1 /* $OpenBSD: readconf.c,v 1.187 2010/07/19 09:15:12 djm Exp $ */ 2 /* 3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5 * All rights reserved 6 * Functions for reading the configuration files. 7 * 8 * As far as I am concerned, the code I have written for this software 9 * can be used freely for any purpose. Any derived versions of this 10 * software must be clearly marked as such, and if the derived work is 11 * incompatible with the protocol description in the RFC file, it must be 12 * called by a name other than "ssh" or "Secure Shell". 13 */ 14 15 #include "includes.h" 16 17 #include <sys/types.h> 18 #include <sys/stat.h> 19 #include <sys/socket.h> 20 21 #include <netinet/in.h> 22 23 #include <ctype.h> 24 #include <errno.h> 25 #include <netdb.h> 26 #include <signal.h> 27 #include <stdarg.h> 28 #include <stdio.h> 29 #include <string.h> 30 #include <unistd.h> 31 32 #include "xmalloc.h" 33 #include "ssh.h" 34 #include "compat.h" 35 #include "cipher.h" 36 #include "pathnames.h" 37 #include "log.h" 38 #include "key.h" 39 #include "readconf.h" 40 #include "match.h" 41 #include "misc.h" 42 #include "buffer.h" 43 #include "kex.h" 44 #include "mac.h" 45 #include "uidswap.h" 46 #include "version.h" 47 48 /* Format of the configuration file: 49 50 # Configuration data is parsed as follows: 51 # 1. command line options 52 # 2. user-specific file 53 # 3. system-wide file 54 # Any configuration value is only changed the first time it is set. 55 # Thus, host-specific definitions should be at the beginning of the 56 # configuration file, and defaults at the end. 57 58 # Host-specific declarations. These may override anything above. A single 59 # host may match multiple declarations; these are processed in the order 60 # that they are given in. 61 62 Host *.ngs.fi ngs.fi 63 User foo 64 65 Host fake.com 66 HostName another.host.name.real.org 67 User blaah 68 Port 34289 69 ForwardX11 no 70 ForwardAgent no 71 72 Host books.com 73 RemoteForward 9999 shadows.cs.hut.fi:9999 74 Cipher 3des 75 76 Host fascist.blob.com 77 Port 23123 78 User tylonen 79 PasswordAuthentication no 80 81 Host puukko.hut.fi 82 User t35124p 83 ProxyCommand ssh-proxy %h %p 84 85 Host *.fr 86 PublicKeyAuthentication no 87 88 Host *.su 89 Cipher none 90 PasswordAuthentication no 91 92 Host vpn.fake.com 93 Tunnel yes 94 TunnelDevice 3 95 96 # Defaults for various options 97 Host * 98 ForwardAgent no 99 ForwardX11 no 100 PasswordAuthentication yes 101 RSAAuthentication yes 102 RhostsRSAAuthentication yes 103 StrictHostKeyChecking yes 104 TcpKeepAlive no 105 IdentityFile ~/.ssh/identity 106 Port 22 107 EscapeChar ~ 108 109 */ 110 111 /* Keyword tokens. */ 112 113 typedef enum { 114 oBadOption, 115 oForwardAgent, oForwardX11, oForwardX11Trusted, oForwardX11Timeout, 116 oGatewayPorts, oExitOnForwardFailure, 117 oPasswordAuthentication, oRSAAuthentication, 118 oChallengeResponseAuthentication, oXAuthLocation, 119 oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward, 120 oUser, oHost, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand, 121 oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts, 122 oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression, 123 oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts, 124 oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs, 125 oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication, 126 oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias, 127 oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication, 128 oHostKeyAlgorithms, oBindAddress, oPKCS11Provider, 129 oClearAllForwardings, oNoHostAuthenticationForLocalhost, 130 oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout, 131 oAddressFamily, oGssAuthentication, oGssDelegateCreds, 132 oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly, 133 oVersionAddendum, 134 oSendEnv, oControlPath, oControlMaster, oControlPersist, 135 oHashKnownHosts, 136 oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand, 137 oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication, 138 oNoneEnabled, oTcpRcvBufPoll, oTcpRcvBuf, oNoneSwitch, oHPNDisabled, 139 oHPNBufferSize, oDeprecated, oUnsupported 140 } OpCodes; 141 142 /* Textual representations of the tokens. */ 143 144 static struct { 145 const char *name; 146 OpCodes opcode; 147 } keywords[] = { 148 { "forwardagent", oForwardAgent }, 149 { "forwardx11", oForwardX11 }, 150 { "forwardx11trusted", oForwardX11Trusted }, 151 { "forwardx11timeout", oForwardX11Timeout }, 152 { "exitonforwardfailure", oExitOnForwardFailure }, 153 { "xauthlocation", oXAuthLocation }, 154 { "gatewayports", oGatewayPorts }, 155 { "useprivilegedport", oUsePrivilegedPort }, 156 { "rhostsauthentication", oDeprecated }, 157 { "passwordauthentication", oPasswordAuthentication }, 158 { "kbdinteractiveauthentication", oKbdInteractiveAuthentication }, 159 { "kbdinteractivedevices", oKbdInteractiveDevices }, 160 { "rsaauthentication", oRSAAuthentication }, 161 { "pubkeyauthentication", oPubkeyAuthentication }, 162 { "dsaauthentication", oPubkeyAuthentication }, /* alias */ 163 { "rhostsrsaauthentication", oRhostsRSAAuthentication }, 164 { "hostbasedauthentication", oHostbasedAuthentication }, 165 { "challengeresponseauthentication", oChallengeResponseAuthentication }, 166 { "skeyauthentication", oChallengeResponseAuthentication }, /* alias */ 167 { "tisauthentication", oChallengeResponseAuthentication }, /* alias */ 168 { "kerberosauthentication", oUnsupported }, 169 { "kerberostgtpassing", oUnsupported }, 170 { "afstokenpassing", oUnsupported }, 171 #if defined(GSSAPI) 172 { "gssapiauthentication", oGssAuthentication }, 173 { "gssapidelegatecredentials", oGssDelegateCreds }, 174 #else 175 { "gssapiauthentication", oUnsupported }, 176 { "gssapidelegatecredentials", oUnsupported }, 177 #endif 178 { "fallbacktorsh", oDeprecated }, 179 { "usersh", oDeprecated }, 180 { "identityfile", oIdentityFile }, 181 { "identityfile2", oIdentityFile }, /* obsolete */ 182 { "identitiesonly", oIdentitiesOnly }, 183 { "hostname", oHostName }, 184 { "hostkeyalias", oHostKeyAlias }, 185 { "proxycommand", oProxyCommand }, 186 { "port", oPort }, 187 { "cipher", oCipher }, 188 { "ciphers", oCiphers }, 189 { "macs", oMacs }, 190 { "protocol", oProtocol }, 191 { "remoteforward", oRemoteForward }, 192 { "localforward", oLocalForward }, 193 { "user", oUser }, 194 { "host", oHost }, 195 { "escapechar", oEscapeChar }, 196 { "globalknownhostsfile", oGlobalKnownHostsFile }, 197 { "globalknownhostsfile2", oGlobalKnownHostsFile2 }, /* obsolete */ 198 { "userknownhostsfile", oUserKnownHostsFile }, 199 { "userknownhostsfile2", oUserKnownHostsFile2 }, /* obsolete */ 200 { "connectionattempts", oConnectionAttempts }, 201 { "batchmode", oBatchMode }, 202 { "checkhostip", oCheckHostIP }, 203 { "stricthostkeychecking", oStrictHostKeyChecking }, 204 { "compression", oCompression }, 205 { "compressionlevel", oCompressionLevel }, 206 { "tcpkeepalive", oTCPKeepAlive }, 207 { "keepalive", oTCPKeepAlive }, /* obsolete */ 208 { "numberofpasswordprompts", oNumberOfPasswordPrompts }, 209 { "loglevel", oLogLevel }, 210 { "dynamicforward", oDynamicForward }, 211 { "preferredauthentications", oPreferredAuthentications }, 212 { "hostkeyalgorithms", oHostKeyAlgorithms }, 213 { "bindaddress", oBindAddress }, 214 #ifdef ENABLE_PKCS11 215 { "smartcarddevice", oPKCS11Provider }, 216 { "pkcs11provider", oPKCS11Provider }, 217 #else 218 { "smartcarddevice", oUnsupported }, 219 { "pkcs11provider", oUnsupported }, 220 #endif 221 { "clearallforwardings", oClearAllForwardings }, 222 { "enablesshkeysign", oEnableSSHKeysign }, 223 { "verifyhostkeydns", oVerifyHostKeyDNS }, 224 { "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost }, 225 { "rekeylimit", oRekeyLimit }, 226 { "connecttimeout", oConnectTimeout }, 227 { "addressfamily", oAddressFamily }, 228 { "serveraliveinterval", oServerAliveInterval }, 229 { "serveralivecountmax", oServerAliveCountMax }, 230 { "versionaddendum", oVersionAddendum }, 231 { "sendenv", oSendEnv }, 232 { "controlpath", oControlPath }, 233 { "controlmaster", oControlMaster }, 234 { "controlpersist", oControlPersist }, 235 { "hashknownhosts", oHashKnownHosts }, 236 { "tunnel", oTunnel }, 237 { "tunneldevice", oTunnelDevice }, 238 { "localcommand", oLocalCommand }, 239 { "permitlocalcommand", oPermitLocalCommand }, 240 { "visualhostkey", oVisualHostKey }, 241 { "useroaming", oUseRoaming }, 242 #ifdef JPAKE 243 { "zeroknowledgepasswordauthentication", 244 oZeroKnowledgePasswordAuthentication }, 245 #else 246 { "zeroknowledgepasswordauthentication", oUnsupported }, 247 #endif 248 { "noneenabled", oNoneEnabled }, 249 { "tcprcvbufpoll", oTcpRcvBufPoll }, 250 { "tcprcvbuf", oTcpRcvBuf }, 251 { "noneswitch", oNoneSwitch }, 252 { "hpndisabled", oHPNDisabled }, 253 { "hpnbuffersize", oHPNBufferSize }, 254 255 { NULL, oBadOption } 256 }; 257 258 /* 259 * Adds a local TCP/IP port forward to options. Never returns if there is an 260 * error. 261 */ 262 263 void 264 add_local_forward(Options *options, const Forward *newfwd) 265 { 266 Forward *fwd; 267 #ifndef NO_IPPORT_RESERVED_CONCEPT 268 extern uid_t original_real_uid; 269 if (newfwd->listen_port < IPPORT_RESERVED && original_real_uid != 0) 270 fatal("Privileged ports can only be forwarded by root."); 271 #endif 272 options->local_forwards = xrealloc(options->local_forwards, 273 options->num_local_forwards + 1, 274 sizeof(*options->local_forwards)); 275 fwd = &options->local_forwards[options->num_local_forwards++]; 276 277 fwd->listen_host = newfwd->listen_host; 278 fwd->listen_port = newfwd->listen_port; 279 fwd->connect_host = newfwd->connect_host; 280 fwd->connect_port = newfwd->connect_port; 281 } 282 283 /* 284 * Adds a remote TCP/IP port forward to options. Never returns if there is 285 * an error. 286 */ 287 288 void 289 add_remote_forward(Options *options, const Forward *newfwd) 290 { 291 Forward *fwd; 292 293 options->remote_forwards = xrealloc(options->remote_forwards, 294 options->num_remote_forwards + 1, 295 sizeof(*options->remote_forwards)); 296 fwd = &options->remote_forwards[options->num_remote_forwards++]; 297 298 fwd->listen_host = newfwd->listen_host; 299 fwd->listen_port = newfwd->listen_port; 300 fwd->connect_host = newfwd->connect_host; 301 fwd->connect_port = newfwd->connect_port; 302 fwd->allocated_port = 0; 303 } 304 305 static void 306 clear_forwardings(Options *options) 307 { 308 int i; 309 310 for (i = 0; i < options->num_local_forwards; i++) { 311 if (options->local_forwards[i].listen_host != NULL) 312 xfree(options->local_forwards[i].listen_host); 313 xfree(options->local_forwards[i].connect_host); 314 } 315 if (options->num_local_forwards > 0) { 316 xfree(options->local_forwards); 317 options->local_forwards = NULL; 318 } 319 options->num_local_forwards = 0; 320 for (i = 0; i < options->num_remote_forwards; i++) { 321 if (options->remote_forwards[i].listen_host != NULL) 322 xfree(options->remote_forwards[i].listen_host); 323 xfree(options->remote_forwards[i].connect_host); 324 } 325 if (options->num_remote_forwards > 0) { 326 xfree(options->remote_forwards); 327 options->remote_forwards = NULL; 328 } 329 options->num_remote_forwards = 0; 330 options->tun_open = SSH_TUNMODE_NO; 331 } 332 333 /* 334 * Returns the number of the token pointed to by cp or oBadOption. 