1 /* $OpenBSD: readconf.c,v 1.181 2009/12/29 16:38:41 stevesk Exp $ */
3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 * Functions for reading the configuration files.
8 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
17 #include <sys/types.h>
19 #include <sys/socket.h>
21 #include <netinet/in.h>
36 #include "pathnames.h"
46 /* Format of the configuration file:
48 # Configuration data is parsed as follows:
49 # 1. command line options
50 # 2. user-specific file
52 # Any configuration value is only changed the first time it is set.
53 # Thus, host-specific definitions should be at the beginning of the
54 # configuration file, and defaults at the end.
56 # Host-specific declarations. These may override anything above. A single
57 # host may match multiple declarations; these are processed in the order
58 # that they are given in.
64 HostName another.host.name.real.org
71 RemoteForward 9999 shadows.cs.hut.fi:9999
77 PasswordAuthentication no
81 ProxyCommand ssh-proxy %h %p
84 PublicKeyAuthentication no
88 PasswordAuthentication no
94 # Defaults for various options
98 PasswordAuthentication yes
100 RhostsRSAAuthentication yes
101 StrictHostKeyChecking yes
103 IdentityFile ~/.ssh/identity
109 /* Keyword tokens. */
113 oForwardAgent, oForwardX11, oForwardX11Trusted, oGatewayPorts,
114 oExitOnForwardFailure,
115 oPasswordAuthentication, oRSAAuthentication,
116 oChallengeResponseAuthentication, oXAuthLocation,
117 oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
118 oUser, oHost, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
119 oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
120 oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
121 oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts,
122 oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,
123 oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
124 oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
125 oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
126 oHostKeyAlgorithms, oBindAddress, oSmartcardDevice,
127 oClearAllForwardings, oNoHostAuthenticationForLocalhost,
128 oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
129 oAddressFamily, oGssAuthentication, oGssDelegateCreds,
130 oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
131 oSendEnv, oControlPath, oControlMaster, oHashKnownHosts,
132 oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
133 oVisualHostKey, oUseRoaming, oRDomain,
134 oZeroKnowledgePasswordAuthentication, oDeprecated, oUnsupported
137 /* Textual representations of the tokens. */
143 { "forwardagent", oForwardAgent },
144 { "forwardx11", oForwardX11 },
145 { "forwardx11trusted", oForwardX11Trusted },
146 { "exitonforwardfailure", oExitOnForwardFailure },
147 { "xauthlocation", oXAuthLocation },
148 { "gatewayports", oGatewayPorts },
149 { "useprivilegedport", oUsePrivilegedPort },
150 { "rhostsauthentication", oDeprecated },
151 { "passwordauthentication", oPasswordAuthentication },
152 { "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
153 { "kbdinteractivedevices", oKbdInteractiveDevices },
154 { "rsaauthentication", oRSAAuthentication },
155 { "pubkeyauthentication", oPubkeyAuthentication },
156 { "dsaauthentication", oPubkeyAuthentication }, /* alias */
157 { "rhostsrsaauthentication", oRhostsRSAAuthentication },
158 { "hostbasedauthentication", oHostbasedAuthentication },
159 { "challengeresponseauthentication", oChallengeResponseAuthentication },
160 { "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
161 { "tisauthentication", oChallengeResponseAuthentication }, /* alias */
162 { "kerberosauthentication", oUnsupported },
163 { "kerberostgtpassing", oUnsupported },
164 { "afstokenpassing", oUnsupported },
166 { "gssapiauthentication", oGssAuthentication },
167 { "gssapidelegatecredentials", oGssDelegateCreds },
169 { "gssapiauthentication", oUnsupported },
170 { "gssapidelegatecredentials", oUnsupported },
172 { "fallbacktorsh", oDeprecated },
173 { "usersh", oDeprecated },
174 { "identityfile", oIdentityFile },
175 { "identityfile2", oIdentityFile }, /* obsolete */
176 { "identitiesonly", oIdentitiesOnly },
177 { "hostname", oHostName },
178 { "hostkeyalias", oHostKeyAlias },
179 { "proxycommand", oProxyCommand },
181 { "cipher", oCipher },
182 { "ciphers", oCiphers },
184 { "protocol", oProtocol },
185 { "remoteforward", oRemoteForward },
186 { "localforward", oLocalForward },
189 { "escapechar", oEscapeChar },
