readconf.c

   1 /*
   2  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   3  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   4  *                    All rights reserved
   5  * Functions for reading the configuration files.
   6  *
   7  * As far as I am concerned, the code I have written for this software
   8  * can be used freely for any purpose.  Any derived versions of this
   9  * software must be clearly marked as such, and if the derived work is
  10  * incompatible with the protocol description in the RFC file, it must be
  11  * called by a name other than "ssh" or "Secure Shell".
  12  */
  13
  14 #include "includes.h"
  15 RCSID("$OpenBSD: readconf.c,v 1.61 2001/02/08 14:39:36 deraadt Exp $");
  16
  17 #include "ssh.h"
  18 #include "xmalloc.h"
  19 #include "compat.h"
  20 #include "cipher.h"
  21 #include "pathnames.h"
  22 #include "log.h"
  23 #include "readconf.h"
  24 #include "match.h"
  25 #include "misc.h"
  26
  27 /* Format of the configuration file:
  28
  29    # Configuration data is parsed as follows:
  30    #  1. command line options
  31    #  2. user-specific file
  32    #  3. system-wide file
  33    # Any configuration value is only changed the first time it is set.
  34    # Thus, host-specific definitions should be at the beginning of the
  35    # configuration file, and defaults at the end.
  36
  37    # Host-specific declarations.  These may override anything above.  A single
  38    # host may match multiple declarations; these are processed in the order
  39    # that they are given in.
  40
  41    Host *.ngs.fi ngs.fi
  42      FallBackToRsh no
  43
  44    Host fake.com
  45      HostName another.host.name.real.org
  46      User blaah
  47      Port 34289
  48      ForwardX11 no
  49      ForwardAgent no
  50
  51    Host books.com
  52      RemoteForward 9999 shadows.cs.hut.fi:9999
  53      Cipher 3des
  54
  55    Host fascist.blob.com
  56      Port 23123
  57      User tylonen
  58      RhostsAuthentication no
  59      PasswordAuthentication no
  60
  61    Host puukko.hut.fi
  62      User t35124p
  63      ProxyCommand ssh-proxy %h %p
  64
  65    Host *.fr
  66      UseRsh yes
  67
  68    Host *.su
  69      Cipher none
  70      PasswordAuthentication no
  71
  72    # Defaults for various options
  73    Host *
  74      ForwardAgent no
  75      ForwardX11 no
  76      RhostsAuthentication yes
  77      PasswordAuthentication yes
  78      RSAAuthentication yes
  79      RhostsRSAAuthentication yes
  80      FallBackToRsh no
  81      UseRsh no
  82      StrictHostKeyChecking yes
  83      KeepAlives no
  84      IdentityFile ~/.ssh/identity
  85      Port 22
  86      EscapeChar ~
  87
  88 */
  89
  90 /* Keyword tokens. */
  91
  92 typedef enum {
  93         oBadOption,
  94         oForwardAgent, oForwardX11, oGatewayPorts, oRhostsAuthentication,
  95         oPasswordAuthentication, oRSAAuthentication, oFallBackToRsh, oUseRsh,
  96         oChallengeResponseAuthentication, oXAuthLocation,
  97 #ifdef KRB4
  98         oKerberosAuthentication,
  99 #endif /* KRB4 */
 100 #ifdef AFS
 101         oKerberosTgtPassing, oAFSTokenPassing,
 102 #endif
 103         oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
 104         oUser, oHost, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
 105         oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
 106         oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
 107         oCompressionLevel, oKeepAlives, oNumberOfPasswordPrompts,
 108         oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol,
 109         oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
 110         oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias
 111 } OpCodes;
 112
 113 /* Textual representations of the tokens. */
 114
 115 static struct {