335 */ 336 337 static OpCodes 338 parse_token(const char *cp, const char *filename, int linenum) 339 { 340 u_int i; 341 342 for (i = 0; keywords[i].name; i++) 343 if (strcasecmp(cp, keywords[i].name) == 0) 344 return keywords[i].opcode; 345 346 error("%s: line %d: Bad configuration option: %s", 347 filename, linenum, cp); 348 return oBadOption; 349 } 350 351 /* 352 * Processes a single option line as used in the configuration files. This 353 * only sets those values that have not already been set. 354 */ 355 #define WHITESPACE " \t\r\n" 356 357 int 358 process_config_line(Options *options, const char *host, 359 char *line, const char *filename, int linenum, 360 int *activep) 361 { 362 char *s, **charptr, *endofnumber, *keyword, *arg, *arg2, fwdarg[256]; 363 int opcode, *intptr, value, value2, scale; 364 LogLevel *log_level_ptr; 365 long long orig, val64; 366 size_t len; 367 Forward fwd; 368 369 /* Strip trailing whitespace */ 370 for (len = strlen(line) - 1; len > 0; len--) { 371 if (strchr(WHITESPACE, line[len]) == NULL) 372 break; 373 line[len] = '\0'; 374 } 375 376 s = line; 377 /* Get the keyword. (Each line is supposed to begin with a keyword). */ 378 if ((keyword = strdelim(&s)) == NULL) 379 return 0; 380 /* Ignore leading whitespace. */ 381 if (*keyword == '\0') 382 keyword = strdelim(&s); 383 if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#') 384 return 0; 385 386 opcode = parse_token(keyword, filename, linenum); 387 388 switch (opcode) { 389 case oBadOption: 390 /* don't panic, but count bad options */ 391 return -1; 392 /* NOTREACHED */ 393 case oConnectTimeout: 394 intptr = &options->connection_timeout; 395 parse_time: 396 arg = strdelim(&s); 397 if (!arg || *arg == '\0') 398 fatal("%s line %d: missing time value.", 399 filename, linenum); 400 if ((value = convtime(arg)) == -1) 401 fatal("%s line %d: invalid time value.", 402 filename, linenum); 403 if (*activep && *intptr == -1) 404 *intptr = value; 405 break; 406 407 case oForwardAgent: 408 intptr = &options->forward_agent; 409 parse_flag: 410 arg = strdelim(&s); 411 if (!arg || *arg == '\0') 412 fatal("%.200s line %d: Missing yes/no argument.", filename, linenum); 413 value = 0; /* To avoid compiler warning... */ 414 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0) 415 value = 1; 416 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0) 417 value = 0; 418 else 419 fatal("%.200s line %d: Bad yes/no argument.", filename, linenum); 420 if (*activep && *intptr == -1) 421 *intptr = value; 422 break; 423 424 case oForwardX11: 425 intptr = &options->forward_x11; 426 goto parse_flag; 427 428 case oForwardX11Trusted: 429 intptr = &options->forward_x11_trusted; 430 goto parse_flag; 431 432 case oForwardX11Timeout: 433 intptr = &options->forward_x11_timeout; 434 goto parse_time; 435 436 case oGatewayPorts: 437 intptr = &options->gateway_ports; 438 goto parse_flag; 439 440 case oExitOnForwardFailure: 441 intptr = &options->exit_on_forward_failure; 442 goto parse_flag; 443 444 case oUsePrivilegedPort: 445 intptr = &options->use_privileged_port; 446 goto parse_flag; 447 448 case oPasswordAuthentication: 449 intptr = &options->password_authentication; 450 goto parse_flag; 451 452 case oZeroKnowledgePasswordAuthentication: 453 intptr = &options->zero_knowledge_password_authentication; 454 goto parse_flag; 455 456 case oKbdInteractiveAuthentication: 457 intptr = &options->kbd_interactive_authentication; 458 goto parse_flag; 459 460 case oKbdInteractiveDevices: 461 charptr = &options->kbd_interactive_devices; 462 goto parse_string; 463 464 case oPubkeyAuthentication: 465 intptr = &options->pubkey_authentication; 466 goto parse_flag; 467 468 case oRSAAuthentication: 469 intptr = &options->rsa_authentication; 470 goto parse_flag; 471 472 case oRhostsRSAAuthentication: 473 intptr = &options->rhosts_rsa_authentication; 474 goto parse_flag; 475 476 case oHostbasedAuthentication: 477 intptr = &options->hostbased_authentication; 478 goto parse_flag; 479 480 case oChallengeResponseAuthentication: 481 intptr = &options->challenge_response_authentication; 482 goto parse_flag; 483 484 case oGssAuthentication: 485 intptr = &options->gss_authentication; 486 goto parse_flag; 487 488 case oGssDelegateCreds: 489 intptr = &options->gss_deleg_creds; 490 goto parse_flag; 491 492 case oBatchMode: 493 intptr = &options->batch_mode; 494 goto parse_flag; 495 496 case oCheckHostIP: 497 intptr = &options->check_host_ip; 498 goto parse_flag; 499 500 case oNoneEnabled: 501 intptr = &options->none_enabled; 502 goto parse_flag; 503 504 /* we check to see if the command comes from the */ 505 /* command line or not. If it does then enable it */ 506 /* otherwise fail. NONE should never be a default configuration */ 507 case oNoneSwitch: 508 if(strcmp(filename,"command-line")==0) 509 { 510 intptr = &options->none_switch; 511 goto parse_flag; 512 } else { 513 error("NoneSwitch is found in %.200s.\nYou may only use this configuration option from the command line", filename); 514 error("Continuing..."); 515 debug("NoneSwitch directive found in %.200s.", filename); 516 return 0; 517 } 518 519 case oHPNDisabled: 520 intptr = &options->hpn_disabled; 521 goto parse_flag; 522 523 case oHPNBufferSize: 524 intptr = &options->hpn_buffer_size; 525 goto parse_int; 526 527 case oTcpRcvBufPoll: 528 intptr = &options->tcp_rcv_buf_poll; 529 goto parse_flag; 530 531 case oVerifyHostKeyDNS: 532 intptr = &options->verify_host_key_dns; 533 goto parse_yesnoask; 534 535 case oStrictHostKeyChecking: 536 intptr = &options->strict_host_key_checking; 537 parse_yesnoask: 538 arg = strdelim(&s); 539 if (!arg || *arg == '\0') 540 fatal("%.200s line %d: Missing yes/no/ask argument.", 541 filename, linenum); 542 value = 0; /* To avoid compiler warning... */ 543 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0) 544 value = 1; 545 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0) 546 value = 0; 547 else if (strcmp(arg, "ask") == 