Annotation of src/usr.bin/ssh/readconf.c, Revision 1.46
1.1 deraadt 1: /*
1.18 deraadt 2: * Author: Tatu Ylonen <ylo@cs.hut.fi>
3: * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4: * All rights reserved
5: * Functions for reading the configuration files.
1.26 markus 6: *
1.46 ! deraadt 7: * As far as I am concerned, the code I have written for this software
! 8: * can be used freely for any purpose. Any derived versions of this
! 9: * software must be clearly marked as such, and if the derived work is
! 10: * incompatible with the protocol description in the RFC file, it must be
! 11: * called by a name other than "ssh" or "Secure Shell".
! 12: *
! 13: *
! 14: * Copyright (c) 2000 Markus Friedl. All rights reserved.
! 15: *
! 16: * Redistribution and use in source and binary forms, with or without
! 17: * modification, are permitted provided that the following conditions
! 18: * are met:
! 19: * 1. Redistributions of source code must retain the above copyright
! 20: * notice, this list of conditions and the following disclaimer.
! 21: * 2. Redistributions in binary form must reproduce the above copyright
! 22: * notice, this list of conditions and the following disclaimer in the
! 23: * documentation and/or other materials provided with the distribution.
! 24: *
! 25: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
! 26: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
! 27: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
! 28: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
! 29: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
! 30: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
! 31: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
! 32: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
! 33: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
! 34: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.18 deraadt 35: */
1.1 deraadt 36:
37: #include "includes.h"
1.46 ! deraadt 38: RCSID("$OpenBSD: readconf.c,v 1.45 2000/08/02 17:27:04 provos Exp $");
1.1 deraadt 39:
40: #include "ssh.h"
41: #include "cipher.h"
42: #include "readconf.h"
1.24 markus 43: #include "match.h"
1.1 deraadt 44: #include "xmalloc.h"
1.25 markus 45: #include "compat.h"
1.1 deraadt 46:
47: /* Format of the configuration file:
48:
49: # Configuration data is parsed as follows:
50: # 1. command line options
51: # 2. user-specific file
52: # 3. system-wide file
53: # Any configuration value is only changed the first time it is set.
54: # Thus, host-specific definitions should be at the beginning of the
55: # configuration file, and defaults at the end.
56:
57: # Host-specific declarations. These may override anything above. A single
58: # host may match multiple declarations; these are processed in the order
59: # that they are given in.
60:
61: Host *.ngs.fi ngs.fi
62: FallBackToRsh no
63:
64: Host fake.com
65: HostName another.host.name.real.org
66: User blaah
67: Port 34289
68: ForwardX11 no
69: ForwardAgent no
70:
71: Host books.com
72: RemoteForward 9999 shadows.cs.hut.fi:9999
73: Cipher 3des
74:
75: Host fascist.blob.com
76: Port 23123
77: User tylonen
78: RhostsAuthentication no
79: PasswordAuthentication no
80:
81: Host puukko.hut.fi
82: User t35124p
83: ProxyCommand ssh-proxy %h %p
84:
85: Host *.fr
86: UseRsh yes
87:
88: Host *.su
89: Cipher none
90: PasswordAuthentication no
91:
92: # Defaults for various options
93: Host *
94: ForwardAgent no
95: ForwardX11 yes
96: RhostsAuthentication yes
97: PasswordAuthentication yes
98: RSAAuthentication yes
99: RhostsRSAAuthentication yes
100: FallBackToRsh no
101: UseRsh no
102: StrictHostKeyChecking yes
103: KeepAlives no
104: IdentityFile ~/.ssh/identity
105: Port 22
106: EscapeChar ~
107:
108: */
109:
110: /* Keyword tokens. */
111:
1.17 markus 112: typedef enum {
113: oBadOption,
114: oForwardAgent, oForwardX11, oGatewayPorts, oRhostsAuthentication,
115: oPasswordAuthentication, oRSAAuthentication, oFallBackToRsh, oUseRsh,
1.34 markus 116: oSkeyAuthentication, oXAuthLocation,