 116         const char *name;
 117         OpCodes opcode;
 118 } keywords[] = {
 119         { "forwardagent", oForwardAgent },
 120         { "forwardx11", oForwardX11 },
 121         { "xauthlocation", oXAuthLocation },
 122         { "gatewayports", oGatewayPorts },
 123         { "useprivilegedport", oUsePrivilegedPort },
 124         { "rhostsauthentication", oRhostsAuthentication },
 125         { "passwordauthentication", oPasswordAuthentication },
 126         { "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
 127         { "kbdinteractivedevices", oKbdInteractiveDevices },
 128         { "rsaauthentication", oRSAAuthentication },
 129         { "pubkeyauthentication", oPubkeyAuthentication },
 130         { "dsaauthentication", oPubkeyAuthentication },             /* alias */
 131         { "challengeresponseauthentication", oChallengeResponseAuthentication },
 132         { "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
 133         { "tisauthentication", oChallengeResponseAuthentication },  /* alias */
 134 #ifdef KRB4
 135         { "kerberosauthentication", oKerberosAuthentication },
 136 #endif /* KRB4 */
 137 #ifdef AFS
 138         { "kerberostgtpassing", oKerberosTgtPassing },
 139         { "afstokenpassing", oAFSTokenPassing },
 140 #endif
 141         { "fallbacktorsh", oFallBackToRsh },
 142         { "usersh", oUseRsh },
 143         { "identityfile", oIdentityFile },
 144         { "identityfile2", oIdentityFile },                     /* alias */
 145         { "hostname", oHostName },
 146         { "hostkeyalias", oHostKeyAlias },
 147         { "proxycommand", oProxyCommand },
 148         { "port", oPort },
 149         { "cipher", oCipher },
 150         { "ciphers", oCiphers },
 151         { "protocol", oProtocol },
 152         { "remoteforward", oRemoteForward },
 153         { "localforward", oLocalForward },
 154         { "user", oUser },
 155         { "host", oHost },
 156         { "escapechar", oEscapeChar },
 157         { "rhostsrsaauthentication", oRhostsRSAAuthentication },
 158         { "globalknownhostsfile", oGlobalKnownHostsFile },
 159         { "userknownhostsfile", oUserKnownHostsFile },
 160         { "globalknownhostsfile2", oGlobalKnownHostsFile2 },
 161         { "userknownhostsfile2", oUserKnownHostsFile2 },
 162         { "connectionattempts", oConnectionAttempts },
 163         { "batchmode", oBatchMode },
 164         { "checkhostip", oCheckHostIP },
 165         { "stricthostkeychecking", oStrictHostKeyChecking },
 166         { "compression", oCompression },
 167         { "compressionlevel", oCompressionLevel },
 168         { "keepalive", oKeepAlives },
 169         { "numberofpasswordprompts", oNumberOfPasswordPrompts },
 170         { "loglevel", oLogLevel },
 171         { NULL, 0 }
 172 };
 173
 174 /*
 175  * Adds a local TCP/IP port forward to options.  Never returns if there is an
 176  * error.
 177  */
 178
 179 void
 180 add_local_forward(Options *options, u_short port, const char *host,
 181                   u_short host_port)
 182 {
 183         Forward *fwd;
 184 #ifndef HAVE_CYGWIN
 185         extern uid_t original_real_uid;
 186         if (port < IPPORT_RESERVED && original_real_uid != 0)
 187                 fatal("Privileged ports can only be forwarded by root.\n");
 188 #endif
 189         if (options->num_local_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
 190                 fatal("Too many local forwards (max %d).", SSH_MAX_FORWARDS_PER_DIRECTION);
 191         fwd = &options->local_forwards[options->num_local_forwards++];
 192         fwd->port = port;
 193         fwd->host = xstrdup(host);
 194         fwd->host_port = host_port;
 195 }
 196
 197 /*
 198  * Adds a remote TCP/IP port forward to options.  Never returns if there is
 199  * an error.