0) 548 value = 2; 549 else 550 fatal("%.200s line %d: Bad yes/no/ask argument.", filename, linenum); 551 if (*activep && *intptr == -1) 552 *intptr = value; 553 break; 554 555 case oCompression: 556 intptr = &options->compression; 557 goto parse_flag; 558 559 case oTCPKeepAlive: 560 intptr = &options->tcp_keep_alive; 561 goto parse_flag; 562 563 case oNoHostAuthenticationForLocalhost: 564 intptr = &options->no_host_authentication_for_localhost; 565 goto parse_flag; 566 567 case oNumberOfPasswordPrompts: 568 intptr = &options->number_of_password_prompts; 569 goto parse_int; 570 571 case oCompressionLevel: 572 intptr = &options->compression_level; 573 goto parse_int; 574 575 case oRekeyLimit: 576 arg = strdelim(&s); 577 if (!arg || *arg == '\0') 578 fatal("%.200s line %d: Missing argument.", filename, linenum); 579 if (arg[0] < '0' || arg[0] > '9') 580 fatal("%.200s line %d: Bad number.", filename, linenum); 581 orig = val64 = strtoll(arg, &endofnumber, 10); 582 if (arg == endofnumber) 583 fatal("%.200s line %d: Bad number.", filename, linenum); 584 switch (toupper(*endofnumber)) { 585 case '\0': 586 scale = 1; 587 break; 588 case 'K': 589 scale = 1<<10; 590 break; 591 case 'M': 592 scale = 1<<20; 593 break; 594 case 'G': 595 scale = 1<<30; 596 break; 597 default: 598 fatal("%.200s line %d: Invalid RekeyLimit suffix", 599 filename, linenum); 600 } 601 val64 *= scale; 602 /* detect integer wrap and too-large limits */ 603 if ((val64 / scale) != orig || val64 > UINT_MAX) 604 fatal("%.200s line %d: RekeyLimit too large", 605 filename, linenum); 606 if (val64 < 16) 607 fatal("%.200s line %d: RekeyLimit too small", 608 filename, linenum); 609 if (*activep && options->rekey_limit == -1) 610 options->rekey_limit = (u_int32_t)val64; 611 break; 612 613 case oIdentityFile: 614 arg = strdelim(&s); 615 if (!arg || *arg == '\0') 616 fatal("%.200s line %d: Missing argument.", filename, linenum); 617 if (*activep) { 618 intptr = &options->num_identity_files; 619 if (*intptr >= SSH_MAX_IDENTITY_FILES) 620 fatal("%.200s line %d: Too many identity files specified (max %d).", 621 filename, linenum, SSH_MAX_IDENTITY_FILES); 622 charptr = &options->identity_files[*intptr]; 623 *charptr = xstrdup(arg); 624 *intptr = *intptr + 1; 625 } 626 break; 627 628 case oXAuthLocation: 629 charptr=&options->xauth_location; 630 goto parse_string; 631 632 case oUser: 633 charptr = &options->user; 634 parse_string: 635 arg = strdelim(&s); 636 if (!arg || *arg == '\0') 637 fatal("%.200s line %d: Missing argument.", filename, linenum); 638 if (*activep && *charptr == NULL) 639 *charptr = xstrdup(arg); 640 break; 641 642 case oGlobalKnownHostsFile: 643 charptr = &options->system_hostfile; 644 goto parse_string; 645 646 case oUserKnownHostsFile: 647 charptr = &options->user_hostfile; 648 goto parse_string; 649 650 case oGlobalKnownHostsFile2: 651 charptr = &options->system_hostfile2; 652 goto parse_string; 653 654 case oUserKnownHostsFile2: 655 charptr = &options->user_hostfile2; 656 goto parse_string; 657 658 case oHostName: 659 charptr = &options->hostname; 660 goto parse_string; 661 662 case oHostKeyAlias: 663 charptr = &options->host_key_alias; 664 goto parse_string; 665 666 case oPreferredAuthentications: 667 charptr = &options->preferred_authentications; 668 goto parse_string; 669 670 case oBindAddress: 671 charptr = &options->bind_address; 672 goto parse_string; 673 674 case oPKCS11Provider: 675 charptr = &options->pkcs11_provider; 676 goto parse_string; 677 678 case oProxyCommand: 679 charptr = &options->proxy_command; 680 parse_command: 681 if (s == NULL) 682 fatal("%.200s line %d: Missing argument.", filename, linenum); 683 len = strspn(s, WHITESPACE "="); 684 if (*activep && *charptr == NULL) 685 *charptr = xstrdup(s + len); 686 return 0; 687 688 case oPort: 689 intptr = &options->port; 690 parse_int: 691 arg = strdelim(&s); 692 if (!arg || *arg == '\0') 693 fatal("%.200s line %d: Missing argument.", filename, linenum); 694 if (arg[0] < '0' || arg[0] > '9') 695 fatal("%.200s line %d: Bad number.", filename, linenum); 696 697 /* Octal, decimal, or hex format? */ 698 value = strtol(arg, &endofnumber, 0); 699 if (arg == endofnumber) 700 fatal("%.200s line %d: Bad number.", filename, linenum); 701 if (*activep && *intptr == -1) 702 *intptr = value; 703 break; 704 705 case oConnectionAttempts: 706 intptr = &options->connection_attempts; 707 goto parse_int; 708 709 case oTcpRcvBuf: 710 intptr = &options->tcp_rcv_buf; 711 goto parse_int; 712 713 case oCipher: 714 intptr = &options->cipher; 715 arg = strdelim(&s); 716 if (!arg || *arg == '\0') 717 fatal("%.200s line %d: Missing argument.", filename, linenum); 718 value = cipher_number(arg); 719 if (value == -1) 720 fatal("%.200s line %d: Bad cipher '%s'.", 721 filename, linenum, arg ? arg : "<NONE>"); 722 if (*activep && *intptr == -1) 723 *intptr = value; 724 break; 725 726 case oCiphers: 727 arg = strdelim(&s); 728 if (!arg || *arg == '\0') 729 fatal("%.200s line %d: Missing argument.", filename, linenum); 730 if (!ciphers_valid(arg)) 731 fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.", 732 filename, linenum, arg ? arg : "<NONE>"); 733 if (*activep && options->ciphers == NULL) 734 options->ciphers = xstrdup(arg); 735 break; 736 737 case oMacs: 738 arg = strdelim(&s); 739 if (!arg || *arg == '\0') 740 fatal("%.200s line %d: Missing argument.", filename, linenum); 741 if (!mac_valid(arg)) 742 fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.", 743 filename, linenum, arg ? arg : "<NONE>"); 744 if (*activep && options->macs == NULL) 745 options->macs = xstrdup(arg); 746 break; 747 748 case oHostKeyAlgorithms: 749 arg = strdelim(&s); 750 if (!arg || *arg == '\0') 751 fatal("%.200s line %d: Missing argument.", filename, linenum); 