190 { "globalknownhostsfile", oGlobalKnownHostsFile },
191 { "globalknownhostsfile2", oGlobalKnownHostsFile2 }, /* obsolete */
192 { "userknownhostsfile", oUserKnownHostsFile },
193 { "userknownhostsfile2", oUserKnownHostsFile2 }, /* obsolete */
194 { "connectionattempts", oConnectionAttempts },
195 { "batchmode", oBatchMode },
196 { "checkhostip", oCheckHostIP },
197 { "stricthostkeychecking", oStrictHostKeyChecking },
198 { "compression", oCompression },
199 { "compressionlevel", oCompressionLevel },
200 { "tcpkeepalive", oTCPKeepAlive },
201 { "keepalive", oTCPKeepAlive }, /* obsolete */
202 { "numberofpasswordprompts", oNumberOfPasswordPrompts },
203 { "loglevel", oLogLevel },
204 { "dynamicforward", oDynamicForward },
205 { "preferredauthentications", oPreferredAuthentications },
206 { "hostkeyalgorithms", oHostKeyAlgorithms },
207 { "bindaddress", oBindAddress },
209 { "smartcarddevice", oSmartcardDevice },
211 { "smartcarddevice", oUnsupported },
213 { "clearallforwardings", oClearAllForwardings },
214 { "enablesshkeysign", oEnableSSHKeysign },
215 { "verifyhostkeydns", oVerifyHostKeyDNS },
216 { "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost },
217 { "rekeylimit", oRekeyLimit },
218 { "connecttimeout", oConnectTimeout },
219 { "addressfamily", oAddressFamily },
220 { "serveraliveinterval", oServerAliveInterval },
221 { "serveralivecountmax", oServerAliveCountMax },
222 { "sendenv", oSendEnv },
223 { "controlpath", oControlPath },
224 { "controlmaster", oControlMaster },
225 { "hashknownhosts", oHashKnownHosts },
226 { "tunnel", oTunnel },
227 { "tunneldevice", oTunnelDevice },
228 { "localcommand", oLocalCommand },
229 { "permitlocalcommand", oPermitLocalCommand },
230 { "visualhostkey", oVisualHostKey },
231 { "useroaming", oUseRoaming },
232 #ifdef USE_ROUTINGDOMAIN
233 { "routingdomain", oRDomain },
235 { "routingdomain", oUnsupported },
238 { "zeroknowledgepasswordauthentication",
239 oZeroKnowledgePasswordAuthentication },
241 { "zeroknowledgepasswordauthentication", oUnsupported },
248 * Adds a local TCP/IP port forward to options. Never returns if there is an
253 add_local_forward(Options *options, const Forward *newfwd)
256 #ifndef NO_IPPORT_RESERVED_CONCEPT
257 extern uid_t original_real_uid;
258 if (newfwd->listen_port < IPPORT_RESERVED && original_real_uid != 0)
259 fatal("Privileged ports can only be forwarded by root.");
261 if (options->num_local_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
262 fatal("Too many local forwards (max %d).", SSH_MAX_FORWARDS_PER_DIRECTION);
263 fwd = &options->local_forwards[options->num_local_forwards++];
265 fwd->listen_host = newfwd->listen_host;
266 fwd->listen_port = newfwd->listen_port;
267 fwd->connect_host = newfwd->connect_host;
268 fwd->connect_port = newfwd->connect_port;
272 * Adds a remote TCP/IP port forward to options. Never returns if there is
277 add_remote_forward(Options *options, const Forward *newfwd)
280 if (options->num_remote_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
281 fatal("Too many remote forwards (max %d).",
282 SSH_MAX_FORWARDS_PER_DIRECTION);
283 fwd = &options->remote_forwards[options->num_remote_forwards++];
285 fwd->listen_host = newfwd->listen_host;
286 fwd->listen_port = newfwd->listen_port;
287 fwd->connect_host = newfwd->connect_host;
288 fwd->connect_port = newfwd->connect_port;
292 clear_forwardings(Options *options)
296 for (i = 0; i < options->num_local_forwards; i++) {
297 if (options->local_forwards[i].listen_host != NULL)
298 xfree(options->local_forwards[i].listen_host);
299 xfree(options->local_forwards[i].connect_host);
301 options->num_local_forwards = 0;
302 for (i = 0; i < options->num_remote_forwards; i++) {
303 if (options->remote_forwards[i].listen_host != NULL)
304 xfree(options->remote_forwards[i].listen_host);
305 xfree(options->remote_forwards[i].connect_host);
307 options->num_remote_forwards = 0;
308 options->tun_open = SSH_TUNMODE_NO;
312 * Returns the number of the token pointed to by cp or oBadOption.
316 parse_token(const char *cp, const char *filename, int linenum)
320 for (i = 0; keywords[i].name; i++)
321 if (strcasecmp(cp, keywords[i].name) == 0)
322 return keywords[i].opcode;
324 error("%s: line %d: Bad configuration option: %s",
325 filename, linenum, cp);
330 * Processes a single option line as used in the configuration files. This
331 * only sets those values that have not already been set.
