readconf.c

   1 /* $OpenBSD: readconf.c,v 1.183 2010/02/08 10:50:20 markus Exp $ */
   2 /*
   3  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   4  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   5  *                    All rights reserved
   6  * Functions for reading the configuration files.
   7  *
   8  * As far as I am concerned, the code I have written for this software
   9  * can be used freely for any purpose.  Any derived versions of this
  10  * software must be clearly marked as such, and if the derived work is
  11  * incompatible with the protocol description in the RFC file, it must be
  12  * called by a name other than "ssh" or "Secure Shell".
  13  */
  14
  15 #include "includes.h"
  16
  17 #include <sys/types.h>
  18 #include <sys/stat.h>
  19 #include <sys/socket.h>
  20
  21 #include <netinet/in.h>
  22
  23 #include <ctype.h>
  24 #include <errno.h>
  25 #include <netdb.h>
  26 #include <signal.h>
  27 #include <stdarg.h>
  28 #include <stdio.h>
  29 #include <string.h>
  30 #include <unistd.h>
  31
  32 #include "xmalloc.h"
  33 #include "ssh.h"
  34 #include "compat.h"
  35 #include "cipher.h"
  36 #include "pathnames.h"
  37 #include "log.h"
  38 #include "key.h"
  39 #include "readconf.h"
  40 #include "match.h"
  41 #include "misc.h"
  42 #include "buffer.h"
  43 #include "kex.h"
  44 #include "mac.h"
  45
  46 /* Format of the configuration file:
  47
  48    # Configuration data is parsed as follows:
  49    #  1. command line options
  50    #  2. user-specific file
  51    #  3. system-wide file
  52    # Any configuration value is only changed the first time it is set.
  53    # Thus, host-specific definitions should be at the beginning of the
  54    # configuration file, and defaults at the end.
  55
  56    # Host-specific declarations.  These may override anything above.  A single
  57    # host may match multiple declarations; these are processed in the order
  58    # that they are given in.
  59
  60    Host *.ngs.fi ngs.fi
  61      User foo
  62
  63    Host fake.com
  64      HostName another.host.name.real.org
  65      User blaah
  66      Port 34289
  67      ForwardX11 no
  68      ForwardAgent no
  69
  70    Host books.com
  71      RemoteForward 9999 shadows.cs.hut.fi:9999
  72      Cipher 3des
  73
  74    Host fascist.blob.com
  75      Port 23123
  76      User tylonen
  77      PasswordAuthentication no
  78
  79    Host puukko.hut.fi
  80      User t35124p
  81      ProxyCommand ssh-proxy %h %p
  82
  83    Host *.fr
  84      PublicKeyAuthentication no
  85
  86    Host *.su
  87      Cipher none
  88      PasswordAuthentication no
  89
  90    Host vpn.fake.com
  91      Tunnel yes
  92      TunnelDevice 3
  93
  94    # Defaults for various options
  95    Host *
  96      ForwardAgent no
  97      ForwardX11 no
  98      PasswordAuthentication yes
  99      RSAAuthentication yes
 100      RhostsRSAAuthentication yes
 101      StrictHostKeyChecking yes
 102      TcpKeepAlive no
 103      IdentityFile ~/.ssh/identity
 104      Port 22
 105      EscapeChar ~
 106
 107 */
 108
 109 /* Keyword tokens. */
 110
 111 typedef enum {
 112         oBadOption,
 113         oForwardAgent, oForwardX11, oForwardX11Trusted, oGatewayPorts,
 114         oExitOnForwardFailure,
 115         oPasswordAuthentication, oRSAAuthentication,
 116         oChallengeResponseAuthentication, oXAuthLocation,
 117         oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
 118         oUser, oHost, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
 119         oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
 120         oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
 121         oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts,
 122         oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,
 123         oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
 124         oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
 125         oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
 126         oHostKeyAlgorithms, oBindAddress, oPKCS11Provider,
 127         oClearAllForwardings, oNoHostAuthenticationForLocalhost,
 128         oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
 129         oAddressFamily, oGssAuthentication, oGssDelegateCreds,
 130         oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
 131         oSendEnv, oControlPath, oControlMaster, oHashKnownHosts,
 132         oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
 133         oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication,
 134         oDeprecated, oUnsupported
 135 } OpCodes;
 136
 137 /* Textual representations of the tokens. */
 138
 139 static struct {
 140         const char *name;
 141         OpCodes opcode;
 142 } keywords[] = {
 143         { "forwardagent", oForwardAgent },
 144         { "forwardx11", oForwardX11 },
 145         { "forwardx11trusted", oForwardX11Trusted },
 146         { "exitonforwardfailure", oExitOnForwardFailure },
 147         { "xauthlocation", oXAuthLocation },
 148         { "gatewayports", oGatewayPorts },
 149         { "useprivilegedport", oUsePrivilegedPort },
 150         { "rhostsauthentication", oDeprecated },
 151         { "passwordauthentication", oPasswordAuthentication },
 152         { "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
 153         { "kbdinteractivedevices", oKbdInteractiveDevices },
 154         { "rsaauthentication", oRSAAuthentication },
 155         { "pubkeyauthentication", oPubkeyAuthentication },
 156         { "dsaauthentication", oPubkeyAuthentication },             /* alias */
 157         { "rhostsrsaauthentication", oRhostsRSAAuthentication },
 158         { "hostbasedauthentication", oHostbasedAuthentication },
 159         { "challengeresponseauthentication", oChallengeResponseAuthentication },
 160         { "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
 161         { "tisauthentication", oChallengeResponseAuthentication },  /* alias */
 162         { "kerberosauthentication", oUnsupported },
 163         { "kerberostgtpassing", oUnsupported },
 164         { "afstokenpassing", oUnsupported },
 165 #if defined(GSSAPI)
 166         { "gssapiauthentication", oGssAuthentication },
 167         { "gssapidelegatecredentials", oGssDelegateCreds },
 168 #else
 169         { "gssapiauthentication", oUnsupported },
 170         { "gssapidelegatecredentials", oUnsupported },
 171 #endif
 172         { "fallbacktorsh", oDeprecated },
 173         { "usersh", oDeprecated },
