crypto/openssh/readconf.c

   1 /* $OpenBSD: readconf.c,v 1.250 2016/02/08 23:40:12 djm Exp $ */
   2 /*
   3  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   4  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   5  *                    All rights reserved
   6  * Functions for reading the configuration files.
   7  *
   8  * As far as I am concerned, the code I have written for this software
   9  * can be used freely for any purpose.  Any derived versions of this
  10  * software must be clearly marked as such, and if the derived work is
  11  * incompatible with the protocol description in the RFC file, it must be
  12  * called by a name other than "ssh" or "Secure Shell".
  13  */
  14
  15 #include "includes.h"
  16 __RCSID("$FreeBSD$");
  17
  18 #include <sys/types.h>
  19 #include <sys/stat.h>
  20 #include <sys/socket.h>
  21 #include <sys/sysctl.h>
  22 #include <sys/wait.h>
  23 #include <sys/un.h>
  24
  25 #include <netinet/in.h>
  26 #include <netinet/in_systm.h>
  27 #include <netinet/ip.h>
  28 #include <arpa/inet.h>
  29
  30 #include <ctype.h>
  31 #include <errno.h>
  32 #include <fcntl.h>
  33 #include <limits.h>
  34 #include <netdb.h>
  35 #ifdef HAVE_PATHS_H
  36 # include <paths.h>
  37 #endif
  38 #include <pwd.h>
  39 #include <signal.h>
  40 #include <stdarg.h>
  41 #include <stdio.h>
  42 #include <string.h>
  43 #include <unistd.h>
  44 #ifdef HAVE_UTIL_H
  45 #include <util.h>
  46 #endif
  47 #if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
  48 # include <vis.h>
  49 #endif
  50
  51 #include "xmalloc.h"
  52 #include "ssh.h"
  53 #include "compat.h"
  54 #include "cipher.h"
  55 #include "pathnames.h"
  56 #include "log.h"
  57 #include "sshkey.h"
  58 #include "misc.h"
  59 #include "readconf.h"
  60 #include "match.h"
  61 #include "kex.h"
  62 #include "mac.h"
  63 #include "uidswap.h"
  64 #include "myproposal.h"
  65 #include "digest.h"
  66 #include "version.h"
  67
  68 /* Format of the configuration file:
  69
  70    # Configuration data is parsed as follows:
  71    #  1. command line options
  72    #  2. user-specific file
  73    #  3. system-wide file
  74    # Any configuration value is only changed the first time it is set.
  75    # Thus, host-specific definitions should be at the beginning of the
  76    # configuration file, and defaults at the end.
  77
  78    # Host-specific declarations.  These may override anything above.  A single
  79    # host may match multiple declarations; these are processed in the order
  80    # that they are given in.
  81
  82    Host *.ngs.fi ngs.fi
  83      User foo
  84
  85    Host fake.com
  86      HostName another.host.name.real.org
  87      User blaah
  88      Port 34289
  89      ForwardX11 no
  90      ForwardAgent no
  91
  92    Host books.com
  93      RemoteForward 9999 shadows.cs.hut.fi:9999
  94      Cipher 3des
  95
  96    Host fascist.blob.com
  97      Port 23123
  98      User tylonen
  99      PasswordAuthentication no
 100
 101    Host puukko.hut.fi
 102      User t35124p
 103      ProxyCommand ssh-proxy %h %p
 104
 105    Host *.fr
 106      PublicKeyAuthentication no
 107
 108    Host *.su
 109      Cipher none
 110      PasswordAuthentication no
 111
 112    Host vpn.fake.com
 113      Tunnel yes
 114      TunnelDevice 3
 115
 116    # Defaults for various options
 117    Host *
 118      ForwardAgent no
 119      ForwardX11 no
 120      PasswordAuthentication yes
 121      RSAAuthentication yes
 122      RhostsRSAAuthentication yes
 123      StrictHostKeyChecking yes
 124      TcpKeepAlive no
 125      IdentityFile ~/.ssh/identity
 126      Port 22
 127      EscapeChar ~
 128
 129 */
 130
 131 /* Keyword tokens. */
 132
 133 typedef enum {
 134         oBadOption,
 135         oVersionAddendum,
 136         oHost, oMatch,
 137         oForwardAgent, oForwardX11, oForwardX11Trusted, oForwardX11Timeout,
 138         oGatewayPorts, oExitOnForwardFailure,
 139         oPasswordAuthentication, oRSAAuthentication,
 140         oChallengeResponseAuthentication, oXAuthLocation,
