2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * Functions for reading the configuration files.
7 * As far as I am concerned, the code I have written for this software
8 * can be used freely for any purpose. Any derived versions of this
9 * software must be clearly marked as such, and if the derived work is
10 * incompatible with the protocol description in the RFC file, it must be
11 * called by a name other than "ssh" or "Secure Shell".
15 RCSID("$OpenBSD: readconf.c,v 1.139 2005/03/10 22:01:05 deraadt Exp $");
21 #include "pathnames.h"
29 /* Format of the configuration file:
31 # Configuration data is parsed as follows:
32 # 1. command line options
33 # 2. user-specific file
35 # Any configuration value is only changed the first time it is set.
36 # Thus, host-specific definitions should be at the beginning of the
37 # configuration file, and defaults at the end.
39 # Host-specific declarations. These may override anything above. A single
40 # host may match multiple declarations; these are processed in the order
41 # that they are given in.
47 HostName another.host.name.real.org
54 RemoteForward 9999 shadows.cs.hut.fi:9999
60 PasswordAuthentication no
64 ProxyCommand ssh-proxy %h %p
67 PublicKeyAuthentication no
71 PasswordAuthentication no
73 # Defaults for various options
77 PasswordAuthentication yes
79 RhostsRSAAuthentication yes
80 StrictHostKeyChecking yes
82 IdentityFile ~/.ssh/identity
92 oForwardAgent, oForwardX11, oForwardX11Trusted, oGatewayPorts,
93 oPasswordAuthentication, oRSAAuthentication,
94 oChallengeResponseAuthentication, oXAuthLocation,
95 oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
96 oUser, oHost, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
97 oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
98 oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
99 oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts,
100 oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,
101 oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
102 oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
103 oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
104 oHostKeyAlgorithms, oBindAddress, oSmartcardDevice,
105 oClearAllForwardings, oNoHostAuthenticationForLocalhost,
106 oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
107 oAddressFamily, oGssAuthentication, oGssDelegateCreds,
108 oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
109 oSendEnv, oControlPath, oControlMaster, oHashKnownHosts,
110 oDeprecated, oUnsupported
113 /* Textual representations of the tokens. */
119 { "forwardagent", oForwardAgent },
120 { "forwardx11", oForwardX11 },
121 { "forwardx11trusted", oForwardX11Trusted },
122 { "xauthlocation", oXAuthLocation },
123 { "gatewayports", oGatewayPorts },
124 { "useprivilegedport", oUsePrivilegedPort },
125 { "rhostsauthentication", oDeprecated },
126 { "passwordauthentication", oPasswordAuthentication },
127 { "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
128 { "kbdinteractivedevices", oKbdInteractiveDevices },
129 { "rsaauthentication", oRSAAuthentication },
130 { "pubkeyauthentication", oPubkeyAuthentication },
131 { "dsaauthentication", oPubkeyAuthentication }, /* alias */
132 { "rhostsrsaauthentication", oRhostsRSAAuthentication },
133 { "hostbasedauthentication", oHostbasedAuthentication },
134 { "challengeresponseauthentication", oChallengeResponseAuthentication },
135 { "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
136 { "tisauthentication", oChallengeResponseAuthentication }, /* alias */
137 { "kerberosauthentication", oUnsupported },
138 { "kerberostgtpassing", oUnsupported },
139 { "afstokenpassing", oUnsupported },
141 { "gssapiauthentication", oGssAuthentication },
142 { "gssapidelegatecredentials", oGssDelegateCreds },
144 { "gssapiauthentication", oUnsupported },
145 { "gssapidelegatecredentials", oUnsupported },
147 { "fallbacktorsh", oDeprecated },
148 { "usersh", oDeprecated },
149 { "identityfile", oIdentityFile },