333 #define WHITESPACE " \t\r\n"
336 process_config_line(Options *options, const char *host,
337 char *line, const char *filename, int linenum,
340 char *s, **charptr, *endofnumber, *keyword, *arg, *arg2, fwdarg[256];
341 int opcode, *intptr, value, value2, scale;
342 LogLevel *log_level_ptr;
343 long long orig, val64;
347 /* Strip trailing whitespace */
348 for (len = strlen(line) - 1; len > 0; len--) {
349 if (strchr(WHITESPACE, line[len]) == NULL)
355 /* Get the keyword. (Each line is supposed to begin with a keyword). */
356 if ((keyword = strdelim(&s)) == NULL)
358 /* Ignore leading whitespace. */
359 if (*keyword == '\0')
360 keyword = strdelim(&s);
361 if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
364 opcode = parse_token(keyword, filename, linenum);
368 /* don't panic, but count bad options */
371 case oConnectTimeout:
372 intptr = &options->connection_timeout;
375 if (!arg || *arg == '\0')
376 fatal("%s line %d: missing time value.",
378 if ((value = convtime(arg)) == -1)
379 fatal("%s line %d: invalid time value.",
381 if (*activep && *intptr == -1)
386 intptr = &options->forward_agent;
389 if (!arg || *arg == '\0')
390 fatal("%.200s line %d: Missing yes/no argument.", filename, linenum);
391 value = 0; /* To avoid compiler warning... */
392 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
394 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
397 fatal("%.200s line %d: Bad yes/no argument.", filename, linenum);
398 if (*activep && *intptr == -1)
403 intptr = &options->forward_x11;
406 case oForwardX11Trusted:
407 intptr = &options->forward_x11_trusted;
411 intptr = &options->gateway_ports;
414 case oExitOnForwardFailure:
415 intptr = &options->exit_on_forward_failure;
418 case oUsePrivilegedPort:
419 intptr = &options->use_privileged_port;
422 case oPasswordAuthentication:
423 intptr = &options->password_authentication;
426 case oZeroKnowledgePasswordAuthentication:
427 intptr = &options->zero_knowledge_password_authentication;
430 case oKbdInteractiveAuthentication:
431 intptr = &options->kbd_interactive_authentication;
434 case oKbdInteractiveDevices:
435 charptr = &options->kbd_interactive_devices;
438 case oPubkeyAuthentication:
439 intptr = &options->pubkey_authentication;
442 case oRSAAuthentication:
443 intptr = &options->rsa_authentication;
446 case oRhostsRSAAuthentication:
447 intptr = &options->rhosts_rsa_authentication;
450 case oHostbasedAuthentication:
451 intptr = &options->hostbased_authentication;
454 case oChallengeResponseAuthentication:
455 intptr = &options->challenge_response_authentication;
458 case oGssAuthentication:
459 intptr = &options->gss_authentication;
462 case oGssDelegateCreds:
463 intptr = &options->gss_deleg_creds;
467 intptr = &options->batch_mode;
471 intptr = &options->check_host_ip;
474 case oVerifyHostKeyDNS:
475 intptr = &options->verify_host_key_dns;
478 case oStrictHostKeyChecking:
479 intptr = &options->strict_host_key_checking;
482 if (!arg || *arg == '\0')
483 fatal("%.200s line %d: Missing yes/no/ask argument.",
485 value = 0; /* To avoid compiler warning... */
486 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
488 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
490 else if (strcmp(arg, "ask") == 0)
493 fatal("%.200s line %d: Bad yes/no/ask argument.", filename, linenum);
494 if (*activep && *intptr == -1)
499 intptr = &options->compression;
503 intptr = &options->tcp_keep_alive;
506 case oNoHostAuthenticationForLocalhost:
507 intptr = &options->no_host_authentication_for_localhost;
510 case oNumberOfPasswordPrompts:
511 intptr = &options->number_of_password_prompts;
514 case oCompressionLevel:
515 intptr = &options->compression_level;
520 if (!arg || *arg == '\0')
521 fatal("%.200s line %d: Missing argument.", filename, linenum);
522 if (arg[0] < '0' || arg[0] > '9')
523 fatal("%.200s line %d: Bad number.", filename, linenum);
524 orig = val64 = strtoll(arg, &endofnumber, 10);
525 if (arg == endofnumber)
526 fatal("%.200s line %d: Bad number.", filename, linenum);
527 switch (toupper(*endofnumber)) {
541 fatal("%.200s line %d: Invalid RekeyLimit suffix",
545 /* detect integer wrap and too-large limits */
546 if ((val64 / scale) != orig || val64 > UINT_MAX)
547 fatal("%.200s line %d: RekeyLimit too large",
550 fatal("%.200s line %d: RekeyLimit too small",
552 if (*activep && options->rekey_limit == -1)
553 options->rekey_limit = (u_int32_t)val64;
558 if (!arg || *arg == '\0')
559 fatal("%.200s line %d: Missing argument.", filename, linenum);
