MFC:
[dragonfly.git] / crypto / openssh-5 / readconf.c
blob30970e7b7b3db97cbe28a4e36440982ec1c41538
1 /* $OpenBSD: readconf.c,v 1.165 2008/01/19 23:09:49 djm Exp $ */
2 /*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * All rights reserved
6 * Functions for reading the configuration files.
8 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
15 #include "includes.h"
17 #include <sys/types.h>
18 #include <sys/stat.h>
19 #include <sys/socket.h>
21 #include <netinet/in.h>
23 #include <ctype.h>
24 #include <errno.h>
25 #include <netdb.h>
26 #include <signal.h>
27 #include <stdarg.h>
28 #include <stdio.h>
29 #include <string.h>
30 #include <unistd.h>
32 #include "xmalloc.h"
33 #include "ssh.h"
34 #include "compat.h"
35 #include "cipher.h"
36 #include "pathnames.h"
37 #include "log.h"
38 #include "key.h"
39 #include "readconf.h"
40 #include "match.h"
41 #include "misc.h"
42 #include "buffer.h"
43 #include "kex.h"
44 #include "mac.h"
45 #include "uidswap.h"
47 /* Format of the configuration file:
49 # Configuration data is parsed as follows:
50 # 1. command line options
51 # 2. user-specific file
52 # 3. system-wide file
53 # Any configuration value is only changed the first time it is set.
54 # Thus, host-specific definitions should be at the beginning of the
55 # configuration file, and defaults at the end.
57 # Host-specific declarations. These may override anything above. A single
58 # host may match multiple declarations; these are processed in the order
59 # that they are given in.
61 Host *.ngs.fi ngs.fi
62 User foo
64 Host fake.com
65 HostName another.host.name.real.org
66 User blaah
67 Port 34289
68 ForwardX11 no
69 ForwardAgent no
71 Host books.com
72 RemoteForward 9999 shadows.cs.hut.fi:9999
73 Cipher 3des
75 Host fascist.blob.com
76 Port 23123
77 User tylonen
78 PasswordAuthentication no
80 Host puukko.hut.fi
81 User t35124p
82 ProxyCommand ssh-proxy %h %p
84 Host *.fr
85 PublicKeyAuthentication no
87 Host *.su
88 Cipher none
89 PasswordAuthentication no
91 Host vpn.fake.com
92 Tunnel yes
93 TunnelDevice 3
95 # Defaults for various options
96 Host *
97 ForwardAgent no
98 ForwardX11 no
99 PasswordAuthentication yes
100 RSAAuthentication yes
101 RhostsRSAAuthentication yes
102 StrictHostKeyChecking yes
103 TcpKeepAlive no
104 IdentityFile ~/.ssh/identity
105 Port 22
106 EscapeChar ~
110 /* Keyword tokens. */
112 typedef enum {
113 oBadOption,
114 oForwardAgent, oForwardX11, oForwardX11Trusted, oGatewayPorts,
115 oExitOnForwardFailure,
116 oPasswordAuthentication, oRSAAuthentication,
117 oChallengeResponseAuthentication, oXAuthLocation,
118 oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
119 oUser, oHost, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
120 oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
121 oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
122 oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts,
123 oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,
124 oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
125 oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
126 oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
127 oHostKeyAlgorithms, oBindAddress, oSmartcardDevice,
128 oClearAllForwardings, oNoHostAuthenticationForLocalhost,
129 oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
130 oAddressFamily, oGssAuthentication, oGssDelegateCreds,
131 oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
132 oVersionAddendum,
133 oSendEnv, oControlPath, oControlMaster, oHashKnownHosts,
134 oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
135 oDeprecated, oUnsupported
136 } OpCodes;
138 /* Textual representations of the tokens. */
140 static struct {
141 const char *name;
142 OpCodes opcode;
143 } keywords[] = {
144 { "forwardagent", oForwardAgent },
145 { "forwardx11", oForwardX11 },
146 { "forwardx11trusted", oForwardX11Trusted },
147 { "exitonforwardfailure", oExitOnForwardFailure },
148 { "xauthlocation", oXAuthLocation },
149 { "gatewayports", oGatewayPorts },
150 { "useprivilegedport", oUsePrivilegedPort },
151 { "rhostsauthentication", oDeprecated },
152 { "passwordauthentication", oPasswordAuthentication },
153 { "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
154 { "kbdinteractivedevices", oKbdInteractiveDevices },
155 { "rsaauthentication", oRSAAuthentication },
156 { "pubkeyauthentication", oPubkeyAuthentication },
157 { "dsaauthentication", oPubkeyAuthentication }, /* alias */
158 { "rhostsrsaauthentication", oRhostsRSAAuthentication },
159 { "hostbasedauthentication", oHostbasedAuthentication },
160 { "challengeresponseauthentication", oChallengeResponseAuthentication },
161 { "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
162 { "tisauthentication", oChallengeResponseAuthentication }, /* alias */
163 { "kerberosauthentication", oUnsupported },
164 { "kerberostgtpassing", oUnsupported },
165 { "afstokenpassing", oUnsupported },
166 #if defined(GSSAPI)
167 { "gssapiauthentication", oGssAuthentication },
168 { "gssapidelegatecredentials", oGssDelegateCreds },
169 #else
170 { "gssapiauthentication", oUnsupported },
171 { "gssapidelegatecredentials", oUnsupported },