 174         { "identityfile", oIdentityFile },
 175         { "identityfile2", oIdentityFile },                     /* obsolete */
 176         { "identitiesonly", oIdentitiesOnly },
 177         { "hostname", oHostName },
 178         { "hostkeyalias", oHostKeyAlias },
 179         { "proxycommand", oProxyCommand },
 180         { "port", oPort },
 181         { "cipher", oCipher },
 182         { "ciphers", oCiphers },
 183         { "macs", oMacs },
 184         { "protocol", oProtocol },
 185         { "remoteforward", oRemoteForward },
 186         { "localforward", oLocalForward },
 187         { "user", oUser },
 188         { "host", oHost },
 189         { "escapechar", oEscapeChar },
 190         { "globalknownhostsfile", oGlobalKnownHostsFile },
 191         { "globalknownhostsfile2", oGlobalKnownHostsFile2 },    /* obsolete */
 192         { "userknownhostsfile", oUserKnownHostsFile },
 193         { "userknownhostsfile2", oUserKnownHostsFile2 },        /* obsolete */
 194         { "connectionattempts", oConnectionAttempts },
 195         { "batchmode", oBatchMode },
 196         { "checkhostip", oCheckHostIP },
 197         { "stricthostkeychecking", oStrictHostKeyChecking },
 198         { "compression", oCompression },
 199         { "compressionlevel", oCompressionLevel },
 200         { "tcpkeepalive", oTCPKeepAlive },
 201         { "keepalive", oTCPKeepAlive },                         /* obsolete */
 202         { "numberofpasswordprompts", oNumberOfPasswordPrompts },
 203         { "loglevel", oLogLevel },
 204         { "dynamicforward", oDynamicForward },
 205         { "preferredauthentications", oPreferredAuthentications },
 206         { "hostkeyalgorithms", oHostKeyAlgorithms },
 207         { "bindaddress", oBindAddress },
 208 #ifdef ENABLE_PKCS11
 209         { "smartcarddevice", oPKCS11Provider },
 210         { "pkcs11provider", oPKCS11Provider },
 211 #else
 212         { "smartcarddevice", oUnsupported },
 213         { "pkcs11provider", oUnsupported },
 214 #endif
 215         { "clearallforwardings", oClearAllForwardings },
 216         { "enablesshkeysign", oEnableSSHKeysign },
 217         { "verifyhostkeydns", oVerifyHostKeyDNS },
 218         { "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost },
 219         { "rekeylimit", oRekeyLimit },
 220         { "connecttimeout", oConnectTimeout },
 221         { "addressfamily", oAddressFamily },
 222         { "serveraliveinterval", oServerAliveInterval },
 223         { "serveralivecountmax", oServerAliveCountMax },
 224         { "sendenv", oSendEnv },
 225         { "controlpath", oControlPath },
 226         { "controlmaster", oControlMaster },
 227         { "hashknownhosts", oHashKnownHosts },
 228         { "tunnel", oTunnel },
 229         { "tunneldevice", oTunnelDevice },
 230         { "localcommand", oLocalCommand },
 231         { "permitlocalcommand", oPermitLocalCommand },
 232         { "visualhostkey", oVisualHostKey },
 233         { "useroaming", oUseRoaming },
 234 #ifdef JPAKE
 235         { "zeroknowledgepasswordauthentication",
 236             oZeroKnowledgePasswordAuthentication },
 237 #else
 238         { "zeroknowledgepasswordauthentication", oUnsupported },
 239 #endif
 240
 241         { NULL, oBadOption }
 242 };
 243
 244 /*
 245  * Adds a local TCP/IP port forward to options.  Never returns if there is an
 246  * error.
 247  */
 248
 249 void
 250 add_local_forward(Options *options, const Forward *newfwd)
 251 {
 252         Forward *fwd;
 253 #ifndef NO_IPPORT_RESERVED_CONCEPT
 254         extern uid_t original_real_uid;
 255         if (newfwd->listen_port < IPPORT_RESERVED && original_real_uid != 0)
 256                 fatal("Privileged ports can only be forwarded by root.");
 257 #endif
 258         if (options->num_local_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
 259                 fatal("Too many local forwards (max %d).", SSH_MAX_FORWARDS_PER_DIRECTION);
 260         fwd = &options->local_forwards[options->num_local_forwards++];
 261
 262         fwd->listen_host = newfwd->listen_host;
 263         fwd->listen_port = newfwd->listen_port;
 264         fwd->connect_host = newfwd->connect_host;
 265         fwd->connect_port = newfwd->connect_port;
 266 }
 267
 268 /*
 269  * Adds a remote TCP/IP port forward to options.  Never returns if there is
 270  * an error.
 271  */
 272
 273 void
 274 add_remote_forward(Options *options, const Forward *newfwd)
 275 {
 276         Forward *fwd;
 277         if (options->num_remote_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
 278                 fatal("Too many remote forwards (max %d).",
 279                     SSH_MAX_FORWARDS_PER_DIRECTION);
 280         fwd = &options->remote_forwards[options->num_remote_forwards++];
 281
 282         fwd->listen_host = newfwd->listen_host;
 283         fwd->listen_port = newfwd->listen_port;
 284         fwd->connect_host = newfwd->connect_host;
 285         fwd->connect_port = newfwd->connect_port;
 286 }
 287
 288 static void
 289 clear_forwardings(Options *options)
 290 {
 291         int i;
 292
 293         for (i = 0; i < options->num_local_forwards; i++) {
 294                 if (options->local_forwards[i].listen_host != NULL)
 295                         xfree(options->local_forwards[i].listen_host);
 296                 xfree(options->local_forwards[i].connect_host);
 297         }
 298         options->num_local_forwards = 0;
 299         for (i = 0; i < options->num_remote_forwards; i++) {
 300                 if (options->remote_forwards[i].listen_host != NULL)
 301                         xfree(options->remote_forwards[i].listen_host);
 302                 xfree(options->remote_forwards[i].connect_host);
 303         }
 304         options->num_remote_forwards = 0;
 305         options->tun_open = SSH_TUNMODE_NO;
 306 }
 307
 308 /*
 309  * Returns the number of the token pointed to by cp or oBadOption.
 310  */
 311
 312 static OpCodes
 313 parse_token(const char *cp, const char *filename, int linenum)
 314 {
 315         u_int i;
 316
 317         for (i = 0; keywords[i].name; i++)
 318                 if (strcasecmp(cp, keywords[i].name) == 0)
 319                         return keywords[i].opcode;
 320
 321         error("%s: line %d: Bad configuration option: %s",
 322             filename, linenum, cp);
 323         return oBadOption;
 324 }
 325
 326 /*
 327  * Processes a single option line as used in the configuration files. This
 328  * only sets those values that have not already been set.