 200  */
 201
 202 void
 203 add_remote_forward(Options *options, u_short port, const char *host,
 204                    u_short host_port)
 205 {
 206         Forward *fwd;
 207         if (options->num_remote_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
 208                 fatal("Too many remote forwards (max %d).",
 209                       SSH_MAX_FORWARDS_PER_DIRECTION);
 210         fwd = &options->remote_forwards[options->num_remote_forwards++];
 211         fwd->port = port;
 212         fwd->host = xstrdup(host);
 213         fwd->host_port = host_port;
 214 }
 215
 216 /*
 217  * Returns the number of the token pointed to by cp of length len. Never
 218  * returns if the token is not known.
 219  */
 220
 221 static OpCodes
 222 parse_token(const char *cp, const char *filename, int linenum)
 223 {
 224         u_int i;
 225
 226         for (i = 0; keywords[i].name; i++)
 227                 if (strcasecmp(cp, keywords[i].name) == 0)
 228                         return keywords[i].opcode;
 229
 230         fprintf(stderr, "%s: line %d: Bad configuration option: %s\n",
 231                 filename, linenum, cp);
 232         return oBadOption;
 233 }
 234
 235 /*
 236  * Processes a single option line as used in the configuration files. This
 237  * only sets those values that have not already been set.
 238  */
 239
 240 int
 241 process_config_line(Options *options, const char *host,
 242                     char *line, const char *filename, int linenum,
 243                     int *activep)
 244 {
 245         char buf[256], *s, *string, **charptr, *endofnumber, *keyword, *arg;
 246         int opcode, *intptr, value;
 247         u_short fwd_port, fwd_host_port;
 248
 249         s = line;
 250         /* Get the keyword. (Each line is supposed to begin with a keyword). */
 251         keyword = strdelim(&s);
 252         /* Ignore leading whitespace. */
 253         if (*keyword == '\0')
 254                 keyword = strdelim(&s);
 255         if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
 256                 return 0;
 257
 258         opcode = parse_token(keyword, filename, linenum);
 259
 260         switch (opcode) {
 261         case oBadOption:
 262                 /* don't panic, but count bad options */
 263                 return -1;
 264                 /* NOTREACHED */
 265         case oForwardAgent:
 266                 intptr = &options->forward_agent;
 267 parse_flag:
 268                 arg = strdelim(&s);
 269                 if (!arg || *arg == '\0')
 270                         fatal("%.200s line %d: Missing yes/no argument.", filename, linenum);
 271                 value = 0;      /* To avoid compiler warning... */
 272                 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
 273                         value = 1;
 274                 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
 275                         value = 0;
 276                 else
 277                         fatal("%.200s line %d: Bad yes/no argument.", filename, linenum);
 278                 if (*activep && *intptr == -1)
 279                         *intptr = value;
 280                 break;
 281
 282         case oForwardX11:
 283                 intptr = &options->forward_x11;
 284                 goto parse_flag;
 285
 286         case oGatewayPorts:
 287                 intptr = &options->gateway_ports;
 288                 goto parse_flag;
 289
 290         case oUsePrivilegedPort:
 291                 intptr = &options->use_privileged_port;
 292                 goto parse_flag;
 293
 294         case oRhostsAuthentication:
 295                 intptr = &options->rhosts_authentication;
 296                 goto parse_flag;
 297
 298         case oPasswordAuthentication:
 299                 intptr = &options->password_authentication;
 300                 goto parse_flag;
 301
 302         case oKbdInteractiveAuthentication:
 303                 intptr = &options->kbd_interactive_authentication;
 304                 goto parse_flag;
 305
 306         case oKbdInteractiveDevices:
 307                 charptr = &options->kbd_interactive_devices;
 308                 goto parse_string;
 309
 310         case oPubkeyAuthentication:
 311                 intptr = &options->pubkey_authentication;
 312                 goto parse_flag;
 313
 314         case oRSAAuthentication:
 315                 intptr = &options->rsa_authentication;
 316                 goto parse_flag;
 317
 318         case oRhostsRSAAuthentication:
 319                 intptr = &options->rhosts_rsa_authentication;
 320                 goto parse_flag;
 321
 322         case oChallengeResponseAuthentication:
 323                 intptr = &options->challenge_reponse_authentication;
 324                 goto parse_flag;
 325
 326 #ifdef KRB4
 327         case oKerberosAuthentication:
 328                 intptr = &options->kerberos_authentication;
 329                 goto parse_flag;
 330 #endif /* KRB4 */
 331
 332 #ifdef AFS
 333         case oKerberosTgtPassing:
 334                 intptr = &options->kerberos_tgt_passing;
 335                 goto parse_flag;
 336
 337         case oAFSTokenPassing:
 338                 intptr = &options->afs_token_passing;
 339                 goto parse_flag;
 340 #endif
 341
 342         case oFallBackToRsh:
 343                 intptr = &options->fallback_to_rsh;
 344                 goto parse_flag;
 345
 346         case oUseRsh:
 347                 intptr = &options->use_rsh;
 348                 goto parse_flag;
 349
 350         case oBatchMode:
 351                 intptr = &options->batch_mode;
 352                 goto parse_flag;
 353
 354         case oCheckHostIP:
 355                 intptr = &options->check_host_ip;
 356                 goto parse_flag;
 357
 358         case oStrictHostKeyChecking:
 359                 intptr = &options->strict_host_key_checking;
 360                 arg = strdelim(&s);
 361                 if (!arg || *arg == '\0')
 362                         fatal("%.200s line %d: Missing yes/no/ask argument.",
 363                               filename, linenum);
 364                 value = 0;      /* To avoid compiler warning... */
 365                 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
 366                         value = 1;
 367                 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
 368                         value = 0;
 369                 else if (strcmp(arg, "ask") == 0)
 370                         value = 2;
 371                 else
 372                         fatal("%.200s line %d: Bad yes/no/ask argument.", filename, linenum);
 373                 if (*activep && *intptr == -1)
 374                         *intptr = value;
 375                 break;
 376
 377         case oCompression:
 378                 intptr = &options->compression;
 379                 goto parse_flag;
 380
 381         case oKeepAlives:
 382                 intptr = &options->keepalives;
 383                 goto parse_flag;
 384
 385         case oNumberOfPasswordPrompts:
 386                 intptr = &options->number_of_password_prompts;
 387                 goto parse_int;
 388
 389         case oCompressionLevel:
 390                 intptr = &options->compression_level;
 391                 goto parse_int;
 392
 393         case oIdentityFile:
 394                 arg = strdelim(&s);
 395                 if (!arg || *arg == '\0')
 396                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 397                 if (*activep) {
 398                         intptr = &options->num_identity_files;
 399                         if (*intptr >= SSH_MAX_IDENTITY_FILES)
 400                                 fatal("%.200s line %d: Too many identity files specified (max %d).",
 401                                       filename, linenum, SSH_MAX_IDENTITY_FILES);
 402                         charptr =  &options->identity_files[*intptr];
 403                         *charptr = xstrdup(arg);
 404                         *intptr = *intptr + 1;
 405                 }
 406                 break;
 407
 408         case oXAuthLocation:
 409                 charptr=&options->xauth_location;
 410                 goto parse_string;
 411
 412         case oUser:
 413                 charptr = &options->user;
 414 parse_string:
 415                 arg = strdelim(&s);
 416                 if (!arg || *arg == '\0')
 417                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 418                 if (*activep && *charptr == NULL)
 419                         *charptr = xstrdup(arg);
 420                 break;
 421
 422         case oGlobalKnownHostsFile:
 423                 charptr = &options->system_hostfile;
 424                 goto parse_string;
 425
 426         case oUserKnownHostsFile:
 427                 charptr = &options->user_hostfile;
 428                 goto parse_string;
 429
 430         case oGlobalKnownHostsFile2:
 431                 charptr = &options->system_hostfile2;
 432                 goto parse_string;
 433
 434         case oUserKnownHostsFile2:
 435                 charptr = &options->user_hostfile2;
 436                 goto parse_string;
 437
 438         case oHostName:
 439                 charptr = &options->hostname;
 440                 goto parse_string;
 441
 442         case oHostKeyAlias:
 443                 charptr = &options->host_key_alias;
 444                 goto parse_string;
 445
 446         case oProxyCommand:
 447                 charptr = &options->proxy_command;
 448                 string = xstrdup("");
 449                 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
 450                         string = xrealloc(string, strlen(string) + strlen(arg) + 2);
 451                         strcat(string, " ");
 452                         strcat(string, arg);
 453                 }
 454                 if (*activep && *charptr == NULL)
 455                         *charptr = string;
 456                 else
 457                         xfree(string);
 458                 return 0;
 459
 460         case oPort:
 461                 intptr = &options->port;
 462 parse_int:
 463                 arg = strdelim(&s);
 464                 if (!arg || *arg == '\0')
 465                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 466                 if (arg[0] < '0' || arg[0] > '9')
 467                         fatal("%.200s line %d: Bad number.", filename, linenum);
 468
 469                 /* Octal, decimal, or hex format? */
 470                 value = strtol(arg, &endofnumber, 0);
 471                 if (arg == endofnumber)
 472                         fatal("%.200s line %d: Bad number.", filename, linenum);
 473                 if (*activep && *intptr == -1)
 474                         *intptr = value;
 475                 break;
 476
 477         case oConnectionAttempts:
 478                 intptr = &options->connection_attempts;
 479                 goto parse_int;
 480
 481         case oCipher:
 482                 intptr = &options->cipher;
 483                 arg = strdelim(&s);
 484                 if (!arg || *arg == '\0')
 485                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 486                 value = cipher_number(arg);
 487                 if (value == -1)
 488                         fatal("%.200s line %d: Bad cipher '%s'.",
 489                               filename, linenum, arg ? arg : "<NONE>");
 490                 if (*activep && *intptr == -1)
 491                         *intptr = value;
 492                 break;
 493
 494         case oCiphers:
 495                 arg = strdelim(&s);
 496                 if (!arg || *arg == '\0')
 497                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 498                 if (!ciphers_valid(arg))
 499                         fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
 500                               filename, linenum, arg ? arg : "<NONE>");
 501                 if (*activep && options->ciphers == NULL)
 502                         options->ciphers = xstrdup(arg);
 503                 break;
 504
 505         case oProtocol:
 506                 intptr = &options->protocol;
 507                 arg = strdelim(&s);
 508                 if (!arg || *arg == '\0')
 509                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 510                 value = proto_spec(arg);
 511                 if (value == SSH_PROTO_UNKNOWN)
 512                         fatal("%.200s line %d: Bad protocol spec '%s'.",
 513                               filename, linenum, arg ? arg : "<NONE>");
 514                 if (*activep && *intptr == SSH_PROTO_UNKNOWN)
 515                         *intptr = value;
 516                 break;
 517
 518         case oLogLevel:
 519                 intptr = (int *) &options->log_level;
 520                 arg = strdelim(&s);
 521                 value = log_level_number(arg);
 522                 if (value == (LogLevel) - 1)
 523                         fatal("%.200s line %d: unsupported log level '%s'\n",
 524                               filename, linenum, arg ? arg : "<NONE>");
 525                 if (*activep && (LogLevel) * intptr == -1)
 526                         *intptr = (LogLevel) value;
 527                 break;
 528
 529         case oRemoteForward:
 530                 arg = strdelim(&s);
 531                 if (!arg || *arg == '\0')
 532                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 533                 if (arg[0] < '0' || arg[0] > '9')
 534                         fatal("%.200s line %d: Badly formatted port number.",
