crypto/openssh/readconf.c

   1 /* $OpenBSD: readconf.c,v 1.159 2006/08/03 03:34:42 deraadt Exp $ */
   2 /*
   3  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   4  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   5  *                    All rights reserved
   6  * Functions for reading the configuration files.
   7  *
   8  * As far as I am concerned, the code I have written for this software
   9  * can be used freely for any purpose.  Any derived versions of this
  10  * software must be clearly marked as such, and if the derived work is
  11  * incompatible with the protocol description in the RFC file, it must be
  12  * called by a name other than "ssh" or "Secure Shell".
  13  */
  14
  15 #include "includes.h"
  16 __RCSID("$FreeBSD$");
  17
  18 #include <sys/types.h>
  19 #include <sys/stat.h>
  20 #include <sys/socket.h>
  21
  22 #include <netinet/in.h>
  23
  24 #include <ctype.h>
  25 #include <errno.h>
  26 #include <netdb.h>
  27 #include <signal.h>
  28 #include <stdarg.h>
  29 #include <stdio.h>
  30 #include <string.h>
  31 #include <unistd.h>
  32
  33 #include "xmalloc.h"
  34 #include "ssh.h"
  35 #include "compat.h"
  36 #include "cipher.h"
  37 #include "pathnames.h"
  38 #include "log.h"
  39 #include "key.h"
  40 #include "readconf.h"
  41 #include "match.h"
  42 #include "misc.h"
  43 #include "buffer.h"
  44 #include "kex.h"
  45 #include "mac.h"
  46
  47 /* Format of the configuration file:
  48
  49    # Configuration data is parsed as follows:
  50    #  1. command line options
  51    #  2. user-specific file
  52    #  3. system-wide file
  53    # Any configuration value is only changed the first time it is set.
  54    # Thus, host-specific definitions should be at the beginning of the
  55    # configuration file, and defaults at the end.
  56
  57    # Host-specific declarations.  These may override anything above.  A single
  58    # host may match multiple declarations; these are processed in the order
  59    # that they are given in.
  60
  61    Host *.ngs.fi ngs.fi
  62      User foo
  63
  64    Host fake.com
  65      HostName another.host.name.real.org
  66      User blaah
  67      Port 34289
  68      ForwardX11 no
  69      ForwardAgent no
  70
  71    Host books.com
  72      RemoteForward 9999 shadows.cs.hut.fi:9999
  73      Cipher 3des
  74
  75    Host fascist.blob.com
  76      Port 23123
  77      User tylonen
  78      PasswordAuthentication no
  79
  80    Host puukko.hut.fi
  81      User t35124p
  82      ProxyCommand ssh-proxy %h %p
  83
  84    Host *.fr
  85      PublicKeyAuthentication no
  86
  87    Host *.su
  88      Cipher none
  89      PasswordAuthentication no
  90
  91    Host vpn.fake.com
  92      Tunnel yes
  93      TunnelDevice 3
  94
  95    # Defaults for various options
  96    Host *
  97      ForwardAgent no
  98      ForwardX11 no
  99      PasswordAuthentication yes
 100      RSAAuthentication yes
 101      RhostsRSAAuthentication yes
 102      StrictHostKeyChecking yes
 103      TcpKeepAlive no
 104      IdentityFile ~/.ssh/identity
 105      Port 22
 106      EscapeChar ~
 107
 108 */
 109
 110 /* Keyword tokens. */
 111
 112 typedef enum {
 113         oBadOption,
 114         oForwardAgent, oForwardX11, oForwardX11Trusted, oGatewayPorts,
 115         oExitOnForwardFailure,
 116         oPasswordAuthentication, oRSAAuthentication,
 117         oChallengeResponseAuthentication, oXAuthLocation,
 118         oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
 119         oUser, oHost, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
 120         oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
 121         oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
 122         oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts,
 123         oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,
 124         oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
 125         oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
 126         oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
 127         oHostKeyAlgorithms, oBindAddress, oSmartcardDevice,
 128         oClearAllForwardings, oNoHostAuthenticationForLocalhost,
 129         oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
 130         oAddressFamily, oGssAuthentication, oGssDelegateCreds,
 131         oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
 132         oSendEnv, oControlPath, oControlMaster, oHashKnownHosts,
 133         oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
 134         oVersionAddendum,
 135         oDeprecated, oUnsupported
 136 } OpCodes;
 137
 138 /* Textual representations of the tokens. */
 139
 140 static struct {
 141         const char *name;
 142         OpCodes opcode;
 143 } keywords[] = {
 144         { "forwardagent", oForwardAgent },
 145         { "forwardx11", oForwardX11 },
 146         { "forwardx11trusted", oForwardX11Trusted },
 147         { "exitonforwardfailure", oExitOnForwardFailure },
 148         { "xauthlocation", oXAuthLocation },
 149         { "gatewayports", oGatewayPorts },
 150         { "useprivilegedport", oUsePrivilegedPort },
 151         { "rhostsauthentication", oDeprecated },
 152         { "passwordauthentication", oPasswordAuthentication },
 153         { "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
 154         { "kbdinteractivedevices", oKbdInteractiveDevices },
 155         { "rsaauthentication", oRSAAuthentication },
 156         { "pubkeyauthentication", oPubkeyAuthentication },
 157         { "dsaauthentication", oPubkeyAuthentication },             /* alias */
 158         { "rhostsrsaauthentication", oRhostsRSAAuthentication },
 159         { "hostbasedauthentication", oHostbasedAuthentication },
 160         { "challengeresponseauthentication", oChallengeResponseAuthentication },
 161         { "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
 162         { "tisauthentication", oChallengeResponseAuthentication },  /* alias */
 163         { "kerberosauthentication", oUnsupported },
 164         { "kerberostgtpassing", oUnsupported },
 165         { "afstokenpassing", oUnsupported },
 166 #if defined(GSSAPI)
 167         { "gssapiauthentication", oGssAuthentication },
 168         { "gssapidelegatecredentials", oGssDelegateCreds },
 169 #else
 170         { "gssapiauthentication", oUnsupported },
 171         { "gssapidelegatecredentials", oUnsupported },
