/* $OpenBSD: readconf.c,v 1.190 2010/11/13 23:27:50 djm Exp $ */

/*

* Author: Tatu Ylonen <ylo@cs.hut.fi>

* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland

* All rights reserved

* Functions for reading the configuration files.

*

* As far as I am concerned, the code I have written for this software

* can be used freely for any purpose. Any derived versions of this

* software must be clearly marked as such, and if the derived work is

* incompatible with the protocol description in the RFC file, it must be

* called by a name other than "ssh" or "Secure Shell".

*/

#include "includes.h"

#include <sys/types.h>

#include <sys/stat.h>

#include <sys/socket.h>

#include <netinet/in.h>

#include <netinet/in_systm.h>

#include <netinet/ip.h>

#include <ctype.h>

#include <errno.h>

#include <netdb.h>

#include <signal.h>

#include <stdarg.h>

#include <stdio.h>

#include <string.h>

#include <unistd.h>

#include "xmalloc.h"

#include "ssh.h"

#include "compat.h"

#include "cipher.h"

#include "pathnames.h"

#include "log.h"

#include "key.h"

#include "readconf.h"

#include "match.h"

#include "misc.h"

#include "buffer.h"

#include "kex.h"

#include "mac.h"

/* Format of the configuration file:

# Configuration data is parsed as follows:

# 1. command line options

# 2. user-specific file

# 3. system-wide file

# Any configuration value is only changed the first time it is set.

# Thus, host-specific definitions should be at the beginning of the

# configuration file, and defaults at the end.

# Host-specific declarations. These may override anything above. A single

# host may match multiple declarations; these are processed in the order

# that they are given in.

Host *.ngs.fi ngs.fi

User foo

Host fake.com

HostName another.host.name.real.org

User blaah

Port 34289

ForwardX11 no

ForwardAgent no

Host books.com

RemoteForward 9999 shadows.cs.hut.fi:9999

Cipher 3des

Host fascist.blob.com

Port 23123

User tylonen

PasswordAuthentication no

Host puukko.hut.fi

User t35124p

ProxyCommand ssh-proxy %h %p

Host *.fr

PublicKeyAuthentication no

Host *.su

Cipher none

PasswordAuthentication no

Host vpn.fake.com

Tunnel yes

TunnelDevice 3

# Defaults for various options

Host *

ForwardAgent no

ForwardX11 no

PasswordAuthentication yes

RSAAuthentication yes

RhostsRSAAuthentication yes

StrictHostKeyChecking yes

TcpKeepAlive no

IdentityFile ~/.ssh/identity

Port 22

EscapeChar ~

*/

/* Keyword tokens. */

typedef enum {

oBadOption,

oForwardAgent, oForwardX11, oForwardX11Trusted, oForwardX11Timeout,

oGatewayPorts, oExitOnForwardFailure,

oPasswordAuthentication, oRSAAuthentication,

oChallengeResponseAuthentication, oXAuthLocation,

oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,

oUser, oHost, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,

oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,

oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,

oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts,

oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,

oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,

oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,

oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,

oHostKeyAlgorithms, oBindAddress, oPKCS11Provider,

oClearAllForwardings, oNoHostAuthenticationForLocalhost,

oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,

oAddressFamily, oGssAuthentication, oGssDelegateCreds,

oGssTrustDns, oGssKeyEx, oGssClientIdentity, oGssRenewalRekey,

oGssServerIdentity,

oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,

oSendEnv, oControlPath, oControlMaster, oControlPersist,

oHashKnownHosts,

oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,

oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication,

oKexAlgorithms, oIPQoS,

oDeprecated, oUnsupported

} OpCodes;

/* Textual representations of the tokens. */

static struct {

const char *name;

OpCodes opcode;