150 { "identityfile2", oIdentityFile }, /* alias */
151 { "identitiesonly", oIdentitiesOnly },
152 { "hostname", oHostName },
153 { "hostkeyalias", oHostKeyAlias },
154 { "proxycommand", oProxyCommand },
156 { "cipher", oCipher },
157 { "ciphers", oCiphers },
159 { "protocol", oProtocol },
160 { "remoteforward", oRemoteForward },
161 { "localforward", oLocalForward },
164 { "escapechar", oEscapeChar },
165 { "globalknownhostsfile", oGlobalKnownHostsFile },
166 { "userknownhostsfile", oUserKnownHostsFile }, /* obsolete */
167 { "globalknownhostsfile2", oGlobalKnownHostsFile2 },
168 { "userknownhostsfile2", oUserKnownHostsFile2 }, /* obsolete */
169 { "connectionattempts", oConnectionAttempts },
170 { "batchmode", oBatchMode },
171 { "checkhostip", oCheckHostIP },
172 { "stricthostkeychecking", oStrictHostKeyChecking },
173 { "compression", oCompression },
174 { "compressionlevel", oCompressionLevel },
175 { "tcpkeepalive", oTCPKeepAlive },
176 { "keepalive", oTCPKeepAlive }, /* obsolete */
177 { "numberofpasswordprompts", oNumberOfPasswordPrompts },
178 { "loglevel", oLogLevel },
179 { "dynamicforward", oDynamicForward },
180 { "preferredauthentications", oPreferredAuthentications },
181 { "hostkeyalgorithms", oHostKeyAlgorithms },
182 { "bindaddress", oBindAddress },
184 { "smartcarddevice", oSmartcardDevice },
186 { "smartcarddevice", oUnsupported },
188 { "clearallforwardings", oClearAllForwardings },
189 { "enablesshkeysign", oEnableSSHKeysign },
190 { "verifyhostkeydns", oVerifyHostKeyDNS },
191 { "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost },
192 { "rekeylimit", oRekeyLimit },
193 { "connecttimeout", oConnectTimeout },
194 { "addressfamily", oAddressFamily },
195 { "serveraliveinterval", oServerAliveInterval },
196 { "serveralivecountmax", oServerAliveCountMax },
197 { "sendenv", oSendEnv },
198 { "controlpath", oControlPath },
199 { "controlmaster", oControlMaster },
200 { "hashknownhosts", oHashKnownHosts },
205 * Adds a local TCP/IP port forward to options. Never returns if there is an
210 add_local_forward(Options *options, const Forward *newfwd)
213 #ifndef NO_IPPORT_RESERVED_CONCEPT
214 extern uid_t original_real_uid;
215 if (newfwd->listen_port < IPPORT_RESERVED && original_real_uid != 0)
216 fatal("Privileged ports can only be forwarded by root.");
218 if (options->num_local_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
219 fatal("Too many local forwards (max %d).", SSH_MAX_FORWARDS_PER_DIRECTION);
220 fwd = &options->local_forwards[options->num_local_forwards++];
222 fwd->listen_host = (newfwd->listen_host == NULL) ?
223 NULL : xstrdup(newfwd->listen_host);
224 fwd->listen_port = newfwd->listen_port;
225 fwd->connect_host = xstrdup(newfwd->connect_host);
226 fwd->connect_port = newfwd->connect_port;
230 * Adds a remote TCP/IP port forward to options. Never returns if there is
235 add_remote_forward(Options *options, const Forward *newfwd)
238 if (options->num_remote_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
239 fatal("Too many remote forwards (max %d).",
240 SSH_MAX_FORWARDS_PER_DIRECTION);
241 fwd = &options->remote_forwards[options->num_remote_forwards++];
243 fwd->listen_host = (newfwd->listen_host == NULL) ?
244 NULL : xstrdup(newfwd->listen_host);
245 fwd->listen_port = newfwd->listen_port;
246 fwd->connect_host = xstrdup(newfwd->connect_host);
247 fwd->connect_port = newfwd->connect_port;
251 clear_forwardings(Options *options)
255 for (i = 0; i < options->num_local_forwards; i++) {
256 if (options->local_forwards[i].listen_host != NULL)
257 xfree(options->local_forwards[i].listen_host);
258 xfree(options->local_forwards[i].connect_host);
260 options->num_local_forwards = 0;
261 for (i = 0; i < options->num_remote_forwards; i++) {
262 if (options->remote_forwards[i].listen_host != NULL)
263 xfree(options->remote_forwards[i].listen_host);
264 xfree(options->remote_forwards[i].connect_host);
266 options->num_remote_forwards = 0;
270 * Returns the number of the token pointed to by cp or oBadOption.