172 #endif
173 { "fallbacktorsh", oDeprecated },
174 { "usersh", oDeprecated },
175 { "identityfile", oIdentityFile },
176 { "identityfile2", oIdentityFile }, /* alias */
177 { "identitiesonly", oIdentitiesOnly },
178 { "hostname", oHostName },
179 { "hostkeyalias", oHostKeyAlias },
180 { "proxycommand", oProxyCommand },
181 { "port", oPort },
182 { "cipher", oCipher },
183 { "ciphers", oCiphers },
184 { "macs", oMacs },
185 { "protocol", oProtocol },
186 { "remoteforward", oRemoteForward },
187 { "localforward", oLocalForward },
188 { "user", oUser },
189 { "host", oHost },
190 { "escapechar", oEscapeChar },
191 { "globalknownhostsfile", oGlobalKnownHostsFile },
192 { "userknownhostsfile", oUserKnownHostsFile }, /* obsolete */
193 { "globalknownhostsfile2", oGlobalKnownHostsFile2 },
194 { "userknownhostsfile2", oUserKnownHostsFile2 }, /* obsolete */
195 { "connectionattempts", oConnectionAttempts },
196 { "batchmode", oBatchMode },
197 { "checkhostip", oCheckHostIP },
198 { "stricthostkeychecking", oStrictHostKeyChecking },
199 { "compression", oCompression },
200 { "compressionlevel", oCompressionLevel },
201 { "tcpkeepalive", oTCPKeepAlive },
202 { "keepalive", oTCPKeepAlive }, /* obsolete */
203 { "numberofpasswordprompts", oNumberOfPasswordPrompts },
204 { "loglevel", oLogLevel },
205 { "dynamicforward", oDynamicForward },
206 { "preferredauthentications", oPreferredAuthentications },
207 { "hostkeyalgorithms", oHostKeyAlgorithms },
208 { "bindaddress", oBindAddress },
209 #ifdef SMARTCARD
210 { "smartcarddevice", oSmartcardDevice },
211 #else
212 { "smartcarddevice", oUnsupported },
213 #endif
214 { "clearallforwardings", oClearAllForwardings },
215 { "enablesshkeysign", oEnableSSHKeysign },
216 { "verifyhostkeydns", oVerifyHostKeyDNS },
217 { "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost },
218 { "rekeylimit", oRekeyLimit },
219 { "connecttimeout", oConnectTimeout },
220 { "addressfamily", oAddressFamily },
221 { "serveraliveinterval", oServerAliveInterval },
222 { "serveralivecountmax", oServerAliveCountMax },
223 { "versionaddendum", oVersionAddendum },
224 { "sendenv", oSendEnv },
225 { "controlpath", oControlPath },
226 { "controlmaster", oControlMaster },
227 { "hashknownhosts", oHashKnownHosts },
228 { "tunnel", oTunnel },
229 { "tunneldevice", oTunnelDevice },
230 { "localcommand", oLocalCommand },
231 { "permitlocalcommand", oPermitLocalCommand },
232 { NULL, oBadOption }
236 * Adds a local TCP/IP port forward to options. Never returns if there is an
237 * error.
240 void
241 add_local_forward(Options *options, const Forward *newfwd)
243 Forward *fwd;
244 #ifndef NO_IPPORT_RESERVED_CONCEPT
245 extern uid_t original_real_uid;
246 if (newfwd->listen_port < IPPORT_RESERVED && original_real_uid != 0)
247 fatal("Privileged ports can only be forwarded by root.");
248 #endif
249 if (options->num_local_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
250 fatal("Too many local forwards (max %d).", SSH_MAX_FORWARDS_PER_DIRECTION);
251 fwd = &options->local_forwards[options->num_local_forwards++];
253 fwd->listen_host = (newfwd->listen_host == NULL) ?
254 NULL : xstrdup(newfwd->listen_host);
255 fwd->listen_port = newfwd->listen_port;
256 fwd->connect_host = xstrdup(newfwd->connect_host);
257 fwd->connect_port = newfwd->connect_port;
261 * Adds a remote TCP/IP port forward to options. Never returns if there is
262 * an error.
265 void
266 add_remote_forward(Options *options, const Forward *newfwd)
268 Forward *fwd;
269 if (options->num_remote_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
270 fatal("Too many remote forwards (max %d).",
271 SSH_MAX_FORWARDS_PER_DIRECTION);
272 fwd = &options->remote_forwards[options->num_remote_forwards++];
274 fwd->listen_host = (newfwd->listen_host == NULL) ?
275 NULL : xstrdup(newfwd->listen_host);
276 fwd->listen_port = newfwd->listen_port;
277 fwd->connect_host = xstrdup(newfwd->connect_host);
278 fwd->connect_port = newfwd->connect_port;
281 static void
282 clear_forwardings(Options *options)
284 int i;
286 for (i = 0; i < options->num_local_forwards; i++) {
287 if (options->local_forwards[i].listen_host != NULL)
288 xfree(options->local_forwards[i].listen_host);
289 xfree(options->local_forwards[i].connect_host);
291 options->num_local_forwards = 0;
292 for (i = 0; i < options->num_remote_forwards; i++) {
293 if (options->remote_forwards[i].listen_host != NULL)
294 xfree(options->remote_forwards[i].listen_host);
295 xfree(options->remote_forwards[i].connect_host);
297 options->num_remote_forwards = 0;
298 options->tun_open = SSH_TUNMODE_NO;
302 * Returns the number of the token pointed to by cp or oBadOption.
305 static OpCodes
306 parse_token(const char *cp, const char *filename, int linenum)
308 u_int i;
310 for (i = 0; keywords[i].name; i++)
311 if (strcasecmp(cp, keywords[i].name) == 0)
312 return keywords[i].opcode;
314 error("%s: line %d: Bad configuration option: %s",
315 filename, linenum, cp);
316 return oBadOption;
320 * Processes a single option line as used in the configuration files. This
321 * only sets those values that have not already been set.