 329  */
 330 #define WHITESPACE " \t\r\n"
 331
 332 int
 333 process_config_line(Options *options, const char *host,
 334                     char *line, const char *filename, int linenum,
 335                     int *activep)
 336 {
 337         char *s, **charptr, *endofnumber, *keyword, *arg, *arg2, fwdarg[256];
 338         int opcode, *intptr, value, value2, scale;
 339         LogLevel *log_level_ptr;
 340         long long orig, val64;
 341         size_t len;
 342         Forward fwd;
 343
 344         /* Strip trailing whitespace */
 345         for (len = strlen(line) - 1; len > 0; len--) {
 346                 if (strchr(WHITESPACE, line[len]) == NULL)
 347                         break;
 348                 line[len] = '\0';
 349         }
 350
 351         s = line;
 352         /* Get the keyword. (Each line is supposed to begin with a keyword). */
 353         if ((keyword = strdelim(&s)) == NULL)
 354                 return 0;
 355         /* Ignore leading whitespace. */
 356         if (*keyword == '\0')
 357                 keyword = strdelim(&s);
 358         if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
 359                 return 0;
 360
 361         opcode = parse_token(keyword, filename, linenum);
 362
 363         switch (opcode) {
 364         case oBadOption:
 365                 /* don't panic, but count bad options */
 366                 return -1;
 367                 /* NOTREACHED */
 368         case oConnectTimeout:
 369                 intptr = &options->connection_timeout;
 370 parse_time:
 371                 arg = strdelim(&s);
 372                 if (!arg || *arg == '\0')
 373                         fatal("%s line %d: missing time value.",
 374                             filename, linenum);
 375                 if ((value = convtime(arg)) == -1)
 376                         fatal("%s line %d: invalid time value.",
 377                             filename, linenum);
 378                 if (*activep && *intptr == -1)
 379                         *intptr = value;
 380                 break;
 381
 382         case oForwardAgent:
 383                 intptr = &options->forward_agent;
 384 parse_flag:
 385                 arg = strdelim(&s);
 386                 if (!arg || *arg == '\0')
 387                         fatal("%.200s line %d: Missing yes/no argument.", filename, linenum);
 388                 value = 0;      /* To avoid compiler warning... */
 389                 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
 390                         value = 1;
 391                 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
 392                         value = 0;
 393                 else
 394                         fatal("%.200s line %d: Bad yes/no argument.", filename, linenum);
 395                 if (*activep && *intptr == -1)
 396                         *intptr = value;
 397                 break;
 398
 399         case oForwardX11:
 400                 intptr = &options->forward_x11;
 401                 goto parse_flag;
 402
 403         case oForwardX11Trusted:
 404                 intptr = &options->forward_x11_trusted;
 405                 goto parse_flag;
 406
 407         case oGatewayPorts:
 408                 intptr = &options->gateway_ports;
 409                 goto parse_flag;
 410
 411         case oExitOnForwardFailure:
 412                 intptr = &options->exit_on_forward_failure;
 413                 goto parse_flag;
 414
 415         case oUsePrivilegedPort:
 416                 intptr = &options->use_privileged_port;
 417                 goto parse_flag;
 418
 419         case oPasswordAuthentication:
 420                 intptr = &options->password_authentication;
 421                 goto parse_flag;
 422
 423         case oZeroKnowledgePasswordAuthentication:
 424                 intptr = &options->zero_knowledge_password_authentication;
 425                 goto parse_flag;
 426
 427         case oKbdInteractiveAuthentication:
 428                 intptr = &options->kbd_interactive_authentication;
 429                 goto parse_flag;
 430
 431         case oKbdInteractiveDevices:
 432                 charptr = &options->kbd_interactive_devices;
 433                 goto parse_string;
 434
 435         case oPubkeyAuthentication:
 436                 intptr = &options->pubkey_authentication;
 437                 goto parse_flag;
 438
 439         case oRSAAuthentication:
 440                 intptr = &options->rsa_authentication;
 441                 goto parse_flag;
 442
 443         case oRhostsRSAAuthentication:
 444                 intptr = &options->rhosts_rsa_authentication;
 445                 goto parse_flag;
 446
 447         case oHostbasedAuthentication:
 448                 intptr = &options->hostbased_authentication;
 449                 goto parse_flag;
 450
 451         case oChallengeResponseAuthentication:
 452                 intptr = &options->challenge_response_authentication;
 453                 goto parse_flag;
 454
 455         case oGssAuthentication:
 456                 intptr = &options->gss_authentication;
 457                 goto parse_flag;
 458
 459         case oGssDelegateCreds:
 460                 intptr = &options->gss_deleg_creds;
 461                 goto parse_flag;
 462
 463         case oBatchMode:
 464                 intptr = &options->batch_mode;
 465                 goto parse_flag;
 466
 467         case oCheckHostIP:
 468                 intptr = &options->check_host_ip;
 469                 goto parse_flag;
 470
 471         case oVerifyHostKeyDNS:
 472                 intptr = &options->verify_host_key_dns;
 473                 goto parse_yesnoask;
 474
 475         case oStrictHostKeyChecking:
 476                 intptr = &options->strict_host_key_checking;
 477 parse_yesnoask:
 478                 arg = strdelim(&s);
 479                 if (!arg || *arg == '\0')
 480                         fatal("%.200s line %d: Missing yes/no/ask argument.",
 481                             filename, linenum);
 482                 value = 0;      /* To avoid compiler warning... */
 483                 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
 484                         value = 1;
 485                 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
 486                         value = 0;
 487                 else if (strcmp(arg, "ask") == 0)
 488                         value = 2;
 489                 else
 490                         fatal("%.200s line %d: Bad yes/no/ask argument.", filename, linenum);
 491                 if (*activep && *intptr == -1)
 492                         *intptr = value;
 493                 break;
 494
 495         case oCompression:
 496                 intptr = &options->compression;
 497                 goto parse_flag;
 498
 499         case oTCPKeepAlive:
 500                 intptr = &options->tcp_keep_alive;
 501                 goto parse_flag;
 502
 503         case oNoHostAuthenticationForLocalhost:
 504                 intptr = &options->no_host_authentication_for_localhost;
 505                 goto parse_flag;
 506
 507         case oNumberOfPasswordPrompts:
 508                 intptr = &options->number_of_password_prompts;
 509                 goto parse_int;
