- jakob@cvs.openbsd.org 2003/11/12 16:39:58

[openssh.git] / readconf.c

diff --git a/readconf.c b/readconf.c
index 96ad25a51032800588f711dd419451719406face..da49a3944a929f2d31925bcbc073185d658d3dbb 100644 (file)
--- a/readconf.c
+++ b/readconf.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: readconf.c,v 1.117 2003/08/13 09:07:09 markus Exp $");
+RCSID("$OpenBSD: readconf.c,v 1.125 2003/11/12 16:39:58 jakob Exp $");
 
 #include "ssh.h"
 #include "xmalloc.h"
@@ -89,10 +89,9 @@ RCSID("$OpenBSD: readconf.c,v 1.117 2003/08/13 09:07:09 markus Exp $");
 
 typedef enum {
        oBadOption,
-       oForwardAgent, oForwardX11, oGatewayPorts,
+       oForwardAgent, oForwardX11, oForwardX11Trusted, oGatewayPorts,
        oPasswordAuthentication, oRSAAuthentication,
        oChallengeResponseAuthentication, oXAuthLocation,
-       oKerberosAuthentication, oKerberosTgtPassing,
        oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
        oUser, oHost, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
        oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
@@ -105,7 +104,7 @@ typedef enum {
        oHostKeyAlgorithms, oBindAddress, oSmartcardDevice,
        oClearAllForwardings, oNoHostAuthenticationForLocalhost,
        oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
-       oAddressFamily,
+       oAddressFamily, oGssAuthentication, oGssDelegateCreds,
        oDeprecated, oUnsupported
 } OpCodes;
 
@@ -117,6 +116,7 @@ static struct {
 } keywords[] = {
        { "forwardagent", oForwardAgent },
        { "forwardx11", oForwardX11 },
+       { "forwardx11trusted", oForwardX11Trusted },
        { "xauthlocation", oXAuthLocation },
        { "gatewayports", oGatewayPorts },
        { "useprivilegedport", oUsePrivilegedPort },
@@ -132,14 +132,16 @@ static struct {
        { "challengeresponseauthentication", oChallengeResponseAuthentication },
        { "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
        { "tisauthentication", oChallengeResponseAuthentication },  /* alias */
-#ifdef KRB5
-       { "kerberosauthentication", oKerberosAuthentication },
-       { "kerberostgtpassing", oKerberosTgtPassing },
-#else
        { "kerberosauthentication", oUnsupported },
        { "kerberostgtpassing", oUnsupported },
-#endif
        { "afstokenpassing", oUnsupported },
+#if defined(GSSAPI)
+       { "gssapiauthentication", oGssAuthentication },
+       { "gssapidelegatecredentials", oGssDelegateCreds },
+#else
+       { "gssapiauthentication", oUnsupported },
+       { "gssapidelegatecredentials", oUnsupported },
+#endif
        { "fallbacktorsh", oDeprecated },
        { "usersh", oDeprecated },
        { "identityfile", oIdentityFile },
@@ -181,11 +183,7 @@ static struct {
 #endif
        { "clearallforwardings", oClearAllForwardings },
        { "enablesshkeysign", oEnableSSHKeysign },
-#ifdef DNS
        { "verifyhostkeydns", oVerifyHostKeyDNS },
-#else
-       { "verifyhostkeydns", oUnsupported },
-#endif
        { "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost },
        { "rekeylimit", oRekeyLimit },
        { "connecttimeout", oConnectTimeout },
@@ -341,6 +339,10 @@ parse_flag:
                intptr = &options->forward_x11;
                goto parse_flag;
 
+       case oForwardX11Trusted:
+               intptr = &options->forward_x11_trusted;
+               goto parse_flag;
+
        case oGatewayPorts:
                intptr = &options->gateway_ports;
                goto parse_flag;
@@ -381,12 +383,12 @@ parse_flag:
                intptr = &options->challenge_response_authentication;
                goto parse_flag;
 
-       case oKerberosAuthentication:
-               intptr = &options->kerberos_authentication;
+       case oGssAuthentication:
+               intptr = &options->gss_authentication;
                goto parse_flag;
 
-       case oKerberosTgtPassing:
-               intptr = &options->kerberos_tgt_passing;
+       case oGssDelegateCreds:
+               intptr = &options->gss_deleg_creds;
                goto parse_flag;
 
        case oBatchMode:
@@ -399,10 +401,11 @@ parse_flag:
 
        case oVerifyHostKeyDNS:
                intptr = &options->verify_host_key_dns;
-               goto parse_flag;
+               goto parse_yesnoask;
 
        case oStrictHostKeyChecking:
                intptr = &options->strict_host_key_checking;
+parse_yesnoask:
                arg = strdelim(&s);
                if (!arg || *arg == '\0')
                        fatal("%.200s line %d: Missing yes/no/ask argument.",
@@ -805,14 +808,15 @@ initialize_options(Options * options)
        memset(options, 'X', sizeof(*options));
        options->forward_agent = -1;
        options->forward_x11 = -1;
+       options->forward_x11_trusted = -1;
        options->xauth_location = NULL;
        options->gateway_ports = -1;
        options->use_privileged_port = -1;
        options->rsa_authentication = -1;
        options->pubkey_authentication = -1;
        options->challenge_response_authentication = -1;
-       options->kerberos_authentication = -1;
-       options->kerberos_tgt_passing = -1;
+       options->gss_authentication = -1;
+       options->gss_deleg_creds = -1;
        options->password_authentication = -1;
        options->kbd_interactive_authentication = -1;
        options->kbd_interactive_devices = NULL;
@@ -871,6 +875,8 @@ fill_default_options(Options * options)
                options->forward_agent = 0;
        if (options->forward_x11 == -1)
                options->forward_x11 = 0;
+       if (options->forward_x11_trusted == -1)
+               options->forward_x11_trusted = 0;
        if (options->xauth_location == NULL)
                options->xauth_location = _PATH_XAUTH;
        if (options->gateway_ports == -1)
@@ -883,10 +889,10 @@ fill_default_options(Options * options)
                options->pubkey_authentication = 1;
        if (options->challenge_response_authentication == -1)
                options->challenge_response_authentication = 1;
-       if (options->kerberos_authentication == -1)
-               options->kerberos_authentication = 1;
-       if (options->kerberos_tgt_passing == -1)
-               options->kerberos_tgt_passing = 1;
+       if (options->gss_authentication == -1)
+               options->gss_authentication = 0;
+       if (options->gss_deleg_creds == -1)
+               options->gss_deleg_creds = 0;
        if (options->password_authentication == -1)
                options->password_authentication = 1;
        if (options->kbd_interactive_authentication == -1)