752 if (!key_names_valid2(arg)) 753 fatal("%.200s line %d: Bad protocol 2 host key algorithms '%s'.", 754 filename, linenum, arg ? arg : "<NONE>"); 755 if (*activep && options->hostkeyalgorithms == NULL) 756 options->hostkeyalgorithms = xstrdup(arg); 757 break; 758 759 case oProtocol: 760 intptr = &options->protocol; 761 arg = strdelim(&s); 762 if (!arg || *arg == '\0') 763 fatal("%.200s line %d: Missing argument.", filename, linenum); 764 value = proto_spec(arg); 765 if (value == SSH_PROTO_UNKNOWN) 766 fatal("%.200s line %d: Bad protocol spec '%s'.", 767 filename, linenum, arg ? arg : "<NONE>"); 768 if (*activep && *intptr == SSH_PROTO_UNKNOWN) 769 *intptr = value; 770 break; 771 772 case oLogLevel: 773 log_level_ptr = &options->log_level; 774 arg = strdelim(&s); 775 value = log_level_number(arg); 776 if (value == SYSLOG_LEVEL_NOT_SET) 777 fatal("%.200s line %d: unsupported log level '%s'", 778 filename, linenum, arg ? arg : "<NONE>"); 779 if (*activep && *log_level_ptr == SYSLOG_LEVEL_NOT_SET) 780 *log_level_ptr = (LogLevel) value; 781 break; 782 783 case oLocalForward: 784 case oRemoteForward: 785 case oDynamicForward: 786 arg = strdelim(&s); 787 if (arg == NULL || *arg == '\0') 788 fatal("%.200s line %d: Missing port argument.", 789 filename, linenum); 790 791 if (opcode == oLocalForward || 792 opcode == oRemoteForward) { 793 arg2 = strdelim(&s); 794 if (arg2 == NULL || *arg2 == '\0') 795 fatal("%.200s line %d: Missing target argument.", 796 filename, linenum); 797 798 /* construct a string for parse_forward */ 799 snprintf(fwdarg, sizeof(fwdarg), "%s:%s", arg, arg2); 800 } else if (opcode == oDynamicForward) { 801 strlcpy(fwdarg, arg, sizeof(fwdarg)); 802 } 803 804 if (parse_forward(&fwd, fwdarg, 805 opcode == oDynamicForward ? 1 : 0, 806 opcode == oRemoteForward ? 1 : 0) == 0) 807 fatal("%.200s line %d: Bad forwarding specification.", 808 filename, linenum); 809 810 if (*activep) { 811 if (opcode == oLocalForward || 812 opcode == oDynamicForward) 813 add_local_forward(options, &fwd); 814 else if (opcode == oRemoteForward) 815 add_remote_forward(options, &fwd); 816 } 817 break; 818 819 case oClearAllForwardings: 820 intptr = &options->clear_forwardings; 821 goto parse_flag; 822 823 case oHost: 824 *activep = 0; 825 while ((arg = strdelim(&s)) != NULL && *arg != '\0') 826 if (match_pattern(host, arg)) { 827 debug("Applying options for %.100s", arg); 828 *activep = 1; 829 break; 830 } 831 /* Avoid garbage check below, as strdelim is done. */ 832 return 0; 833 834 case oEscapeChar: 835 intptr = &options->escape_char; 836 arg = strdelim(&s); 837 if (!arg || *arg == '\0') 838 fatal("%.200s line %d: Missing argument.", filename, linenum); 839 if (arg[0] == '^' && arg[2] == 0 && 840 (u_char) arg[1] >= 64 && (u_char) arg[1] < 128) 841 value = (u_char) arg[1] & 31; 842 else if (strlen(arg) == 1) 843 value = (u_char) arg[0]; 844 else if (strcmp(arg, "none") == 0) 845 value = SSH_ESCAPECHAR_NONE; 846 else { 847 fatal("%.200s line %d: Bad escape character.", 848 filename, linenum); 849 /* NOTREACHED */ 850 value = 0; /* Avoid compiler warning. */ 851 } 852 if (*activep && *intptr == -1) 853 *intptr = value; 854 break; 855 856 case oAddressFamily: 857 arg = strdelim(&s); 858 if (!arg || *arg == '\0') 859 fatal("%s line %d: missing address family.", 860 filename, linenum); 861 intptr = &options->address_family; 862 if (strcasecmp(arg, "inet") == 0) 863 value = AF_INET; 864 else if (strcasecmp(arg, "inet6") == 0) 865 value = AF_INET6; 866 else if (strcasecmp(arg, "any") == 0) 867 value = AF_UNSPEC; 868 else 869 fatal("Unsupported AddressFamily \"%s\"", arg); 870 if (*activep && *intptr == -1) 871 *intptr = value; 872 break; 873 874 case oEnableSSHKeysign: 875 intptr = &options->enable_ssh_keysign; 876 goto parse_flag; 877 878 case oIdentitiesOnly: 879 intptr = &options->identities_only; 880 goto parse_flag; 881 882 case oServerAliveInterval: 883 intptr = &options->server_alive_interval; 884 goto parse_time; 885 886 case oServerAliveCountMax: 887 intptr = &options->server_alive_count_max; 888 goto parse_int; 889 890 case oVersionAddendum: 891 ssh_version_set_addendum(strtok(s, "\n")); 892 do { 893 arg = strdelim(&s); 894 } while (arg != NULL && *arg != '\0'); 895 break; 896 897 case oSendEnv: 898 while ((arg = strdelim(&s)) != NULL && *arg != '\0') { 899 if (strchr(arg, '=') != NULL) 900 fatal("%s line %d: Invalid environment name.", 901 filename, linenum); 902 if (!*activep) 903 continue; 904 if (options->num_send_env >= MAX_SEND_ENV) 905 fatal("%s line %d: too many send env.", 906 filename, linenum); 907 options->send_env[options->num_send_env++] = 908 xstrdup(arg); 909 } 910 break; 911 912 case oControlPath: 913 charptr = &options->control_path; 914 goto parse_string; 915 916 case oControlMaster: 917 intptr = &options->control_master; 918 arg = strdelim(&s); 919 if (!arg || *arg == '\0') 920 fatal("%.200s line %d: Missing ControlMaster argument.", 921 filename, linenum); 922 value = 0; /* To avoid compiler warning... */ 923 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0) 924 value = SSHCTL_MASTER_YES; 925 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0) 926 value = SSHCTL_MASTER_NO; 927 else if (strcmp(arg, "auto") == 0) 928 value = SSHCTL_MASTER_AUTO; 929 else if (strcmp(arg, "ask") == 0) 930 value = SSHCTL_MASTER_ASK; 931 else if (strcmp(arg, "autoask") == 0) 932 value = SSHCTL_MASTER_AUTO_ASK; 933 else 934 fatal("%.200s line %d: Bad ControlMaster argument.", 935 filename, linenum); 936 if (*activep && *intptr == -1) 937 *intptr = value; 938 break; 939 940 case oControlPersist: 941 /* no/false/yes/true, or a time spec */ 942 intptr = &options->control_persist; 943 arg = strdelim(&s); 944 if (!arg || *arg == '\0') 945 