323 #define WHITESPACE " \t\r\n"
326 process_config_line(Options *options, const char *host,
327 char *line, const char *filename, int linenum,
328 int *activep)
330 char *s, **charptr, *endofnumber, *keyword, *arg, *arg2, fwdarg[256];
331 int opcode, *intptr, value, value2, scale;
332 LogLevel *log_level_ptr;
333 long long orig, val64;
334 size_t len;
335 Forward fwd;
337 /* Strip trailing whitespace */
338 for (len = strlen(line) - 1; len > 0; len--) {
339 if (strchr(WHITESPACE, line[len]) == NULL)
340 break;
341 line[len] = '\0';
344 s = line;
345 /* Get the keyword. (Each line is supposed to begin with a keyword). */
346 if ((keyword = strdelim(&s)) == NULL)
347 return 0;
348 /* Ignore leading whitespace. */
349 if (*keyword == '\0')
350 keyword = strdelim(&s);
351 if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
352 return 0;
354 opcode = parse_token(keyword, filename, linenum);
356 switch (opcode) {
357 case oBadOption:
358 /* don't panic, but count bad options */
359 return -1;
360 /* NOTREACHED */
361 case oConnectTimeout:
362 intptr = &options->connection_timeout;
363 parse_time:
364 arg = strdelim(&s);
365 if (!arg || *arg == '\0')
366 fatal("%s line %d: missing time value.",
367 filename, linenum);
368 if ((value = convtime(arg)) == -1)
369 fatal("%s line %d: invalid time value.",
370 filename, linenum);
371 if (*activep && *intptr == -1)
372 *intptr = value;
373 break;
375 case oForwardAgent:
376 intptr = &options->forward_agent;
377 parse_flag:
378 arg = strdelim(&s);
379 if (!arg || *arg == '\0')
380 fatal("%.200s line %d: Missing yes/no argument.", filename, linenum);
381 value = 0; /* To avoid compiler warning... */
382 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
383 value = 1;
384 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
385 value = 0;
386 else
387 fatal("%.200s line %d: Bad yes/no argument.", filename, linenum);
388 if (*activep && *intptr == -1)
389 *intptr = value;
390 break;
392 case oForwardX11:
393 intptr = &options->forward_x11;
394 goto parse_flag;
396 case oForwardX11Trusted:
397 intptr = &options->forward_x11_trusted;
398 goto parse_flag;
400 case oGatewayPorts:
401 intptr = &options->gateway_ports;
402 goto parse_flag;
404 case oExitOnForwardFailure:
405 intptr = &options->exit_on_forward_failure;
406 goto parse_flag;
408 case oUsePrivilegedPort:
409 intptr = &options->use_privileged_port;
410 goto parse_flag;
412 case oPasswordAuthentication:
413 intptr = &options->password_authentication;
414 goto parse_flag;
416 case oKbdInteractiveAuthentication:
417 intptr = &options->kbd_interactive_authentication;
418 goto parse_flag;
420 case oKbdInteractiveDevices:
421 charptr = &options->kbd_interactive_devices;
422 goto parse_string;
424 case oPubkeyAuthentication:
425 intptr = &options->pubkey_authentication;
426 goto parse_flag;
428 case oRSAAuthentication:
429 intptr = &options->rsa_authentication;
430 goto parse_flag;
432 case oRhostsRSAAuthentication:
433 intptr = &options->rhosts_rsa_authentication;
434 goto parse_flag;
436 case oHostbasedAuthentication:
437 intptr = &options->hostbased_authentication;
438 goto parse_flag;
440 case oChallengeResponseAuthentication:
441 intptr = &options->challenge_response_authentication;
442 goto parse_flag;
444 case oGssAuthentication:
445 intptr = &options->gss_authentication;
446 goto parse_flag;
448 case oGssDelegateCreds:
449 intptr = &options->gss_deleg_creds;
450 goto parse_flag;
452 case oBatchMode:
453 intptr = &options->batch_mode;
454 goto parse_flag;
456 case oCheckHostIP:
457 intptr = &options->check_host_ip;
458 goto parse_flag;
460 case oVerifyHostKeyDNS:
461 intptr = &options->verify_host_key_dns;
462 goto parse_yesnoask;
464 case oStrictHostKeyChecking:
465 intptr = &options->strict_host_key_checking;
466 parse_yesnoask:
467 arg = strdelim(&s);
468 if (!arg || *arg == '\0')
469 fatal("%.200s line %d: Missing yes/no/ask argument.",
470 filename, linenum);
471 value = 0; /* To avoid compiler warning... */
472 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
473 value = 1;
474 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
475 value = 0;
476 else if (strcmp(arg, "ask") == 0)
477 value = 2;
478 else
479 fatal("%.200s line %d: Bad yes/no/ask argument.", filename, linenum);
480 if (*activep && *intptr == -1)
481 *intptr = value;
482 break;
484 case oCompression:
485 intptr = &options->compression;
486 goto parse_flag;
488 case oTCPKeepAlive:
489 intptr = &options->tcp_keep_alive;
490 goto parse_flag;
492 case oNoHostAuthenticationForLocalhost:
493 intptr = &options->no_host_authentication_for_localhost;
494 goto parse_flag;
496 case oNumberOfPasswordPrompts:
497 intptr = &options->number_of_password_prompts;
498 goto parse_int;
500 case oCompressionLevel:
501 intptr = &options->compression_level;