274 parse_token(const char *cp, const char *filename, int linenum)
278 for (i = 0; keywords[i].name; i++)
279 if (strcasecmp(cp, keywords[i].name) == 0)
280 return keywords[i].opcode;
282 error("%s: line %d: Bad configuration option: %s",
283 filename, linenum, cp);
288 * Processes a single option line as used in the configuration files. This
289 * only sets those values that have not already been set.
291 #define WHITESPACE " \t\r\n"
294 process_config_line(Options *options, const char *host,
295 char *line, const char *filename, int linenum,
298 char *s, **charptr, *endofnumber, *keyword, *arg, *arg2, fwdarg[256];
299 int opcode, *intptr, value;
303 /* Strip trailing whitespace */
304 for (len = strlen(line) - 1; len > 0; len--) {
305 if (strchr(WHITESPACE, line[len]) == NULL)
311 /* Get the keyword. (Each line is supposed to begin with a keyword). */
312 keyword = strdelim(&s);
313 /* Ignore leading whitespace. */
314 if (*keyword == '\0')
315 keyword = strdelim(&s);
316 if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
319 opcode = parse_token(keyword, filename, linenum);
323 /* don't panic, but count bad options */
326 case oConnectTimeout:
327 intptr = &options->connection_timeout;
330 if (!arg || *arg == '\0')
331 fatal("%s line %d: missing time value.",
333 if ((value = convtime(arg)) == -1)
334 fatal("%s line %d: invalid time value.",
341 intptr = &options->forward_agent;
344 if (!arg || *arg == '\0')
345 fatal("%.200s line %d: Missing yes/no argument.", filename, linenum);
346 value = 0; /* To avoid compiler warning... */
347 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
349 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
352 fatal("%.200s line %d: Bad yes/no argument.", filename, linenum);
353 if (*activep && *intptr == -1)
358 intptr = &options->forward_x11;
361 case oForwardX11Trusted:
362 intptr = &options->forward_x11_trusted;
366 intptr = &options->gateway_ports;
369 case oUsePrivilegedPort:
370 intptr = &options->use_privileged_port;
373 case oPasswordAuthentication:
374 intptr = &options->password_authentication;
377 case oKbdInteractiveAuthentication:
378 intptr = &options->kbd_interactive_authentication;
381 case oKbdInteractiveDevices:
382 charptr = &options->kbd_interactive_devices;
385 case oPubkeyAuthentication:
386 intptr = &options->pubkey_authentication;
389 case oRSAAuthentication:
390 intptr = &options->rsa_authentication;
393 case oRhostsRSAAuthentication:
394 intptr = &options->rhosts_rsa_authentication;
397 case oHostbasedAuthentication:
398 intptr = &options->hostbased_authentication;
401 case oChallengeResponseAuthentication:
402 intptr = &options->challenge_response_authentication;
405 case oGssAuthentication:
406 intptr = &options->gss_authentication;
409 case oGssDelegateCreds:
410 intptr = &options->gss_deleg_creds;
414 intptr = &options->batch_mode;
418 intptr = &options->check_host_ip;
421 case oVerifyHostKeyDNS:
422 intptr = &options->verify_host_key_dns;
425 case oStrictHostKeyChecking:
426 intptr = &options->strict_host_key_checking;
429 if (!arg || *arg == '\0')
430 fatal("%.200s line %d: Missing yes/no/ask argument.",
432 value = 0; /* To avoid compiler warning... */
433 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
435 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
437 else if (strcmp(arg, "ask") == 0)
440 fatal("%.200s line %d: Bad yes/no/ask argument.", filename, linenum);
441 if (*activep && *intptr == -1)
446 intptr = &options->compression;
450 intptr = &options->tcp_keep_alive;
453 case oNoHostAuthenticationForLocalhost:
454 intptr = &options->no_host_authentication_for_localhost;
457 case oNumberOfPasswordPrompts:
458 intptr = &options->number_of_password_prompts;
461 case oCompressionLevel:
462 intptr = &options->compression_level;
466 intptr = &options->rekey_limit;
468 if (!arg || *arg == '\0')