 172 #endif
 173         { "fallbacktorsh", oDeprecated },
 174         { "usersh", oDeprecated },
 175         { "identityfile", oIdentityFile },
 176         { "identityfile2", oIdentityFile },                     /* alias */
 177         { "identitiesonly", oIdentitiesOnly },
 178         { "hostname", oHostName },
 179         { "hostkeyalias", oHostKeyAlias },
 180         { "proxycommand", oProxyCommand },
 181         { "port", oPort },
 182         { "cipher", oCipher },
 183         { "ciphers", oCiphers },
 184         { "macs", oMacs },
 185         { "protocol", oProtocol },
 186         { "remoteforward", oRemoteForward },
 187         { "localforward", oLocalForward },
 188         { "user", oUser },
 189         { "host", oHost },
 190         { "escapechar", oEscapeChar },
 191         { "globalknownhostsfile", oGlobalKnownHostsFile },
 192         { "userknownhostsfile", oUserKnownHostsFile },          /* obsolete */
 193         { "globalknownhostsfile2", oGlobalKnownHostsFile2 },
 194         { "userknownhostsfile2", oUserKnownHostsFile2 },        /* obsolete */
 195         { "connectionattempts", oConnectionAttempts },
 196         { "batchmode", oBatchMode },
 197         { "checkhostip", oCheckHostIP },
 198         { "stricthostkeychecking", oStrictHostKeyChecking },
 199         { "compression", oCompression },
 200         { "compressionlevel", oCompressionLevel },
 201         { "tcpkeepalive", oTCPKeepAlive },
 202         { "keepalive", oTCPKeepAlive },                         /* obsolete */
 203         { "numberofpasswordprompts", oNumberOfPasswordPrompts },
 204         { "loglevel", oLogLevel },
 205         { "dynamicforward", oDynamicForward },
 206         { "preferredauthentications", oPreferredAuthentications },
 207         { "hostkeyalgorithms", oHostKeyAlgorithms },
 208         { "bindaddress", oBindAddress },
 209 #ifdef SMARTCARD
 210         { "smartcarddevice", oSmartcardDevice },
 211 #else
 212         { "smartcarddevice", oUnsupported },
 213 #endif
 214         { "clearallforwardings", oClearAllForwardings },
 215         { "enablesshkeysign", oEnableSSHKeysign },
 216         { "verifyhostkeydns", oVerifyHostKeyDNS },
 217         { "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost },
 218         { "rekeylimit", oRekeyLimit },
 219         { "connecttimeout", oConnectTimeout },
 220         { "addressfamily", oAddressFamily },
 221         { "serveraliveinterval", oServerAliveInterval },
 222         { "serveralivecountmax", oServerAliveCountMax },
 223         { "sendenv", oSendEnv },
 224         { "controlpath", oControlPath },
 225         { "controlmaster", oControlMaster },
 226         { "hashknownhosts", oHashKnownHosts },
 227         { "tunnel", oTunnel },
 228         { "tunneldevice", oTunnelDevice },
 229         { "localcommand", oLocalCommand },
 230         { "permitlocalcommand", oPermitLocalCommand },
 231         { "versionaddendum", oVersionAddendum },
 232         { NULL, oBadOption }
 233 };
 234
 235 /*
 236  * Adds a local TCP/IP port forward to options.  Never returns if there is an
 237  * error.
 238  */
 239
 240 void
 241 add_local_forward(Options *options, const Forward *newfwd)
 242 {
 243         Forward *fwd;
 244 #ifndef NO_IPPORT_RESERVED_CONCEPT
 245         extern uid_t original_real_uid;
 246         if (newfwd->listen_port < IPPORT_RESERVED && original_real_uid != 0)
 247                 fatal("Privileged ports can only be forwarded by root.");
 248 #endif
 249         if (options->num_local_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
 250                 fatal("Too many local forwards (max %d).", SSH_MAX_FORWARDS_PER_DIRECTION);
 251         fwd = &options->local_forwards[options->num_local_forwards++];
 252
 253         fwd->listen_host = (newfwd->listen_host == NULL) ?
 254             NULL : xstrdup(newfwd->listen_host);
 255         fwd->listen_port = newfwd->listen_port;
 256         fwd->connect_host = xstrdup(newfwd->connect_host);
 257         fwd->connect_port = newfwd->connect_port;
 258 }
 259
 260 /*
 261  * Adds a remote TCP/IP port forward to options.  Never returns if there is
 262  * an error.
 263  */
 264
 265 void
 266 add_remote_forward(Options *options, const Forward *newfwd)
 267 {
 268         Forward *fwd;
 269         if (options->num_remote_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
 270                 fatal("Too many remote forwards (max %d).",
 271                     SSH_MAX_FORWARDS_PER_DIRECTION);
 272         fwd = &options->remote_forwards[options->num_remote_forwards++];
 273
 274         fwd->listen_host = (newfwd->listen_host == NULL) ?
 275             NULL : xstrdup(newfwd->listen_host);
 276         fwd->listen_port = newfwd->listen_port;
 277         fwd->connect_host = xstrdup(newfwd->connect_host);
 278         fwd->connect_port = newfwd->connect_port;
 279 }
 280
 281 static void
 282 clear_forwardings(Options *options)
 283 {
 284         int i;
 285
 286         for (i = 0; i < options->num_local_forwards; i++) {
 287                 if (options->local_forwards[i].listen_host != NULL)
 288                         xfree(options->local_forwards[i].listen_host);
 289                 xfree(options->local_forwards[i].connect_host);
 290         }
 291         options->num_local_forwards = 0;
 292         for (i = 0; i < options->num_remote_forwards; i++) {
 293                 if (options->remote_forwards[i].listen_host != NULL)
 294                         xfree(options->remote_forwards[i].listen_host);
 295                 xfree(options->remote_forwards[i].connect_host);
 296         }
 297         options->num_remote_forwards = 0;
 298         options->tun_open = SSH_TUNMODE_NO;
 299 }
 300
 301 /*
 302  * Returns the number of the token pointed to by cp or oBadOption.
 303  */
 304
 305 static OpCodes
 306 parse_token(const char *cp, const char *filename, int linenum)
 307 {
 308         u_int i;
 309
 310         for (i = 0; keywords[i].name; i++)
 311                 if (strcasecmp(cp, keywords[i].name) == 0)
 312                         return keywords[i].opcode;
 313
 314         error("%s: line %d: Bad configuration option: %s",
 315             filename, linenum, cp);
 316         return oBadOption;
 317 }
 318
 319 /*
 320  * Processes a single option line as used in the configuration files. This
 321  * only sets those values that have not already been set.