 141         oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
 142         oCertificateFile, oAddKeysToAgent,
 143         oUser, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
 144         oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
 145         oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
 146         oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts,
 147         oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,
 148         oPubkeyAuthentication,
 149         oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
 150         oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
 151         oHostKeyAlgorithms, oBindAddress, oPKCS11Provider,
 152         oClearAllForwardings, oNoHostAuthenticationForLocalhost,
 153         oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
 154         oAddressFamily, oGssAuthentication, oGssDelegateCreds,
 155         oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
 156         oSendEnv, oControlPath, oControlMaster, oControlPersist,
 157         oHashKnownHosts,
 158         oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
 159         oVisualHostKey,
 160         oKexAlgorithms, oIPQoS, oRequestTTY, oIgnoreUnknown, oProxyUseFdpass,
 161         oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots,
 162         oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs,
 163         oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys,
 164         oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes,
 165         oPubkeyAcceptedKeyTypes,
 166         oIgnoredUnknownOption, oDeprecated, oUnsupported
 167 } OpCodes;
 168
 169 /* Textual representations of the tokens. */
 170
 171 static struct {
 172         const char *name;
 173         OpCodes opcode;
 174 } keywords[] = {
 175         { "forwardagent", oForwardAgent },
 176         { "forwardx11", oForwardX11 },
 177         { "forwardx11trusted", oForwardX11Trusted },
 178         { "forwardx11timeout", oForwardX11Timeout },
 179         { "exitonforwardfailure", oExitOnForwardFailure },
 180         { "xauthlocation", oXAuthLocation },
 181         { "gatewayports", oGatewayPorts },
 182         { "useprivilegedport", oUsePrivilegedPort },
 183         { "rhostsauthentication", oDeprecated },
 184         { "passwordauthentication", oPasswordAuthentication },
 185         { "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
 186         { "kbdinteractivedevices", oKbdInteractiveDevices },
 187         { "rsaauthentication", oRSAAuthentication },
 188         { "pubkeyauthentication", oPubkeyAuthentication },
 189         { "dsaauthentication", oPubkeyAuthentication },             /* alias */
 190         { "rhostsrsaauthentication", oRhostsRSAAuthentication },
 191         { "hostbasedauthentication", oHostbasedAuthentication },
 192         { "challengeresponseauthentication", oChallengeResponseAuthentication },
 193         { "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
 194         { "tisauthentication", oChallengeResponseAuthentication },  /* alias */
 195         { "kerberosauthentication", oUnsupported },
 196         { "kerberostgtpassing", oUnsupported },
 197         { "afstokenpassing", oUnsupported },
 198 #if defined(GSSAPI)
 199         { "gssapiauthentication", oGssAuthentication },
 200         { "gssapidelegatecredentials", oGssDelegateCreds },
 201 #else
 202         { "gssapiauthentication", oUnsupported },
 203         { "gssapidelegatecredentials", oUnsupported },
 204 #endif
 205         { "fallbacktorsh", oDeprecated },
 206         { "usersh", oDeprecated },
 207         { "identityfile", oIdentityFile },
 208         { "identityfile2", oIdentityFile },                     /* obsolete */
 209         { "identitiesonly", oIdentitiesOnly },
 210         { "certificatefile", oCertificateFile },
 211         { "addkeystoagent", oAddKeysToAgent },
 212         { "hostname", oHostName },
 213         { "hostkeyalias", oHostKeyAlias },
 214         { "proxycommand", oProxyCommand },
 215         { "port", oPort },
 216         { "cipher", oCipher },