} keywords[] = {

{ "forwardagent", oForwardAgent },

{ "forwardx11", oForwardX11 },

{ "forwardx11trusted", oForwardX11Trusted },

{ "forwardx11timeout", oForwardX11Timeout },

{ "exitonforwardfailure", oExitOnForwardFailure },

{ "xauthlocation", oXAuthLocation },

{ "gatewayports", oGatewayPorts },

{ "useprivilegedport", oUsePrivilegedPort },

{ "rhostsauthentication", oDeprecated },

{ "passwordauthentication", oPasswordAuthentication },

{ "kbdinteractiveauthentication", oKbdInteractiveAuthentication },

{ "kbdinteractivedevices", oKbdInteractiveDevices },

{ "rsaauthentication", oRSAAuthentication },

{ "pubkeyauthentication", oPubkeyAuthentication },

{ "dsaauthentication", oPubkeyAuthentication }, /* alias */

{ "rhostsrsaauthentication", oRhostsRSAAuthentication },

{ "hostbasedauthentication", oHostbasedAuthentication },

{ "challengeresponseauthentication", oChallengeResponseAuthentication },

{ "skeyauthentication", oChallengeResponseAuthentication }, /* alias */

{ "tisauthentication", oChallengeResponseAuthentication }, /* alias */

{ "kerberosauthentication", oUnsupported },

{ "kerberostgtpassing", oUnsupported },

{ "afstokenpassing", oUnsupported },

#if defined(GSSAPI)