fatal("%.200s line %d: Missing ControlPersist" 946 " argument.", filename, linenum); 947 value = 0; 948 value2 = 0; /* timeout */ 949 if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0) 950 value = 0; 951 else if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0) 952 value = 1; 953 else if ((value2 = convtime(arg)) >= 0) 954 value = 1; 955 else 956 fatal("%.200s line %d: Bad ControlPersist argument.", 957 filename, linenum); 958 if (*activep && *intptr == -1) { 959 *intptr = value; 960 options->control_persist_timeout = value2; 961 } 962 break; 963 964 case oHashKnownHosts: 965 intptr = &options->hash_known_hosts; 966 goto parse_flag; 967 968 case oTunnel: 969 intptr = &options->tun_open; 970 arg = strdelim(&s); 971 if (!arg || *arg == '\0') 972 fatal("%s line %d: Missing yes/point-to-point/" 973 "ethernet/no argument.", filename, linenum); 974 value = 0; /* silence compiler */ 975 if (strcasecmp(arg, "ethernet") == 0) 976 value = SSH_TUNMODE_ETHERNET; 977 else if (strcasecmp(arg, "point-to-point") == 0) 978 value = SSH_TUNMODE_POINTOPOINT; 979 else if (strcasecmp(arg, "yes") == 0) 980 value = SSH_TUNMODE_DEFAULT; 981 else if (strcasecmp(arg, "no") == 0) 982 value = SSH_TUNMODE_NO; 983 else 984 fatal("%s line %d: Bad yes/point-to-point/ethernet/" 985 "no argument: %s", filename, linenum, arg); 986 if (*activep) 987 *intptr = value; 988 break; 989 990 case oTunnelDevice: 991 arg = strdelim(&s); 992 if (!arg || *arg == '\0') 993 fatal("%.200s line %d: Missing argument.", filename, linenum); 994 value = a2tun(arg, &value2); 995 if (value == SSH_TUNID_ERR) 996 fatal("%.200s line %d: Bad tun device.", filename, linenum); 997 if (*activep) { 998 options->tun_local = value; 999 options->tun_remote = value2; 1000 } 1001 break; 1002 1003 case oLocalCommand: 1004 charptr = &options->local_command; 1005 goto parse_command; 1006 1007 case oPermitLocalCommand: 1008 intptr = &options->permit_local_command; 1009 goto parse_flag; 1010 1011 case oVisualHostKey: 1012 intptr = &options->visual_host_key; 1013 goto parse_flag; 1014 1015 case oUseRoaming: 1016 intptr = &options->use_roaming; 1017 goto parse_flag; 1018 1019 case oDeprecated: 1020 debug("%s line %d: Deprecated option \"%s\"", 1021 filename, linenum, keyword); 1022 return 0; 1023 1024 case oUnsupported: 1025 error("%s line %d: Unsupported option \"%s\"", 1026 filename, linenum, keyword); 1027 return 0; 1028 1029 default: 1030 fatal("process_config_line: Unimplemented opcode %d", opcode); 1031 } 1032 1033 /* Check that there is no garbage at end of line. */ 1034 if ((arg = strdelim(&s)) != NULL && *arg != '\0') { 1035 fatal("%.200s line %d: garbage at end of line; \"%.200s\".", 1036 filename, linenum, arg); 1037 } 1038 return 0; 1039 } 1040 1041 1042 /* 1043 * Reads the config file and modifies the options accordingly. Options 1044 * should already be initialized before this call. This never returns if 1045 * there is an error. If the file does not exist, this returns 0. 1046 */ 1047 1048 int 1049 read_config_file(const char *filename, const char *host, Options *options, 1050 int checkperm) 1051 { 1052 FILE *f; 1053 char line[1024]; 1054 int active, linenum; 1055 int bad_options = 0; 1056 1057 if ((f = fopen(filename, "r")) == NULL) 1058 return 0; 1059 1060 if (checkperm) { 1061 struct stat sb; 1062 1063 if (fstat(fileno(f), &sb) == -1) 1064 fatal("fstat %s: %s", filename, strerror(errno)); 1065 if (((sb.st_uid != 0 && sb.st_uid != getuid()) || 1066 (sb.st_mode & 022) != 0)) 1067 fatal("Bad owner or permissions on %s", filename); 1068 } 1069 1070 debug("Reading configuration data %.200s", filename); 1071 1072 /* 1073 * Mark that we are now processing the options. This flag is turned 1074 * on/off by Host specifications. 1075 */ 1076 active = 1; 1077 linenum = 0; 1078 while (fgets(line, sizeof(line), f)) { 1079 /* Update line number counter. */ 1080 linenum++; 1081 if (process_config_line(options, host, line, filename, linenum, &active) != 0) 1082 bad_options++; 1083 } 1084 fclose(f); 1085 if (bad_options > 0) 1086 fatal("%s: terminating, %d bad configuration options", 1087 filename, bad_options); 1088 return 1; 1089 } 1090 1091 /* 1092 * Initializes options to special values that indicate that they have not yet 1093 * been set. Read_config_file will only set options with this value. Options 1094 * are processed in the following order: command line, user config file, 1095 * system config file. Last, fill_default_options is called. 1096 */ 1097 1098 void 1099 initialize_options(Options * options) 1100 { 1101 memset(options, 'X', sizeof(*options)); 1102 options->forward_agent = -1; 1103 options->forward_x11 = -1; 1104 options->forward_x11_trusted = -1; 1105 options->forward_x11_timeout = -1; 1106 options->exit_on_forward_failure = -1; 1107 options->xauth_location = NULL; 1108 options->gateway_ports = -1; 1109 options->use_privileged_port = -1; 1110 options->rsa_authentication = -1; 1111 options->pubkey_authentication = -1; 1112 options->challenge_response_authentication = -1; 1113 options->gss_authentication = -1; 1114 options->gss_deleg_creds = -1; 1115 options->password_authentication = -1; 1116 options->kbd_interactive_authentication = -1; 1117 options->kbd_interactive_devices = NULL; 1118 options->rhosts_rsa_authentication = -1; 1119 options->hostbased_authentication = -1; 1120 options->batch_mode = -1; 1121 options->check_host_ip = -1; 1122 options->strict_host_key_checking = -1; 1123 options->compression = -1; 1124 options->tcp_keep_alive = -1; 1125 options->compression_level = -1; 1126 options->port = -1; 1127 options->address_family = -1; 1128 options->connection_attempts = -1; 1129 options->connection_timeout = -1; 1130 options->number_of_password_prompts = -1; 1131 options->cipher = -1; 