502 goto parse_int;
504 case oRekeyLimit:
505 arg = strdelim(&s);
506 if (!arg || *arg == '\0')
507 fatal("%.200s line %d: Missing argument.", filename, linenum);
508 if (arg[0] < '0' || arg[0] > '9')
509 fatal("%.200s line %d: Bad number.", filename, linenum);
510 orig = val64 = strtoll(arg, &endofnumber, 10);
511 if (arg == endofnumber)
512 fatal("%.200s line %d: Bad number.", filename, linenum);
513 switch (toupper(*endofnumber)) {
514 case '\0':
515 scale = 1;
516 break;
517 case 'K':
518 scale = 1<<10;
519 break;
520 case 'M':
521 scale = 1<<20;
522 break;
523 case 'G':
524 scale = 1<<30;
525 break;
526 default:
527 fatal("%.200s line %d: Invalid RekeyLimit suffix",
528 filename, linenum);
530 val64 *= scale;
531 /* detect integer wrap and too-large limits */
532 if ((val64 / scale) != orig || val64 > UINT_MAX)
533 fatal("%.200s line %d: RekeyLimit too large",
534 filename, linenum);
535 if (val64 < 16)
536 fatal("%.200s line %d: RekeyLimit too small",
537 filename, linenum);
538 if (*activep && options->rekey_limit == -1)
539 options->rekey_limit = (u_int32_t)val64;
540 break;
542 case oIdentityFile:
543 arg = strdelim(&s);
544 if (!arg || *arg == '\0')
545 fatal("%.200s line %d: Missing argument.", filename, linenum);
546 if (*activep) {
547 intptr = &options->num_identity_files;
548 if (*intptr >= SSH_MAX_IDENTITY_FILES)
549 fatal("%.200s line %d: Too many identity files specified (max %d).",
550 filename, linenum, SSH_MAX_IDENTITY_FILES);
551 charptr = &options->identity_files[*intptr];
552 *charptr = xstrdup(arg);
553 *intptr = *intptr + 1;
555 break;
557 case oXAuthLocation:
558 charptr=&options->xauth_location;
559 goto parse_string;
561 case oUser:
562 charptr = &options->user;
563 parse_string:
564 arg = strdelim(&s);
565 if (!arg || *arg == '\0')
566 fatal("%.200s line %d: Missing argument.", filename, linenum);
567 if (*activep && *charptr == NULL)
568 *charptr = xstrdup(arg);
569 break;
571 case oGlobalKnownHostsFile:
572 charptr = &options->system_hostfile;
573 goto parse_string;
575 case oUserKnownHostsFile:
576 charptr = &options->user_hostfile;
577 goto parse_string;
579 case oGlobalKnownHostsFile2:
580 charptr = &options->system_hostfile2;
581 goto parse_string;
583 case oUserKnownHostsFile2:
584 charptr = &options->user_hostfile2;
585 goto parse_string;
587 case oHostName:
588 charptr = &options->hostname;
589 goto parse_string;
591 case oHostKeyAlias:
592 charptr = &options->host_key_alias;
593 goto parse_string;
595 case oPreferredAuthentications:
596 charptr = &options->preferred_authentications;
597 goto parse_string;
599 case oBindAddress:
600 charptr = &options->bind_address;
601 goto parse_string;
603 case oSmartcardDevice:
604 charptr = &options->smartcard_device;
605 goto parse_string;
607 case oProxyCommand:
608 charptr = &options->proxy_command;
609 parse_command:
610 if (s == NULL)
611 fatal("%.200s line %d: Missing argument.", filename, linenum);
612 len = strspn(s, WHITESPACE "=");
613 if (*activep && *charptr == NULL)
614 *charptr = xstrdup(s + len);
615 return 0;
617 case oPort:
618 intptr = &options->port;
619 parse_int:
620 arg = strdelim(&s);
621 if (!arg || *arg == '\0')
622 fatal("%.200s line %d: Missing argument.", filename, linenum);
623 if (arg[0] < '0' || arg[0] > '9')
624 fatal("%.200s line %d: Bad number.", filename, linenum);
626 /* Octal, decimal, or hex format? */
627 value = strtol(arg, &endofnumber, 0);
628 if (arg == endofnumber)
629 fatal("%.200s line %d: Bad number.", filename, linenum);
630 if (*activep && *intptr == -1)
631 *intptr = value;
632 break;
634 case oConnectionAttempts:
635 intptr = &options->connection_attempts;
636 goto parse_int;
638 case oCipher:
639 intptr = &options->cipher;
640 arg = strdelim(&s);
641 if (!arg || *arg == '\0')
642 fatal("%.200s line %d: Missing argument.", filename, linenum);
643 value = cipher_number(arg);
644 if (value == -1)
645 fatal("%.200s line %d: Bad cipher '%s'.",
646 filename, linenum, arg ? arg : "<NONE>");
647 if (*activep && *intptr == -1)
648 *intptr = value;
649 break;
651 case oCiphers:
652 arg = strdelim(&s);
653 if (!arg || *arg == '\0')
654 fatal("%.200s line %d: Missing argument.", filename, linenum);
655 if (!ciphers_valid(arg))
656 fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
657 filename, linenum, arg ? arg : "<NONE>");
658 if (*activep && options->ciphers == NULL)
659 options->ciphers = xstrdup(arg);
660 break;
662 case oMacs:
663 arg = strdelim(&s);
664 if (!arg || *arg == '\0')
665 fatal("%.200s line %d: Missing argument.", filename, linenum);
666 if (!mac_valid(arg))
667 fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.",
668 filename, linenum, arg ? arg : "<NONE>");
669 if (*activep && options->macs == NULL)
670 options->macs = xstrdup(arg);
671 break;
673 case oHostKeyAlgorithms:
674 arg = strdelim(&s);
675 if (!arg || *arg == '\0')
676 fatal("%.200s line %d: Missing argument.", filename, linenum);
677 if (!key_names_valid2(arg))
678 fatal("%.200s line %d: Bad protocol 2 host key algorithms '%s'.",
679 filename, linenum, arg ? arg : "<NONE>");
680 if (*activep && options->hostkeyalgorithms == NULL)
681 options->hostkeyalgorithms = xstrdup(arg);
682 break;
684 case oProtocol:
685 intptr = &options->protocol;
686 arg = strdelim(&s);
687 if (!arg || *arg == '\0')
688 fatal("%.200s line %d: Missing argument.", filename, linenum);
689 value = proto_spec(arg);
690 if (value == SSH_PROTO_UNKNOWN)
691 fatal("%.200s line %d: Bad protocol spec '%s'.",
692 filename, linenum, arg ? arg : "<NONE>");
693 if (*activep && *intptr == SSH_PROTO_UNKNOWN)
694 *intptr = value;
695 break;
697 case oLogLevel:
698 log_level_ptr = &options->log_level;
699 arg = strdelim(&s);
700 value = log_level_number(arg);
701 if (value == SYSLOG_LEVEL_NOT_SET)
702 fatal("%.200s line %d: unsupported log level '%s'",
703 filename, linenum, arg ? arg : "<NONE>");
704 if (*activep && *log_level_ptr == SYSLOG_LEVEL_NOT_SET)
705 *log_level_ptr = (LogLevel) value;
706 break;
708 case oLocalForward:
709 case oRemoteForward:
710 arg = strdelim(&s);
711 if (arg == NULL || *arg == '\0')
712 fatal("%.200s line %d: Missing port argument.",
713 filename, linenum);
714 arg2 = strdelim(&s);
715 if (arg2 == NULL || *arg2 == '\0')
716 fatal("%.200s line %d: Missing target argument.",
717 filename, linenum);
719 /* construct a string for parse_forward */
720 snprintf(fwdarg, sizeof(fwdarg), "%s:%s", arg, arg2);
722 if (parse_forward(&fwd, fwdarg) == 0)
723 fatal("%.200s line %d: Bad forwarding specification.",
724 filename, linenum);
726 if (*activep) {
727 if (opcode == oLocalForward)
728 add_local_forward(options, &fwd);
729 else if (opcode == oRemoteForward)
730 add_remote_forward(options, &fwd);
732 break;
734 case oDynamicForward:
735 arg = strdelim(&s);
736 if (!arg || *arg == '\0')
737 fatal("%.200s line %d: Missing port argument.",
738 filename, linenum);
739 memset(&fwd, '\0', sizeof(fwd));
740 fwd.connect_host = "socks";
741 fwd.listen_host = hpdelim(&arg);
742 if (fwd.listen_host == NULL ||
743 strlen(fwd.listen_host) >= NI_MAXHOST)
744 fatal("%.200s line %d: Bad forwarding specification.",
745 filename, linenum);
746 if (arg) {
747 fwd.listen_port = a2port(arg);
748 fwd.listen_host = cleanhostname(fwd.listen_host);
749 } else {
750 fwd.listen_port = a2port(fwd.listen_host);
751 fwd.listen_host = NULL;
753 if (fwd.listen_port == 0)
754 fatal("%.200s line %d: Badly formatted port number.",
755 filename, linenum);
756 if (*activep)
757 add_local_forward(options, &fwd);
758 break;
760 case oClearAllForwardings:
761 intptr = &options->clear_forwardings;
762 goto parse_flag;
764 case oHost:
765 *activep = 0;
766 while ((arg = strdelim(&s)) != NULL && *arg != '\0')
767 if (match_pattern(host, arg)) {
768 debug("Applying options for %.100s", arg);
769 *activep = 1;
770 break;
772 /* Avoid garbage check below, as strdelim is done. */
773 return 0;
775 case oEscapeChar:
776 intptr = &options->escape_char;
777 arg = strdelim(&s);
778 if (!arg || *arg == '\0')
779 fatal("%.200s line %d: Missing argument.", filename, linenum);
780 if (arg[0] == '^' && arg[2] == 0 &&
781 (u_char) arg[1] >= 64 && (u_char) arg[1] < 128)
782 value = (u_char) arg[1] & 31;
783 else if (strlen(arg) == 1)
784 value = (u_char) arg[0];
785 else if (strcmp(arg, "none") == 0)
786 value = SSH_ESCAPECHAR_NONE;
787 else {
788 fatal("%.200s line %d: Bad escape character.",
789 filename, linenum);
790 /* NOTREACHED */
791 value = 0; /* Avoid compiler warning. */
793 if (*activep && *intptr == -1)
794 *intptr = value;
795 break;
797 case oAddressFamily:
798 arg = strdelim(&s);
799 if (!arg || *arg == '\0')
800 fatal("%s line %d: missing address family.",
801 filename, linenum);
802 intptr = &options->address_family;
803 if (strcasecmp(arg, "inet") == 0)
804 value = AF_INET;
805 else if (strcasecmp(arg, "inet6") == 0)
806 value = AF_INET6;
807 else if (strcasecmp(arg, "any") == 0)
808 value = AF_UNSPEC;
809 else
810 fatal("Unsupported AddressFamily \"%s\"", arg);
811 if (*activep && *intptr == -1)
812 *intptr = value;
813 break;
815 case oEnableSSHKeysign:
816 intptr = &options->enable_ssh_keysign;
817 goto parse_flag;
819 case oIdentitiesOnly:
820 intptr = &options->identities_only;
821 goto parse_flag;
823 case oServerAliveInterval:
824 intptr = &options->server_alive_interval;
825 goto parse_time;
827 case oServerAliveCountMax:
828 intptr = &options->server_alive_count_max;
829 goto parse_int;
831 case oVersionAddendum:
832 ssh_version_set_addendum(strtok(s, "\n"));
833 do {
834 arg = strdelim(&s);
835 } while (arg != NULL && *arg != '\0');
836 break;