{ "gssapiauthentication", oGssAuthentication },

{ "gssapikeyexchange", oGssKeyEx },

{ "gssapidelegatecredentials", oGssDelegateCreds },

{ "gssapitrustdns", oGssTrustDns },

{ "gssapiclientidentity", oGssClientIdentity },

{ "gssapiserveridentity", oGssServerIdentity },

{ "gssapirenewalforcesrekey", oGssRenewalRekey },

#else

{ "gssapiauthentication", oUnsupported },

{ "gssapikeyexchange", oUnsupported },

{ "gssapidelegatecredentials", oUnsupported },

{ "gssapitrustdns", oUnsupported },

{ "gssapiclientidentity", oUnsupported },

{ "gssapirenewalforcesrekey", oUnsupported },

#endif

{ "fallbacktorsh", oDeprecated },

{ "usersh", oDeprecated },

{ "identityfile", oIdentityFile },

{ "identityfile2", oIdentityFile }, /* obsolete */

{ "identitiesonly", oIdentitiesOnly },

{ "hostname", oHostName },

{ "hostkeyalias", oHostKeyAlias },

{ "proxycommand", oProxyCommand },

{ "port", oPort },

{ "cipher", oCipher },

{ "ciphers", oCiphers },

{ "macs", oMacs },

{ "protocol", oProtocol },

{ "remoteforward", oRemoteForward },

{ "localforward", oLocalForward },

{ "user", oUser },

{ "host", oHost },

{ "escapechar", oEscapeChar },

{ "globalknownhostsfile", oGlobalKnownHostsFile },

{ "globalknownhostsfile2", oGlobalKnownHostsFile2 }, /* obsolete */

{ "userknownhostsfile", oUserKnownHostsFile },

{ "userknownhostsfile2", oUserKnownHostsFile2 }, /* obsolete */

{ "connectionattempts", oConnectionAttempts },

{ "batchmode", oBatchMode },

{ "checkhostip", oCheckHostIP },

{ "stricthostkeychecking", oStrictHostKeyChecking },

{ "compression", oCompression },

{ "compressionlevel", oCompressionLevel },

{ "tcpkeepalive", oTCPKeepAlive },

{ "keepalive", oTCPKeepAlive }, /* obsolete */

{ "numberofpasswordprompts", oNumberOfPasswordPrompts },

{ "loglevel", oLogLevel },

{ "dynamicforward", oDynamicForward },

{ "preferredauthentications", oPreferredAuthentications },

{ "hostkeyalgorithms", oHostKeyAlgorithms },

{ "bindaddress", oBindAddress },

#ifdef ENABLE_PKCS11

{ "smartcarddevice", oPKCS11Provider },

{ "pkcs11provider", oPKCS11Provider },

#else

{ "smartcarddevice", oUnsupported },

{ "pkcs11provider", oUnsupported },

#endif

{ "clearallforwardings", oClearAllForwardings },

{ "enablesshkeysign", oEnableSSHKeysign },

{ "verifyhostkeydns", oVerifyHostKeyDNS },

{ "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost },

{ "rekeylimit", oRekeyLimit },

{ "connecttimeout", oConnectTimeout },

{ "addressfamily", oAddressFamily },

{ "serveraliveinterval", oServerAliveInterval },

{ "serveralivecountmax", oServerAliveCountMax },

{ "sendenv", oSendEnv },

{ "controlpath", oControlPath },

{ "controlmaster", oControlMaster },

{ "controlpersist", oControlPersist },

{ "hashknownhosts", oHashKnownHosts },

{ "tunnel", oTunnel },

{ "tunneldevice", oTunnelDevice },

{ "localcommand", oLocalCommand },

{ "permitlocalcommand", oPermitLocalCommand },

{ "visualhostkey", oVisualHostKey },

{ "useroaming", oUseRoaming },

#ifdef JPAKE

{ "zeroknowledgepasswordauthentication",

oZeroKnowledgePasswordAuthentication },

#else

{ "zeroknowledgepasswordauthentication", oUnsupported },

#endif

{ "kexalgorithms", oKexAlgorithms },

{ "ipqos", oIPQoS },

{ NULL, oBadOption }

};

/*

* Adds a local TCP/IP port forward to options. Never returns if there is an

* error.

*/

void

add_local_forward(Options *options, const Forward *newfwd)

{

Forward *fwd;

#ifndef NO_IPPORT_RESERVED_CONCEPT

extern uid_t original_real_uid;

if (newfwd->listen_port < IPPORT_RESERVED && original_real_uid != 0)

fatal("Privileged ports can only be forwarded by root.");

#endif

options->local_forwards = xrealloc(options->local_forwards,

options->num_local_forwards + 1,

sizeof(*options->local_forwards));

fwd = &options->local_forwards[options->num_local_forwards++];

fwd->listen_host = newfwd->listen_host;

fwd->listen_port = newfwd->listen_port;

fwd->connect_host = newfwd->connect_host;

fwd->connect_port = newfwd->connect_port;

}

/*

* Adds a remote TCP/IP port forward to options. Never returns if there is

* an error.

*/

void

add_remote_forward(Options *options, const Forward *newfwd)

{

Forward *fwd;

options->remote_forwards = xrealloc(options->remote_forwards,

options->num_remote_forwards + 1,

sizeof(*options->remote_forwards));

fwd = &options->remote_forwards[options->num_remote_forwards++];

fwd->listen_host = newfwd->listen_host;

fwd->listen_port = newfwd->listen_port;

fwd->connect_host = newfwd->connect_host;

fwd->connect_port = newfwd->connect_port;

fwd->allocated_port = 0;

}

static void

clear_forwardings(Options *options)

{

int i;

for (i = 0; i < options->num_local_forwards; i++) {

if (options->local_forwards[i].listen_host != NULL)

xfree(options->local_forwards[i].listen_host);

xfree(options->local_forwards[i].connect_host);

}

if (options->num_local_forwards > 0) {

xfree(options->local_forwards);

options->local_forwards = NULL;

}

options->num_local_forwards = 0;

for (i = 0; i < options->num_remote_forwards; i++) {

if (options->remote_forwards[i].listen_host != NULL)

xfree(options->remote_forwards[i].listen_host);

xfree(options->remote_forwards[i].connect_host);

}

if (options->num_remote_forwards > 0) {

xfree(options->remote_forwards);

options->remote_forwards = NULL;

}

options->num_remote_forwards = 0;

options->tun_open = SSH_TUNMODE_NO;

}

/*

* Returns the number of the token pointed to by cp or oBadOption.

*/

static OpCodes

parse_token(const char *cp, const char *filename, int linenum)

{

u_int i;

for (i = 0; keywords[i].name; i++)

if (strcasecmp(cp, keywords[i].name) == 0)

return keywords[i].opcode;

error("%s: line %d: Bad configuration option: %s",

filename, linenum, cp);

return oBadOption;

}

/*

* Processes a single option line as used in the configuration files. This

* only sets those values that have not already been set.