 510
 511         case oCompressionLevel:
 512                 intptr = &options->compression_level;
 513                 goto parse_int;
 514
 515         case oRekeyLimit:
 516                 arg = strdelim(&s);
 517                 if (!arg || *arg == '\0')
 518                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 519                 if (arg[0] < '0' || arg[0] > '9')
 520                         fatal("%.200s line %d: Bad number.", filename, linenum);
 521                 orig = val64 = strtoll(arg, &endofnumber, 10);
 522                 if (arg == endofnumber)
 523                         fatal("%.200s line %d: Bad number.", filename, linenum);
 524                 switch (toupper(*endofnumber)) {
 525                 case '\0':
 526                         scale = 1;
 527                         break;
 528                 case 'K':
 529                         scale = 1<<10;
 530                         break;
 531                 case 'M':
 532                         scale = 1<<20;
 533                         break;
 534                 case 'G':
 535                         scale = 1<<30;
 536                         break;
 537                 default:
 538                         fatal("%.200s line %d: Invalid RekeyLimit suffix",
 539                             filename, linenum);
 540                 }
 541                 val64 *= scale;
 542                 /* detect integer wrap and too-large limits */
 543                 if ((val64 / scale) != orig || val64 > UINT_MAX)
 544                         fatal("%.200s line %d: RekeyLimit too large",
 545                             filename, linenum);
 546                 if (val64 < 16)
 547                         fatal("%.200s line %d: RekeyLimit too small",
 548                             filename, linenum);
 549                 if (*activep && options->rekey_limit == -1)
 550                         options->rekey_limit = (u_int32_t)val64;
 551                 break;
 552
 553         case oIdentityFile:
 554                 arg = strdelim(&s);
 555                 if (!arg || *arg == '\0')
 556                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 557                 if (*activep) {
 558                         intptr = &options->num_identity_files;
 559                         if (*intptr >= SSH_MAX_IDENTITY_FILES)
 560                                 fatal("%.200s line %d: Too many identity files specified (max %d).",
 561                                     filename, linenum, SSH_MAX_IDENTITY_FILES);
 562                         charptr = &options->identity_files[*intptr];
 563                         *charptr = xstrdup(arg);
 564                         *intptr = *intptr + 1;
 565                 }
 566                 break;
 567
 568         case oXAuthLocation:
 569                 charptr=&options->xauth_location;
 570                 goto parse_string;
 571
 572         case oUser:
 573                 charptr = &options->user;
 574 parse_string:
 575                 arg = strdelim(&s);
 576                 if (!arg || *arg == '\0')
 577                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 578                 if (*activep && *charptr == NULL)
 579                         *charptr = xstrdup(arg);
 580                 break;
 581
 582         case oGlobalKnownHostsFile:
 583                 charptr = &options->system_hostfile;
 584                 goto parse_string;
 585
 586         case oUserKnownHostsFile:
 587                 charptr = &options->user_hostfile;
 588                 goto parse_string;
 589
 590         case oGlobalKnownHostsFile2:
 591                 charptr = &options->system_hostfile2;
 592                 goto parse_string;
 593
 594         case oUserKnownHostsFile2:
 595                 charptr = &options->user_hostfile2;
 596                 goto parse_string;
 597
 598         case oHostName:
 599                 charptr = &options->hostname;
 600                 goto parse_string;
 601
 602         case oHostKeyAlias:
 603                 charptr = &options->host_key_alias;
 604                 goto parse_string;
 605
 606         case oPreferredAuthentications:
 607                 charptr = &options->preferred_authentications;
 608                 goto parse_string;
 609
 610         case oBindAddress:
 611                 charptr = &options->bind_address;
 612                 goto parse_string;
 613
 614         case oPKCS11Provider:
 615                 charptr = &options->pkcs11_provider;
 616                 goto parse_string;
 617
 618         case oProxyCommand:
 619                 charptr = &options->proxy_command;
 620 parse_command:
 621                 if (s == NULL)
 622                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 623                 len = strspn(s, WHITESPACE "=");
 624                 if (*activep && *charptr == NULL)
 625                         *charptr = xstrdup(s + len);
 626                 return 0;
 627
 628         case oPort:
 629                 intptr = &options->port;
 630 parse_int:
 631                 arg = strdelim(&s);
 632                 if (!arg || *arg == '\0')
 633                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 634                 if (arg[0] < '0' || arg[0] > '9')
 635                         fatal("%.200s line %d: Bad number.", filename, linenum);
 636
 637                 /* Octal, decimal, or hex format? */
 638                 value = strtol(arg, &endofnumber, 0);
 639                 if (arg == endofnumber)
 640                         fatal("%.200s line %d: Bad number.", filename, linenum);
 641                 if (*activep && *intptr == -1)
 642                         *intptr = value;
 643                 break;
 644
 645         case oConnectionAttempts:
 646                 intptr = &options->connection_attempts;
 647                 goto parse_int;
 648
 649         case oCipher:
 650                 intptr = &options->cipher;
 651                 arg = strdelim(&s);
 652                 if (!arg || *arg == '\0')
 653                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 654                 value = cipher_number(arg);
 655                 if (value == -1)
 656                         fatal("%.200s line %d: Bad cipher '%s'.",
 657                             filename, linenum, arg ? arg : "<NONE>");
 658                 if (*activep && *intptr == -1)
 659                         *intptr = value;
 660                 break;
 661
 662         case oCiphers:
 663                 arg = strdelim(&s);
 664                 if (!arg || *arg == '\0')
 665                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 666                 if (!ciphers_valid(arg))
 667                         fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
 668                             filename, linenum, arg ? arg : "<NONE>");
 669                 if (*activep && options->ciphers == NULL)
 670                         options->ciphers = xstrdup(arg);
 671                 break;
 672
 673         case oMacs:
 674                 arg = strdelim(&s);
 675                 if (!arg || *arg == '\0')
 676                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 677                 if (!mac_valid(arg))