838 case oSendEnv:
839 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
840 if (strchr(arg, '=') != NULL)
841 fatal("%s line %d: Invalid environment name.",
842 filename, linenum);
843 if (!*activep)
844 continue;
845 if (options->num_send_env >= MAX_SEND_ENV)
846 fatal("%s line %d: too many send env.",
847 filename, linenum);
848 options->send_env[options->num_send_env++] =
849 xstrdup(arg);
851 break;
853 case oControlPath:
854 charptr = &options->control_path;
855 goto parse_string;
857 case oControlMaster:
858 intptr = &options->control_master;
859 arg = strdelim(&s);
860 if (!arg || *arg == '\0')
861 fatal("%.200s line %d: Missing ControlMaster argument.",
862 filename, linenum);
863 value = 0; /* To avoid compiler warning... */
864 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
865 value = SSHCTL_MASTER_YES;
866 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
867 value = SSHCTL_MASTER_NO;
868 else if (strcmp(arg, "auto") == 0)
869 value = SSHCTL_MASTER_AUTO;
870 else if (strcmp(arg, "ask") == 0)
871 value = SSHCTL_MASTER_ASK;
872 else if (strcmp(arg, "autoask") == 0)
873 value = SSHCTL_MASTER_AUTO_ASK;
874 else
875 fatal("%.200s line %d: Bad ControlMaster argument.",
876 filename, linenum);
877 if (*activep && *intptr == -1)
878 *intptr = value;
879 break;
881 case oHashKnownHosts:
882 intptr = &options->hash_known_hosts;
883 goto parse_flag;
885 case oTunnel:
886 intptr = &options->tun_open;
887 arg = strdelim(&s);
888 if (!arg || *arg == '\0')
889 fatal("%s line %d: Missing yes/point-to-point/"
890 "ethernet/no argument.", filename, linenum);
891 value = 0; /* silence compiler */
892 if (strcasecmp(arg, "ethernet") == 0)
893 value = SSH_TUNMODE_ETHERNET;
894 else if (strcasecmp(arg, "point-to-point") == 0)
895 value = SSH_TUNMODE_POINTOPOINT;
896 else if (strcasecmp(arg, "yes") == 0)
897 value = SSH_TUNMODE_DEFAULT;
898 else if (strcasecmp(arg, "no") == 0)
899 value = SSH_TUNMODE_NO;
900 else
901 fatal("%s line %d: Bad yes/point-to-point/ethernet/"
902 "no argument: %s", filename, linenum, arg);
903 if (*activep)
904 *intptr = value;
905 break;
907 case oTunnelDevice:
908 arg = strdelim(&s);
909 if (!arg || *arg == '\0')
910 fatal("%.200s line %d: Missing argument.", filename, linenum);
911 value = a2tun(arg, &value2);
912 if (value == SSH_TUNID_ERR)
913 fatal("%.200s line %d: Bad tun device.", filename, linenum);
914 if (*activep) {
915 options->tun_local = value;
916 options->tun_remote = value2;
918 break;
920 case oLocalCommand:
921 charptr = &options->local_command;
922 goto parse_command;
924 case oPermitLocalCommand:
925 intptr = &options->permit_local_command;
926 goto parse_flag;
928 case oDeprecated:
929 debug("%s line %d: Deprecated option \"%s\"",
930 filename, linenum, keyword);
931 return 0;
933 case oUnsupported:
934 error("%s line %d: Unsupported option \"%s\"",
935 filename, linenum, keyword);
936 return 0;
938 default:
939 fatal("process_config_line: Unimplemented opcode %d", opcode);
942 /* Check that there is no garbage at end of line. */
943 if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
944 fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
945 filename, linenum, arg);
947 return 0;
952 * Reads the config file and modifies the options accordingly. Options
953 * should already be initialized before this call. This never returns if
954 * there is an error. If the file does not exist, this returns 0.
958 read_config_file(const char *filename, const char *host, Options *options,
959 int checkperm)
961 FILE *f;
962 char line[1024];
963 int active, linenum;
964 int bad_options = 0;
966 /* Open the file. */
967 if ((f = fopen(filename, "r")) == NULL)
968 return 0;
970 if (checkperm) {
971 struct stat sb;
973 if (fstat(fileno(f), &sb) == -1)
974 fatal("fstat %s: %s", filename, strerror(errno));
975 if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
976 (sb.st_mode & 022) != 0))
977 fatal("Bad owner or permissions on %s", filename);
980 debug("Reading configuration data %.200s", filename);
983 * Mark that we are now processing the options. This flag is turned
984 * on/off by Host specifications.
986 active = 1;
987 linenum = 0;
988 while (fgets(line, sizeof(line), f)) {
989 /* Update line number counter. */
990 linenum++;
991 if (process_config_line(options, host, line, filename, linenum, &active) != 0)
992 bad_options++;
994 fclose(f);
995 if (bad_options > 0)
996 fatal("%s: terminating, %d bad configuration options",
997 filename, bad_options);
998 return 1;
1002 * Initializes options to special values that indicate that they have not yet
1003 * been set. Read_config_file will only set options with this value. Options
1004 * are processed in the following order: command line, user config file,
1005 * system config file. Last, fill_default_options is called.