561 intptr = &options->num_identity_files;
562 if (*intptr >= SSH_MAX_IDENTITY_FILES)
563 fatal("%.200s line %d: Too many identity files specified (max %d).",
564 filename, linenum, SSH_MAX_IDENTITY_FILES);
565 charptr = &options->identity_files[*intptr];
566 *charptr = xstrdup(arg);
567 *intptr = *intptr + 1;
572 charptr=&options->xauth_location;
576 charptr = &options->user;
579 if (!arg || *arg == '\0')
580 fatal("%.200s line %d: Missing argument.", filename, linenum);
581 if (*activep && *charptr == NULL)
582 *charptr = xstrdup(arg);
585 case oGlobalKnownHostsFile:
586 charptr = &options->system_hostfile;
589 case oUserKnownHostsFile:
590 charptr = &options->user_hostfile;
593 case oGlobalKnownHostsFile2:
594 charptr = &options->system_hostfile2;
597 case oUserKnownHostsFile2:
598 charptr = &options->user_hostfile2;
602 charptr = &options->hostname;
606 charptr = &options->host_key_alias;
609 case oPreferredAuthentications:
610 charptr = &options->preferred_authentications;
614 charptr = &options->bind_address;
617 case oSmartcardDevice:
618 charptr = &options->smartcard_device;
622 charptr = &options->proxy_command;
625 fatal("%.200s line %d: Missing argument.", filename, linenum);
626 len = strspn(s, WHITESPACE "=");
627 if (*activep && *charptr == NULL)
628 *charptr = xstrdup(s + len);
632 intptr = &options->port;
635 if (!arg || *arg == '\0')
636 fatal("%.200s line %d: Missing argument.", filename, linenum);
637 if (arg[0] < '0' || arg[0] > '9')
638 fatal("%.200s line %d: Bad number.", filename, linenum);
640 /* Octal, decimal, or hex format? */
641 value = strtol(arg, &endofnumber, 0);
642 if (arg == endofnumber)
643 fatal("%.200s line %d: Bad number.", filename, linenum);
644 if (*activep && *intptr == -1)
648 case oConnectionAttempts:
649 intptr = &options->connection_attempts;
653 intptr = &options->cipher;
655 if (!arg || *arg == '\0')
656 fatal("%.200s line %d: Missing argument.", filename, linenum);
657 value = cipher_number(arg);
659 fatal("%.200s line %d: Bad cipher '%s'.",
660 filename, linenum, arg ? arg : "<NONE>");
661 if (*activep && *intptr == -1)
667 if (!arg || *arg == '\0')
668 fatal("%.200s line %d: Missing argument.", filename, linenum);
669 if (!ciphers_valid(arg))
670 fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
671 filename, linenum, arg ? arg : "<NONE>");
672 if (*activep && options->ciphers == NULL)
673 options->ciphers = xstrdup(arg);
678 if (!arg || *arg == '\0')
679 fatal("%.200s line %d: Missing argument.", filename, linenum);
681 fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.",
682 filename, linenum, arg ? arg : "<NONE>");
683 if (*activep && options->macs == NULL)
684 options->macs = xstrdup(arg);
687 case oHostKeyAlgorithms:
689 if (!arg || *arg == '\0')
690 fatal("%.200s line %d: Missing argument.", filename, linenum);
691 if (!key_names_valid2(arg))
692 fatal("%.200s line %d: Bad protocol 2 host key algorithms '%s'.",
693 filename, linenum, arg ? arg : "<NONE>");
694 if (*activep && options->hostkeyalgorithms == NULL)
695 options->hostkeyalgorithms = xstrdup(arg);
699 intptr = &options->protocol;
701 if (!arg || *arg == '\0')
702 fatal("%.200s line %d: Missing argument.", filename, linenum);
703 value = proto_spec(arg);
704 if (value == SSH_PROTO_UNKNOWN)
705 fatal("%.200s line %d: Bad protocol spec '%s'.",
706 filename, linenum, arg ? arg : "<NONE>");
707 if (*activep && *intptr == SSH_PROTO_UNKNOWN)
712 log_level_ptr = &options->log_level;
714 value = log_level_number(arg);
715 if (value == SYSLOG_LEVEL_NOT_SET)
716 fatal("%.200s line %d: unsupported log level '%s'",
717 filename, linenum, arg ? arg : "<NONE>");
718 if (*activep && *log_level_ptr == SYSLOG_LEVEL_NOT_SET)
719 *log_level_ptr = (LogLevel) value;
724 case oDynamicForward:
726 if (arg == NULL || *arg == '\0')
727 fatal("%.200s line %d: Missing port argument.",
730 if (opcode == oLocalForward ||
731 opcode == oRemoteForward) {
733 if (arg2 == NULL || *arg2 == '\0')
734 fatal("%.200s line %d: Missing target argument.",
737 /* construct a string for parse_forward */
738 snprintf(fwdarg, sizeof(fwdarg), "%s:%s", arg, arg2);
739 } else if (opcode == oDynamicForward) {
740 strlcpy(fwdarg, arg, sizeof(fwdarg));
743 if (parse_forward(&fwd, fwdarg,
744 opcode == oDynamicForward ? 1 : 0,
745 opcode == oRemoteForward ? 1 : 0) == 0)
746 fatal("%.200s line %d: Bad forwarding specification.",
750 if (opcode == oLocalForward ||
751 opcode == oDynamicForward)
752 add_local_forward(options, &fwd);