 322  */
 323 #define WHITESPACE " \t\r\n"
 324
 325 int
 326 process_config_line(Options *options, const char *host,
 327                     char *line, const char *filename, int linenum,
 328                     int *activep)
 329 {
 330         char *s, **charptr, *endofnumber, *keyword, *arg, *arg2, fwdarg[256];
 331         int opcode, *intptr, value, value2, scale;
 332         long long orig, val64;
 333         size_t len;
 334         Forward fwd;
 335
 336         /* Strip trailing whitespace */
 337         for (len = strlen(line) - 1; len > 0; len--) {
 338                 if (strchr(WHITESPACE, line[len]) == NULL)
 339                         break;
 340                 line[len] = '\0';
 341         }
 342
 343         s = line;
 344         /* Get the keyword. (Each line is supposed to begin with a keyword). */
 345         if ((keyword = strdelim(&s)) == NULL)
 346                 return 0;
 347         /* Ignore leading whitespace. */
 348         if (*keyword == '\0')
 349                 keyword = strdelim(&s);
 350         if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
 351                 return 0;
 352
 353         opcode = parse_token(keyword, filename, linenum);
 354
 355         switch (opcode) {
 356         case oBadOption:
 357                 /* don't panic, but count bad options */
 358                 return -1;
 359                 /* NOTREACHED */
 360         case oConnectTimeout:
 361                 intptr = &options->connection_timeout;
 362 parse_time:
 363                 arg = strdelim(&s);
 364                 if (!arg || *arg == '\0')
 365                         fatal("%s line %d: missing time value.",
 366                             filename, linenum);
 367                 if ((value = convtime(arg)) == -1)
 368                         fatal("%s line %d: invalid time value.",
 369                             filename, linenum);
 370                 if (*intptr == -1)
 371                         *intptr = value;
 372                 break;
 373
 374         case oForwardAgent:
 375                 intptr = &options->forward_agent;
 376 parse_flag:
 377                 arg = strdelim(&s);
 378                 if (!arg || *arg == '\0')
 379                         fatal("%.200s line %d: Missing yes/no argument.", filename, linenum);
 380                 value = 0;      /* To avoid compiler warning... */
 381                 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
 382                         value = 1;
 383                 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
 384                         value = 0;
 385                 else
 386                         fatal("%.200s line %d: Bad yes/no argument.", filename, linenum);
 387                 if (*activep && *intptr == -1)
 388                         *intptr = value;
 389                 break;
 390
 391         case oForwardX11:
 392                 intptr = &options->forward_x11;
 393                 goto parse_flag;
 394
 395         case oForwardX11Trusted:
 396                 intptr = &options->forward_x11_trusted;
 397                 goto parse_flag;
 398
 399         case oGatewayPorts:
 400                 intptr = &options->gateway_ports;
 401                 goto parse_flag;
 402
 403         case oExitOnForwardFailure:
 404                 intptr = &options->exit_on_forward_failure;
 405                 goto parse_flag;
 406
 407         case oUsePrivilegedPort:
 408                 intptr = &options->use_privileged_port;
 409                 goto parse_flag;
 410
 411         case oPasswordAuthentication:
 412                 intptr = &options->password_authentication;
 413                 goto parse_flag;
 414
 415         case oKbdInteractiveAuthentication:
 416                 intptr = &options->kbd_interactive_authentication;
 417                 goto parse_flag;
 418
 419         case oKbdInteractiveDevices:
 420                 charptr = &options->kbd_interactive_devices;
 421                 goto parse_string;
 422
 423         case oPubkeyAuthentication:
 424                 intptr = &options->pubkey_authentication;
 425                 goto parse_flag;
 426
 427         case oRSAAuthentication:
 428                 intptr = &options->rsa_authentication;
 429                 goto parse_flag;
 430
 431         case oRhostsRSAAuthentication:
 432                 intptr = &options->rhosts_rsa_authentication;
 433                 goto parse_flag;
 434
 435         case oHostbasedAuthentication:
 436                 intptr = &options->hostbased_authentication;
 437                 goto parse_flag;
 438
 439         case oChallengeResponseAuthentication:
 440                 intptr = &options->challenge_response_authentication;
 441                 goto parse_flag;
 442
 443         case oGssAuthentication:
 444                 intptr = &options->gss_authentication;
 445                 goto parse_flag;
 446
 447         case oGssDelegateCreds:
 448                 intptr = &options->gss_deleg_creds;
 449                 goto parse_flag;
 450
 451         case oBatchMode:
 452                 intptr = &options->batch_mode;
 453                 goto parse_flag;
 454
 455         case oCheckHostIP:
 456                 intptr = &options->check_host_ip;
 457                 goto parse_flag;
 458
 459         case oVerifyHostKeyDNS:
 460                 intptr = &options->verify_host_key_dns;
 461                 goto parse_yesnoask;
 462
 463         case oStrictHostKeyChecking:
 464                 intptr = &options->strict_host_key_checking;
 465 parse_yesnoask:
 466                 arg = strdelim(&s);
 467                 if (!arg || *arg == '\0')
 468                         fatal("%.200s line %d: Missing yes/no/ask argument.",
 469                             filename, linenum);
 470                 value = 0;      /* To avoid compiler warning... */
 471                 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
 472                         value = 1;
 473                 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
 474                         value = 0;
 475                 else if (strcmp(arg, "ask") == 0)
 476                         value = 2;
 477                 else
 478                         fatal("%.200s line %d: Bad yes/no/ask argument.", filename, linenum);
 479                 if (*activep && *intptr == -1)
 480                         *intptr = value;
 481                 break;
 482
 483         case oCompression:
 484                 intptr = &options->compression;
 485                 goto parse_flag;
 486
 487         case oTCPKeepAlive:
 488                 intptr = &options->tcp_keep_alive;
 489                 goto parse_flag;
 490
 491         case oNoHostAuthenticationForLocalhost:
 492                 intptr = &options->no_host_authentication_for_localhost;
 493                 goto parse_flag;
 494
 495         case oNumberOfPasswordPrompts:
 496                 intptr = &options->number_of_password_prompts;
 497                 goto parse_int;
 498
 499         case oCompressionLevel:
 500                 intptr = &options->compression_level;
 501                 goto parse_int;
 502
 503         case oRekeyLimit:
 504                 intptr = &options->rekey_limit;
 505                 arg = strdelim(&s);
 506                 if (!arg || *arg == '\0')
 507                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 508                 if (arg[0] < '0' || arg[0] > '9')