 535                               filename, linenum);
 536                 fwd_port = atoi(arg);
 537                 arg = strdelim(&s);
 538                 if (!arg || *arg == '\0')
 539                         fatal("%.200s line %d: Missing second argument.",
 540                               filename, linenum);
 541                 if (sscanf(arg, "%255[^:]:%hu", buf, &fwd_host_port) != 2)
 542                         fatal("%.200s line %d: Badly formatted host:port.",
 543                               filename, linenum);
 544                 if (*activep)
 545                         add_remote_forward(options, fwd_port, buf, fwd_host_port);
 546                 break;
 547
 548         case oLocalForward:
 549                 arg = strdelim(&s);
 550                 if (!arg || *arg == '\0')
 551                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 552                 if (arg[0] < '0' || arg[0] > '9')
 553                         fatal("%.200s line %d: Badly formatted port number.",
 554                               filename, linenum);
 555                 fwd_port = atoi(arg);
 556                 arg = strdelim(&s);
 557                 if (!arg || *arg == '\0')
 558                         fatal("%.200s line %d: Missing second argument.",
 559                               filename, linenum);
 560                 if (sscanf(arg, "%255[^:]:%hu", buf, &fwd_host_port) != 2)
 561                         fatal("%.200s line %d: Badly formatted host:port.",
 562                               filename, linenum);
 563                 if (*activep)
 564                         add_local_forward(options, fwd_port, buf, fwd_host_port);
 565                 break;
 566
 567         case oHost:
 568                 *activep = 0;
 569                 while ((arg = strdelim(&s)) != NULL && *arg != '\0')
 570                         if (match_pattern(host, arg)) {
 571                                 debug("Applying options for %.100s", arg);
 572                                 *activep = 1;
 573                                 break;
 574                         }
 575                 /* Avoid garbage check below, as strdelim is done. */
 576                 return 0;
 577
 578         case oEscapeChar:
 579                 intptr = &options->escape_char;
 580                 arg = strdelim(&s);
 581                 if (!arg || *arg == '\0')
 582                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 583                 if (arg[0] == '^' && arg[2] == 0 &&
 584                     (u_char) arg[1] >= 64 && (u_char) arg[1] < 128)
 585                         value = (u_char) arg[1] & 31;
 586                 else if (strlen(arg) == 1)
 587                         value = (u_char) arg[0];
 588                 else if (strcmp(arg, "none") == 0)
 589                         value = -2;
 590                 else {
 591                         fatal("%.200s line %d: Bad escape character.",
 592                               filename, linenum);
 593                         /* NOTREACHED */
 594                         value = 0;      /* Avoid compiler warning. */
 595                 }
 596                 if (*activep && *intptr == -1)
 597                         *intptr = value;
 598                 break;
 599
 600         default:
 601                 fatal("process_config_line: Unimplemented opcode %d", opcode);
 602         }
 603
 604         /* Check that there is no garbage at end of line. */
 605         if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
 606                 fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
 607                       filename, linenum, arg);
 608         }
 609         return 0;
 610 }
 611
 612
 613 /*
 614  * Reads the config file and modifies the options accordingly.  Options
 615  * should already be initialized before this call.  This never returns if
 616  * there is an error.  If the file does not exist, this returns immediately.
 617  */
 618
 619 void
 620 read_config_file(const char *filename, const char *host, Options *options)
 621 {
 622         FILE *f;
 623         char line[1024];
 624         int active, linenum;
 625         int bad_options = 0;
 626
 627         /* Open the file. */
 628         f = fopen(filename, "r");
 629         if (!f)
 630                 return;
 631
 632         debug("Reading configuration data %.200s", filename);
 633
 634         /*
 635          * Mark that we are now processing the options.  This flag is turned
 636          * on/off by Host specifications.