1132 options->ciphers = NULL; 1133 options->macs = NULL; 1134 options->hostkeyalgorithms = NULL; 1135 options->protocol = SSH_PROTO_UNKNOWN; 1136 options->num_identity_files = 0; 1137 options->hostname = NULL; 1138 options->host_key_alias = NULL; 1139 options->proxy_command = NULL; 1140 options->user = NULL; 1141 options->escape_char = -1; 1142 options->system_hostfile = NULL; 1143 options->user_hostfile = NULL; 1144 options->system_hostfile2 = NULL; 1145 options->user_hostfile2 = NULL; 1146 options->local_forwards = NULL; 1147 options->num_local_forwards = 0; 1148 options->remote_forwards = NULL; 1149 options->num_remote_forwards = 0; 1150 options->clear_forwardings = -1; 1151 options->log_level = SYSLOG_LEVEL_NOT_SET; 1152 options->preferred_authentications = NULL; 1153 options->bind_address = NULL; 1154 options->pkcs11_provider = NULL; 1155 options->enable_ssh_keysign = - 1; 1156 options->no_host_authentication_for_localhost = - 1; 1157 options->identities_only = - 1; 1158 options->rekey_limit = - 1; 1159 options->verify_host_key_dns = -1; 1160 options->server_alive_interval = -1; 1161 options->server_alive_count_max = -1; 1162 options->num_send_env = 0; 1163 options->control_path = NULL; 1164 options->control_master = -1; 1165 options->control_persist = -1; 1166 options->control_persist_timeout = 0; 1167 options->hash_known_hosts = -1; 1168 options->tun_open = -1; 1169 options->tun_local = -1; 1170 options->tun_remote = -1; 1171 options->local_command = NULL; 1172 options->permit_local_command = -1; 1173 options->use_roaming = -1; 1174 options->visual_host_key = -1; 1175 options->zero_knowledge_password_authentication = -1; 1176 options->none_switch = -1; 1177 options->none_enabled = -1; 1178 options->hpn_disabled = -1; 1179 options->hpn_buffer_size = -1; 1180 options->tcp_rcv_buf_poll = -1; 1181 options->tcp_rcv_buf = -1; 1182 } 1183 1184 /* 1185 * Called after processing other sources of option data, this fills those 1186 * options for which no value has been specified with their default values. 1187 */ 1188 1189 void 1190 fill_default_options(Options * options) 1191 { 1192 int len; 1193 1194 if (options->forward_agent == -1) 1195 options->forward_agent = 0; 1196 if (options->forward_x11 == -1) 1197 options->forward_x11 = 0; 1198 if (options->forward_x11_trusted == -1) 1199 options->forward_x11_trusted = 0; 1200 if (options->forward_x11_timeout == -1) 1201 options->forward_x11_timeout = 1200; 1202 if (options->exit_on_forward_failure == -1) 1203 options->exit_on_forward_failure = 0; 1204 if (options->xauth_location == NULL) 1205 options->xauth_location = _PATH_XAUTH; 1206 if (options->gateway_ports == -1) 1207 options->gateway_ports = 0; 1208 if (options->use_privileged_port == -1) 1209 options->use_privileged_port = 0; 1210 if (options->rsa_authentication == -1) 1211 options->rsa_authentication = 1; 1212 if (options->pubkey_authentication == -1) 1213 options->pubkey_authentication = 1; 1214 if (options->challenge_response_authentication == -1) 1215 options->challenge_response_authentication = 1; 1216 if (options->gss_authentication == -1) 1217 options->gss_authentication = 0; 1218 if (options->gss_deleg_creds == -1) 1219 options->gss_deleg_creds = 0; 1220 if (options->password_authentication == -1) 1221 options->password_authentication = 1; 1222 if (options->kbd_interactive_authentication == -1) 1223 options->kbd_interactive_authentication = 1; 1224 if (options->rhosts_rsa_authentication == -1) 1225 options->rhosts_rsa_authentication = 0; 1226 if (options->hostbased_authentication == -1) 1227 options->hostbased_authentication = 0; 1228 if (options->batch_mode == -1) 1229 options->batch_mode = 0; 1230 if (options->check_host_ip == -1) 1231 options->check_host_ip = 0; 1232 if (options->strict_host_key_checking == -1) 1233 options->strict_host_key_checking = 2; /* 2 is default */ 1234 if (options->compression == -1) 1235 options->compression = 0; 1236 if (options->tcp_keep_alive == -1) 1237 options->tcp_keep_alive = 1; 1238 if (options->compression_level == -1) 1239 options->compression_level = 6; 1240 if (options->port == -1) 1241 options->port = 0; /* Filled in ssh_connect. */ 1242 if (options->address_family == -1) 1243 options->address_family = AF_UNSPEC; 1244 if (options->connection_attempts == -1) 1245 options->connection_attempts = 1; 1246 if (options->number_of_password_prompts == -1) 1247 options->number_of_password_prompts = 3; 1248 /* Selected in ssh_login(). */ 1249 if (options->cipher == -1) 1250 options->cipher = SSH_CIPHER_NOT_SET; 1251 /* options->ciphers, default set in myproposals.h */ 1252 /* options->macs, default set in myproposals.h */ 1253 /* options->hostkeyalgorithms, default set in myproposals.h */ 1254 if (options->protocol == SSH_PROTO_UNKNOWN) 1255 options->protocol = SSH_PROTO_2; 1256 if (options->num_identity_files == 0) { 1257 if (options->protocol & SSH_PROTO_1) { 1258 len = 2 + strlen(_PATH_SSH_CLIENT_IDENTITY) + 1; 1259 options->identity_files[options->num_identity_files] = 1260 xmalloc(len); 1261 snprintf(options->identity_files[options->num_identity_files++], 1262 len, "~/%.100s", _PATH_SSH_CLIENT_IDENTITY); 1263 } 1264 if (options->protocol & SSH_PROTO_2) { 1265 len = 2 + strlen(_PATH_SSH_CLIENT_ID_RSA) + 1; 1266 options->identity_files[options->num_identity_files] = 1267 xmalloc(len); 1268 snprintf(options->identity_files[options->num_identity_files++], 1269 len, "~/%.100s", _PATH_SSH_CLIENT_ID_RSA); 1270 1271 len = 2 + strlen(_PATH_SSH_CLIENT_ID_DSA) + 1; 1272 options->identity_files[options->num_identity_files] = 1273 xmalloc(len); 1274 snprintf(options->identity_files[options->num_identity_files++], 1275 len, "~/%.100s", _PATH_SSH_CLIENT_ID_DSA); 1276 } 1277 } 1278 if (options->escape_char == -1) 1279 