 509                         fatal("%.200s line %d: Bad number.", filename, linenum);
 510                 orig = val64 = strtoll(arg, &endofnumber, 10);
 511                 if (arg == endofnumber)
 512                         fatal("%.200s line %d: Bad number.", filename, linenum);
 513                 switch (toupper(*endofnumber)) {
 514                 case '\0':
 515                         scale = 1;
 516                         break;
 517                 case 'K':
 518                         scale = 1<<10;
 519                         break;
 520                 case 'M':
 521                         scale = 1<<20;
 522                         break;
 523                 case 'G':
 524                         scale = 1<<30;
 525                         break;
 526                 default:
 527                         fatal("%.200s line %d: Invalid RekeyLimit suffix",
 528                             filename, linenum);
 529                 }
 530                 val64 *= scale;
 531                 /* detect integer wrap and too-large limits */
 532                 if ((val64 / scale) != orig || val64 > INT_MAX)
 533                         fatal("%.200s line %d: RekeyLimit too large",
 534                             filename, linenum);
 535                 if (val64 < 16)
 536                         fatal("%.200s line %d: RekeyLimit too small",
 537                             filename, linenum);
 538                 if (*activep && *intptr == -1)
 539                         *intptr = (int)val64;
 540                 break;
 541
 542         case oIdentityFile:
 543                 arg = strdelim(&s);
 544                 if (!arg || *arg == '\0')
 545                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 546                 if (*activep) {
 547                         intptr = &options->num_identity_files;
 548                         if (*intptr >= SSH_MAX_IDENTITY_FILES)
 549                                 fatal("%.200s line %d: Too many identity files specified (max %d).",
 550                                     filename, linenum, SSH_MAX_IDENTITY_FILES);
 551                         charptr =  &options->identity_files[*intptr];
 552                         *charptr = xstrdup(arg);
 553                         *intptr = *intptr + 1;
 554                 }
 555                 break;
 556
 557         case oXAuthLocation:
 558                 charptr=&options->xauth_location;
 559                 goto parse_string;
 560
 561         case oUser:
 562                 charptr = &options->user;
 563 parse_string:
 564                 arg = strdelim(&s);
 565                 if (!arg || *arg == '\0')
 566                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 567                 if (*activep && *charptr == NULL)
 568                         *charptr = xstrdup(arg);
 569                 break;
 570
 571         case oGlobalKnownHostsFile:
 572                 charptr = &options->system_hostfile;
 573                 goto parse_string;
 574
 575         case oUserKnownHostsFile:
 576                 charptr = &options->user_hostfile;
 577                 goto parse_string;
 578
 579         case oGlobalKnownHostsFile2:
 580                 charptr = &options->system_hostfile2;
 581                 goto parse_string;
 582
 583         case oUserKnownHostsFile2:
 584                 charptr = &options->user_hostfile2;
 585                 goto parse_string;
 586
 587         case oHostName:
 588                 charptr = &options->hostname;
 589                 goto parse_string;
 590
 591         case oHostKeyAlias:
 592                 charptr = &options->host_key_alias;
 593                 goto parse_string;
 594
 595         case oPreferredAuthentications:
 596                 charptr = &options->preferred_authentications;
 597                 goto parse_string;
 598
 599         case oBindAddress:
 600                 charptr = &options->bind_address;
 601                 goto parse_string;
 602
 603         case oSmartcardDevice:
 604                 charptr = &options->smartcard_device;
 605                 goto parse_string;
 606
 607         case oProxyCommand:
 608                 charptr = &options->proxy_command;
 609 parse_command:
 610                 if (s == NULL)
 611                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 612                 len = strspn(s, WHITESPACE "=");
 613                 if (*activep && *charptr == NULL)
 614                         *charptr = xstrdup(s + len);
 615                 return 0;
 616
 617         case oPort:
 618                 intptr = &options->port;
 619 parse_int:
 620                 arg = strdelim(&s);
 621                 if (!arg || *arg == '\0')
 622                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 623                 if (arg[0] < '0' || arg[0] > '9')
 624                         fatal("%.200s line %d: Bad number.", filename, linenum);
 625
 626                 /* Octal, decimal, or hex format? */
 627                 value = strtol(arg, &endofnumber, 0);
 628                 if (arg == endofnumber)
 629                         fatal("%.200s line %d: Bad number.", filename, linenum);
 630                 if (*activep && *intptr == -1)
 631                         *intptr = value;
 632                 break;
 633
 634         case oConnectionAttempts:
 635                 intptr = &options->connection_attempts;
 636                 goto parse_int;
 637
 638         case oCipher:
 639                 intptr = &options->cipher;
 640                 arg = strdelim(&s);
 641                 if (!arg || *arg == '\0')
 642                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 643                 value = cipher_number(arg);
 644                 if (value == -1)
 645                         fatal("%.200s line %d: Bad cipher '%s'.",
 646                             filename, linenum, arg ? arg : "<NONE>");
 647                 if (*activep && *intptr == -1)
 648                         *intptr = value;
 649                 break;
 650
 651         case oCiphers:
 652                 arg = strdelim(&s);
 653                 if (!arg || *arg == '\0')
 654                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 655                 if (!ciphers_valid(arg))
 656                         fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
 657                             filename, linenum, arg ? arg : "<NONE>");
 658                 if (*activep && options->ciphers == NULL)
 659                         options->ciphers = xstrdup(arg);
 660                 break;
 661
 662         case oMacs:
 663                 arg = strdelim(&s);
 664                 if (!arg || *arg == '\0')
 665                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 666                 if (!mac_valid(arg))
 667                         fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.",
 668                             filename, linenum, arg ? arg : "<NONE>");
 669                 if (*activep && options->macs == NULL)
 670                         options->macs = xstrdup(arg);
 671                 break;
 672
 673         case oHostKeyAlgorithms:
 674                 arg = strdelim(&s);
 675                 if (!arg || *arg == '\0')
 676                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 677                 if (!key_names_valid2(arg))