753 else if (opcode == oRemoteForward)
754 add_remote_forward(options, &fwd);
758 case oClearAllForwardings:
759 intptr = &options->clear_forwardings;
764 while ((arg = strdelim(&s)) != NULL && *arg != '\0')
765 if (match_pattern(host, arg)) {
766 debug("Applying options for %.100s", arg);
770 /* Avoid garbage check below, as strdelim is done. */
774 intptr = &options->escape_char;
776 if (!arg || *arg == '\0')
777 fatal("%.200s line %d: Missing argument.", filename, linenum);
778 if (arg[0] == '^' && arg[2] == 0 &&
779 (u_char) arg[1] >= 64 && (u_char) arg[1] < 128)
780 value = (u_char) arg[1] & 31;
781 else if (strlen(arg) == 1)
782 value = (u_char) arg[0];
783 else if (strcmp(arg, "none") == 0)
784 value = SSH_ESCAPECHAR_NONE;
786 fatal("%.200s line %d: Bad escape character.",
789 value = 0; /* Avoid compiler warning. */
791 if (*activep && *intptr == -1)
797 if (!arg || *arg == '\0')
798 fatal("%s line %d: missing address family.",
800 intptr = &options->address_family;
801 if (strcasecmp(arg, "inet") == 0)
803 else if (strcasecmp(arg, "inet6") == 0)
805 else if (strcasecmp(arg, "any") == 0)
808 fatal("Unsupported AddressFamily \"%s\"", arg);
809 if (*activep && *intptr == -1)
813 case oEnableSSHKeysign:
814 intptr = &options->enable_ssh_keysign;
817 case oIdentitiesOnly:
818 intptr = &options->identities_only;
821 case oServerAliveInterval:
822 intptr = &options->server_alive_interval;
825 case oServerAliveCountMax:
826 intptr = &options->server_alive_count_max;
830 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
831 if (strchr(arg, '=') != NULL)
832 fatal("%s line %d: Invalid environment name.",
836 if (options->num_send_env >= MAX_SEND_ENV)
837 fatal("%s line %d: too many send env.",
839 options->send_env[options->num_send_env++] =
845 charptr = &options->control_path;
849 intptr = &options->control_master;
851 if (!arg || *arg == '\0')
852 fatal("%.200s line %d: Missing ControlMaster argument.",
854 value = 0; /* To avoid compiler warning... */
855 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
856 value = SSHCTL_MASTER_YES;
857 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
858 value = SSHCTL_MASTER_NO;
859 else if (strcmp(arg, "auto") == 0)
860 value = SSHCTL_MASTER_AUTO;
861 else if (strcmp(arg, "ask") == 0)
862 value = SSHCTL_MASTER_ASK;
863 else if (strcmp(arg, "autoask") == 0)
864 value = SSHCTL_MASTER_AUTO_ASK;
866 fatal("%.200s line %d: Bad ControlMaster argument.",
868 if (*activep && *intptr == -1)
872 case oHashKnownHosts:
873 intptr = &options->hash_known_hosts;
877 intptr = &options->tun_open;
879 if (!arg || *arg == '\0')
880 fatal("%s line %d: Missing yes/point-to-point/"
881 "ethernet/no argument.", filename, linenum);
882 value = 0; /* silence compiler */
883 if (strcasecmp(arg, "ethernet") == 0)
884 value = SSH_TUNMODE_ETHERNET;
885 else if (strcasecmp(arg, "point-to-point") == 0)
886 value = SSH_TUNMODE_POINTOPOINT;
887 else if (strcasecmp(arg, "yes") == 0)
888 value = SSH_TUNMODE_DEFAULT;
889 else if (strcasecmp(arg, "no") == 0)
890 value = SSH_TUNMODE_NO;
892 fatal("%s line %d: Bad yes/point-to-point/ethernet/"
893 "no argument: %s", filename, linenum, arg);
900 if (!arg || *arg == '\0')
901 fatal("%.200s line %d: Missing argument.", filename, linenum);
902 value = a2tun(arg, &value2);
903 if (value == SSH_TUNID_ERR)
904 fatal("%.200s line %d: Bad tun device.", filename, linenum);
906 options->tun_local = value;
907 options->tun_remote = value2;
912 charptr = &options->local_command;
915 case oPermitLocalCommand:
916 intptr = &options->permit_local_command;
920 intptr = &options->visual_host_key;
924 intptr = &options->use_roaming;
927 #ifdef USE_ROUTINGDOMAIN
930 if (!arg || *arg == '\0')
931 fatal("%.200s line %d: Missing argument.",
933 value = a2rdomain(arg);
935 fatal("%.200s line %d: Bad rdomain.",
938 options->rdomain = value;
943 debug("%s line %d: Deprecated option \"%s\"",
944 filename, linenum, keyword);
948 error("%s line %d: Unsupported option \"%s\"",
949 filename, linenum, keyword);
953 fatal("process_config_line: Unimplemented opcode %d", opcode);
956 /* Check that there is no garbage at end of line. */
957 if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
958 fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
959 filename, linenum, arg);
966 * Reads the config file and modifies the options accordingly. Options
967 * should already be initialized before this call. This never returns if
968 * there is an error. If the file does not exist, this returns 0.