 637          */
 638         active = 1;
 639         linenum = 0;
 640         while (fgets(line, sizeof(line), f)) {
 641                 /* Update line number counter. */
 642                 linenum++;
 643                 if (process_config_line(options, host, line, filename, linenum, &active) != 0)
 644                         bad_options++;
 645         }
 646         fclose(f);
 647         if (bad_options > 0)
 648                 fatal("%s: terminating, %d bad configuration options\n",
 649                       filename, bad_options);
 650 }
 651
 652 /*
 653  * Initializes options to special values that indicate that they have not yet
 654  * been set.  Read_config_file will only set options with this value. Options
 655  * are processed in the following order: command line, user config file,
 656  * system config file.  Last, fill_default_options is called.
 657  */
 658
 659 void
 660 initialize_options(Options * options)
 661 {
 662         memset(options, 'X', sizeof(*options));
 663         options->forward_agent = -1;
 664         options->forward_x11 = -1;
 665         options->xauth_location = NULL;
 666         options->gateway_ports = -1;
 667         options->use_privileged_port = -1;
 668         options->rhosts_authentication = -1;
 669         options->rsa_authentication = -1;
 670         options->pubkey_authentication = -1;
 671         options->challenge_reponse_authentication = -1;
 672 #ifdef KRB4
 673         options->kerberos_authentication = -1;
 674 #endif
 675 #ifdef AFS
 676         options->kerberos_tgt_passing = -1;
 677         options->afs_token_passing = -1;
 678 #endif
 679         options->password_authentication = -1;
 680         options->kbd_interactive_authentication = -1;
 681         options->kbd_interactive_devices = NULL;
 682         options->rhosts_rsa_authentication = -1;
 683         options->fallback_to_rsh = -1;
 684         options->use_rsh = -1;
 685         options->batch_mode = -1;
 686         options->check_host_ip = -1;
 687         options->strict_host_key_checking = -1;
 688         options->compression = -1;
 689         options->keepalives = -1;
 690         options->compression_level = -1;
 691         options->port = -1;
 692         options->connection_attempts = -1;
 693         options->number_of_password_prompts = -1;
 694         options->cipher = -1;
 695         options->ciphers = NULL;
 696         options->protocol = SSH_PROTO_UNKNOWN;
 697         options->num_identity_files = 0;
 698         options->hostname = NULL;
 699         options->host_key_alias = NULL;
 700         options->proxy_command = NULL;
 701         options->user = NULL;
 702         options->escape_char = -1;
 703         options->system_hostfile = NULL;
 704         options->user_hostfile = NULL;
 705         options->system_hostfile2 = NULL;
 706         options->user_hostfile2 = NULL;
 707         options->num_local_forwards = 0;
 708         options->num_remote_forwards = 0;
 709         options->log_level = (LogLevel) - 1;
 710 }
 711
 712 /*
 713  * Called after processing other sources of option data, this fills those
 714  * options for which no value has been specified with their default values.
 715  */
 716
 717 void
 718 fill_default_options(Options * options)
 719 {
 720         int len;
 721
 722         if (options->forward_agent == -1)
 723                 options->forward_agent = 0;
 724         if (options->forward_x11 == -1)
 725                 options->forward_x11 = 0;
 726 #ifdef XAUTH_PATH
 727         if (options->xauth_location == NULL)
 728                 options->xauth_location = XAUTH_PATH;
 729 #endif /* XAUTH_PATH */
 730         if (options->gateway_ports == -1)
 731                 options->gateway_ports = 0;
 732         if (options->use_privileged_port == -1)
 733                 options->use_privileged_port = 1;
 734         if (options->rhosts_authentication == -1)
 735                 options->rhosts_authentication = 1;
 736         if (options->rsa_authentication == -1)
 737                 options->rsa_authentication = 1;
 738         if (options->pubkey_authentication == -1)
 739                 options->pubkey_authentication = 1;
 740         if (options->challenge_reponse_authentication == -1)
 741                 options->challenge_reponse_authentication = 0;
