-11-03 19:27:34 +11001741 * dynamicfwd == 0
Damien Millerf91ee4c2005-03-01 21:24:33 +11001742 * [listenhost:]listenport:connecthost:connectport
Damien Millera699d952008-11-03 19:27:34 +11001743 * dynamicfwd == 1
1744 * [listenhost:]listenport
Damien Millerf91ee4c2005-03-01 21:24:33 +11001745 * returns number of arguments parsed or zero on error
1746 */
1747int
Damien Miller4bf648f2009-02-14 16:28:21 +11001748parse_forward(Forward *fwd, const char *fwdspec, int dynamicfwd, int remotefwd)
Damien Millerf91ee4c2005-03-01 21:24:33 +11001749{
1750 int i;
1751 char *p, *cp, *fwdarg[4];
1752
1753 memset(fwd, '\0', sizeof(*fwd));
1754
1755 cp = p = xstrdup(fwdspec);
1756
1757 /* skip leading spaces */
Damien Millerfdb23062013-11-21 13:57:15 +11001758 while (isspace((u_char)*cp))
Damien Millerf91ee4c2005-03-01 21:24:33 +11001759 cp++;
1760
1761 for (i = 0; i < 4; ++i)
1762 if ((fwdarg[i] = hpdelim(&cp)) == NULL)
1763 break;
1764
Damien Millerf4b39532008-11-03 19:28:21 +11001765 /* Check for trailing garbage */
Damien Millerf91ee4c2005-03-01 21:24:33 +11001766 if (cp != NULL)
1767 i = 0; /* failure */
1768
1769 switch (i) {
Damien Millera699d952008-11-03 19:27:34 +11001770 case 1:
1771 fwd->listen_host = NULL;
1772 fwd->listen_port = a2port(fwdarg[0]);
1773 fwd->connect_host = xstrdup("socks");
1774 break;
1775
1776 case 2:
1777 fwd->listen_host = xstrdup(cleanhostname(fwdarg[0]));
1778 fwd->listen_port = a2port(fwdarg[1]);
1779 fwd->connect_host = xstrdup("socks");
1780 break;
1781
Damien Millerf91ee4c2005-03-01 21:24:33 +11001782 case 3:
1783 fwd->listen_host = NULL;
1784 fwd->listen_port = a2port(fwdarg[0]);
1785 fwd->connect_host = xstrdup(cleanhostname(fwdarg[1]));
1786 fwd->connect_port = a2port(fwdarg[2]);
1787 break;
1788
1789 case 4:
1790 fwd->listen_host = xstrdup(cleanhostname(fwdarg[0]));
1791 fwd->listen_port = a2port(fwdarg[1]);
1792 fwd->connect_host = xstrdup(cleanhostname(fwdarg[2]));
1793 fwd->connect_port = a2port(fwdarg[3]);
1794 break;
1795 default:
1796 i = 0; /* failure */
1797 }
1798
Darren Tuckera627d422013-06-02 07:31:17 +10001799 free(p);
Damien Millerf91ee4c2005-03-01 21:24:33 +11001800
Damien Millera699d952008-11-03 19:27:34 +11001801 if (dynamicfwd) {
1802 if (!(i == 1 || i == 2))
1803 goto fail_free;
1804 } else {
1805 if (!(i == 3 || i == 4))
1806 goto fail_free;
Damien Miller3dc71ad2009-01-28 16:31:22 +11001807 if (fwd->connect_port <= 0)
Damien Millera699d952008-11-03 19:27:34 +11001808 goto fail_free;
1809 }
1810
Damien Miller4bf648f2009-02-14 16:28:21 +11001811 if (fwd->listen_port < 0 || (!remotefwd && fwd->listen_port == 0))
Damien Millerf91ee4c2005-03-01 21:24:33 +11001812 goto fail_free;
1813
1814 if (fwd->connect_host != NULL &&
1815 strlen(fwd->connect_host) >= NI_MAXHOST)
1816 goto fail_free;
Damien Miller4bf648f2009-02-14 16:28:21 +11001817 if (fwd->listen_host != NULL &&
1818 strlen(fwd->listen_host) >= NI_MAXHOST)
1819 goto fail_free;
1820
Damien Millerf91ee4c2005-03-01 21:24:33 +11001821
1822 return (i);
1823
1824 fail_free:
Darren Tuckera627d422013-06-02 07:31:17 +10001825 free(fwd->connect_host);
1826 fwd->connect_host = NULL;
1827 free(fwd->listen_host);
1828 fwd->listen_host = NULL;
Damien Millerf91ee4c2005-03-01 21:24:33 +11001829 return (0);
1830}