 217         { "ciphers", oCiphers },
 218         { "macs", oMacs },
 219         { "protocol", oProtocol },
 220         { "remoteforward", oRemoteForward },
 221         { "localforward", oLocalForward },
 222         { "user", oUser },
 223         { "host", oHost },
 224         { "match", oMatch },
 225         { "escapechar", oEscapeChar },
 226         { "globalknownhostsfile", oGlobalKnownHostsFile },
 227         { "globalknownhostsfile2", oDeprecated },
 228         { "userknownhostsfile", oUserKnownHostsFile },
 229         { "userknownhostsfile2", oDeprecated },
 230         { "connectionattempts", oConnectionAttempts },
 231         { "batchmode", oBatchMode },
 232         { "checkhostip", oCheckHostIP },
 233         { "stricthostkeychecking", oStrictHostKeyChecking },
 234         { "compression", oCompression },
 235         { "compressionlevel", oCompressionLevel },
 236         { "tcpkeepalive", oTCPKeepAlive },
 237         { "keepalive", oTCPKeepAlive },                         /* obsolete */
 238         { "numberofpasswordprompts", oNumberOfPasswordPrompts },
 239         { "loglevel", oLogLevel },
 240         { "dynamicforward", oDynamicForward },
 241         { "preferredauthentications", oPreferredAuthentications },
 242         { "hostkeyalgorithms", oHostKeyAlgorithms },
 243         { "bindaddress", oBindAddress },
 244 #ifdef ENABLE_PKCS11
 245         { "smartcarddevice", oPKCS11Provider },
 246         { "pkcs11provider", oPKCS11Provider },
 247 #else
 248         { "smartcarddevice", oUnsupported },
 249         { "pkcs11provider", oUnsupported },
 250 #endif
 251         { "clearallforwardings", oClearAllForwardings },
 252         { "enablesshkeysign", oEnableSSHKeysign },
 253         { "verifyhostkeydns", oVerifyHostKeyDNS },
 254         { "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost },
 255         { "rekeylimit", oRekeyLimit },
 256         { "connecttimeout", oConnectTimeout },
 257         { "addressfamily", oAddressFamily },
 258         { "serveraliveinterval", oServerAliveInterval },
 259         { "serveralivecountmax", oServerAliveCountMax },
 260         { "sendenv", oSendEnv },
 261         { "controlpath", oControlPath },
 262         { "controlmaster", oControlMaster },
 263         { "controlpersist", oControlPersist },
 264         { "hashknownhosts", oHashKnownHosts },
 265         { "tunnel", oTunnel },
 266         { "tunneldevice", oTunnelDevice },
 267         { "localcommand", oLocalCommand },
 268         { "permitlocalcommand", oPermitLocalCommand },
 269         { "visualhostkey", oVisualHostKey },
 270         { "useroaming", oDeprecated },
 271         { "kexalgorithms", oKexAlgorithms },
 272         { "ipqos", oIPQoS },
 273         { "requesttty", oRequestTTY },
 274         { "proxyusefdpass", oProxyUseFdpass },
 275         { "canonicaldomains", oCanonicalDomains },
 276         { "canonicalizefallbacklocal", oCanonicalizeFallbackLocal },
 277         { "canonicalizehostname", oCanonicalizeHostname },
 278         { "canonicalizemaxdots", oCanonicalizeMaxDots },
 279         { "canonicalizepermittedcnames", oCanonicalizePermittedCNAMEs },
 280         { "streamlocalbindmask", oStreamLocalBindMask },
 281         { "streamlocalbindunlink", oStreamLocalBindUnlink },
 282         { "revokedhostkeys", oRevokedHostKeys },
 283         { "fingerprinthash", oFingerprintHash },
 284         { "updatehostkeys", oUpdateHostkeys },
 285         { "hostbasedkeytypes", oHostbasedKeyTypes },
 286         { "pubkeyacceptedkeytypes", oPubkeyAcceptedKeyTypes },
 287         { "ignoreunknown", oIgnoreUnknown },
 288         { "hpndisabled", oDeprecated },
 289         { "hpnbuffersize", oDeprecated },
 290         { "tcprcvbufpoll", oDeprecated },
 291         { "tcprcvbuf", oDeprecated },
 292         { "noneenabled", oUnsupported },
 293         { "noneswitch", oUnsupported },
 294         { "versionaddendum", oVersionAddendum },
 295
 296         { NULL, oBadOption }
 297 };
 298
 299 /*
 300  * Adds a local TCP/IP port forward to options.  Never returns if there is an
 301  * error.