972 read_config_file(const char *filename, const char *host, Options *options,
980 if ((f = fopen(filename, "r")) == NULL)
986 if (fstat(fileno(f), &sb) == -1)
987 fatal("fstat %s: %s", filename, strerror(errno));
988 if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
989 (sb.st_mode & 022) != 0))
990 fatal("Bad owner or permissions on %s", filename);
993 debug("Reading configuration data %.200s", filename);
996 * Mark that we are now processing the options. This flag is turned
997 * on/off by Host specifications.
1001 while (fgets(line, sizeof(line), f)) {
1002 /* Update line number counter. */
1004 if (process_config_line(options, host, line, filename, linenum, &active) != 0)
1008 if (bad_options > 0)
1009 fatal("%s: terminating, %d bad configuration options",
1010 filename, bad_options);
1015 * Initializes options to special values that indicate that they have not yet
1016 * been set. Read_config_file will only set options with this value. Options
1017 * are processed in the following order: command line, user config file,
1018 * system config file. Last, fill_default_options is called.
1022 initialize_options(Options * options)
1024 memset(options, 'X', sizeof(*options));
1025 options->forward_agent = -1;
1026 options->forward_x11 = -1;
1027 options->forward_x11_trusted = -1;
1028 options->exit_on_forward_failure = -1;
1029 options->xauth_location = NULL;
1030 options->gateway_ports = -1;
1031 options->use_privileged_port = -1;
1032 options->rsa_authentication = -1;
1033 options->pubkey_authentication = -1;
1034 options->challenge_response_authentication = -1;
1035 options->gss_authentication = -1;
1036 options->gss_deleg_creds = -1;
1037 options->password_authentication = -1;
1038 options->kbd_interactive_authentication = -1;
1039 options->kbd_interactive_devices = NULL;
1040 options->rhosts_rsa_authentication = -1;
1041 options->hostbased_authentication = -1;
1042 options->batch_mode = -1;
1043 options->check_host_ip = -1;
1044 options->strict_host_key_checking = -1;
1045 options->compression = -1;
1046 options->tcp_keep_alive = -1;
1047 options->compression_level = -1;
1049 options->address_family = -1;
1050 options->connection_attempts = -1;
1051 options->connection_timeout = -1;
1052 options->number_of_password_prompts = -1;
1053 options->cipher = -1;
1054 options->ciphers = NULL;
1055 options->macs = NULL;
1056 options->hostkeyalgorithms = NULL;
1057 options->protocol = SSH_PROTO_UNKNOWN;
1058 options->num_identity_files = 0;
1059 options->hostname = NULL;
1060 options->host_key_alias = NULL;
1061 options->proxy_command = NULL;
1062 options->user = NULL;
1063 options->escape_char = -1;
1064 options->system_hostfile = NULL;
1065 options->user_hostfile = NULL;
1066 options->system_hostfile2 = NULL;
1067 options->user_hostfile2 = NULL;
1068 options->num_local_forwards = 0;
1069 options->num_remote_forwards = 0;
1070 options->clear_forwardings = -1;
1071 options->log_level = SYSLOG_LEVEL_NOT_SET;
1072 options->preferred_authentications = NULL;
1073 options->bind_address = NULL;
1074 options->smartcard_device = NULL;
1075 options->enable_ssh_keysign = - 1;
1076 options->no_host_authentication_for_localhost = - 1;
1077 options->identities_only = - 1;
1078 options->rekey_limit = - 1;
1079 options->verify_host_key_dns = -1;
1080 options->server_alive_interval = -1;
1081 options->server_alive_count_max = -1;
1082 options->num_send_env = 0;
1083 options->control_path = NULL;
1084 options->control_master = -1;
1085 options->hash_known_hosts = -1;
1086 options->tun_open = -1;
1087 options->tun_local = -1;
1088 options->tun_remote = -1;
1089 options->local_command = NULL;
1090 options->permit_local_command = -1;
1091 options->use_roaming = -1;
1092 options->rdomain = -1;
1093 options->visual_host_key = -1;
1094 options->zero_knowledge_password_authentication = -1;
1098 * Called after processing other sources of option data, this fills those
1099 * options for which no value has been specified with their default values.