*/

#define WHITESPACE " \t\r\n"

int

process_config_line(Options *options, const char *host,

char *line, const char *filename, int linenum,

int *activep)

{

char *s, **charptr, *endofnumber, *keyword, *arg, *arg2, fwdarg[256];

int opcode, *intptr, value, value2, scale;

LogLevel *log_level_ptr;

long long orig, val64;

size_t len;

Forward fwd;

/* Strip trailing whitespace */

for (len = strlen(line) - 1; len > 0; len--) {

if (strchr(WHITESPACE, line[len]) == NULL)

break;

line[len] = '\0';

}

s = line;

/* Get the keyword. (Each line is supposed to begin with a keyword). */

if ((keyword = strdelim(&s)) == NULL)

return 0;

/* Ignore leading whitespace. */

if (*keyword == '\0')

keyword = strdelim(&s);

if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')

return 0;

opcode = parse_token(keyword, filename, linenum);

switch (opcode) {

case oBadOption:

/* don't panic, but count bad options */

return -1;

/* NOTREACHED */

case oConnectTimeout:

intptr = &options->connection_timeout;

parse_time:

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%s line %d: missing time value.",

filename, linenum);

if ((value = convtime(arg)) == -1)

fatal("%s line %d: invalid time value.",

filename, linenum);

if (*activep && *intptr == -1)

*intptr = value;

break;

case oForwardAgent:

intptr = &options->forward_agent;

parse_flag:

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing yes/no argument.", filename, linenum);

value = 0; /* To avoid compiler warning... */

if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)

value = 1;

else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)

value = 0;

else

fatal("%.200s line %d: Bad yes/no argument.", filename, linenum);

if (*activep && *intptr == -1)

*intptr = value;

break;

case oForwardX11:

intptr = &options->forward_x11;

goto parse_flag;

case oForwardX11Trusted:

intptr = &options->forward_x11_trusted;

goto parse_flag;

case oForwardX11Timeout:

intptr = &options->forward_x11_timeout;

goto parse_time;

case oGatewayPorts:

intptr = &options->gateway_ports;

goto parse_flag;

case oExitOnForwardFailure:

intptr = &options->exit_on_forward_failure;

goto parse_flag;

case oUsePrivilegedPort:

intptr = &options->use_privileged_port;

goto parse_flag;

case oPasswordAuthentication:

intptr = &options->password_authentication;

goto parse_flag;

case oZeroKnowledgePasswordAuthentication:

intptr = &options->zero_knowledge_password_authentication;

goto parse_flag;

case oKbdInteractiveAuthentication:

intptr = &options->kbd_interactive_authentication;

goto parse_flag;

case oKbdInteractiveDevices:

charptr = &options->kbd_interactive_devices;

goto parse_string;

case oPubkeyAuthentication:

intptr = &options->pubkey_authentication;

goto parse_flag;

case oRSAAuthentication:

intptr = &options->rsa_authentication;

goto parse_flag;

case oRhostsRSAAuthentication:

intptr = &options->rhosts_rsa_authentication;

goto parse_flag;

case oHostbasedAuthentication:

intptr = &options->hostbased_authentication;

goto parse_flag;

case oChallengeResponseAuthentication:

intptr = &options->challenge_response_authentication;

goto parse_flag;

case oGssAuthentication:

intptr = &options->gss_authentication;

goto parse_flag;

case oGssKeyEx:

intptr = &options->gss_keyex;

goto parse_flag;

case oGssDelegateCreds:

intptr = &options->gss_deleg_creds;

goto parse_flag;

case oGssTrustDns:

intptr = &options->gss_trust_dns;

goto parse_flag;

case oGssClientIdentity:

charptr = &options->gss_client_identity;

goto parse_string;

case oGssServerIdentity:

charptr = &options->gss_server_identity;

goto parse_string;

case oGssRenewalRekey:

intptr = &options->gss_renewal_rekey;

goto parse_flag;

case oBatchMode:

intptr = &options->batch_mode;

goto parse_flag;

case oCheckHostIP:

intptr = &options->check_host_ip;

goto parse_flag;

case oVerifyHostKeyDNS:

intptr = &options->verify_host_key_dns;

goto parse_yesnoask;

case oStrictHostKeyChecking:

intptr = &options->strict_host_key_checking;

parse_yesnoask:

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing yes/no/ask argument.",

filename, linenum);

value = 0; /* To avoid compiler warning... */

if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)

value = 1;

else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)

value = 0;

else if (strcmp(arg, "ask") == 0)

value = 2;

else

fatal("%.200s line %d: Bad yes/no/ask argument.", filename, linenum);

if (*activep && *intptr == -1)