 302  */
 303
 304 void
 305 add_local_forward(Options *options, const struct Forward *newfwd)
 306 {
 307         struct Forward *fwd;
 308 #ifndef NO_IPPORT_RESERVED_CONCEPT
 309         extern uid_t original_real_uid;
 310         int ipport_reserved;
 311 #ifdef __FreeBSD__
 312         size_t len_ipport_reserved = sizeof(ipport_reserved);
 313
 314         if (sysctlbyname("net.inet.ip.portrange.reservedhigh",
 315             &ipport_reserved, &len_ipport_reserved, NULL, 0) != 0)
 316                 ipport_reserved = IPPORT_RESERVED;
 317         else
 318                 ipport_reserved++;
 319 #else
 320         ipport_reserved = IPPORT_RESERVED;
 321 #endif
 322         if (newfwd->listen_port < ipport_reserved && original_real_uid != 0)
 323         if (newfwd->listen_port < ipport_reserved && original_real_uid != 0 &&
 324             newfwd->listen_path == NULL)
 325                 fatal("Privileged ports can only be forwarded by root.");
 326 #endif
 327         options->local_forwards = xreallocarray(options->local_forwards,
 328             options->num_local_forwards + 1,
 329             sizeof(*options->local_forwards));
 330         fwd = &options->local_forwards[options->num_local_forwards++];
 331
 332         fwd->listen_host = newfwd->listen_host;
 333         fwd->listen_port = newfwd->listen_port;
 334         fwd->listen_path = newfwd->listen_path;
 335         fwd->connect_host = newfwd->connect_host;
 336         fwd->connect_port = newfwd->connect_port;
 337         fwd->connect_path = newfwd->connect_path;
 338 }
 339
 340 /*
 341  * Adds a remote TCP/IP port forward to options.  Never returns if there is
 342  * an error.
 343  */
 344
 345 void
 346 add_remote_forward(Options *options, const struct Forward *newfwd)
 347 {
 348         struct Forward *fwd;
 349
 350         options->remote_forwards = xreallocarray(options->remote_forwards,
 351             options->num_remote_forwards + 1,
 352             sizeof(*options->remote_forwards));
 353         fwd = &options->remote_forwards[options->num_remote_forwards++];
 354
 355         fwd->listen_host = newfwd->listen_host;
 356         fwd->listen_port = newfwd->listen_port;
 357         fwd->listen_path = newfwd->listen_path;
 358         fwd->connect_host = newfwd->connect_host;
 359         fwd->connect_port = newfwd->connect_port;
 360         fwd->connect_path = newfwd->connect_path;
 361         fwd->handle = newfwd->handle;
 362         fwd->allocated_port = 0;
 363 }
 364
 365 static void
 366 clear_forwardings(Options *options)
 367 {
 368         int i;
 369
 370         for (i = 0; i < options->num_local_forwards; i++) {
 371                 free(options->local_forwards[i].listen_host);
 372                 free(options->local_forwards[i].listen_path);
 373                 free(options->local_forwards[i].connect_host);
 374                 free(options->local_forwards[i].connect_path);
 375         }
 376         if (options->num_local_forwards > 0) {
 377                 free(options->local_forwards);
 378                 options->local_forwards = NULL;
 379         }
 380         options->num_local_forwards = 0;
 381         for (i = 0; i < options->num_remote_forwards; i++) {
 382                 free(options->remote_forwards[i].listen_host);
 383                 free(options->remote_forwards[i].listen_path);
 384                 free(options->remote_forwards[i].connect_host);
 385                 free(options->remote_forwards[i].connect_path);
 386         }
 387         if (options->num_remote_forwards > 0) {
 388                 free(options->remote_forwards);
 389                 options->remote_forwards = NULL;
 390         }
 391         options->num_remote_forwards = 0;
 392         options->tun_open = SSH_TUNMODE_NO;
 393 }
 394
 395 void
 396 add_certificate_file(Options *options, const char *path, int userprovided)
 397 {
 398         int i;
 399
 400         if (options->num_certificate_files >= SSH_MAX_CERTIFICATE_FILES)
 401                 fatal("Too many certificate files specified (max %d)",
 402                     SSH_MAX_CERTIFICATE_FILES);
 403
 404         /* Avoid registering duplicates */
 405         for (i = 0; i < options->num_certificate_files; i++) {
 406                 if (options->certificate_file_userprovided[i] == userprovided &&
 407                     strcmp(options->certificate_files[i], path) == 0) {
 408                         debug2("%s: ignoring duplicate key %s", __func__, path);
 409                         return;