1.1 deraadt 117: #ifdef KRB4
1.17 markus 118: oKerberosAuthentication,
1.1 deraadt 119: #endif /* KRB4 */
120: #ifdef AFS
1.17 markus 121: oKerberosTgtPassing, oAFSTokenPassing,
1.1 deraadt 122: #endif
1.17 markus 123: oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
124: oUser, oHost, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
125: oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
126: oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
127: oCompressionLevel, oKeepAlives, oNumberOfPasswordPrompts, oTISAuthentication,
1.27 markus 128: oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oIdentityFile2,
1.30 markus 129: oGlobalKnownHostsFile2, oUserKnownHostsFile2, oDSAAuthentication
1.1 deraadt 130: } OpCodes;
131:
132: /* Textual representations of the tokens. */
133:
1.17 markus 134: static struct {
135: const char *name;
136: OpCodes opcode;
137: } keywords[] = {
138: { "forwardagent", oForwardAgent },
139: { "forwardx11", oForwardX11 },
1.34 markus 140: { "xauthlocation", oXAuthLocation },
1.17 markus 141: { "gatewayports", oGatewayPorts },
142: { "useprivilegedport", oUsePrivilegedPort },
143: { "rhostsauthentication", oRhostsAuthentication },
144: { "passwordauthentication", oPasswordAuthentication },
145: { "rsaauthentication", oRSAAuthentication },
1.30 markus 146: { "dsaauthentication", oDSAAuthentication },
1.17 markus 147: { "skeyauthentication", oSkeyAuthentication },
1.1 deraadt 148: #ifdef KRB4
1.17 markus 149: { "kerberosauthentication", oKerberosAuthentication },
1.1 deraadt 150: #endif /* KRB4 */
1.5 dugsong 151: #ifdef AFS
1.17 markus 152: { "kerberostgtpassing", oKerberosTgtPassing },
153: { "afstokenpassing", oAFSTokenPassing },
1.1 deraadt 154: #endif
1.17 markus 155: { "fallbacktorsh", oFallBackToRsh },
156: { "usersh", oUseRsh },
157: { "identityfile", oIdentityFile },
1.27 markus 158: { "identityfile2", oIdentityFile2 },
1.17 markus 159: { "hostname", oHostName },
160: { "proxycommand", oProxyCommand },
161: { "port", oPort },
162: { "cipher", oCipher },
1.25 markus 163: { "ciphers", oCiphers },
164: { "protocol", oProtocol },
1.17 markus 165: { "remoteforward", oRemoteForward },
166: { "localforward", oLocalForward },
167: { "user", oUser },
168: { "host", oHost },
169: { "escapechar", oEscapeChar },
170: { "rhostsrsaauthentication", oRhostsRSAAuthentication },
171: { "globalknownhostsfile", oGlobalKnownHostsFile },
172: { "userknownhostsfile", oUserKnownHostsFile },
1.27 markus 173: { "globalknownhostsfile2", oGlobalKnownHostsFile2 },
174: { "userknownhostsfile2", oUserKnownHostsFile2 },
1.17 markus 175: { "connectionattempts", oConnectionAttempts },
176: { "batchmode", oBatchMode },
177: { "checkhostip", oCheckHostIP },
178: { "stricthostkeychecking", oStrictHostKeyChecking },
179: { "compression", oCompression },
180: { "compressionlevel", oCompressionLevel },
181: { "keepalive", oKeepAlives },
182: { "numberofpasswordprompts", oNumberOfPasswordPrompts },
183: { "tisauthentication", oTISAuthentication },
184: { "loglevel", oLogLevel },
185: { NULL, 0 }
1.13 markus 186: };
187:
1.19 markus 188: /*
189: * Adds a local TCP/IP port forward to options. Never returns if there is an
190: * error.
191: */
1.1 deraadt 192:
1.26 markus 193: void
1.22 markus 194: add_local_forward(Options *options, u_short port, const char *host,
195: u_short host_port)
1.1 deraadt 196: {
1.17 markus 197: Forward *fwd;
198: extern uid_t original_real_uid;
199: if (port < IPPORT_RESERVED && original_real_uid != 0)
200: fatal("Privileged ports can only be forwarded by root.\n");
201: if (options->num_local_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
202: fatal("Too many local forwards (max %d).", SSH_MAX_FORWARDS_PER_DIRECTION);
203: fwd = &options->local_forwards[options->num_local_forwards++];
204: fwd->port = port;
205: fwd->host = xstrdup(host);
206: fwd->host_port = host_port;
1.1 deraadt 207: }
208:
1.19 markus 209: /*
210: * Adds a remote TCP/IP port forward to options. Never returns if there is
211: * an error.