 678                         fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.",
 679                             filename, linenum, arg ? arg : "<NONE>");
 680                 if (*activep && options->macs == NULL)
 681                         options->macs = xstrdup(arg);
 682                 break;
 683
 684         case oHostKeyAlgorithms:
 685                 arg = strdelim(&s);
 686                 if (!arg || *arg == '\0')
 687                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 688                 if (!key_names_valid2(arg))
 689                         fatal("%.200s line %d: Bad protocol 2 host key algorithms '%s'.",
 690                             filename, linenum, arg ? arg : "<NONE>");
 691                 if (*activep && options->hostkeyalgorithms == NULL)
 692                         options->hostkeyalgorithms = xstrdup(arg);
 693                 break;
 694
 695         case oProtocol:
 696                 intptr = &options->protocol;
 697                 arg = strdelim(&s);
 698                 if (!arg || *arg == '\0')
 699                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 700                 value = proto_spec(arg);
 701                 if (value == SSH_PROTO_UNKNOWN)
 702                         fatal("%.200s line %d: Bad protocol spec '%s'.",
 703                             filename, linenum, arg ? arg : "<NONE>");
 704                 if (*activep && *intptr == SSH_PROTO_UNKNOWN)
 705                         *intptr = value;
 706                 break;
 707
 708         case oLogLevel:
 709                 log_level_ptr = &options->log_level;
 710                 arg = strdelim(&s);
 711                 value = log_level_number(arg);
 712                 if (value == SYSLOG_LEVEL_NOT_SET)
 713                         fatal("%.200s line %d: unsupported log level '%s'",
 714                             filename, linenum, arg ? arg : "<NONE>");
 715                 if (*activep && *log_level_ptr == SYSLOG_LEVEL_NOT_SET)
 716                         *log_level_ptr = (LogLevel) value;
 717                 break;
 718
 719         case oLocalForward:
 720         case oRemoteForward:
 721         case oDynamicForward:
 722                 arg = strdelim(&s);
 723                 if (arg == NULL || *arg == '\0')
 724                         fatal("%.200s line %d: Missing port argument.",
 725                             filename, linenum);
 726
 727                 if (opcode == oLocalForward ||
 728                     opcode == oRemoteForward) {
 729                         arg2 = strdelim(&s);
 730                         if (arg2 == NULL || *arg2 == '\0')
 731                                 fatal("%.200s line %d: Missing target argument.",
 732                                     filename, linenum);
 733
 734                         /* construct a string for parse_forward */
 735                         snprintf(fwdarg, sizeof(fwdarg), "%s:%s", arg, arg2);
 736                 } else if (opcode == oDynamicForward) {
 737                         strlcpy(fwdarg, arg, sizeof(fwdarg));
 738                 }
 739
 740                 if (parse_forward(&fwd, fwdarg,
 741                     opcode == oDynamicForward ? 1 : 0,
 742                     opcode == oRemoteForward ? 1 : 0) == 0)
 743                         fatal("%.200s line %d: Bad forwarding specification.",
 744                             filename, linenum);
 745
 746                 if (*activep) {
 747                         if (opcode == oLocalForward ||
 748                             opcode == oDynamicForward)
 749                                 add_local_forward(options, &fwd);
 750                         else if (opcode == oRemoteForward)
 751                                 add_remote_forward(options, &fwd);
 752                 }
 753                 break;
 754
 755         case oClearAllForwardings:
 756                 intptr = &options->clear_forwardings;
 757                 goto parse_flag;
 758
 759         case oHost:
 760                 *activep = 0;
 761                 while ((arg = strdelim(&s)) != NULL && *arg != '\0')
 762                         if (match_pattern(host, arg)) {
 763                                 debug("Applying options for %.100s", arg);
 764                                 *activep = 1;
 765                                 break;
 766                         }
 767                 /* Avoid garbage check below, as strdelim is done. */
 768                 return 0;
 769
 770         case oEscapeChar:
 771                 intptr = &options->escape_char;
 772                 arg = strdelim(&s);
 773                 if (!arg || *arg == '\0')
 774                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 775                 if (arg[0] == '^' && arg[2] == 0 &&
 776                     (u_char) arg[1] >= 64 && (u_char) arg[1] < 128)
 777                         value = (u_char) arg[1] & 31;
 778                 else if (strlen(arg) == 1)
 779                         value = (u_char) arg[0];
 780                 else if (strcmp(arg, "none") == 0)
 781                         value = SSH_ESCAPECHAR_NONE;
 782                 else {
 783                         fatal("%.200s line %d: Bad escape character.",
 784                             filename, linenum);
 785                         /* NOTREACHED */
 786                         value = 0;      /* Avoid compiler warning. */
 787                 }
 788                 if (*activep && *intptr == -1)
 789                         *intptr = value;
 790                 break;
 791
 792         case oAddressFamily:
 793                 arg = strdelim(&s);
 794                 if (!arg || *arg == '\0')
 795                         fatal("%s line %d: missing address family.",
 796                             filename, linenum);
 797                 intptr = &options->address_family;
 798                 if (strcasecmp(arg, "inet") == 0)
 799                         value = AF_INET;
 800                 else if (strcasecmp(arg, "inet6") == 0)
 801                         value = AF_INET6;
 802                 else if (strcasecmp(arg, "any") == 0)
 803                         value = AF_UNSPEC;
 804                 else
 805                         fatal("Unsupported AddressFamily \"%s\"", arg);
 806                 if (*activep && *intptr == -1)
 807                         *intptr = value;
 808                 break;
 809
 810         case oEnableSSHKeysign:
 811                 intptr = &options->enable_ssh_keysign;
 812                 goto parse_flag;
 813
 814         case oIdentitiesOnly:
 815                 intptr = &options->identities_only;
 816                 goto parse_flag;
 817
 818         case oServerAliveInterval:
 819                 intptr = &options->server_alive_interval;
 820                 goto parse_time;
 821
 822         case oServerAliveCountMax:
 823                 intptr = &options->server_alive_count_max;
 824                 goto parse_int;
 825
 826         case oSendEnv:
 827                 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
 828                         if (strchr(arg, '=') != NULL)
 829                                 fatal("%s line %d: Invalid environment name.",
 830                                     filename, linenum);