469 fatal("%.200s line %d: Missing argument.", filename, linenum);
470 if (arg[0] < '0' || arg[0] > '9')
471 fatal("%.200s line %d: Bad number.", filename, linenum);
472 value = strtol(arg, &endofnumber, 10);
473 if (arg == endofnumber)
474 fatal("%.200s line %d: Bad number.", filename, linenum);
475 switch (toupper(*endofnumber)) {
486 if (*activep && *intptr == -1)
492 if (!arg || *arg == '\0')
493 fatal("%.200s line %d: Missing argument.", filename, linenum);
495 intptr = &options->num_identity_files;
496 if (*intptr >= SSH_MAX_IDENTITY_FILES)
497 fatal("%.200s line %d: Too many identity files specified (max %d).",
498 filename, linenum, SSH_MAX_IDENTITY_FILES);
499 charptr = &options->identity_files[*intptr];
500 *charptr = xstrdup(arg);
501 *intptr = *intptr + 1;
506 charptr=&options->xauth_location;
510 charptr = &options->user;
513 if (!arg || *arg == '\0')
514 fatal("%.200s line %d: Missing argument.", filename, linenum);
515 if (*activep && *charptr == NULL)
516 *charptr = xstrdup(arg);
519 case oGlobalKnownHostsFile:
520 charptr = &options->system_hostfile;
523 case oUserKnownHostsFile:
524 charptr = &options->user_hostfile;
527 case oGlobalKnownHostsFile2:
528 charptr = &options->system_hostfile2;
531 case oUserKnownHostsFile2:
532 charptr = &options->user_hostfile2;
536 charptr = &options->hostname;
540 charptr = &options->host_key_alias;
543 case oPreferredAuthentications:
544 charptr = &options->preferred_authentications;
548 charptr = &options->bind_address;
551 case oSmartcardDevice:
552 charptr = &options->smartcard_device;
557 fatal("%.200s line %d: Missing argument.", filename, linenum);
558 charptr = &options->proxy_command;
559 len = strspn(s, WHITESPACE "=");
560 if (*activep && *charptr == NULL)
561 *charptr = xstrdup(s + len);
565 intptr = &options->port;
568 if (!arg || *arg == '\0')
569 fatal("%.200s line %d: Missing argument.", filename, linenum);
570 if (arg[0] < '0' || arg[0] > '9')
571 fatal("%.200s line %d: Bad number.", filename, linenum);
573 /* Octal, decimal, or hex format? */
574 value = strtol(arg, &endofnumber, 0);
575 if (arg == endofnumber)
576 fatal("%.200s line %d: Bad number.", filename, linenum);
577 if (*activep && *intptr == -1)
581 case oConnectionAttempts:
582 intptr = &options->connection_attempts;
586 intptr = &options->cipher;
588 if (!arg || *arg == '\0')
589 fatal("%.200s line %d: Missing argument.", filename, linenum);
590 value = cipher_number(arg);
592 fatal("%.200s line %d: Bad cipher '%s'.",
593 filename, linenum, arg ? arg : "<NONE>");
594 if (*activep && *intptr == -1)
600 if (!arg || *arg == '\0')
601 fatal("%.200s line %d: Missing argument.", filename, linenum);
602 if (!ciphers_valid(arg))
603 fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
604 filename, linenum, arg ? arg : "<NONE>");
605 if (*activep && options->ciphers == NULL)
606 options->ciphers = xstrdup(arg);
611 if (!arg || *arg == '\0')
612 fatal("%.200s line %d: Missing argument.", filename, linenum);
614 fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.",
615 filename, linenum, arg ? arg : "<NONE>");
616 if (*activep && options->macs == NULL)
617 options->macs = xstrdup(arg);
620 case oHostKeyAlgorithms:
622 if (!arg || *arg == '\0')
623 fatal("%.200s line %d: Missing argument.", filename, linenum);
624 if (!key_names_valid2(arg))
625 fatal("%.200s line %d: Bad protocol 2 host key algorithms '%s'.",
626 filename, linenum, arg ? arg : "<NONE>");
627 if (*activep && options->hostkeyalgorithms == NULL)
628 options->hostkeyalgorithms = xstrdup(arg);
632 intptr = &options->protocol;
634 if (!arg || *arg == '\0')
635 fatal("%.200s line %d: Missing argument.", filename, linenum);
636 value = proto_spec(arg);
637 if (value == SSH_PROTO_UNKNOWN)
638 fatal("%.200s line %d: Bad protocol spec '%s'.",
639 filename, linenum, arg ? arg : "<NONE>");
640 if (*activep && *intptr == SSH_PROTO_UNKNOWN)
645 intptr = (int *) &options->log_level;