*intptr = value;

break;

case oCompression:

intptr = &options->compression;

goto parse_flag;

case oTCPKeepAlive:

intptr = &options->tcp_keep_alive;

goto parse_flag;

case oNoHostAuthenticationForLocalhost:

intptr = &options->no_host_authentication_for_localhost;

goto parse_flag;

case oNumberOfPasswordPrompts:

intptr = &options->number_of_password_prompts;

goto parse_int;

case oCompressionLevel:

intptr = &options->compression_level;

goto parse_int;

case oRekeyLimit:

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing argument.", filename, linenum);

if (arg[0] < '0' || arg[0] > '9')

fatal("%.200s line %d: Bad number.", filename, linenum);

orig = val64 = strtoll(arg, &endofnumber, 10);

if (arg == endofnumber)

fatal("%.200s line %d: Bad number.", filename, linenum);

switch (toupper(*endofnumber)) {

case '\0':

scale = 1;

break;

case 'K':

scale = 1<<10;

break;

case 'M':

scale = 1<<20;

break;

case 'G':

scale = 1<<30;

break;

default:

fatal("%.200s line %d: Invalid RekeyLimit suffix",

filename, linenum);

}

val64 *= scale;

/* detect integer wrap and too-large limits */

if ((val64 / scale) != orig || val64 > UINT_MAX)

fatal("%.200s line %d: RekeyLimit too large",

filename, linenum);

if (val64 < 16)

fatal("%.200s line %d: RekeyLimit too small",

filename, linenum);

if (*activep && options->rekey_limit == -1)

options->rekey_limit = (u_int32_t)val64;

break;

case oIdentityFile:

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing argument.", filename, linenum);

if (*activep) {

intptr = &options->num_identity_files;

if (*intptr >= SSH_MAX_IDENTITY_FILES)

fatal("%.200s line %d: Too many identity files specified (max %d).",

filename, linenum, SSH_MAX_IDENTITY_FILES);

charptr = &options->identity_files[*intptr];

*charptr = xstrdup(arg);

*intptr = *intptr + 1;

}

break;

case oXAuthLocation:

charptr=&options->xauth_location;

goto parse_string;

case oUser:

charptr = &options->user;

parse_string:

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing argument.", filename, linenum);

if (*activep && *charptr == NULL)

*charptr = xstrdup(arg);

break;

case oGlobalKnownHostsFile:

charptr = &options->system_hostfile;

goto parse_string;

case oUserKnownHostsFile:

charptr = &options->user_hostfile;

goto parse_string;

case oGlobalKnownHostsFile2:

charptr = &options->system_hostfile2;

goto parse_string;

case oUserKnownHostsFile2:

charptr = &options->user_hostfile2;

goto parse_string;

case oHostName:

charptr = &options->hostname;

goto parse_string;

case oHostKeyAlias:

charptr = &options->host_key_alias;

goto parse_string;

case oPreferredAuthentications:

charptr = &options->preferred_authentications;

goto parse_string;

case oBindAddress:

charptr = &options->bind_address;

goto parse_string;

case oPKCS11Provider:

charptr = &options->pkcs11_provider;

goto parse_string;

case oProxyCommand:

charptr = &options->proxy_command;

parse_command:

if (s == NULL)

fatal("%.200s line %d: Missing argument.", filename, linenum);

len = strspn(s, WHITESPACE "=");

if (*activep && *charptr == NULL)

*charptr = xstrdup(s + len);

return 0;

case oPort:

intptr = &options->port;

parse_int:

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing argument.", filename, linenum);

if (arg[0] < '0' || arg[0] > '9')

fatal("%.200s line %d: Bad number.", filename, linenum);

/* Octal, decimal, or hex format? */

value = strtol(arg, &endofnumber, 0);

if (arg == endofnumber)

fatal("%.200s line %d: Bad number.", filename, linenum);

if (*activep && *intptr == -1)

*intptr = value;

break;

case oConnectionAttempts:

intptr = &options->connection_attempts;

goto parse_int;

case oCipher:

intptr = &options->cipher;

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing argument.", filename, linenum);

value = cipher_number(arg);

if (value == -1)

fatal("%.200s line %d: Bad cipher '%s'.",

filename, linenum, arg ? arg : "<NONE>");

if (*activep && *intptr == -1)