212: */
1.1 deraadt 213:
1.26 markus 214: void
1.22 markus 215: add_remote_forward(Options *options, u_short port, const char *host,
216: u_short host_port)
1.1 deraadt 217: {
1.17 markus 218: Forward *fwd;
219: if (options->num_remote_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
220: fatal("Too many remote forwards (max %d).",
221: SSH_MAX_FORWARDS_PER_DIRECTION);
222: fwd = &options->remote_forwards[options->num_remote_forwards++];
223: fwd->port = port;
224: fwd->host = xstrdup(host);
225: fwd->host_port = host_port;
1.1 deraadt 226: }
227:
1.19 markus 228: /*
229: * Returns the number of the token pointed to by cp of length len. Never
230: * returns if the token is not known.
231: */
1.1 deraadt 232:
1.26 markus 233: static OpCodes
1.17 markus 234: parse_token(const char *cp, const char *filename, int linenum)
1.1 deraadt 235: {
1.17 markus 236: unsigned int i;
1.1 deraadt 237:
1.17 markus 238: for (i = 0; keywords[i].name; i++)
1.20 markus 239: if (strcasecmp(cp, keywords[i].name) == 0)
1.17 markus 240: return keywords[i].opcode;
241:
242: fprintf(stderr, "%s: line %d: Bad configuration option: %s\n",
243: filename, linenum, cp);
244: return oBadOption;
1.1 deraadt 245: }
246:
1.19 markus 247: /*
248: * Processes a single option line as used in the configuration files. This
249: * only sets those values that have not already been set.
250: */
1.1 deraadt 251:
1.14 markus 252: int
253: process_config_line(Options *options, const char *host,
1.17 markus 254: char *line, const char *filename, int linenum,
255: int *activep)
1.1 deraadt 256: {
1.38 provos 257: char buf[256], *s, *string, **charptr, *endofnumber, *keyword, *arg;
1.22 markus 258: int opcode, *intptr, value;
259: u_short fwd_port, fwd_host_port;
1.1 deraadt 260:
1.42 provos 261: s = line;
262: /* Get the keyword. (Each line is supposed to begin with a keyword). */
263: keyword = strdelim(&s);
264: /* Ignore leading whitespace. */
265: if (*keyword == '\0')
1.43 markus 266: keyword = strdelim(&s);
1.42 provos 267: if (!*keyword || *keyword == '\n' || *keyword == '#')
1.17 markus 268: return 0;
269:
1.38 provos 270: opcode = parse_token(keyword, filename, linenum);
1.17 markus 271:
272: switch (opcode) {
273: case oBadOption:
1.19 markus 274: /* don't panic, but count bad options */
275: return -1;
1.17 markus 276: /* NOTREACHED */
277: case oForwardAgent:
278: intptr = &options->forward_agent;
279: parse_flag:
1.42 provos 280: arg = strdelim(&s);
1.40 ho 281: if (!arg || *arg == '\0')
1.17 markus 282: fatal("%.200s line %d: Missing yes/no argument.", filename, linenum);
283: value = 0; /* To avoid compiler warning... */
1.38 provos 284: if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
1.17 markus 285: value = 1;
1.38 provos 286: else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
1.17 markus 287: value = 0;
288: else
289: fatal("%.200s line %d: Bad yes/no argument.", filename, linenum);
290: if (*activep && *intptr == -1)
291: *intptr = value;
292: break;
293:
294: case oForwardX11:
295: intptr = &options->forward_x11;
296: goto parse_flag;
297:
298: case oGatewayPorts:
299: intptr = &options->gateway_ports;
300: goto parse_flag;
301:
302: case oUsePrivilegedPort:
303: intptr = &options->use_privileged_port;
304: goto parse_flag;
305:
306: case oRhostsAuthentication:
307: intptr = &options->rhosts_authentication;
308: goto parse_flag;
309:
310: case oPasswordAuthentication:
311: intptr = &options->password_authentication;
312: goto parse_flag;
313:
1.30 markus 314: case oDSAAuthentication:
315: intptr = &options->dsa_authentication;
316: goto parse_flag;
317:
1.17 markus 318: case oRSAAuthentication:
319: intptr = &options->rsa_authentication;
320: goto parse_flag;
321:
322: case oRhostsRSAAuthentication:
323: intptr = &options->rhosts_rsa_authentication;
324: goto parse_flag;
325:
326: case oTISAuthentication:
327: /* fallthrough, there is no difference on the client side */
328: case oSkeyAuthentication:
329: intptr = &options->skey_authentication;
330: goto parse_flag;
1.16 markus 331:
1.1 deraadt 332: #ifdef KRB4
1.17 markus 333: case oKerberosAuthentication:
334: intptr = &options->kerberos_authentication;
335: goto parse_flag;
1.1 deraadt 336: #endif /* KRB4 */
337:
1.5 dugsong 338: #ifdef AFS
1.17 markus 339: case oKerberosTgtPassing:
340: intptr = &options->kerberos_tgt_passing;
341: goto parse_flag;
342:
343: case oAFSTokenPassing:
344: intptr = &options->afs_token_passing;
345: goto parse_flag;
1.1 deraadt 346: #endif
1.17 markus 347:
348: case oFallBackToRsh:
349: intptr = &options->fallback_to_rsh;
350: goto parse_flag;
351:
352: case oUseRsh:
353: intptr = &options->use_rsh;
354: goto parse_flag;
355:
356: case oBatchMode:
357: intptr = &options->batch_mode;
358: goto parse_flag;
359:
360: case oCheckHostIP:
361: intptr = &options->check_host_ip;
362: goto parse_flag;
363:
364: case oStrictHostKeyChecking:
365: intptr = &options->strict_host_key_checking;
1.42 provos 366: arg = strdelim(&s);
1.40 ho 367: if (!arg || *arg == '\0')
1.17 markus 368: fatal("%.200s line %d: Missing yes/no argument.",
369: filename, linenum);
370: value = 0; /* To avoid compiler warning... */
1.38 provos 371: if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
1.17 markus 372: value = 1;
1.38 provos 373: else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
1.17 markus 374: value = 0;
1.38 provos 375: else if (strcmp(arg, "ask") == 0)
1.17 markus 376: value = 2;
377: else
378: fatal("%.200s line %d: Bad yes/no/ask argument.", filename, linenum);
379: if (*activep && *intptr == -1)
380: *intptr = value;
381: break;
382:
383: case oCompression:
384: intptr = &options->compression;
385: goto parse_flag;
386:
387: case oKeepAlives:
388: intptr = &options->keepalives;
389: goto parse_flag;
390:
391: case oNumberOfPasswordPrompts:
392: intptr = &options->number_of_password_prompts;
393: goto parse_int;
394:
395: case oCompressionLevel:
396: intptr = &options->compression_level;
397: goto parse_int;
398:
399: case oIdentityFile:
1.27 markus 400: case oIdentityFile2:
1.42 provos 401: arg = strdelim(&s);
1.40 ho 402: if (!arg || *arg == '\0')
1.17 markus 403: fatal("%.200s line %d: Missing argument.", filename, linenum);
404: if (*activep) {
1.27 markus 405: intptr = (opcode == oIdentityFile) ?
406: &options->num_identity_files :
407: &options->num_identity_files2;
408: if (*intptr >= SSH_MAX_IDENTITY_FILES)
1.17 markus 409: fatal("%.200s line %d: Too many identity files specified (max %d).",
410: filename, linenum, SSH_MAX_IDENTITY_FILES);
1.27 markus 411: charptr = (opcode == oIdentityFile) ?