647 value = log_level_number(arg);
648 if (value == SYSLOG_LEVEL_NOT_SET)
649 fatal("%.200s line %d: unsupported log level '%s'",
650 filename, linenum, arg ? arg : "<NONE>");
651 if (*activep && (LogLevel) *intptr == SYSLOG_LEVEL_NOT_SET)
652 *intptr = (LogLevel) value;
658 if (arg == NULL || *arg == '\0')
659 fatal("%.200s line %d: Missing port argument.",
662 if (arg2 == NULL || *arg2 == '\0')
663 fatal("%.200s line %d: Missing target argument.",
666 /* construct a string for parse_forward */
667 snprintf(fwdarg, sizeof(fwdarg), "%s:%s", arg, arg2);
669 if (parse_forward(&fwd, fwdarg) == 0)
670 fatal("%.200s line %d: Bad forwarding specification.",
674 if (opcode == oLocalForward)
675 add_local_forward(options, &fwd);
676 else if (opcode == oRemoteForward)
677 add_remote_forward(options, &fwd);
681 case oDynamicForward:
683 if (!arg || *arg == '\0')
684 fatal("%.200s line %d: Missing port argument.",
686 memset(&fwd, '\0', sizeof(fwd));
687 fwd.connect_host = "socks";
688 fwd.listen_host = hpdelim(&arg);
689 if (fwd.listen_host == NULL ||
690 strlen(fwd.listen_host) >= NI_MAXHOST)
691 fatal("%.200s line %d: Bad forwarding specification.",
694 fwd.listen_port = a2port(arg);
695 fwd.listen_host = cleanhostname(fwd.listen_host);
697 fwd.listen_port = a2port(fwd.listen_host);
698 fwd.listen_host = "";
700 if (fwd.listen_port == 0)
701 fatal("%.200s line %d: Badly formatted port number.",
704 add_local_forward(options, &fwd);
707 case oClearAllForwardings:
708 intptr = &options->clear_forwardings;
713 while ((arg = strdelim(&s)) != NULL && *arg != '\0')
714 if (match_pattern(host, arg)) {
715 debug("Applying options for %.100s", arg);
719 /* Avoid garbage check below, as strdelim is done. */
723 intptr = &options->escape_char;
725 if (!arg || *arg == '\0')
726 fatal("%.200s line %d: Missing argument.", filename, linenum);
727 if (arg[0] == '^' && arg[2] == 0 &&
728 (u_char) arg[1] >= 64 && (u_char) arg[1] < 128)
729 value = (u_char) arg[1] & 31;
730 else if (strlen(arg) == 1)
731 value = (u_char) arg[0];
732 else if (strcmp(arg, "none") == 0)
733 value = SSH_ESCAPECHAR_NONE;
735 fatal("%.200s line %d: Bad escape character.",
738 value = 0; /* Avoid compiler warning. */
740 if (*activep && *intptr == -1)
746 intptr = &options->address_family;
747 if (strcasecmp(arg, "inet") == 0)
749 else if (strcasecmp(arg, "inet6") == 0)
751 else if (strcasecmp(arg, "any") == 0)
754 fatal("Unsupported AddressFamily \"%s\"", arg);
755 if (*activep && *intptr == -1)
759 case oEnableSSHKeysign:
760 intptr = &options->enable_ssh_keysign;
763 case oIdentitiesOnly:
764 intptr = &options->identities_only;
767 case oServerAliveInterval:
768 intptr = &options->server_alive_interval;
771 case oServerAliveCountMax:
772 intptr = &options->server_alive_count_max;
776 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
777 if (strchr(arg, '=') != NULL)
778 fatal("%s line %d: Invalid environment name.",
782 if (options->num_send_env >= MAX_SEND_ENV)
783 fatal("%s line %d: too many send env.",
785 options->send_env[options->num_send_env++] =
791 charptr = &options->control_path;
795 intptr = &options->control_master;
798 case oHashKnownHosts:
799 intptr = &options->hash_known_hosts;
803 debug("%s line %d: Deprecated option \"%s\"",
804 filename, linenum, keyword);
808 error("%s line %d: Unsupported option \"%s\"",
809 filename, linenum, keyword);
813 fatal("process_config_line: Unimplemented opcode %d", opcode);
816 /* Check that there is no garbage at end of line. */
817 if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
818 fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
819 filename, linenum, arg);
826 * Reads the config file and modifies the options accordingly. Options
827 * should already be initialized before this call. This never returns if
828 * there is an error. If the file does not exist, this returns 0.