 678                         fatal("%.200s line %d: Bad protocol 2 host key algorithms '%s'.",
 679                             filename, linenum, arg ? arg : "<NONE>");
 680                 if (*activep && options->hostkeyalgorithms == NULL)
 681                         options->hostkeyalgorithms = xstrdup(arg);
 682                 break;
 683
 684         case oProtocol:
 685                 intptr = &options->protocol;
 686                 arg = strdelim(&s);
 687                 if (!arg || *arg == '\0')
 688                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 689                 value = proto_spec(arg);
 690                 if (value == SSH_PROTO_UNKNOWN)
 691                         fatal("%.200s line %d: Bad protocol spec '%s'.",
 692                             filename, linenum, arg ? arg : "<NONE>");
 693                 if (*activep && *intptr == SSH_PROTO_UNKNOWN)
 694                         *intptr = value;
 695                 break;
 696
 697         case oLogLevel:
 698                 intptr = (int *) &options->log_level;
 699                 arg = strdelim(&s);
 700                 value = log_level_number(arg);
 701                 if (value == SYSLOG_LEVEL_NOT_SET)
 702                         fatal("%.200s line %d: unsupported log level '%s'",
 703                             filename, linenum, arg ? arg : "<NONE>");
 704                 if (*activep && (LogLevel) *intptr == SYSLOG_LEVEL_NOT_SET)
 705                         *intptr = (LogLevel) value;
 706                 break;
 707
 708         case oLocalForward:
 709         case oRemoteForward:
 710                 arg = strdelim(&s);
 711                 if (arg == NULL || *arg == '\0')
 712                         fatal("%.200s line %d: Missing port argument.",
 713                             filename, linenum);
 714                 arg2 = strdelim(&s);
 715                 if (arg2 == NULL || *arg2 == '\0')
 716                         fatal("%.200s line %d: Missing target argument.",
 717                             filename, linenum);
 718
 719                 /* construct a string for parse_forward */
 720                 snprintf(fwdarg, sizeof(fwdarg), "%s:%s", arg, arg2);
 721
 722                 if (parse_forward(&fwd, fwdarg) == 0)
 723                         fatal("%.200s line %d: Bad forwarding specification.",
 724                             filename, linenum);
 725
 726                 if (*activep) {
 727                         if (opcode == oLocalForward)
 728                                 add_local_forward(options, &fwd);
 729                         else if (opcode == oRemoteForward)
 730                                 add_remote_forward(options, &fwd);
 731                 }
 732                 break;
 733
 734         case oDynamicForward:
 735                 arg = strdelim(&s);
 736                 if (!arg || *arg == '\0')
 737                         fatal("%.200s line %d: Missing port argument.",
 738                             filename, linenum);
 739                 memset(&fwd, '\0', sizeof(fwd));
 740                 fwd.connect_host = "socks";
 741                 fwd.listen_host = hpdelim(&arg);
 742                 if (fwd.listen_host == NULL ||
 743                     strlen(fwd.listen_host) >= NI_MAXHOST)
 744                         fatal("%.200s line %d: Bad forwarding specification.",
 745                             filename, linenum);
 746                 if (arg) {
 747                         fwd.listen_port = a2port(arg);
 748                         fwd.listen_host = cleanhostname(fwd.listen_host);
 749                 } else {
 750                         fwd.listen_port = a2port(fwd.listen_host);
 751                         fwd.listen_host = NULL;
 752                 }
 753                 if (fwd.listen_port == 0)
 754                         fatal("%.200s line %d: Badly formatted port number.",
 755                             filename, linenum);
 756                 if (*activep)
 757                         add_local_forward(options, &fwd);
 758                 break;
 759
 760         case oClearAllForwardings:
 761                 intptr = &options->clear_forwardings;
 762                 goto parse_flag;
 763
 764         case oHost:
 765                 *activep = 0;
 766                 while ((arg = strdelim(&s)) != NULL && *arg != '\0')
 767                         if (match_pattern(host, arg)) {
 768                                 debug("Applying options for %.100s", arg);
 769                                 *activep = 1;
 770                                 break;
 771                         }
 772                 /* Avoid garbage check below, as strdelim is done. */
 773                 return 0;
 774
 775         case oEscapeChar:
 776                 intptr = &options->escape_char;
 777                 arg = strdelim(&s);
 778                 if (!arg || *arg == '\0')
 779                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 780                 if (arg[0] == '^' && arg[2] == 0 &&
 781                     (u_char) arg[1] >= 64 && (u_char) arg[1] < 128)
 782                         value = (u_char) arg[1] & 31;
 783                 else if (strlen(arg) == 1)
 784                         value = (u_char) arg[0];
 785                 else if (strcmp(arg, "none") == 0)
 786                         value = SSH_ESCAPECHAR_NONE;
 787                 else {
 788                         fatal("%.200s line %d: Bad escape character.",
 789                             filename, linenum);
 790                         /* NOTREACHED */
 791                         value = 0;      /* Avoid compiler warning. */
 792                 }
 793                 if (*activep && *intptr == -1)
 794                         *intptr = value;
 795                 break;
 796
 797         case oAddressFamily:
 798                 arg = strdelim(&s);
 799                 if (!arg || *arg == '\0')
 800                         fatal("%s line %d: missing address family.",
 801                             filename, linenum);
 802                 intptr = &options->address_family;
 803                 if (strcasecmp(arg, "inet") == 0)
 804                         value = AF_INET;
 805                 else if (strcasecmp(arg, "inet6") == 0)
 806                         value = AF_INET6;
 807                 else if (strcasecmp(arg, "any") == 0)
 808                         value = AF_UNSPEC;
 809                 else
 810                         fatal("Unsupported AddressFamily \"%s\"", arg);
 811                 if (*activep && *intptr == -1)
 812                         *intptr = value;
 813                 break;
 814
 815         case oEnableSSHKeysign:
 816                 intptr = &options->enable_ssh_keysign;
 817                 goto parse_flag;
 818
 819         case oIdentitiesOnly:
 820                 intptr = &options->identities_only;
 821                 goto parse_flag;
 822
 823         case oServerAliveInterval:
 824                 intptr = &options->server_alive_interval;
 825                 goto parse_time;
 826
 827         case oServerAliveCountMax:
 828                 intptr = &options->server_alive_count_max;
 829                 goto parse_int;
 830
 831         case oSendEnv:
 832                 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
 833                         if (strchr(arg, '=') != NULL)