 831                         if (!*activep)
 832                                 continue;
 833                         if (options->num_send_env >= MAX_SEND_ENV)
 834                                 fatal("%s line %d: too many send env.",
 835                                     filename, linenum);
 836                         options->send_env[options->num_send_env++] =
 837                             xstrdup(arg);
 838                 }
 839                 break;
 840
 841         case oControlPath:
 842                 charptr = &options->control_path;
 843                 goto parse_string;
 844
 845         case oControlMaster:
 846                 intptr = &options->control_master;
 847                 arg = strdelim(&s);
 848                 if (!arg || *arg == '\0')
 849                         fatal("%.200s line %d: Missing ControlMaster argument.",
 850                             filename, linenum);
 851                 value = 0;      /* To avoid compiler warning... */
 852                 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
 853                         value = SSHCTL_MASTER_YES;
 854                 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
 855                         value = SSHCTL_MASTER_NO;
 856                 else if (strcmp(arg, "auto") == 0)
 857                         value = SSHCTL_MASTER_AUTO;
 858                 else if (strcmp(arg, "ask") == 0)
 859                         value = SSHCTL_MASTER_ASK;
 860                 else if (strcmp(arg, "autoask") == 0)
 861                         value = SSHCTL_MASTER_AUTO_ASK;
 862                 else
 863                         fatal("%.200s line %d: Bad ControlMaster argument.",
 864                             filename, linenum);
 865                 if (*activep && *intptr == -1)
 866                         *intptr = value;
 867                 break;
 868
 869         case oHashKnownHosts:
 870                 intptr = &options->hash_known_hosts;
 871                 goto parse_flag;
 872
 873         case oTunnel:
 874                 intptr = &options->tun_open;
 875                 arg = strdelim(&s);
 876                 if (!arg || *arg == '\0')
 877                         fatal("%s line %d: Missing yes/point-to-point/"
 878                             "ethernet/no argument.", filename, linenum);
 879                 value = 0;      /* silence compiler */
 880                 if (strcasecmp(arg, "ethernet") == 0)
 881                         value = SSH_TUNMODE_ETHERNET;
 882                 else if (strcasecmp(arg, "point-to-point") == 0)
 883                         value = SSH_TUNMODE_POINTOPOINT;
 884                 else if (strcasecmp(arg, "yes") == 0)
 885                         value = SSH_TUNMODE_DEFAULT;
 886                 else if (strcasecmp(arg, "no") == 0)
 887                         value = SSH_TUNMODE_NO;
 888                 else
 889                         fatal("%s line %d: Bad yes/point-to-point/ethernet/"
 890                             "no argument: %s", filename, linenum, arg);
 891                 if (*activep)
 892                         *intptr = value;
 893                 break;
 894
 895         case oTunnelDevice:
 896                 arg = strdelim(&s);
 897                 if (!arg || *arg == '\0')
 898                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 899                 value = a2tun(arg, &value2);
 900                 if (value == SSH_TUNID_ERR)
 901                         fatal("%.200s line %d: Bad tun device.", filename, linenum);
 902                 if (*activep) {
 903                         options->tun_local = value;
 904                         options->tun_remote = value2;
 905                 }
 906                 break;
 907
 908         case oLocalCommand:
 909                 charptr = &options->local_command;
 910                 goto parse_command;
 911
 912         case oPermitLocalCommand:
 913                 intptr = &options->permit_local_command;
 914                 goto parse_flag;
 915
 916         case oVisualHostKey:
 917                 intptr = &options->visual_host_key;
 918                 goto parse_flag;
 919
 920         case oUseRoaming:
 921                 intptr = &options->use_roaming;
 922                 goto parse_flag;
 923
 924         case oDeprecated:
 925                 debug("%s line %d: Deprecated option \"%s\"",
 926                     filename, linenum, keyword);
 927                 return 0;
 928
 929         case oUnsupported:
 930                 error("%s line %d: Unsupported option \"%s\"",
 931                     filename, linenum, keyword);
 932                 return 0;
 933
 934         default:
 935                 fatal("process_config_line: Unimplemented opcode %d", opcode);
 936         }
 937
 938         /* Check that there is no garbage at end of line. */
 939         if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
 940                 fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
 941                     filename, linenum, arg);
 942         }
 943         return 0;
 944 }
 945
 946
 947 /*
 948  * Reads the config file and modifies the options accordingly.  Options
 949  * should already be initialized before this call.  This never returns if
 950  * there is an error.  If the file does not exist, this returns 0.
 951  */
 952
 953 int
 954 read_config_file(const char *filename, const char *host, Options *options,
 955     int checkperm)
 956 {
 957         FILE *f;
 958         char line[1024];
 959         int active, linenum;
 960         int bad_options = 0;
 961
 962         if ((f = fopen(filename, "r")) == NULL)
 963                 return 0;
 964
 965         if (checkperm) {
 966                 struct stat sb;
 967
 968                 if (fstat(fileno(f), &sb) == -1)
 969                         fatal("fstat %s: %s", filename, strerror(errno));
 970                 if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
 971                     (sb.st_mode & 022) != 0))
 972                         fatal("Bad owner or permissions on %s", filename);
 973         }
 974
 975         debug("Reading configuration data %.200s", filename);
 976
 977         /*
 978          * Mark that we are now processing the options.  This flag is turned
 979          * on/off by Host specifications.
 980          */
 981         active = 1;
 982         linenum = 0;
 983         while (fgets(line, sizeof(line), f)) {
 984                 /* Update line number counter. */
 985                 linenum++;
 986                 if (process_config_line(options, host, line, filename, linenum, &active) != 0)
 987                         bad_options++;
 988         }
 989         fclose(f);
 990         if (bad_options > 0)
 991                 fatal("%s: terminating, %d bad configuration options",
 992                     filename, bad_options);
 993         return 1;
 994 }
 995
 996 /*
 997  * Initializes options to special values that indicate that they have not yet
 998  * been set.  Read_config_file will only set options with this value. Options
 999  * are processed in the following order: command line, user config file,
1000  * system config file.  Last, fill_default_options is called.