*intptr = value;

break;

case oCiphers:

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing argument.", filename, linenum);

if (!ciphers_valid(arg))

fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",

filename, linenum, arg ? arg : "<NONE>");

if (*activep && options->ciphers == NULL)

options->ciphers = xstrdup(arg);

break;

case oMacs:

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing argument.", filename, linenum);

if (!mac_valid(arg))

fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.",

filename, linenum, arg ? arg : "<NONE>");

if (*activep && options->macs == NULL)

options->macs = xstrdup(arg);

break;

case oKexAlgorithms:

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing argument.",

filename, linenum);

if (!kex_names_valid(arg))

fatal("%.200s line %d: Bad SSH2 KexAlgorithms '%s'.",

filename, linenum, arg ? arg : "<NONE>");

if (*activep && options->kex_algorithms == NULL)

options->kex_algorithms = xstrdup(arg);

break;

case oHostKeyAlgorithms:

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing argument.", filename, linenum);

if (!key_names_valid2(arg))

fatal("%.200s line %d: Bad protocol 2 host key algorithms '%s'.",

filename, linenum, arg ? arg : "<NONE>");

if (*activep && options->hostkeyalgorithms == NULL)

options->hostkeyalgorithms = xstrdup(arg);

break;

case oProtocol:

intptr = &options->protocol;

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing argument.", filename, linenum);

value = proto_spec(arg);

if (value == SSH_PROTO_UNKNOWN)

fatal("%.200s line %d: Bad protocol spec '%s'.",

filename, linenum, arg ? arg : "<NONE>");

if (*activep && *intptr == SSH_PROTO_UNKNOWN)

*intptr = value;

break;

case oLogLevel:

log_level_ptr = &options->log_level;

arg = strdelim(&s);

value = log_level_number(arg);

if (value == SYSLOG_LEVEL_NOT_SET)

fatal("%.200s line %d: unsupported log level '%s'",

filename, linenum, arg ? arg : "<NONE>");

if (*activep && *log_level_ptr == SYSLOG_LEVEL_NOT_SET)

*log_level_ptr = (LogLevel) value;

break;

case oLocalForward:

case oRemoteForward:

case oDynamicForward:

arg = strdelim(&s);

if (arg == NULL || *arg == '\0')

fatal("%.200s line %d: Missing port argument.",

filename, linenum);

if (opcode == oLocalForward ||

opcode == oRemoteForward) {

arg2 = strdelim(&s);

if (arg2 == NULL || *arg2 == '\0')

fatal("%.200s line %d: Missing target argument.",

filename, linenum);

/* construct a string for parse_forward */

snprintf(fwdarg, sizeof(fwdarg), "%s:%s", arg, arg2);

} else if (opcode == oDynamicForward) {

strlcpy(fwdarg, arg, sizeof(fwdarg));

}

if (parse_forward(&fwd, fwdarg,

opcode == oDynamicForward ? 1 : 0,

opcode == oRemoteForward ? 1 : 0) == 0)

fatal("%.200s line %d: Bad forwarding specification.",

filename, linenum);

if (*activep) {

if (opcode == oLocalForward ||

opcode == oDynamicForward)

add_local_forward(options, &fwd);

else if (opcode == oRemoteForward)

add_remote_forward(options, &fwd);

}

break;

case oClearAllForwardings:

intptr = &options->clear_forwardings;

goto parse_flag;

case oHost:

*activep = 0;

while ((arg = strdelim(&s)) != NULL && *arg != '\0')

if (match_pattern(host, arg)) {

debug("Applying options for %.100s", arg);

*activep = 1;

break;

}

/* Avoid garbage check below, as strdelim is done. */

return 0;

case oEscapeChar:

intptr = &options->escape_char;

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing argument.", filename, linenum);

if (arg[0] == '^' && arg[2] == 0 &&

(u_char) arg[1] >= 64 && (u_char) arg[1] < 128)

value = (u_char) arg[1] & 31;

else if (strlen(arg) == 1)

value = (u_char) arg[0];

else if (strcmp(arg, "none") == 0)

value = SSH_ESCAPECHAR_NONE;

else {

fatal("%.200s line %d: Bad escape character.",

filename, linenum);