 834                                 fatal("%s line %d: Invalid environment name.",
 835                                     filename, linenum);
 836                         if (!*activep)
 837                                 continue;
 838                         if (options->num_send_env >= MAX_SEND_ENV)
 839                                 fatal("%s line %d: too many send env.",
 840                                     filename, linenum);
 841                         options->send_env[options->num_send_env++] =
 842                             xstrdup(arg);
 843                 }
 844                 break;
 845
 846         case oControlPath:
 847                 charptr = &options->control_path;
 848                 goto parse_string;
 849
 850         case oControlMaster:
 851                 intptr = &options->control_master;
 852                 arg = strdelim(&s);
 853                 if (!arg || *arg == '\0')
 854                         fatal("%.200s line %d: Missing ControlMaster argument.",
 855                             filename, linenum);
 856                 value = 0;      /* To avoid compiler warning... */
 857                 if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
 858                         value = SSHCTL_MASTER_YES;
 859                 else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
 860                         value = SSHCTL_MASTER_NO;
 861                 else if (strcmp(arg, "auto") == 0)
 862                         value = SSHCTL_MASTER_AUTO;
 863                 else if (strcmp(arg, "ask") == 0)
 864                         value = SSHCTL_MASTER_ASK;
 865                 else if (strcmp(arg, "autoask") == 0)
 866                         value = SSHCTL_MASTER_AUTO_ASK;
 867                 else
 868                         fatal("%.200s line %d: Bad ControlMaster argument.",
 869                             filename, linenum);
 870                 if (*activep && *intptr == -1)
 871                         *intptr = value;
 872                 break;
 873
 874         case oHashKnownHosts:
 875                 intptr = &options->hash_known_hosts;
 876                 goto parse_flag;
 877
 878         case oTunnel:
 879                 intptr = &options->tun_open;
 880                 arg = strdelim(&s);
 881                 if (!arg || *arg == '\0')
 882                         fatal("%s line %d: Missing yes/point-to-point/"
 883                             "ethernet/no argument.", filename, linenum);
 884                 value = 0;      /* silence compiler */
 885                 if (strcasecmp(arg, "ethernet") == 0)
 886                         value = SSH_TUNMODE_ETHERNET;
 887                 else if (strcasecmp(arg, "point-to-point") == 0)
 888                         value = SSH_TUNMODE_POINTOPOINT;
 889                 else if (strcasecmp(arg, "yes") == 0)
 890                         value = SSH_TUNMODE_DEFAULT;
 891                 else if (strcasecmp(arg, "no") == 0)
 892                         value = SSH_TUNMODE_NO;
 893                 else
 894                         fatal("%s line %d: Bad yes/point-to-point/ethernet/"
 895                             "no argument: %s", filename, linenum, arg);
 896                 if (*activep)
 897                         *intptr = value;
 898                 break;
 899
 900         case oTunnelDevice:
 901                 arg = strdelim(&s);
 902                 if (!arg || *arg == '\0')
 903                         fatal("%.200s line %d: Missing argument.", filename, linenum);
 904                 value = a2tun(arg, &value2);
 905                 if (value == SSH_TUNID_ERR)
 906                         fatal("%.200s line %d: Bad tun device.", filename, linenum);
 907                 if (*activep) {
 908                         options->tun_local = value;
 909                         options->tun_remote = value2;
 910                 }
 911                 break;
 912
 913         case oLocalCommand:
 914                 charptr = &options->local_command;
 915                 goto parse_command;
 916
 917         case oPermitLocalCommand:
 918                 intptr = &options->permit_local_command;
 919                 goto parse_flag;
 920
 921         case oVersionAddendum:
 922                 ssh_version_set_addendum(strtok(s, "\n"));
 923                 do {
 924                         arg = strdelim(&s);
 925                 } while (arg != NULL && *arg != '\0');
 926                 break;
 927
 928         case oDeprecated:
 929                 debug("%s line %d: Deprecated option \"%s\"",
 930                     filename, linenum, keyword);
 931                 return 0;
 932
 933         case oUnsupported:
 934                 error("%s line %d: Unsupported option \"%s\"",
 935                     filename, linenum, keyword);
 936                 return 0;
 937
 938         default:
 939                 fatal("process_config_line: Unimplemented opcode %d", opcode);
 940         }
 941
 942         /* Check that there is no garbage at end of line. */
 943         if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
 944                 fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
 945                     filename, linenum, arg);
 946         }
 947         return 0;
 948 }
 949
 950
 951 /*
 952  * Reads the config file and modifies the options accordingly.  Options
 953  * should already be initialized before this call.  This never returns if
 954  * there is an error.  If the file does not exist, this returns 0.
 955  */
 956
 957 int
 958 read_config_file(const char *filename, const char *host, Options *options,
 959     int checkperm)
 960 {
 961         FILE *f;
 962         char line[1024];
 963         int active, linenum;
 964         int bad_options = 0;
 965
 966         /* Open the file. */
 967         if ((f = fopen(filename, "r")) == NULL)
 968                 return 0;
 969
 970         if (checkperm) {
 971                 struct stat sb;
 972
 973                 if (fstat(fileno(f), &sb) == -1)
 974                         fatal("fstat %s: %s", filename, strerror(errno));
 975                 if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
 976                     (sb.st_mode & 022) != 0))
 977                         fatal("Bad owner or permissions on %s", filename);
 978         }
 979
 980         debug("Reading configuration data %.200s", filename);
 981
 982         /*
 983          * Mark that we are now processing the options.  This flag is turned
 984          * on/off by Host specifications.
 985          */
 986         active = 1;
 987         linenum = 0;
 988         while (fgets(line, sizeof(line), f)) {
 989                 /* Update line number counter. */
 990                 linenum++;
 991                 if (process_config_line(options, host, line, filename, linenum, &active) != 0)
 992                         bad_options++;
 993         }
 994         fclose(f);
 995         if (bad_options > 0)
 996                 fatal("%s: terminating, %d bad configuration options",
 997                     filename, bad_options);
 998         return 1;
 999 }
1000
1001 /*
1002  * Initializes options to special values that indicate that they have not yet
1003  * been set.  Read_config_file will only set options with this value. Options
1004  * are processed in the following order: command line, user config file,
1005  * system config file.  Last, fill_default_options is called.