412: &options->identity_files[*intptr] :
413: &options->identity_files2[*intptr];
1.38 provos 414: *charptr = xstrdup(arg);
1.27 markus 415: *intptr = *intptr + 1;
1.17 markus 416: }
417: break;
418:
1.34 markus 419: case oXAuthLocation:
420: charptr=&options->xauth_location;
421: goto parse_string;
422:
1.17 markus 423: case oUser:
424: charptr = &options->user;
425: parse_string:
1.42 provos 426: arg = strdelim(&s);
1.40 ho 427: if (!arg || *arg == '\0')
1.17 markus 428: fatal("%.200s line %d: Missing argument.", filename, linenum);
429: if (*activep && *charptr == NULL)
1.38 provos 430: *charptr = xstrdup(arg);
1.17 markus 431: break;
432:
433: case oGlobalKnownHostsFile:
434: charptr = &options->system_hostfile;
435: goto parse_string;
436:
437: case oUserKnownHostsFile:
438: charptr = &options->user_hostfile;
439: goto parse_string;
440:
1.27 markus 441: case oGlobalKnownHostsFile2:
442: charptr = &options->system_hostfile2;
443: goto parse_string;
444:
445: case oUserKnownHostsFile2:
446: charptr = &options->user_hostfile2;
447: goto parse_string;
448:
1.17 markus 449: case oHostName:
450: charptr = &options->hostname;
451: goto parse_string;
452:
453: case oProxyCommand:
454: charptr = &options->proxy_command;
455: string = xstrdup("");
1.42 provos 456: while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1.38 provos 457: string = xrealloc(string, strlen(string) + strlen(arg) + 2);
1.17 markus 458: strcat(string, " ");
1.38 provos 459: strcat(string, arg);
1.17 markus 460: }
461: if (*activep && *charptr == NULL)
462: *charptr = string;
463: else
464: xfree(string);
465: return 0;
466:
467: case oPort:
468: intptr = &options->port;
469: parse_int:
1.42 provos 470: arg = strdelim(&s);
1.40 ho 471: if (!arg || *arg == '\0')
1.17 markus 472: fatal("%.200s line %d: Missing argument.", filename, linenum);
1.38 provos 473: if (arg[0] < '0' || arg[0] > '9')
1.17 markus 474: fatal("%.200s line %d: Bad number.", filename, linenum);
1.21 markus 475:
476: /* Octal, decimal, or hex format? */
1.38 provos 477: value = strtol(arg, &endofnumber, 0);
478: if (arg == endofnumber)
1.21 markus 479: fatal("%.200s line %d: Bad number.", filename, linenum);
1.17 markus 480: if (*activep && *intptr == -1)
481: *intptr = value;
482: break;
483:
484: case oConnectionAttempts:
485: intptr = &options->connection_attempts;
486: goto parse_int;
487:
488: case oCipher:
489: intptr = &options->cipher;
1.42 provos 490: arg = strdelim(&s);
1.40 ho 491: if (!arg || *arg == '\0')
1.32 markus 492: fatal("%.200s line %d: Missing argument.", filename, linenum);
1.38 provos 493: value = cipher_number(arg);
1.17 markus 494: if (value == -1)
495: fatal("%.200s line %d: Bad cipher '%s'.",
1.38 provos 496: filename, linenum, arg ? arg : "<NONE>");
1.17 markus 497: if (*activep && *intptr == -1)
498: *intptr = value;
499: break;
500:
1.25 markus 501: case oCiphers:
1.42 provos 502: arg = strdelim(&s);
1.40 ho 503: if (!arg || *arg == '\0')
1.32 markus 504: fatal("%.200s line %d: Missing argument.", filename, linenum);
1.38 provos 505: if (!ciphers_valid(arg))
1.31 markus 506: fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
1.38 provos 507: filename, linenum, arg ? arg : "<NONE>");
1.25 markus 508: if (*activep && options->ciphers == NULL)
1.38 provos 509: options->ciphers = xstrdup(arg);
1.25 markus 510: break;
511:
512: case oProtocol:
513: intptr = &options->protocol;
1.42 provos 514: arg = strdelim(&s);
1.40 ho 515: if (!arg || *arg == '\0')
1.32 markus 516: fatal("%.200s line %d: Missing argument.", filename, linenum);
1.38 provos 517: value = proto_spec(arg);
1.25 markus 518: if (value == SSH_PROTO_UNKNOWN)
519: fatal("%.200s line %d: Bad protocol spec '%s'.",
1.38 provos 520: filename, linenum, arg ? arg : "<NONE>");
1.25 markus 521: if (*activep && *intptr == SSH_PROTO_UNKNOWN)