1103 fill_default_options(Options * options)
1107 if (options->forward_agent == -1)
1108 options->forward_agent = 0;
1109 if (options->forward_x11 == -1)
1110 options->forward_x11 = 0;
1111 if (options->forward_x11_trusted == -1)
1112 options->forward_x11_trusted = 0;
1113 if (options->exit_on_forward_failure == -1)
1114 options->exit_on_forward_failure = 0;
1115 if (options->xauth_location == NULL)
1116 options->xauth_location = _PATH_XAUTH;
1117 if (options->gateway_ports == -1)
1118 options->gateway_ports = 0;
1119 if (options->use_privileged_port == -1)
1120 options->use_privileged_port = 0;
1121 if (options->rsa_authentication == -1)
1122 options->rsa_authentication = 1;
1123 if (options->pubkey_authentication == -1)
1124 options->pubkey_authentication = 1;
1125 if (options->challenge_response_authentication == -1)
1126 options->challenge_response_authentication = 1;
1127 if (options->gss_authentication == -1)
1128 options->gss_authentication = 0;
1129 if (options->gss_deleg_creds == -1)
1130 options->gss_deleg_creds = 0;
1131 if (options->password_authentication == -1)
1132 options->password_authentication = 1;
1133 if (options->kbd_interactive_authentication == -1)
1134 options->kbd_interactive_authentication = 1;
1135 if (options->rhosts_rsa_authentication == -1)
1136 options->rhosts_rsa_authentication = 0;
1137 if (options->hostbased_authentication == -1)
1138 options->hostbased_authentication = 0;
1139 if (options->batch_mode == -1)
1140 options->batch_mode = 0;
1141 if (options->check_host_ip == -1)
1142 options->check_host_ip = 1;
1143 if (options->strict_host_key_checking == -1)
1144 options->strict_host_key_checking = 2; /* 2 is default */
1145 if (options->compression == -1)
1146 options->compression = 0;
1147 if (options->tcp_keep_alive == -1)
1148 options->tcp_keep_alive = 1;
1149 if (options->compression_level == -1)
1150 options->compression_level = 6;
1151 if (options->port == -1)
1152 options->port = 0; /* Filled in ssh_connect. */
1153 if (options->address_family == -1)
1154 options->address_family = AF_UNSPEC;
1155 if (options->connection_attempts == -1)
1156 options->connection_attempts = 1;
1157 if (options->number_of_password_prompts == -1)
1158 options->number_of_password_prompts = 3;
1159 /* Selected in ssh_login(). */
1160 if (options->cipher == -1)
1161 options->cipher = SSH_CIPHER_NOT_SET;
1162 /* options->ciphers, default set in myproposals.h */
1163 /* options->macs, default set in myproposals.h */
1164 /* options->hostkeyalgorithms, default set in myproposals.h */
1165 if (options->protocol == SSH_PROTO_UNKNOWN)
1166 options->protocol = SSH_PROTO_2;
1167 if (options->num_identity_files == 0) {
1168 if (options->protocol & SSH_PROTO_1) {
1169 len = 2 + strlen(_PATH_SSH_CLIENT_IDENTITY) + 1;
1170 options->identity_files[options->num_identity_files] =
1172 snprintf(options->identity_files[options->num_identity_files++],
1173 len, "~/%.100s", _PATH_SSH_CLIENT_IDENTITY);
1175 if (options->protocol & SSH_PROTO_2) {
1176 len = 2 + strlen(_PATH_SSH_CLIENT_ID_RSA) + 1;
1177 options->identity_files[options->num_identity_files] =
1179 snprintf(options->identity_files[options->num_identity_files++],
1180 len, "~/%.100s", _PATH_SSH_CLIENT_ID_RSA);
1182 len = 2 + strlen(_PATH_SSH_CLIENT_ID_DSA) + 1;
1183 options->identity_files[options->num_identity_files] =
1185 snprintf(options->identity_files[options->num_identity_files++],
1186 len, "~/%.100s", _PATH_SSH_CLIENT_ID_DSA);
1189 if (options->escape_char == -1)
1190 options->escape_char = '~';
1191 if (options->system_hostfile == NULL)
1192 options->system_hostfile = _PATH_SSH_SYSTEM_HOSTFILE;
1193 if (options->user_hostfile == NULL)
1194 options->user_hostfile = _PATH_SSH_USER_HOSTFILE;
1195 if (options->system_hostfile2 == NULL)
1196 options->system_hostfile2 = _PATH_SSH_SYSTEM_HOSTFILE2;
1197 if (options->user_hostfile2 == NULL)