1006  */
1007
1008 void
1009 initialize_options(Options * options)
1010 {
1011         memset(options, 'X', sizeof(*options));
1012         options->forward_agent = -1;
1013         options->forward_x11 = -1;
1014         options->forward_x11_trusted = -1;
1015         options->exit_on_forward_failure = -1;
1016         options->xauth_location = NULL;
1017         options->gateway_ports = -1;
1018         options->use_privileged_port = -1;
1019         options->rsa_authentication = -1;
1020         options->pubkey_authentication = -1;
1021         options->challenge_response_authentication = -1;
1022         options->gss_authentication = -1;
1023         options->gss_deleg_creds = -1;
1024         options->password_authentication = -1;
1025         options->kbd_interactive_authentication = -1;
1026         options->kbd_interactive_devices = NULL;
1027         options->rhosts_rsa_authentication = -1;
1028         options->hostbased_authentication = -1;
1029         options->batch_mode = -1;
1030         options->check_host_ip = -1;
1031         options->strict_host_key_checking = -1;
1032         options->compression = -1;
1033         options->tcp_keep_alive = -1;
1034         options->compression_level = -1;
1035         options->port = -1;
1036         options->address_family = -1;
1037         options->connection_attempts = -1;
1038         options->connection_timeout = -1;
1039         options->number_of_password_prompts = -1;
1040         options->cipher = -1;
1041         options->ciphers = NULL;
1042         options->macs = NULL;
1043         options->hostkeyalgorithms = NULL;
1044         options->protocol = SSH_PROTO_UNKNOWN;
1045         options->num_identity_files = 0;
1046         options->hostname = NULL;
1047         options->host_key_alias = NULL;
1048         options->proxy_command = NULL;
1049         options->user = NULL;
1050         options->escape_char = -1;
1051         options->system_hostfile = NULL;
1052         options->user_hostfile = NULL;
1053         options->system_hostfile2 = NULL;
1054         options->user_hostfile2 = NULL;
1055         options->num_local_forwards = 0;
1056         options->num_remote_forwards = 0;
1057         options->clear_forwardings = -1;
1058         options->log_level = SYSLOG_LEVEL_NOT_SET;
1059         options->preferred_authentications = NULL;
1060         options->bind_address = NULL;
1061         options->smartcard_device = NULL;
1062         options->enable_ssh_keysign = - 1;
1063         options->no_host_authentication_for_localhost = - 1;
1064         options->identities_only = - 1;
1065         options->rekey_limit = - 1;
1066         options->verify_host_key_dns = -1;
1067         options->server_alive_interval = -1;
1068         options->server_alive_count_max = -1;
1069         options->num_send_env = 0;
1070         options->control_path = NULL;
1071         options->control_master = -1;
1072         options->hash_known_hosts = -1;
1073         options->tun_open = -1;
1074         options->tun_local = -1;
1075         options->tun_remote = -1;
1076         options->local_command = NULL;
1077         options->permit_local_command = -1;
1078 }
1079
1080 /*
1081  * Called after processing other sources of option data, this fills those
1082  * options for which no value has been specified with their default values.
1083  */
1084
1085 void
1086 fill_default_options(Options * options)
1087 {
1088         int len;
1089
1090         if (options->forward_agent == -1)
1091                 options->forward_agent = 0;
1092         if (options->forward_x11 == -1)
1093                 options->forward_x11 = 0;
1094         if (options->forward_x11_trusted == -1)
1095                 options->forward_x11_trusted = 0;
1096         if (options->exit_on_forward_failure == -1)
1097                 options->exit_on_forward_failure = 0;
1098         if (options->xauth_location == NULL)
1099                 options->xauth_location = _PATH_XAUTH;
1100         if (options->gateway_ports == -1)
1101                 options->gateway_ports = 0;
1102         if (options->use_privileged_port == -1)
1103                 options->use_privileged_port = 0;
1104         if (options->rsa_authentication == -1)
1105                 options->rsa_authentication = 1;
1106         if (options->pubkey_authentication == -1)
1107                 options->pubkey_authentication = 1;
1108         if (options->challenge_response_authentication == -1)
1109                 options->challenge_response_authentication = 1;
1110         if (options->gss_authentication == -1)
1111                 options->gss_authentication = 0;
1112         if (options->gss_deleg_creds == -1)
1113                 options->gss_deleg_creds = 0;
1114         if (options->password_authentication == -1)
1115                 options->password_authentication = 1;
1116         if (options->kbd_interactive_authentication == -1)
1117                 options->kbd_interactive_authentication = 1;
1118         if (options->rhosts_rsa_authentication == -1)
1119                 options->rhosts_rsa_authentication = 0;
1120         if (options->hostbased_authentication == -1)
1121                 options->hostbased_authentication = 0;
1122         if (options->batch_mode == -1)
1123                 options->batch_mode = 0;
1124         if (options->check_host_ip == -1)
1125                 options->check_host_ip = 0;
1126         if (options->strict_host_key_checking == -1)
1127                 options->strict_host_key_checking = 2;  /* 2 is default */
1128         if (options->compression == -1)
1129                 options->compression = 0;
1130         if (options->tcp_keep_alive == -1)
1131                 options->tcp_keep_alive = 1;
1132         if (options->compression_level == -1)
1133                 options->compression_level = 6;
1134         if (options->port == -1)
1135                 options->port = 0;      /* Filled in ssh_connect. */
1136         if (options->address_family == -1)
1137                 options->address_family = AF_UNSPEC;
1138         if (options->connection_attempts == -1)
1139                 options->connection_attempts = 1;
1140         if (options->number_of_password_prompts == -1)
1141                 options->number_of_password_prompts = 3;
1142         /* Selected in ssh_login(). */
1143         if (options->cipher == -1)
1144                 options->cipher = SSH_CIPHER_NOT_SET;