 742 #ifdef KRB4
 743         if (options->kerberos_authentication == -1)
 744                 options->kerberos_authentication = 1;
 745 #endif /* KRB4 */
 746 #ifdef AFS
 747         if (options->kerberos_tgt_passing == -1)
 748                 options->kerberos_tgt_passing = 1;
 749         if (options->afs_token_passing == -1)
 750                 options->afs_token_passing = 1;
 751 #endif /* AFS */
 752         if (options->password_authentication == -1)
 753                 options->password_authentication = 1;
 754         if (options->kbd_interactive_authentication == -1)
 755                 options->kbd_interactive_authentication = 1;
 756         if (options->rhosts_rsa_authentication == -1)
 757                 options->rhosts_rsa_authentication = 1;
 758         if (options->fallback_to_rsh == -1)
 759                 options->fallback_to_rsh = 0;
 760         if (options->use_rsh == -1)
 761                 options->use_rsh = 0;
 762         if (options->batch_mode == -1)
 763                 options->batch_mode = 0;
 764         if (options->check_host_ip == -1)
 765                 options->check_host_ip = 1;
 766         if (options->strict_host_key_checking == -1)
 767                 options->strict_host_key_checking = 2;  /* 2 is default */
 768         if (options->compression == -1)
 769                 options->compression = 0;
 770         if (options->keepalives == -1)
 771                 options->keepalives = 1;
 772         if (options->compression_level == -1)
 773                 options->compression_level = 6;
 774         if (options->port == -1)
 775                 options->port = 0;      /* Filled in ssh_connect. */
 776         if (options->connection_attempts == -1)
 777                 options->connection_attempts = 4;
 778         if (options->number_of_password_prompts == -1)
 779                 options->number_of_password_prompts = 3;
 780         /* Selected in ssh_login(). */
 781         if (options->cipher == -1)
 782                 options->cipher = SSH_CIPHER_NOT_SET;
 783         /* options->ciphers, default set in myproposals.h */
 784         if (options->protocol == SSH_PROTO_UNKNOWN)
 785                 options->protocol = SSH_PROTO_1|SSH_PROTO_2|SSH_PROTO_1_PREFERRED;
 786         if (options->num_identity_files == 0) {
 787                 if (options->protocol & SSH_PROTO_1) {
 788                         len = 2 + strlen(_PATH_SSH_CLIENT_IDENTITY) + 1;
 789                         options->identity_files[options->num_identity_files] =
 790                             xmalloc(len);
 791                         snprintf(options->identity_files[options->num_identity_files++],
 792                             len, "~/%.100s", _PATH_SSH_CLIENT_IDENTITY);
 793                 }
 794                 if (options->protocol & SSH_PROTO_2) {
 795                         len = 2 + strlen(_PATH_SSH_CLIENT_ID_DSA) + 1;
 796                         options->identity_files[options->num_identity_files] =
 797                             xmalloc(len);
 798                         snprintf(options->identity_files[options->num_identity_files++],
 799                             len, "~/%.100s", _PATH_SSH_CLIENT_ID_DSA);
 800                 }
 801         }
 802         if (options->escape_char == -1)
 803                 options->escape_char = '~';
 804         if (options->system_hostfile == NULL)
 805                 options->system_hostfile = _PATH_SSH_SYSTEM_HOSTFILE;
 806         if (options->user_hostfile == NULL)
 807                 options->user_hostfile = _PATH_SSH_USER_HOSTFILE;
 808         if (options->system_hostfile2 == NULL)
 809                 options->system_hostfile2 = _PATH_SSH_SYSTEM_HOSTFILE2;
 810         if (options->user_hostfile2 == NULL)
 811                 options->user_hostfile2 = _PATH_SSH_USER_HOSTFILE2;
 812         if (options->log_level == (LogLevel) - 1)
 813                 options->log_level = SYSLOG_LEVEL_INFO;
 814         /* options->proxy_command should not be set by default */
 815         /* options->user will be set in the main program if appropriate */
 816         /* options->hostname will be set in the main program if appropriate */
 817         /* options->host_key_alias should not be set by default */
 818 }