1001  */
1002
1003 void
1004 initialize_options(Options * options)
1005 {
1006         memset(options, 'X', sizeof(*options));
1007         options->forward_agent = -1;
1008         options->forward_x11 = -1;
1009         options->forward_x11_trusted = -1;
1010         options->exit_on_forward_failure = -1;
1011         options->xauth_location = NULL;
1012         options->gateway_ports = -1;
1013         options->use_privileged_port = -1;
1014         options->rsa_authentication = -1;
1015         options->pubkey_authentication = -1;
1016         options->challenge_response_authentication = -1;
1017         options->gss_authentication = -1;
1018         options->gss_deleg_creds = -1;
1019         options->password_authentication = -1;
1020         options->kbd_interactive_authentication = -1;
1021         options->kbd_interactive_devices = NULL;
1022         options->rhosts_rsa_authentication = -1;
1023         options->hostbased_authentication = -1;
1024         options->batch_mode = -1;
1025         options->check_host_ip = -1;
1026         options->strict_host_key_checking = -1;
1027         options->compression = -1;
1028         options->tcp_keep_alive = -1;
1029         options->compression_level = -1;
1030         options->port = -1;
1031         options->address_family = -1;
1032         options->connection_attempts = -1;
1033         options->connection_timeout = -1;
1034         options->number_of_password_prompts = -1;
1035         options->cipher = -1;
1036         options->ciphers = NULL;
1037         options->macs = NULL;
1038         options->hostkeyalgorithms = NULL;
1039         options->protocol = SSH_PROTO_UNKNOWN;
1040         options->num_identity_files = 0;
1041         options->hostname = NULL;
1042         options->host_key_alias = NULL;
1043         options->proxy_command = NULL;
1044         options->user = NULL;
1045         options->escape_char = -1;
1046         options->system_hostfile = NULL;
1047         options->user_hostfile = NULL;
1048         options->system_hostfile2 = NULL;
1049         options->user_hostfile2 = NULL;
1050         options->num_local_forwards = 0;
1051         options->num_remote_forwards = 0;
1052         options->clear_forwardings = -1;
1053         options->log_level = SYSLOG_LEVEL_NOT_SET;
1054         options->preferred_authentications = NULL;
1055         options->bind_address = NULL;
1056         options->pkcs11_provider = NULL;
1057         options->enable_ssh_keysign = - 1;
1058         options->no_host_authentication_for_localhost = - 1;
1059         options->identities_only = - 1;
1060         options->rekey_limit = - 1;
1061         options->verify_host_key_dns = -1;
1062         options->server_alive_interval = -1;
1063         options->server_alive_count_max = -1;
1064         options->num_send_env = 0;
1065         options->control_path = NULL;
1066         options->control_master = -1;
1067         options->hash_known_hosts = -1;
1068         options->tun_open = -1;
1069         options->tun_local = -1;
1070         options->tun_remote = -1;
1071         options->local_command = NULL;
1072         options->permit_local_command = -1;
1073         options->use_roaming = -1;
1074         options->visual_host_key = -1;
1075         options->zero_knowledge_password_authentication = -1;
1076 }
1077
1078 /*
1079  * Called after processing other sources of option data, this fills those
1080  * options for which no value has been specified with their default values.
1081  */
1082
1083 void
1084 fill_default_options(Options * options)
1085 {
1086         int len;
1087
1088         if (options->forward_agent == -1)
1089                 options->forward_agent = 0;
1090         if (options->forward_x11 == -1)
1091                 options->forward_x11 = 0;
1092         if (options->forward_x11_trusted == -1)
1093                 options->forward_x11_trusted = 0;
1094         if (options->exit_on_forward_failure == -1)
1095                 options->exit_on_forward_failure = 0;
1096         if (options->xauth_location == NULL)
1097                 options->xauth_location = _PATH_XAUTH;
1098         if (options->gateway_ports == -1)
1099                 options->gateway_ports = 0;
1100         if (options->use_privileged_port == -1)
1101                 options->use_privileged_port = 0;
1102         if (options->rsa_authentication == -1)
1103                 options->rsa_authentication = 1;
1104         if (options->pubkey_authentication == -1)
1105                 options->pubkey_authentication = 1;
1106         if (options->challenge_response_authentication == -1)
1107                 options->challenge_response_authentication = 1;
1108         if (options->gss_authentication == -1)
1109                 options->gss_authentication = 0;
1110         if (options->gss_deleg_creds == -1)
1111                 options->gss_deleg_creds = 0;
1112         if (options->password_authentication == -1)
1113                 options->password_authentication = 1;
1114         if (options->kbd_interactive_authentication == -1)
1115                 options->kbd_interactive_authentication = 1;
1116         if (options->rhosts_rsa_authentication == -1)
1117                 options->rhosts_rsa_authentication = 0;
1118         if (options->hostbased_authentication == -1)
1119                 options->hostbased_authentication = 0;
1120         if (options->batch_mode == -1)
1121                 options->batch_mode = 0;
1122         if (options->check_host_ip == -1)
1123                 options->check_host_ip = 1;
1124         if (options->strict_host_key_checking == -1)
1125                 options->strict_host_key_checking = 2;  /* 2 is default */
1126         if (options->compression == -1)
1127                 options->compression = 0;
1128         if (options->tcp_keep_alive == -1)
1129                 options->tcp_keep_alive = 1;
1130         if (options->compression_level == -1)
1131                 options->compression_level = 6;
1132         if (options->port == -1)
1133                 options->port = 0;      /* Filled in ssh_connect. */
1134         if (options->address_family == -1)
1135                 options->address_family = AF_UNSPEC;
1136         if (options->connection_attempts == -1)
1137                 options->connection_attempts = 1;
1138         if (options->number_of_password_prompts == -1)
1139                 options->number_of_password_prompts = 3;
1140         /* Selected in ssh_login(). */
1141         if (options->cipher == -1)
1142                 options->cipher = SSH_CIPHER_NOT_SET;
1143         /* options->ciphers, default set in myproposals.h */
1144         /* options->macs, default set in myproposals.h */
1145         /* options->hostkeyalgorithms, default set in myproposals.h */
1146         if (options->protocol == SSH_PROTO_UNKNOWN)
1147                 options->protocol = SSH_PROTO_2;
1148         if (options->num_identity_files == 0) {
1149                 if (options->protocol & SSH_PROTO_1) {
1150                         len = 2 + strlen(_PATH_SSH_CLIENT_IDENTITY) + 1;
1151                         options->identity_files[options->num_identity_files] =
1152                             xmalloc(len);
1153                         snprintf(options->identity_files[options->num_identity_files++],