1008 void
1009 initialize_options(Options * options)
1011 memset(options, 'X', sizeof(*options));
1012 options->forward_agent = -1;
1013 options->forward_x11 = -1;
1014 options->forward_x11_trusted = -1;
1015 options->exit_on_forward_failure = -1;
1016 options->xauth_location = NULL;
1017 options->gateway_ports = -1;
1018 options->use_privileged_port = -1;
1019 options->rsa_authentication = -1;
1020 options->pubkey_authentication = -1;
1021 options->challenge_response_authentication = -1;
1022 options->gss_authentication = -1;
1023 options->gss_deleg_creds = -1;
1024 options->password_authentication = -1;
1025 options->kbd_interactive_authentication = -1;
1026 options->kbd_interactive_devices = NULL;
1027 options->rhosts_rsa_authentication = -1;
1028 options->hostbased_authentication = -1;
1029 options->batch_mode = -1;
1030 options->check_host_ip = -1;
1031 options->strict_host_key_checking = -1;
1032 options->compression = -1;
1033 options->tcp_keep_alive = -1;
1034 options->compression_level = -1;
1035 options->port = -1;
1036 options->address_family = -1;
1037 options->connection_attempts = -1;
1038 options->connection_timeout = -1;
1039 options->number_of_password_prompts = -1;
1040 options->cipher = -1;
1041 options->ciphers = NULL;
1042 options->macs = NULL;
1043 options->hostkeyalgorithms = NULL;
1044 options->protocol = SSH_PROTO_UNKNOWN;
1045 options->num_identity_files = 0;
1046 options->hostname = NULL;
1047 options->host_key_alias = NULL;
1048 options->proxy_command = NULL;
1049 options->user = NULL;
1050 options->escape_char = -1;
1051 options->system_hostfile = NULL;
1052 options->user_hostfile = NULL;
1053 options->system_hostfile2 = NULL;
1054 options->user_hostfile2 = NULL;
1055 options->num_local_forwards = 0;
1056 options->num_remote_forwards = 0;
1057 options->clear_forwardings = -1;
1058 options->log_level = SYSLOG_LEVEL_NOT_SET;
1059 options->preferred_authentications = NULL;
1060 options->bind_address = NULL;
1061 options->smartcard_device = NULL;
1062 options->enable_ssh_keysign = - 1;
1063 options->no_host_authentication_for_localhost = - 1;
1064 options->identities_only = - 1;
1065 options->rekey_limit = - 1;
1066 options->verify_host_key_dns = -1;
1067 options->server_alive_interval = -1;
1068 options->server_alive_count_max = -1;
1069 options->num_send_env = 0;
1070 options->control_path = NULL;
1071 options->control_master = -1;
1072 options->hash_known_hosts = -1;
1073 options->tun_open = -1;
1074 options->tun_local = -1;
1075 options->tun_remote = -1;
1076 options->local_command = NULL;
1077 options->permit_local_command = -1;
1081 * Called after processing other sources of option data, this fills those
1082 * options for which no value has been specified with their default values.
1085 void
1086 fill_default_options(Options * options)
1088 int len;
1090 if (options->forward_agent == -1)
1091 options->forward_agent = 0;
1092 if (options->forward_x11 == -1)
1093 options->forward_x11 = 0;
1094 if (options->forward_x11_trusted == -1)
1095 options->forward_x11_trusted = 0;
1096 if (options->exit_on_forward_failure == -1)
1097 options->exit_on_forward_failure = 0;
1098 if (options->xauth_location == NULL)
1099 options->xauth_location = _PATH_XAUTH;
1100 if (options->gateway_ports == -1)
1101 options->gateway_ports = 0;
1102 if (options->use_privileged_port == -1)
1103 options->use_privileged_port = 0;
1104 if (options->rsa_authentication == -1)
1105 options->rsa_authentication = 1;
1106 if (options->pubkey_authentication == -1)
1107 options->pubkey_authentication = 1;
1108 if (options->challenge_response_authentication == -1)
1109 options->challenge_response_authentication = 1;
1110 if (options->gss_authentication == -1)
1111 options->gss_authentication = 0;
1112 if (options->gss_deleg_creds == -1)
1113 options->gss_deleg_creds = 0;
1114 if (options->password_authentication == -1)
1115 options->password_authentication = 1;
1116 if (options->kbd_interactive_authentication == -1)
1117 options->kbd_interactive_authentication = 1;
1118 if (options->rhosts_rsa_authentication == -1)
1119 options->rhosts_rsa_authentication = 0;
1120 if (options->hostbased_authentication == -1)
1121 options->hostbased_authentication = 0;
1122 if (options->batch_mode == -1)
1123 options->batch_mode = 0;
1124 if (options->check_host_ip == -1)
1125 options->check_host_ip = 0;
1126 if (options->strict_host_key_checking == -1)
1127 options->strict_host_key_checking = 2; /* 2 is default */
1128 if (options->compression == -1)
1129 options->compression = 0;
1130 if (options->tcp_keep_alive == -1)
1131 options->tcp_keep_alive = 1;
1132 if (options->compression_level == -1)
1133 options->compression_level = 6;
1134 if (options->port == -1)
1135 options->port = 0; /* Filled in ssh_connect. */
1136 if (options->address_family == -1)
1137 options->address_family = AF_UNSPEC;
1138 if (options->connection_attempts == -1)
1139 options->connection_attempts = 1;
1140 if (options->number_of_password_prompts == -1)