1198 options->user_hostfile2 = _PATH_SSH_USER_HOSTFILE2;
1199 if (options->log_level == SYSLOG_LEVEL_NOT_SET)
1200 options->log_level = SYSLOG_LEVEL_INFO;
1201 if (options->clear_forwardings == 1)
1202 clear_forwardings(options);
1203 if (options->no_host_authentication_for_localhost == - 1)
1204 options->no_host_authentication_for_localhost = 0;
1205 if (options->identities_only == -1)
1206 options->identities_only = 0;
1207 if (options->enable_ssh_keysign == -1)
1208 options->enable_ssh_keysign = 0;
1209 if (options->rekey_limit == -1)
1210 options->rekey_limit = 0;
1211 if (options->verify_host_key_dns == -1)
1212 options->verify_host_key_dns = 0;
1213 if (options->server_alive_interval == -1)
1214 options->server_alive_interval = 0;
1215 if (options->server_alive_count_max == -1)
1216 options->server_alive_count_max = 3;
1217 if (options->control_master == -1)
1218 options->control_master = 0;
1219 if (options->hash_known_hosts == -1)
1220 options->hash_known_hosts = 0;
1221 if (options->tun_open == -1)
1222 options->tun_open = SSH_TUNMODE_NO;
1223 if (options->tun_local == -1)
1224 options->tun_local = SSH_TUNID_ANY;
1225 if (options->tun_remote == -1)
1226 options->tun_remote = SSH_TUNID_ANY;
1227 if (options->permit_local_command == -1)
1228 options->permit_local_command = 0;
1229 if (options->use_roaming == -1)
1230 options->use_roaming = 1;
1231 if (options->visual_host_key == -1)
1232 options->visual_host_key = 0;
1233 if (options->zero_knowledge_password_authentication == -1)
1234 options->zero_knowledge_password_authentication = 0;
1235 /* options->local_command should not be set by default */
1236 /* options->proxy_command should not be set by default */
1237 /* options->user will be set in the main program if appropriate */
1238 /* options->hostname will be set in the main program if appropriate */
1239 /* options->host_key_alias should not be set by default */
1240 /* options->preferred_authentications will be set in ssh */
1241 /* options->rdomain should not be set by default */
1246 * parses a string containing a port forwarding specification of the form:
1248 * [listenhost:]listenport:connecthost:connectport
1250 * [listenhost:]listenport
1251 * returns number of arguments parsed or zero on error
1254 parse_forward(Forward *fwd, const char *fwdspec, int dynamicfwd, int remotefwd)
1257 char *p, *cp, *fwdarg[4];
1259 memset(fwd, '\0', sizeof(*fwd));
1261 cp = p = xstrdup(fwdspec);
1263 /* skip leading spaces */
1264 while (isspace(*cp))
1267 for (i = 0; i < 4; ++i)
1268 if ((fwdarg[i] = hpdelim(&cp)) == NULL)
1271 /* Check for trailing garbage */
1273 i = 0; /* failure */
1277 fwd->listen_host = NULL;
1278 fwd->listen_port = a2port(fwdarg[0]);
1279 fwd->connect_host = xstrdup("socks");
1283 fwd->listen_host = xstrdup(cleanhostname(fwdarg[0]));
1284 fwd->listen_port = a2port(fwdarg[1]);
1285 fwd->connect_host = xstrdup("socks");
1289 fwd->listen_host = NULL;
1290 fwd->listen_port = a2port(fwdarg[0]);
1291 fwd->connect_host = xstrdup(cleanhostname(fwdarg[1]));
1292 fwd->connect_port = a2port(fwdarg[2]);
1296 fwd->listen_host = xstrdup(cleanhostname(fwdarg[0]));
1297 fwd->listen_port = a2port(fwdarg[1]);
1298 fwd->connect_host = xstrdup(cleanhostname(fwdarg[2]));
1299 fwd->connect_port = a2port(fwdarg[3]);
1302 i = 0; /* failure */
1308 if (!(i == 1 || i == 2))
1311 if (!(i == 3 || i == 4))
1313 if (fwd->connect_port <= 0)
1317 if (fwd->listen_port < 0 || (!remotefwd && fwd->listen_port == 0))
1320 if (fwd->connect_host != NULL &&
1321 strlen(fwd->connect_host) >= NI_MAXHOST)
1323 if (fwd->listen_host != NULL &&
1324 strlen(fwd->listen_host) >= NI_MAXHOST)
1331 if (fwd->connect_host != NULL) {
1332 xfree(fwd->connect_host);
1333 fwd->connect_host = NULL;
1335 if (fwd->listen_host != NULL) {
1336 xfree(fwd->listen_host);
1337 fwd->listen_host = NULL;