832 read_config_file(const char *filename, const char *host, Options *options,
841 if ((f = fopen(filename, "r")) == NULL)
847 if (fstat(fileno(f), &sb) == -1)
848 fatal("fstat %s: %s", filename, strerror(errno));
849 if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
850 (sb.st_mode & 022) != 0))
851 fatal("Bad owner or permissions on %s", filename);
854 debug("Reading configuration data %.200s", filename);
857 * Mark that we are now processing the options. This flag is turned
858 * on/off by Host specifications.
862 while (fgets(line, sizeof(line), f)) {
863 /* Update line number counter. */
865 if (process_config_line(options, host, line, filename, linenum, &active) != 0)
870 fatal("%s: terminating, %d bad configuration options",
871 filename, bad_options);
876 * Initializes options to special values that indicate that they have not yet
877 * been set. Read_config_file will only set options with this value. Options
878 * are processed in the following order: command line, user config file,
879 * system config file. Last, fill_default_options is called.
883 initialize_options(Options * options)
885 memset(options, 'X', sizeof(*options));
886 options->forward_agent = -1;
887 options->forward_x11 = -1;
888 options->forward_x11_trusted = -1;
889 options->xauth_location = NULL;
890 options->gateway_ports = -1;
891 options->use_privileged_port = -1;
892 options->rsa_authentication = -1;
893 options->pubkey_authentication = -1;
894 options->challenge_response_authentication = -1;
895 options->gss_authentication = -1;
896 options->gss_deleg_creds = -1;
897 options->password_authentication = -1;
898 options->kbd_interactive_authentication = -1;
899 options->kbd_interactive_devices = NULL;
900 options->rhosts_rsa_authentication = -1;
901 options->hostbased_authentication = -1;
902 options->batch_mode = -1;
903 options->check_host_ip = -1;
904 options->strict_host_key_checking = -1;
905 options->compression = -1;
906 options->tcp_keep_alive = -1;
907 options->compression_level = -1;
909 options->address_family = -1;
910 options->connection_attempts = -1;
911 options->connection_timeout = -1;
912 options->number_of_password_prompts = -1;
913 options->cipher = -1;
914 options->ciphers = NULL;
915 options->macs = NULL;
916 options->hostkeyalgorithms = NULL;
917 options->protocol = SSH_PROTO_UNKNOWN;
918 options->num_identity_files = 0;
919 options->hostname = NULL;
920 options->host_key_alias = NULL;
921 options->proxy_command = NULL;
922 options->user = NULL;
923 options->escape_char = -1;
924 options->system_hostfile = NULL;
925 options->user_hostfile = NULL;
926 options->system_hostfile2 = NULL;
927 options->user_hostfile2 = NULL;
928 options->num_local_forwards = 0;
929 options->num_remote_forwards = 0;
930 options->clear_forwardings = -1;
931 options->log_level = SYSLOG_LEVEL_NOT_SET;
932 options->preferred_authentications = NULL;
933 options->bind_address = NULL;
934 options->smartcard_device = NULL;
935 options->enable_ssh_keysign = - 1;
936 options->no_host_authentication_for_localhost = - 1;
937 options->identities_only = - 1;
938 options->rekey_limit = - 1;
939 options->verify_host_key_dns = -1;
940 options->server_alive_interval = -1;
941 options->server_alive_count_max = -1;
942 options->num_send_env = 0;
943 options->control_path = NULL;
944 options->control_master = -1;
945 options->hash_known_hosts = -1;
949 * Called after processing other sources of option data, this fills those
950 * options for which no value has been specified with their default values.