/* NOTREACHED */

value = 0; /* Avoid compiler warning. */

}

if (*activep && *intptr == -1)

*intptr = value;

break;

case oAddressFamily:

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%s line %d: missing address family.",

filename, linenum);

intptr = &options->address_family;

if (strcasecmp(arg, "inet") == 0)

value = AF_INET;

else if (strcasecmp(arg, "inet6") == 0)

value = AF_INET6;

else if (strcasecmp(arg, "any") == 0)

value = AF_UNSPEC;

else

fatal("Unsupported AddressFamily \"%s\"", arg);

if (*activep && *intptr == -1)

*intptr = value;

break;

case oEnableSSHKeysign:

intptr = &options->enable_ssh_keysign;

goto parse_flag;

case oIdentitiesOnly:

intptr = &options->identities_only;

goto parse_flag;

case oServerAliveInterval:

intptr = &options->server_alive_interval;

goto parse_time;

case oServerAliveCountMax:

intptr = &options->server_alive_count_max;

goto parse_int;

case oSendEnv:

while ((arg = strdelim(&s)) != NULL && *arg != '\0') {

if (strchr(arg, '=') != NULL)

fatal("%s line %d: Invalid environment name.",

filename, linenum);

if (!*activep)

continue;

if (options->num_send_env >= MAX_SEND_ENV)

fatal("%s line %d: too many send env.",

filename, linenum);

options->send_env[options->num_send_env++] =

xstrdup(arg);

}

break;

case oControlPath:

charptr = &options->control_path;

goto parse_string;

case oControlMaster:

intptr = &options->control_master;

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing ControlMaster argument.",

filename, linenum);

value = 0; /* To avoid compiler warning... */

if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)

value = SSHCTL_MASTER_YES;

else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)

value = SSHCTL_MASTER_NO;

else if (strcmp(arg, "auto") == 0)

value = SSHCTL_MASTER_AUTO;

else if (strcmp(arg, "ask") == 0)

value = SSHCTL_MASTER_ASK;

else if (strcmp(arg, "autoask") == 0)

value = SSHCTL_MASTER_AUTO_ASK;

else

fatal("%.200s line %d: Bad ControlMaster argument.",

filename, linenum);

if (*activep && *intptr == -1)

*intptr = value;

break;

case oControlPersist:

/* no/false/yes/true, or a time spec */

intptr = &options->control_persist;

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing ControlPersist"

" argument.", filename, linenum);

value = 0;

value2 = 0; /* timeout */

if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)

value = 0;

else if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)

value = 1;

else if ((value2 = convtime(arg)) >= 0)

value = 1;

else

fatal("%.200s line %d: Bad ControlPersist argument.",

filename, linenum);

if (*activep && *intptr == -1) {

*intptr = value;

options->control_persist_timeout = value2;

}

break;

case oHashKnownHosts:

intptr = &options->hash_known_hosts;

goto parse_flag;

case oTunnel:

intptr = &options->tun_open;

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%s line %d: Missing yes/point-to-point/"

"ethernet/no argument.", filename, linenum);

value = 0; /* silence compiler */

if (strcasecmp(arg, "ethernet") == 0)

value = SSH_TUNMODE_ETHERNET;

else if (strcasecmp(arg, "point-to-point") == 0)

value = SSH_TUNMODE_POINTOPOINT;

else if (strcasecmp(arg, "yes") == 0)

value = SSH_TUNMODE_DEFAULT;

else if (strcasecmp(arg, "no") == 0)

value = SSH_TUNMODE_NO;

else

fatal("%s line %d: Bad yes/point-to-point/ethernet/"

"no argument: %s", filename, linenum, arg);

if (*activep)

*intptr = value;

break;

case oTunnelDevice:

arg = strdelim(&s);

if (!arg || *arg == '\0')

fatal("%.200s line %d: Missing argument.", filename, linenum);

value = a2tun(arg, &value2);

if (value == SSH_TUNID_ERR)

fatal("%.200s line %d: Bad tun device.", filename, linenum);

if (*activep) {

options->tun_local = value;

options->tun_remote = value2;

}

break;

case oLocalCommand:

charptr = &options->local_command;

goto parse_command;