1154                             len, "~/%.100s", _PATH_SSH_CLIENT_IDENTITY);
1155                 }
1156                 if (options->protocol & SSH_PROTO_2) {
1157                         len = 2 + strlen(_PATH_SSH_CLIENT_ID_RSA) + 1;
1158                         options->identity_files[options->num_identity_files] =
1159                             xmalloc(len);
1160                         snprintf(options->identity_files[options->num_identity_files++],
1161                             len, "~/%.100s", _PATH_SSH_CLIENT_ID_RSA);
1162
1163                         len = 2 + strlen(_PATH_SSH_CLIENT_ID_DSA) + 1;
1164                         options->identity_files[options->num_identity_files] =
1165                             xmalloc(len);
1166                         snprintf(options->identity_files[options->num_identity_files++],
1167                             len, "~/%.100s", _PATH_SSH_CLIENT_ID_DSA);
1168                 }
1169         }
1170         if (options->escape_char == -1)
1171                 options->escape_char = '~';
1172         if (options->system_hostfile == NULL)
1173                 options->system_hostfile = _PATH_SSH_SYSTEM_HOSTFILE;
1174         if (options->user_hostfile == NULL)
1175                 options->user_hostfile = _PATH_SSH_USER_HOSTFILE;
1176         if (options->system_hostfile2 == NULL)
1177                 options->system_hostfile2 = _PATH_SSH_SYSTEM_HOSTFILE2;
1178         if (options->user_hostfile2 == NULL)
1179                 options->user_hostfile2 = _PATH_SSH_USER_HOSTFILE2;
1180         if (options->log_level == SYSLOG_LEVEL_NOT_SET)
1181                 options->log_level = SYSLOG_LEVEL_INFO;
1182         if (options->clear_forwardings == 1)
1183                 clear_forwardings(options);
1184         if (options->no_host_authentication_for_localhost == - 1)
1185                 options->no_host_authentication_for_localhost = 0;
1186         if (options->identities_only == -1)
1187                 options->identities_only = 0;
1188         if (options->enable_ssh_keysign == -1)
1189                 options->enable_ssh_keysign = 0;
1190         if (options->rekey_limit == -1)
1191                 options->rekey_limit = 0;
1192         if (options->verify_host_key_dns == -1)
1193                 options->verify_host_key_dns = 0;
1194         if (options->server_alive_interval == -1)
1195                 options->server_alive_interval = 0;
1196         if (options->server_alive_count_max == -1)
1197                 options->server_alive_count_max = 3;
1198         if (options->control_master == -1)
1199                 options->control_master = 0;
1200         if (options->hash_known_hosts == -1)
1201                 options->hash_known_hosts = 0;
1202         if (options->tun_open == -1)
1203                 options->tun_open = SSH_TUNMODE_NO;
1204         if (options->tun_local == -1)
1205                 options->tun_local = SSH_TUNID_ANY;
1206         if (options->tun_remote == -1)
1207                 options->tun_remote = SSH_TUNID_ANY;
1208         if (options->permit_local_command == -1)
1209                 options->permit_local_command = 0;
1210         if (options->use_roaming == -1)
1211                 options->use_roaming = 1;
1212         if (options->visual_host_key == -1)
1213                 options->visual_host_key = 0;
1214         if (options->zero_knowledge_password_authentication == -1)
1215                 options->zero_knowledge_password_authentication = 0;
1216         /* options->local_command should not be set by default */
1217         /* options->proxy_command should not be set by default */
1218         /* options->user will be set in the main program if appropriate */
1219         /* options->hostname will be set in the main program if appropriate */
1220         /* options->host_key_alias should not be set by default */
1221         /* options->preferred_authentications will be set in ssh */
1222 }
1223
1224 /*
1225  * parse_forward
1226  * parses a string containing a port forwarding specification of the form:
1227  *   dynamicfwd == 0
1228  *      [listenhost:]listenport:connecthost:connectport
1229  *   dynamicfwd == 1
1230  *      [listenhost:]listenport
1231  * returns number of arguments parsed or zero on error
1232  */
1233 int
1234 parse_forward(Forward *fwd, const char *fwdspec, int dynamicfwd, int remotefwd)
1235 {
1236         int i;
1237         char *p, *cp, *fwdarg[4];
1238
1239         memset(fwd, '\0', sizeof(*fwd));
1240
1241         cp = p = xstrdup(fwdspec);
1242
1243         /* skip leading spaces */
1244         while (isspace(*cp))
1245                 cp++;
1246
1247         for (i = 0; i < 4; ++i)
1248                 if ((fwdarg[i] = hpdelim(&cp)) == NULL)
1249                         break;
1250
1251         /* Check for trailing garbage */
1252         if (cp != NULL)
1253                 i = 0;  /* failure */
1254
1255         switch (i) {
1256         case 1:
1257                 fwd->listen_host = NULL;
1258                 fwd->listen_port = a2port(fwdarg[0]);
1259                 fwd->connect_host = xstrdup("socks");
1260                 break;
1261
1262         case 2:
1263                 fwd->listen_host = xstrdup(cleanhostname(fwdarg[0]));
1264                 fwd->listen_port = a2port(fwdarg[1]);
1265                 fwd->connect_host = xstrdup("socks");
1266                 break;
1267
1268         case 3:
1269                 fwd->listen_host = NULL;
1270                 fwd->listen_port = a2port(fwdarg[0]);
1271                 fwd->connect_host = xstrdup(cleanhostname(fwdarg[1]));
1272                 fwd->connect_port = a2port(fwdarg[2]);
1273                 break;
1274
1275         case 4:
1276                 fwd->listen_host = xstrdup(cleanhostname(fwdarg[0]));
1277                 fwd->listen_port = a2port(fwdarg[1]);
1278                 fwd->connect_host = xstrdup(cleanhostname(fwdarg[2]));
1279                 fwd->connect_port = a2port(fwdarg[3]);
1280                 break;
1281         default:
1282                 i = 0; /* failure */
1283         }
1284
1285         xfree(p);
1286
1287         if (dynamicfwd) {
1288                 if (!(i == 1 || i == 2))
1289                         goto fail_free;
1290         } else {
1291                 if (!(i == 3 || i == 4))
1292                         goto fail_free;
1293                 if (fwd->connect_port <= 0)
1294                         goto fail_free;
1295         }
1296
1297         if (fwd->listen_port < 0 || (!remotefwd && fwd->listen_port == 0))
1298                 goto fail_free;
1299
1300         if (fwd->connect_host != NULL &&
1301             strlen(fwd->connect_host) >= NI_MAXHOST)
1302                 goto fail_free;
1303         if (fwd->listen_host != NULL &&
1304             strlen(fwd->listen_host) >= NI_MAXHOST)
1305                 goto fail_free;
1306
1307
1308         return (i);
1309
1310  fail_free:
1311         if (fwd->connect_host != NULL) {
1312                 xfree(fwd->connect_host);
1313                 fwd->connect_host = NULL;
1314         }
1315         if (fwd->listen_host != NULL) {
1316                 xfree(fwd->listen_host);
1317                 fwd->listen_host = NULL;
1318         }
1319         return (0);
1320 }