 410                 }
 411         }
 412
 413         options->certificate_file_userprovided[options->num_certificate_files] =
 414             userprovided;
 415         options->certificate_files[options->num_certificate_files++] =
 416             xstrdup(path);
 417 }
 418
 419 void
 420 add_identity_file(Options *options, const char *dir, const char *filename,
 421     int userprovided)
 422 {
 423         char *path;
 424         int i;
 425
 426         if (options->num_identity_files >= SSH_MAX_IDENTITY_FILES)
 427                 fatal("Too many identity files specified (max %d)",
 428                     SSH_MAX_IDENTITY_FILES);
 429
 430         if (dir == NULL) /* no dir, filename is absolute */
 431                 path = xstrdup(filename);
 432         else
 433                 (void)xasprintf(&path, "%.100s%.100s", dir, filename);
 434
 435         /* Avoid registering duplicates */
 436         for (i = 0; i < options->num_identity_files; i++) {
 437                 if (options->identity_file_userprovided[i] == userprovided &&
 438                     strcmp(options->identity_files[i], path) == 0) {
 439                         debug2("%s: ignoring duplicate key %s", __func__, path);
 440                         free(path);
 441                         return;
 442                 }
 443         }
 444
 445         options->identity_file_userprovided[options->num_identity_files] =
 446             userprovided;
 447         options->identity_files[options->num_identity_files++] = path;
 448 }
 449
 450 int
 451 default_ssh_port(void)
 452 {
 453         static int port;
 454         struct servent *sp;
 455
 456         if (port == 0) {
 457                 sp = getservbyname(SSH_SERVICE_NAME, "tcp");
 458                 port = sp ? ntohs(sp->s_port) : SSH_DEFAULT_PORT;
 459         }
 460         return port;
 461 }
 462
 463 /*
 464  * Execute a command in a shell.
 465  * Return its exit status or -1 on abnormal exit.
 466  */
 467 static int
 468 execute_in_shell(const char *cmd)
 469 {
 470         char *shell;
 471         pid_t pid;
 472         int devnull, status;
 473         extern uid_t original_real_uid;
 474
 475         if ((shell = getenv("SHELL")) == NULL)
 476                 shell = _PATH_BSHELL;
 477
 478         /* Need this to redirect subprocess stdin/out */
 479         if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1)
 480                 fatal("open(/dev/null): %s", strerror(errno));
 481
 482         debug("Executing command: '%.500s'", cmd);
 483
 484         /* Fork and execute the command. */
 485         if ((pid = fork()) == 0) {
 486                 char *argv[4];
 487
 488                 /* Child.  Permanently give up superuser privileges. */
 489                 permanently_drop_suid(original_real_uid);
 490
 491                 /* Redirect child stdin and stdout. Leave stderr */
 492                 if (dup2(devnull, STDIN_FILENO) == -1)
 493                         fatal("dup2: %s", strerror(errno));
 494                 if (dup2(devnull, STDOUT_FILENO) == -1)
 495                         fatal("dup2: %s", strerror(errno));
 496                 if (devnull > STDERR_FILENO)
 497                         close(devnull);
 498                 closefrom(STDERR_FILENO + 1);
 499
 500                 argv[0] = shell;
 501                 argv[1] = "-c";
 502                 argv[2] = xstrdup(cmd);
 503                 argv[3] = NULL;
 504
 505                 execv(argv[0], argv);
 506                 error("Unable to execute '%.100s': %s", cmd, strerror(errno));
 507                 /* Die with signal to make this error apparent to parent. */
 508                 signal(SIGTERM, SIG_DFL);
 509                 kill(getpid(), SIGTERM);
 510                 _exit(1);
 511         }
 512         /* Parent. */
 513         if (pid < 0)
 514                 fatal("%s: fork: %.100s", __func__, strerror(errno));
 515
 516         close(devnull);
 517
 518         while (waitpid(pid, &status, 0) == -1) {
 519                 if (errno != EINTR && errno != EAGAIN)
 520                         fatal("%s: waitpid: %s", __func__, strerror(errno));
 521         }
 522         if (!WIFEXITED(status)) {
 523                 error("command '%.100s' exited abnormally", cmd);
 524                 return -1;
 525         }
 526         debug3("command returned status %d", WEXITSTATUS(status));
 527         return WEXITSTATUS(status);
 528 }
 529
 530 /*
 531  * Parse and execute a Match directive.