954 fill_default_options(Options * options)
958 if (options->forward_agent == -1)
959 options->forward_agent = 0;
960 if (options->forward_x11 == -1)
961 options->forward_x11 = 0;
962 if (options->forward_x11_trusted == -1)
963 options->forward_x11_trusted = 0;
964 if (options->xauth_location == NULL)
965 options->xauth_location = _PATH_XAUTH;
966 if (options->gateway_ports == -1)
967 options->gateway_ports = 0;
968 if (options->use_privileged_port == -1)
969 options->use_privileged_port = 0;
970 if (options->rsa_authentication == -1)
971 options->rsa_authentication = 1;
972 if (options->pubkey_authentication == -1)
973 options->pubkey_authentication = 1;
974 if (options->challenge_response_authentication == -1)
975 options->challenge_response_authentication = 1;
976 if (options->gss_authentication == -1)
977 options->gss_authentication = 0;
978 if (options->gss_deleg_creds == -1)
979 options->gss_deleg_creds = 0;
980 if (options->password_authentication == -1)
981 options->password_authentication = 1;
982 if (options->kbd_interactive_authentication == -1)
983 options->kbd_interactive_authentication = 1;
984 if (options->rhosts_rsa_authentication == -1)
985 options->rhosts_rsa_authentication = 0;
986 if (options->hostbased_authentication == -1)
987 options->hostbased_authentication = 0;
988 if (options->batch_mode == -1)
989 options->batch_mode = 0;
990 if (options->check_host_ip == -1)
991 options->check_host_ip = 1;
992 if (options->strict_host_key_checking == -1)
993 options->strict_host_key_checking = 2; /* 2 is default */
994 if (options->compression == -1)
995 options->compression = 0;
996 if (options->tcp_keep_alive == -1)
997 options->tcp_keep_alive = 1;
998 if (options->compression_level == -1)
999 options->compression_level = 6;
1000 if (options->port == -1)
1001 options->port = 0; /* Filled in ssh_connect. */
1002 if (options->address_family == -1)
1003 options->address_family = AF_UNSPEC;
1004 if (options->connection_attempts == -1)
1005 options->connection_attempts = 1;
1006 if (options->number_of_password_prompts == -1)
1007 options->number_of_password_prompts = 3;
1008 /* Selected in ssh_login(). */
1009 if (options->cipher == -1)
1010 options->cipher = SSH_CIPHER_NOT_SET;
1011 /* options->ciphers, default set in myproposals.h */
1012 /* options->macs, default set in myproposals.h */
1013 /* options->hostkeyalgorithms, default set in myproposals.h */
1014 if (options->protocol == SSH_PROTO_UNKNOWN)
1015 options->protocol = SSH_PROTO_1|SSH_PROTO_2;
1016 if (options->num_identity_files == 0) {
1017 if (options->protocol & SSH_PROTO_1) {
1018 len = 2 + strlen(_PATH_SSH_CLIENT_IDENTITY) + 1;
1019 options->identity_files[options->num_identity_files] =
1021 snprintf(options->identity_files[options->num_identity_files++],
1022 len, "~/%.100s", _PATH_SSH_CLIENT_IDENTITY);
1024 if (options->protocol & SSH_PROTO_2) {
1025 len = 2 + strlen(_PATH_SSH_CLIENT_ID_RSA) + 1;
1026 options->identity_files[options->num_identity_files] =
1028 snprintf(options->identity_files[options->num_identity_files++],
1029 len, "~/%.100s", _PATH_SSH_CLIENT_ID_RSA);
1031 len = 2 + strlen(_PATH_SSH_CLIENT_ID_DSA) + 1;