1141 options->number_of_password_prompts = 3;
1142 /* Selected in ssh_login(). */
1143 if (options->cipher == -1)
1144 options->cipher = SSH_CIPHER_NOT_SET;
1145 /* options->ciphers, default set in myproposals.h */
1146 /* options->macs, default set in myproposals.h */
1147 /* options->hostkeyalgorithms, default set in myproposals.h */
1148 if (options->protocol == SSH_PROTO_UNKNOWN)
1149 options->protocol = SSH_PROTO_1|SSH_PROTO_2;
1150 if (options->num_identity_files == 0) {
1151 if (options->protocol & SSH_PROTO_1) {
1152 len = 2 + strlen(_PATH_SSH_CLIENT_IDENTITY) + 1;
1153 options->identity_files[options->num_identity_files] =
1154 xmalloc(len);
1155 snprintf(options->identity_files[options->num_identity_files++],
1156 len, "~/%.100s", _PATH_SSH_CLIENT_IDENTITY);
1158 if (options->protocol & SSH_PROTO_2) {
1159 len = 2 + strlen(_PATH_SSH_CLIENT_ID_RSA) + 1;
1160 options->identity_files[options->num_identity_files] =
1161 xmalloc(len);
1162 snprintf(options->identity_files[options->num_identity_files++],
1163 len, "~/%.100s", _PATH_SSH_CLIENT_ID_RSA);
1165 len = 2 + strlen(_PATH_SSH_CLIENT_ID_DSA) + 1;
1166 options->identity_files[options->num_identity_files] =
1167 xmalloc(len);
1168 snprintf(options->identity_files[options->num_identity_files++],
1169 len, "~/%.100s", _PATH_SSH_CLIENT_ID_DSA);
1172 if (options->escape_char == -1)
1173 options->escape_char = '~';
1174 if (options->system_hostfile == NULL)
1175 options->system_hostfile = _PATH_SSH_SYSTEM_HOSTFILE;
1176 if (options->user_hostfile == NULL)
1177 options->user_hostfile = _PATH_SSH_USER_HOSTFILE;
1178 if (options->system_hostfile2 == NULL)
1179 options->system_hostfile2 = _PATH_SSH_SYSTEM_HOSTFILE2;
1180 if (options->user_hostfile2 == NULL)
1181 options->user_hostfile2 = _PATH_SSH_USER_HOSTFILE2;
1182 if (options->log_level == SYSLOG_LEVEL_NOT_SET)
1183 options->log_level = SYSLOG_LEVEL_INFO;
1184 if (options->clear_forwardings == 1)
1185 clear_forwardings(options);
1186 if (options->no_host_authentication_for_localhost == - 1)
1187 options->no_host_authentication_for_localhost = 0;
1188 if (options->identities_only == -1)
1189 options->identities_only = 0;
1190 if (options->enable_ssh_keysign == -1)
1191 options->enable_ssh_keysign = 0;
1192 if (options->rekey_limit == -1)
1193 options->rekey_limit = 0;
1194 if (options->verify_host_key_dns == -1)
1195 options->verify_host_key_dns = 0;
1196 if (options->server_alive_interval == -1)
1197 options->server_alive_interval = 0;
1198 if (options->server_alive_count_max == -1)
1199 options->server_alive_count_max = 3;
1200 if (options->control_master == -1)
1201 options->control_master = 0;
1202 if (options->hash_known_hosts == -1)
1203 options->hash_known_hosts = 0;
1204 if (options->tun_open == -1)
1205 options->tun_open = SSH_TUNMODE_NO;
1206 if (options->tun_local == -1)
1207 options->tun_local = SSH_TUNID_ANY;
1208 if (options->tun_remote == -1)
1209 options->tun_remote = SSH_TUNID_ANY;
1210 if (options->permit_local_command == -1)
1211 options->permit_local_command = 0;
1212 /* options->local_command should not be set by default */
1213 /* options->proxy_command should not be set by default */
1214 /* options->user will be set in the main program if appropriate */
1215 /* options->hostname will be set in the main program if appropriate */
1216 /* options->host_key_alias should not be set by default */
1217 /* options->preferred_authentications will be set in ssh */
1221 * parse_forward
1222 * parses a string containing a port forwarding specification of the form:
1223 * [listenhost:]listenport:connecthost:connectport
1224 * returns number of arguments parsed or zero on error
1227 parse_forward(Forward *fwd, const char *fwdspec)
1229 int i;
1230 char *p, *cp, *fwdarg[4];
1232 memset(fwd, '\0', sizeof(*fwd));
1234 cp = p = xstrdup(fwdspec);
1236 /* skip leading spaces */
1237 while (isspace(*cp))
1238 cp++;
1240 for (i = 0; i < 4; ++i)
1241 if ((fwdarg[i] = hpdelim(&cp)) == NULL)
1242 break;
1244 /* Check for trailing garbage in 4-arg case*/
1245 if (cp != NULL)
1246 i = 0; /* failure */
1248 switch (i) {
1249 case 3:
1250 fwd->listen_host = NULL;
1251 fwd->listen_port = a2port(fwdarg[0]);
1252 fwd->connect_host = xstrdup(cleanhostname(fwdarg[1]));
1253 fwd->connect_port = a2port(fwdarg[2]);
1254 break;
1256 case 4:
1257 fwd->listen_host = xstrdup(cleanhostname(fwdarg[0]));
1258 fwd->listen_port = a2port(fwdarg[1]);
1259 fwd->connect_host = xstrdup(cleanhostname(fwdarg[2]));
1260 fwd->connect_port = a2port(fwdarg[3]);
1261 break;
1262 default:
1263 i = 0; /* failure */
1266 xfree(p);
1268 if (fwd->listen_port == 0 || fwd->connect_port == 0)
1269 goto fail_free;
1271 if (fwd->connect_host != NULL &&
1272 strlen(fwd->connect_host) >= NI_MAXHOST)
1273 goto fail_free;
1275 return (i);
1277 fail_free:
1278 if (fwd->connect_host != NULL)
1279 xfree(fwd->connect_host);
1280 if (fwd->listen_host != NULL)
1281 xfree(fwd->listen_host);
1282 return (0);