1145         /* options->ciphers, default set in myproposals.h */
1146         /* options->macs, default set in myproposals.h */
1147         /* options->hostkeyalgorithms, default set in myproposals.h */
1148         if (options->protocol == SSH_PROTO_UNKNOWN)
1149                 options->protocol = SSH_PROTO_1|SSH_PROTO_2;
1150         if (options->num_identity_files == 0) {
1151                 if (options->protocol & SSH_PROTO_1) {
1152                         len = 2 + strlen(_PATH_SSH_CLIENT_IDENTITY) + 1;
1153                         options->identity_files[options->num_identity_files] =
1154                             xmalloc(len);
1155                         snprintf(options->identity_files[options->num_identity_files++],
1156                             len, "~/%.100s", _PATH_SSH_CLIENT_IDENTITY);
1157                 }
1158                 if (options->protocol & SSH_PROTO_2) {
1159                         len = 2 + strlen(_PATH_SSH_CLIENT_ID_RSA) + 1;
1160                         options->identity_files[options->num_identity_files] =
1161                             xmalloc(len);
1162                         snprintf(options->identity_files[options->num_identity_files++],
1163                             len, "~/%.100s", _PATH_SSH_CLIENT_ID_RSA);
1164
1165                         len = 2 + strlen(_PATH_SSH_CLIENT_ID_DSA) + 1;
1166                         options->identity_files[options->num_identity_files] =
1167                             xmalloc(len);
1168                         snprintf(options->identity_files[options->num_identity_files++],
1169                             len, "~/%.100s", _PATH_SSH_CLIENT_ID_DSA);
1170                 }
1171         }
1172         if (options->escape_char == -1)
1173                 options->escape_char = '~';
1174         if (options->system_hostfile == NULL)
1175                 options->system_hostfile = _PATH_SSH_SYSTEM_HOSTFILE;
1176         if (options->user_hostfile == NULL)
1177                 options->user_hostfile = _PATH_SSH_USER_HOSTFILE;
1178         if (options->system_hostfile2 == NULL)
1179                 options->system_hostfile2 = _PATH_SSH_SYSTEM_HOSTFILE2;
1180         if (options->user_hostfile2 == NULL)
1181                 options->user_hostfile2 = _PATH_SSH_USER_HOSTFILE2;
1182         if (options->log_level == SYSLOG_LEVEL_NOT_SET)
1183                 options->log_level = SYSLOG_LEVEL_INFO;
1184         if (options->clear_forwardings == 1)
1185                 clear_forwardings(options);
1186         if (options->no_host_authentication_for_localhost == - 1)
1187                 options->no_host_authentication_for_localhost = 0;
1188         if (options->identities_only == -1)
1189                 options->identities_only = 0;
1190         if (options->enable_ssh_keysign == -1)
1191                 options->enable_ssh_keysign = 0;
1192         if (options->rekey_limit == -1)
1193                 options->rekey_limit = 0;
1194         if (options->verify_host_key_dns == -1)
1195                 options->verify_host_key_dns = 0;
1196         if (options->server_alive_interval == -1)
1197                 options->server_alive_interval = 0;
1198         if (options->server_alive_count_max == -1)
1199                 options->server_alive_count_max = 3;
1200         if (options->control_master == -1)
1201                 options->control_master = 0;
1202         if (options->hash_known_hosts == -1)
1203                 options->hash_known_hosts = 0;
1204         if (options->tun_open == -1)
1205                 options->tun_open = SSH_TUNMODE_NO;
1206         if (options->tun_local == -1)
1207                 options->tun_local = SSH_TUNID_ANY;
1208         if (options->tun_remote == -1)
1209                 options->tun_remote = SSH_TUNID_ANY;
1210         if (options->permit_local_command == -1)
1211                 options->permit_local_command = 0;
1212         /* options->local_command should not be set by default */
1213         /* options->proxy_command should not be set by default */
1214         /* options->user will be set in the main program if appropriate */
1215         /* options->hostname will be set in the main program if appropriate */
1216         /* options->host_key_alias should not be set by default */
1217         /* options->preferred_authentications will be set in ssh */
1218 }
1219
1220 /*
1221  * parse_forward
1222  * parses a string containing a port forwarding specification of the form:
1223  *      [listenhost:]listenport:connecthost:connectport
1224  * returns number of arguments parsed or zero on error
1225  */
1226 int
1227 parse_forward(Forward *fwd, const char *fwdspec)
1228 {
1229         int i;
1230         char *p, *cp, *fwdarg[4];
1231
1232         memset(fwd, '\0', sizeof(*fwd));
1233
1234         cp = p = xstrdup(fwdspec);
1235
1236         /* skip leading spaces */
1237         while (*cp && isspace(*cp))
1238                 cp++;
1239
1240         for (i = 0; i < 4; ++i)
1241                 if ((fwdarg[i] = hpdelim(&cp)) == NULL)
1242                         break;
1243
1244         /* Check for trailing garbage in 4-arg case*/
1245         if (cp != NULL)
1246                 i = 0;  /* failure */
1247
1248         switch (i) {
1249         case 3:
1250                 fwd->listen_host = NULL;
1251                 fwd->listen_port = a2port(fwdarg[0]);
1252                 fwd->connect_host = xstrdup(cleanhostname(fwdarg[1]));
1253                 fwd->connect_port = a2port(fwdarg[2]);
1254                 break;
1255
1256         case 4:
1257                 fwd->listen_host = xstrdup(cleanhostname(fwdarg[0]));
1258                 fwd->listen_port = a2port(fwdarg[1]);
1259                 fwd->connect_host = xstrdup(cleanhostname(fwdarg[2]));
1260                 fwd->connect_port = a2port(fwdarg[3]);
1261                 break;
1262         default:
1263                 i = 0; /* failure */
1264         }
1265
1266         xfree(p);
1267
1268         if (fwd->listen_port == 0 && fwd->connect_port == 0)
1269                 goto fail_free;
1270
1271         if (fwd->connect_host != NULL &&
1272             strlen(fwd->connect_host) >= NI_MAXHOST)
1273                 goto fail_free;
1274
1275         return (i);
1276
1277  fail_free:
1278         if (fwd->connect_host != NULL)
1279                 xfree(fwd->connect_host);
1280         if (fwd->listen_host != NULL)
1281                 xfree(fwd->listen_host);
1282         return (0);
1283 }