1032 options->identity_files[options->num_identity_files] =
1034 snprintf(options->identity_files[options->num_identity_files++],
1035 len, "~/%.100s", _PATH_SSH_CLIENT_ID_DSA);
1038 if (options->escape_char == -1)
1039 options->escape_char = '~';
1040 if (options->system_hostfile == NULL)
1041 options->system_hostfile = _PATH_SSH_SYSTEM_HOSTFILE;
1042 if (options->user_hostfile == NULL)
1043 options->user_hostfile = _PATH_SSH_USER_HOSTFILE;
1044 if (options->system_hostfile2 == NULL)
1045 options->system_hostfile2 = _PATH_SSH_SYSTEM_HOSTFILE2;
1046 if (options->user_hostfile2 == NULL)
1047 options->user_hostfile2 = _PATH_SSH_USER_HOSTFILE2;
1048 if (options->log_level == SYSLOG_LEVEL_NOT_SET)
1049 options->log_level = SYSLOG_LEVEL_INFO;
1050 if (options->clear_forwardings == 1)
1051 clear_forwardings(options);
1052 if (options->no_host_authentication_for_localhost == - 1)
1053 options->no_host_authentication_for_localhost = 0;
1054 if (options->identities_only == -1)
1055 options->identities_only = 0;
1056 if (options->enable_ssh_keysign == -1)
1057 options->enable_ssh_keysign = 0;
1058 if (options->rekey_limit == -1)
1059 options->rekey_limit = 0;
1060 if (options->verify_host_key_dns == -1)
1061 options->verify_host_key_dns = 0;
1062 if (options->server_alive_interval == -1)
1063 options->server_alive_interval = 0;
1064 if (options->server_alive_count_max == -1)
1065 options->server_alive_count_max = 3;
1066 if (options->control_master == -1)
1067 options->control_master = 0;
1068 if (options->hash_known_hosts == -1)
1069 options->hash_known_hosts = 0;
1070 /* options->proxy_command should not be set by default */
1071 /* options->user will be set in the main program if appropriate */
1072 /* options->hostname will be set in the main program if appropriate */
1073 /* options->host_key_alias should not be set by default */
1074 /* options->preferred_authentications will be set in ssh */
1079 * parses a string containing a port forwarding specification of the form:
1080 * [listenhost:]listenport:connecthost:connectport
1081 * returns number of arguments parsed or zero on error
1084 parse_forward(Forward *fwd, const char *fwdspec)
1087 char *p, *cp, *fwdarg[4];
1089 memset(fwd, '\0', sizeof(*fwd));
1091 cp = p = xstrdup(fwdspec);
1093 /* skip leading spaces */
1094 while (*cp && isspace(*cp))
1097 for (i = 0; i < 4; ++i)
1098 if ((fwdarg[i] = hpdelim(&cp)) == NULL)
1101 /* Check for trailing garbage in 4-arg case*/
1103 i = 0; /* failure */
1107 fwd->listen_host = NULL;
1108 fwd->listen_port = a2port(fwdarg[0]);
1109 fwd->connect_host = xstrdup(cleanhostname(fwdarg[1]));
1110 fwd->connect_port = a2port(fwdarg[2]);
1114 fwd->listen_host = xstrdup(cleanhostname(fwdarg[0]));
1115 fwd->listen_port = a2port(fwdarg[1]);
1116 fwd->connect_host = xstrdup(cleanhostname(fwdarg[2]));
1117 fwd->connect_port = a2port(fwdarg[3]);
1120 i = 0; /* failure */
1125 if (fwd->listen_port == 0 && fwd->connect_port == 0)
1128 if (fwd->connect_host != NULL &&
1129 strlen(fwd->connect_host) >= NI_MAXHOST)
1135 if (fwd->connect_host != NULL)
1136 xfree(fwd->connect_host);
1137 if (fwd->listen_host != NULL)
1138 xfree(fwd->listen_host);