 532  */
 533 static int
 534 match_cfg_line(Options *options, char **condition, struct passwd *pw,
 535     const char *host_arg, const char *original_host, int post_canon,
 536     const char *filename, int linenum)
 537 {
 538         char *arg, *oattrib, *attrib, *cmd, *cp = *condition, *host, *criteria;
 539         const char *ruser;
 540         int r, port, this_result, result = 1, attributes = 0, negate;
 541         char thishost[NI_MAXHOST], shorthost[NI_MAXHOST], portstr[NI_MAXSERV];
 542
 543         /*
 544          * Configuration is likely to be incomplete at this point so we
 545          * must be prepared to use default values.
 546          */
 547         port = options->port <= 0 ? default_ssh_port() : options->port;
 548         ruser = options->user == NULL ? pw->pw_name : options->user;
 549         if (post_canon) {
 550                 host = xstrdup(options->hostname);
 551         } else if (options->hostname != NULL) {
 552                 /* NB. Please keep in sync with ssh.c:main() */
 553                 host = percent_expand(options->hostname,
 554                     "h", host_arg, (char *)NULL);
 555         } else {
 556                 host = xstrdup(host_arg);
 557         }
 558
 559         debug2("checking match for '%s' host %s originally %s",
 560             cp, host, original_host);
 561         while ((oattrib = attrib = strdelim(&cp)) && *attrib != '\0') {
 562                 criteria = NULL;
 563                 this_result = 1;
 564                 if ((negate = attrib[0] == '!'))
 565                         attrib++;
 566                 /* criteria "all" and "canonical" have no argument */
 567                 if (strcasecmp(attrib, "all") == 0) {
 568                         if (attributes > 1 ||
 569                             ((arg = strdelim(&cp)) != NULL && *arg != '\0')) {
 570                                 error("%.200s line %d: '%s' cannot be combined "
 571                                     "with other Match attributes",
 572                                     filename, linenum, oattrib);
 573                                 result = -1;
 574                                 goto out;
 575                         }
 576                         if (result)
 577                                 result = negate ? 0 : 1;
 578                         goto out;
 579                 }
 580                 attributes++;
 581                 if (strcasecmp(attrib, "canonical") == 0) {
 582                         r = !!post_canon;  /* force bitmask member to boolean */
 583                         if (r == (negate ? 1 : 0))
 584                                 this_result = result = 0;
 585                         debug3("%.200s line %d: %smatched '%s'",
 586                             filename, linenum,
 587                             this_result ? "" : "not ", oattrib);
 588                         continue;
 589                 }
 590                 /* All other criteria require an argument */
 591                 if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
 592                         error("Missing Match criteria for %s", attrib);
 593                         result = -1;
 594                         goto out;
 595                 }
 596                 if (strcasecmp(attrib, "host") == 0) {
 597                         criteria = xstrdup(host);
 598                         r = match_hostname(host, arg) == 1;
 599                         if (r == (negate ? 1 : 0))
 600                                 this_result = result = 0;
 601                 } else if (strcasecmp(attrib, "originalhost") == 0) {
 602                         criteria = xstrdup(original_host);
 603                         r = match_hostname(original_host, arg) == 1;
 604                         if (r == (negate ? 1 : 0))
 605                                 this_result = result = 0;
 606                 } else if (strcasecmp(attrib, "user") == 0) {
 607                         criteria = xstrdup(ruser);
 608                         r = match_pattern_list(ruser, arg, 0) == 1;
 609                         if (r == (negate ? 1 : 0))
 610                                 this_result = result = 0;
 611                 } else if (strcasecmp(attrib, "localuser") == 0) {
 612                         criteria = xstrdup(pw->pw_name);
 613                         r = match_pattern_list(pw->pw_name, arg, 0) == 1;
 614                         if (r == (negate ? 1 : 0))
 615                                 this_result = result = 0;
 616                 } else if (strcasecmp(attrib, "exec") == 0) {
 617                         if (gethostname(thishost, sizeof(thishost)) == -1)
 618                                 fatal("gethostname: %s", strerror(errno));
 619                         strlcpy(shorthost, thishost, sizeof(shorthost));
 620                         shorthost[strcspn(thishost, ".")] = '\0';
 621                         snprintf(portstr, sizeof(portstr), "%d", port);
 622