522: *intptr = value;
523: break;
524:
1.17 markus 525: case oLogLevel:
526: intptr = (int *) &options->log_level;
1.42 provos 527: arg = strdelim(&s);
1.38 provos 528: value = log_level_number(arg);
1.17 markus 529: if (value == (LogLevel) - 1)
530: fatal("%.200s line %d: unsupported log level '%s'\n",
1.38 provos 531: filename, linenum, arg ? arg : "<NONE>");
1.17 markus 532: if (*activep && (LogLevel) * intptr == -1)
533: *intptr = (LogLevel) value;
534: break;
535:
536: case oRemoteForward:
1.42 provos 537: arg = strdelim(&s);
1.40 ho 538: if (!arg || *arg == '\0')
1.17 markus 539: fatal("%.200s line %d: Missing argument.", filename, linenum);
1.38 provos 540: if (arg[0] < '0' || arg[0] > '9')
1.17 markus 541: fatal("%.200s line %d: Badly formatted port number.",
542: filename, linenum);
1.38 provos 543: fwd_port = atoi(arg);
1.42 provos 544: arg = strdelim(&s);
1.40 ho 545: if (!arg || *arg == '\0')
1.17 markus 546: fatal("%.200s line %d: Missing second argument.",
547: filename, linenum);
1.38 provos 548: if (sscanf(arg, "%255[^:]:%hu", buf, &fwd_host_port) != 2)
1.17 markus 549: fatal("%.200s line %d: Badly formatted host:port.",
550: filename, linenum);
551: if (*activep)
552: add_remote_forward(options, fwd_port, buf, fwd_host_port);
553: break;
554:
555: case oLocalForward:
1.42 provos 556: arg = strdelim(&s);
1.40 ho 557: if (!arg || *arg == '\0')
1.17 markus 558: fatal("%.200s line %d: Missing argument.", filename, linenum);
1.38 provos 559: if (arg[0] < '0' || arg[0] > '9')
1.17 markus 560: fatal("%.200s line %d: Badly formatted port number.",
561: filename, linenum);
1.38 provos 562: fwd_port = atoi(arg);
1.42 provos 563: arg = strdelim(&s);
1.40 ho 564: if (!arg || *arg == '\0')
1.17 markus 565: fatal("%.200s line %d: Missing second argument.",
566: filename, linenum);
1.38 provos 567: if (sscanf(arg, "%255[^:]:%hu", buf, &fwd_host_port) != 2)
1.17 markus 568: fatal("%.200s line %d: Badly formatted host:port.",
569: filename, linenum);
570: if (*activep)
571: add_local_forward(options, fwd_port, buf, fwd_host_port);
572: break;
573:
574: case oHost:
575: *activep = 0;
1.42 provos 576: while ((arg = strdelim(&s)) != NULL && *arg != '\0')
1.38 provos 577: if (match_pattern(host, arg)) {
578: debug("Applying options for %.100s", arg);
1.17 markus 579: *activep = 1;
580: break;
581: }
1.42 provos 582: /* Avoid garbage check below, as strdelim is done. */
1.17 markus 583: return 0;
584:
585: case oEscapeChar:
586: intptr = &options->escape_char;
1.42 provos 587: arg = strdelim(&s);
1.40 ho 588: if (!arg || *arg == '\0')
1.17 markus 589: fatal("%.200s line %d: Missing argument.", filename, linenum);
1.38 provos 590: if (arg[0] == '^' && arg[2] == 0 &&
591: (unsigned char) arg[1] >= 64 && (unsigned char) arg[1] < 128)
592: value = (unsigned char) arg[1] & 31;
593: else if (strlen(arg) == 1)
594: value = (unsigned char) arg[0];
595: else if (strcmp(arg, "none") == 0)
1.17 markus 596: value = -2;
597: else {
598: fatal("%.200s line %d: Bad escape character.",
599: filename, linenum);
600: /* NOTREACHED */
601: value = 0; /* Avoid compiler warning. */
602: }
603: if (*activep && *intptr == -1)
604: *intptr = value;
605: break;
606:
607: default:
608: fatal("process_config_line: Unimplemented opcode %d", opcode);
609: }
610:
611: /* Check that there is no garbage at end of line. */
1.42 provos 612: if ((arg = strdelim(&s)) != NULL && *arg != '\0')
1.39 ho 613: {
614: fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
615: filename, linenum, arg);
616: }
1.17 markus 617: return 0;
1.1 deraadt 618: }
619:
620:
1.19 markus 621: /*
622: * Reads the config file and modifies the options accordingly. Options
623: * should already be initialized before this call. This never returns if
624: * there is an error. If the file does not exist, this returns immediately.