options->escape_char = '~'; 1280 if (options->system_hostfile == NULL) 1281 options->system_hostfile = _PATH_SSH_SYSTEM_HOSTFILE; 1282 if (options->user_hostfile == NULL) 1283 options->user_hostfile = _PATH_SSH_USER_HOSTFILE; 1284 if (options->system_hostfile2 == NULL) 1285 options->system_hostfile2 = _PATH_SSH_SYSTEM_HOSTFILE2; 1286 if (options->user_hostfile2 == NULL) 1287 options->user_hostfile2 = _PATH_SSH_USER_HOSTFILE2; 1288 if (options->log_level == SYSLOG_LEVEL_NOT_SET) 1289 options->log_level = SYSLOG_LEVEL_INFO; 1290 if (options->clear_forwardings == 1) 1291 clear_forwardings(options); 1292 if (options->no_host_authentication_for_localhost == - 1) 1293 options->no_host_authentication_for_localhost = 0; 1294 if (options->identities_only == -1) 1295 options->identities_only = 0; 1296 if (options->enable_ssh_keysign == -1) 1297 options->enable_ssh_keysign = 0; 1298 if (options->rekey_limit == -1) 1299 options->rekey_limit = 0; 1300 if (options->verify_host_key_dns == -1) 1301 options->verify_host_key_dns = 0; 1302 if (options->server_alive_interval == -1) 1303 options->server_alive_interval = 0; 1304 if (options->server_alive_count_max == -1) 1305 options->server_alive_count_max = 3; 1306 if (options->none_switch == -1) 1307 options->none_switch = 0; 1308 if (options->hpn_disabled == -1) 1309 options->hpn_disabled = 0; 1310 if (options->hpn_buffer_size > -1) 1311 { 1312 /* if a user tries to set the size to 0 set it to 1KB */ 1313 if (options->hpn_buffer_size == 0) 1314 options->hpn_buffer_size = 1024; 1315 /*limit the buffer to 64MB*/ 1316 if (options->hpn_buffer_size > 65536) 1317 { 1318 options->hpn_buffer_size = 65536*1024; 1319 debug("User requested buffer larger than 64MB. Request reverted to 64MB"); 1320 } 1321 debug("hpn_buffer_size set to %d", options->hpn_buffer_size); 1322 } 1323 if (options->tcp_rcv_buf == 0) 1324 options->tcp_rcv_buf = 1; 1325 if (options->tcp_rcv_buf > -1) 1326 options->tcp_rcv_buf *=1024; 1327 if (options->tcp_rcv_buf_poll == -1) 1328 options->tcp_rcv_buf_poll = 1; 1329 if (options->control_master == -1) 1330 options->control_master = 0; 1331 if (options->control_persist == -1) { 1332 options->control_persist = 0; 1333 options->control_persist_timeout = 0; 1334 } 1335 if (options->hash_known_hosts == -1) 1336 options->hash_known_hosts = 0; 1337 if (options->tun_open == -1) 1338 options->tun_open = SSH_TUNMODE_NO; 1339 if (options->tun_local == -1) 1340 options->tun_local = SSH_TUNID_ANY; 1341 if (options->tun_remote == -1) 1342 options->tun_remote = SSH_TUNID_ANY; 1343 if (options->permit_local_command == -1) 1344 options->permit_local_command = 0; 1345 if (options->use_roaming == -1) 1346 options->use_roaming = 1; 1347 if (options->visual_host_key == -1) 1348 options->visual_host_key = 0; 1349 if (options->zero_knowledge_password_authentication == -1) 1350 options->zero_knowledge_password_authentication = 0; 1351 /* options->local_command should not be set by default */ 1352 /* options->proxy_command should not be set by default */ 1353 /* options->user will be set in the main program if appropriate */ 1354 /* options->hostname will be set in the main program if appropriate */ 1355 /* options->host_key_alias should not be set by default */ 1356 /* options->preferred_authentications will be set in ssh */ 1357 } 1358 1359 /* 1360 * parse_forward 1361 * parses a string containing a port forwarding specification of the form: 1362 * dynamicfwd == 0 1363 * [listenhost:]listenport:connecthost:connectport 1364 * dynamicfwd == 1 1365 * [listenhost:]listenport 1366 * returns number of arguments parsed or zero on error 1367 */ 1368 int 1369 parse_forward(Forward *fwd, const char *fwdspec, int dynamicfwd, int remotefwd) 1370 { 1371 int i; 1372 char *p, *cp, *fwdarg[4]; 1373 1374 memset(fwd, '\0', sizeof(*fwd)); 1375 1376 cp = p = xstrdup(fwdspec); 1377 1378 /* skip leading spaces */ 1379 while (isspace(*cp)) 1380 cp++; 1381 1382 for (i = 0; i < 4; ++i) 1383 if ((fwdarg[i] = hpdelim(&cp)) == NULL) 1384 break; 1385 1386 /* Check for trailing garbage */ 1387 if (cp != NULL) 1388 i = 0; /* failure */ 1389 1390 switch (i) { 1391 case 1: 1392 fwd->listen_host = NULL; 1393 fwd->listen_port = a2port(fwdarg[0]); 1394 fwd->connect_host = xstrdup("socks"); 1395 break; 1396 1397 case 2: 1398 fwd->listen_host = xstrdup(cleanhostname(fwdarg[0])); 1399 fwd->listen_port = a2port(fwdarg[1]); 1400 fwd->connect_host = xstrdup("socks"); 1401 break; 1402 1403 case 3: 1404 fwd->listen_host = NULL; 1405 fwd->listen_port = a2port(fwdarg[0]); 1406 fwd->connect_host = xstrdup(cleanhostname(fwdarg[1])); 1407 fwd->connect_port = a2port(fwdarg[2]); 1408 break; 1409 1410 case 4: 1411 fwd->listen_host = xstrdup(cleanhostname(fwdarg[0])); 1412 fwd->listen_port = a2port(fwdarg[1]); 1413 fwd->connect_host = xstrdup(cleanhostname(fwdarg[2])); 1414 fwd->connect_port = a2port(fwdarg[3]); 1415 break; 1416 default: 1417 i = 0; /* failure */ 1418 } 1419 1420 xfree(p); 1421 1422 if (dynamicfwd) { 1423 if (!(i == 1 || i == 2)) 1424 goto fail_free; 1425 } else { 1426 if (!(i == 3 || i == 4)) 1427 goto fail_free; 1428 if (fwd->connect_port <= 0) 1429 goto fail_free; 1430 } 1431 1432 if (fwd->listen_port < 0 || (!remotefwd && fwd->listen_port == 0)) 1433 goto fail_free; 1434 1435 if (fwd->connect_host != NULL && 1436 strlen(fwd->connect_host) >= NI_MAXHOST) 1437 goto fail_free; 1438 if (fwd->listen_host != NULL && 1439 strlen(fwd->listen_host) >= NI_MAXHOST) 1440 goto fail_free; 1441 1442 1443 return (i); 1444 1445 fail_free: 1446 if (fwd->connect_host != NULL) { 1447 xfree(fwd->connect_host); 1448 fwd->connect_host = NULL; 1449 } 1450 if (fwd->listen_host != NULL) { 1451 xfree(fwd->listen_host); 1452 fwd->listen_host = NULL; 1453 } 1454 return (0); 1455 } 1456