 623                         cmd = percent_expand(arg,
 624                             "L", shorthost,
 625                             "d", pw->pw_dir,
 626                             "h", host,
 627                             "l", thishost,
 628                             "n", original_host,
 629                             "p", portstr,
 630                             "r", ruser,
 631                             "u", pw->pw_name,
 632                             (char *)NULL);
 633                         if (result != 1) {
 634                                 /* skip execution if prior predicate failed */
 635                                 debug3("%.200s line %d: skipped exec "
 636                                     "\"%.100s\"", filename, linenum, cmd);
 637                                 free(cmd);
 638                                 continue;
 639                         }
 640                         r = execute_in_shell(cmd);
 641                         if (r == -1) {
 642                                 fatal("%.200s line %d: match exec "
 643                                     "'%.100s' error", filename,
 644                                     linenum, cmd);
 645                         }
 646                         criteria = xstrdup(cmd);
 647                         free(cmd);
 648                         /* Force exit status to boolean */
 649                         r = r == 0;
 650                         if (r == (negate ? 1 : 0))
 651                                 this_result = result = 0;
 652                 } else {
 653                         error("Unsupported Match attribute %s", attrib);
 654                         result = -1;
 655                         goto out;
 656                 }
 657                 debug3("%.200s line %d: %smatched '%s \"%.100s\"' ",
 658                     filename, linenum, this_result ? "": "not ",
 659                     oattrib, criteria);
 660                 free(criteria);
 661         }
 662         if (attributes == 0) {
 663                 error("One or more attributes required for Match");
 664                 result = -1;
 665                 goto out;
 666         }
 667  out:
 668         if (result != -1)
 669                 debug2("match %sfound", result ? "" : "not ");
 670         *condition = cp;
 671         free(host);
 672         return result;
 673 }
 674
 675 /* Check and prepare a domain name: removes trailing '.' and lowercases */
 676 static void
 677 valid_domain(char *name, const char *filename, int linenum)
 678 {
 679         size_t i, l = strlen(name);
 680         u_char c, last = '\0';
 681
 682         if (l == 0)
 683                 fatal("%s line %d: empty hostname suffix", filename, linenum);
 684         if (!isalpha((u_char)name[0]) && !isdigit((u_char)name[0]))
 685                 fatal("%s line %d: hostname suffix \"%.100s\" "
 686                     "starts with invalid character", filename, linenum, name);
 687         for (i = 0; i < l; i++) {
 688                 c = tolower((u_char)name[i]);
 689                 name[i] = (char)c;
 690                 if (last == '.' && c == '.')
 691                         fatal("%s line %d: hostname suffix \"%.100s\" contains "
 692                             "consecutive separators", filename, linenum, name);
 693                 if (c != '.' && c != '-' && !isalnum(c) &&
 694                     c != '_') /* technically invalid, but common */
 695                         fatal("%s line %d: hostname suffix \"%.100s\" contains "
 696                             "invalid characters", filename, linenum, name);
 697                 last = c;
 698         }
 699         if (name[l - 1] == '.')
 700                 name[l - 1] = '\0';
 701 }
 702
 703 /*
 704  * Returns the number of the token pointed to by cp or oBadOption.
 705  */
 706 static OpCodes
 707 parse_token(const char *cp, const char *filename, int linenum,
 708     const char *ignored_unknown)
 709 {
 710         int i;
 711
 712         for (i = 0; keywords[i].name; i++)
 713                 if (strcmp(cp, keywords[i].name) == 0)
 714                         return keywords[i].opcode;
 715         if (ignored_unknown != NULL &&
 716             match_pattern_list(cp, ignored_unknown, 1) == 1)
 717                 return oIgnoredUnknownOption;
 718         error("%s: line %d: Bad configuration option: %s",
 719             filename, linenum, cp);
 720         return oBadOption;
 721 }
 722
 723 /* Multistate option parsing */
 724 struct multistate {
 725         char *key;
 726         int value;
 727 };
 728 static const struct multistate multistate_flag[] = {
 729         { "true",                       1 },
 730         { "false",                      0 },
 731         { "yes",                        1 },
 732         { "no",                         0 },
 733         { NULL, -1 }
 734 };
 735 static const struct multistate multistate_yesnoask[] = {
 736         { "true",                       1 },