625: */
1.1 deraadt 626:
1.26 markus 627: void
1.17 markus 628: read_config_file(const char *filename, const char *host, Options *options)
1.1 deraadt 629: {
1.17 markus 630: FILE *f;
631: char line[1024];
632: int active, linenum;
633: int bad_options = 0;
634:
635: /* Open the file. */
636: f = fopen(filename, "r");
637: if (!f)
638: return;
639:
640: debug("Reading configuration data %.200s", filename);
641:
1.19 markus 642: /*
643: * Mark that we are now processing the options. This flag is turned
644: * on/off by Host specifications.
645: */
1.17 markus 646: active = 1;
647: linenum = 0;
648: while (fgets(line, sizeof(line), f)) {
649: /* Update line number counter. */
650: linenum++;
651: if (process_config_line(options, host, line, filename, linenum, &active) != 0)
652: bad_options++;
653: }
654: fclose(f);
655: if (bad_options > 0)
656: fatal("%s: terminating, %d bad configuration options\n",
657: filename, bad_options);
1.1 deraadt 658: }
659:
1.19 markus 660: /*
661: * Initializes options to special values that indicate that they have not yet
662: * been set. Read_config_file will only set options with this value. Options
663: * are processed in the following order: command line, user config file,
664: * system config file. Last, fill_default_options is called.
665: */
1.1 deraadt 666:
1.26 markus 667: void
1.17 markus 668: initialize_options(Options * options)
1.1 deraadt 669: {
1.17 markus 670: memset(options, 'X', sizeof(*options));
671: options->forward_agent = -1;
672: options->forward_x11 = -1;
1.34 markus 673: options->xauth_location = NULL;
1.17 markus 674: options->gateway_ports = -1;
675: options->use_privileged_port = -1;
676: options->rhosts_authentication = -1;
677: options->rsa_authentication = -1;
1.30 markus 678: options->dsa_authentication = -1;
1.17 markus 679: options->skey_authentication = -1;
1.1 deraadt 680: #ifdef KRB4
1.17 markus 681: options->kerberos_authentication = -1;
1.1 deraadt 682: #endif
1.5 dugsong 683: #ifdef AFS
1.17 markus 684: options->kerberos_tgt_passing = -1;
685: options->afs_token_passing = -1;
1.1 deraadt 686: #endif
1.17 markus 687: options->password_authentication = -1;
688: options->rhosts_rsa_authentication = -1;
689: options->fallback_to_rsh = -1;
690: options->use_rsh = -1;
691: options->batch_mode = -1;
692: options->check_host_ip = -1;
693: options->strict_host_key_checking = -1;
694: options->compression = -1;
695: options->keepalives = -1;
696: options->compression_level = -1;
697: options->port = -1;
698: options->connection_attempts = -1;
699: options->number_of_password_prompts = -1;
700: options->cipher = -1;
1.25 markus 701: options->ciphers = NULL;
702: options->protocol = SSH_PROTO_UNKNOWN;
1.17 markus 703: options->num_identity_files = 0;
1.27 markus 704: options->num_identity_files2 = 0;
1.17 markus 705: options->hostname = NULL;
706: options->proxy_command = NULL;
707: options->user = NULL;
708: options->escape_char = -1;
709: options->system_hostfile = NULL;
710: options->user_hostfile = NULL;
1.27 markus 711: options->system_hostfile2 = NULL;
712: options->user_hostfile2 = NULL;
1.17 markus 713: options->num_local_forwards = 0;
714: options->num_remote_forwards = 0;
715: options->log_level = (LogLevel) - 1;
1.1 deraadt 716: }
717:
1.19 markus 718: /*
719: * Called after processing other sources of option data, this fills those
720: * options for which no value has been specified with their default values.
721: */
1.1 deraadt 722:
1.26 markus 723: void
1.17 markus 724: fill_default_options(Options * options)
1.1 deraadt 725: {
1.17 markus 726: if (options->forward_agent == -1)
1.33 markus 727: options->forward_agent = 0;
1.17 markus 728: if (options->forward_x11 == -1)
1.23 markus 729: options->forward_x11 = 0;
1.34 markus 730: #ifdef XAUTH_PATH
731: if (options->xauth_location == NULL)
1.35 markus 732: options->xauth_location = XAUTH_PATH;
1.34 markus 733: #endif /* XAUTH_PATH */
1.17 markus 734: if (options->gateway_ports == -1)
735: options->gateway_ports = 0;
736: if (options->use_privileged_port == -1)
737: options->use_privileged_port = 1;
738: if (options->rhosts_authentication == -1)
739: options->rhosts_authentication = 1;
740: if (options->rsa_authentication == -1)
741: options->rsa_authentication = 1;
1.30 markus 742: if (options->dsa_authentication == -1)
743: options->dsa_authentication = 1;
1.17 markus 744: if (options->skey_authentication == -1)
745: options->skey_authentication = 0;
1.1 deraadt 746: #ifdef KRB4
1.17 markus 747: if (options->kerberos_authentication == -1)
1.45 provos 748: options->kerberos_authentication = 1;
1.5 dugsong 749: #endif /* KRB4 */
750: #ifdef AFS
1.17 markus 751: if (options->kerberos_tgt_passing == -1)
752: options->kerberos_tgt_passing = 1;
753: if (options->afs_token_passing == -1)
754: options->afs_token_passing = 1;
1.5 dugsong 755: #endif /* AFS */
1.17 markus 756: if (options->password_authentication == -1)
757: options->password_authentication = 1;
758: if (options->rhosts_rsa_authentication == -1)
759: options->rhosts_rsa_authentication = 1;
760: if (options->fallback_to_rsh == -1)
1.41 deraadt 761: options->fallback_to_rsh = 0;
1.17 markus 762: if (options->use_rsh == -1)
763: options->use_rsh = 0;
764: if (options->batch_mode == -1)
765: options->batch_mode = 0;
766: if (options->check_host_ip == -1)
767: options->check_host_ip = 1;
768: if (options->strict_host_key_checking == -1)
769: options->strict_host_key_checking = 2; /* 2 is default */
770: if (options->compression == -1)
771: options->compression = 0;
772: if (options->keepalives == -1)
773: options->keepalives = 1;
774: if (options->compression_level == -1)
775: options->compression_level = 6;
776: if (options->port == -1)
777: options->port = 0; /* Filled in ssh_connect. */
778: if (options->connection_attempts == -1)
779: options->connection_attempts = 4;
780: if (options->number_of_password_prompts == -1)
781: options->number_of_password_prompts = 3;
782: /* Selected in ssh_login(). */
783: if (options->cipher == -1)
784: options->cipher = SSH_CIPHER_NOT_SET;
1.31 markus 785: /* options->ciphers, default set in myproposals.h */
1.25 markus 786: if (options->protocol == SSH_PROTO_UNKNOWN)
1.28 markus 787: options->protocol = SSH_PROTO_1|SSH_PROTO_2|SSH_PROTO_1_PREFERRED;
1.17 markus 788: if (options->num_identity_files == 0) {
789: options->identity_files[0] =
790: xmalloc(2 + strlen(SSH_CLIENT_IDENTITY) + 1);
791: sprintf(options->identity_files[0], "~/%.100s", SSH_CLIENT_IDENTITY);
792: options->num_identity_files = 1;
793: }
1.27 markus 794: if (options->num_identity_files2 == 0) {
795: options->identity_files2[0] =
1.29 markus 796: xmalloc(2 + strlen(SSH_CLIENT_ID_DSA) + 1);
797: sprintf(options->identity_files2[0], "~/%.100s", SSH_CLIENT_ID_DSA);
1.27 markus 798: options->num_identity_files2 = 1;
799: }
1.17 markus 800: if (options->escape_char == -1)
801: options->escape_char = '~';
802: if (options->system_hostfile == NULL)
803: options->system_hostfile = SSH_SYSTEM_HOSTFILE;
804: if (options->user_hostfile == NULL)
805: options->user_hostfile = SSH_USER_HOSTFILE;
1.27 markus 806: if (options->system_hostfile2 == NULL)
807: options->system_hostfile2 = SSH_SYSTEM_HOSTFILE2;
808: if (options->user_hostfile2 == NULL)
809: options->user_hostfile2 = SSH_USER_HOSTFILE2;
1.17 markus 810: if (options->log_level == (LogLevel) - 1)
811: options->log_level = SYSLOG_LEVEL_INFO;
812: /* options->proxy_command should not be set by default */
813: /* options->user will be set in the main program if appropriate */
814: /* options->hostname will be set in the main program if appropriate */
1.1 deraadt 815: }