 737         { "false",                      0 },
 738         { "yes",                        1 },
 739         { "no",                         0 },
 740         { "ask",                        2 },
 741         { NULL, -1 }
 742 };
 743 static const struct multistate multistate_yesnoaskconfirm[] = {
 744         { "true",                       1 },
 745         { "false",                      0 },
 746         { "yes",                        1 },
 747         { "no",                         0 },
 748         { "ask",                        2 },
 749         { "confirm",                    3 },
 750         { NULL, -1 }
 751 };
 752 static const struct multistate multistate_addressfamily[] = {
 753         { "inet",                       AF_INET },
 754         { "inet6",                      AF_INET6 },
 755         { "any",                        AF_UNSPEC },
 756         { NULL, -1 }
 757 };
 758 static const struct multistate multistate_controlmaster[] = {
 759         { "true",                       SSHCTL_MASTER_YES },
 760         { "yes",                        SSHCTL_MASTER_YES },
 761         { "false",                      SSHCTL_MASTER_NO },
 762         { "no",                         SSHCTL_MASTER_NO },
 763         { "auto",                       SSHCTL_MASTER_AUTO },
 764         { "ask",                        SSHCTL_MASTER_ASK },
 765         { "autoask",                    SSHCTL_MASTER_AUTO_ASK },
 766         { NULL, -1 }
 767 };
 768 static const struct multistate multistate_tunnel[] = {
 769         { "ethernet",                   SSH_TUNMODE_ETHERNET },
 770         { "point-to-point",             SSH_TUNMODE_POINTOPOINT },
 771         { "true",                       SSH_TUNMODE_DEFAULT },
 772         { "yes",                        SSH_TUNMODE_DEFAULT },
 773         { "false",                      SSH_TUNMODE_NO },
 774         { "no",                         SSH_TUNMODE_NO },
 775         { NULL, -1 }
 776 };
 777 static const struct multistate multistate_requesttty[] = {
 778         { "true",                       REQUEST_TTY_YES },
 779         { "yes",                        REQUEST_TTY_YES },
 780         { "false",                      REQUEST_TTY_NO },
 781         { "no",                         REQUEST_TTY_NO },
 782         { "force",                      REQUEST_TTY_FORCE },
 783         { "auto",                       REQUEST_TTY_AUTO },
 784         { NULL, -1 }
 785 };
 786 static const struct multistate multistate_canonicalizehostname[] = {
 787         { "true",                       SSH_CANONICALISE_YES },
 788         { "false",                      SSH_CANONICALISE_NO },
 789         { "yes",                        SSH_CANONICALISE_YES },
 790         { "no",                         SSH_CANONICALISE_NO },
 791         { "always",                     SSH_CANONICALISE_ALWAYS },
 792         { NULL, -1 }
 793 };
 794
 795 /*
 796  * Processes a single option line as used in the configuration files. This
 797  * only sets those values that have not already been set.
 798  */
 799 #define WHITESPACE " \t\r\n"
 800 int
 801 process_config_line(Options *options, struct passwd *pw, const char *host,
 802     const char *original_host, char *line, const char *filename,
 803     int linenum, int *activep, int flags)
 804 {
 805         char *s, **charptr, *endofnumber, *keyword, *arg, *arg2;
 806         char **cpptr, fwdarg[256];
 807         u_int i, *uintptr, max_entries = 0;
 808         int negated, opcode, *intptr, value, value2, cmdline = 0;
 809         LogLevel *log_level_ptr;
 810         long long val64;
 811         size_t len;
 812         struct Forward fwd;
 813         const struct multistate *multistate_ptr;
 814         struct allowed_cname *cname;
 815
 816         if (activep == NULL) { /* We are processing a command line directive */
 817                 cmdline = 1;
 818                 activep = &cmdline;
 819         }
 820
 821         /* Strip trailing whitespace */
 822         if ((len = strlen(line)) == 0)
 823                 return 0;
 824         for (len--; len > 0; len--) {
 825                 if (strchr(WHITESPACE, line[len]) == NULL)
 826                         break;
 827                 line[len] = '\0';
 828         }
 829
 830         s = line;
 831         /* Get the keyword. (Each line is supposed to begin with a keyword). */
 832         if ((keyword = strdelim(&s)) == NULL)
 833                 return 0;
 834         /* Ignore leading whitespace. */
 835         if (*keyword == '\0')
 836                 keyword = strdelim(&s);
 837         if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
 838                 return 0;
 839         /* Match lowercase keyword */
 840         lowercase(keyword);
 841
 842         opcode = parse_token(keyword, filename, linenum,
 843             options->ignored_unknown);
 844
 845         switch (opcode) {
 846         case oBadOption:
 847                 /* don't panic, but count bad options */
 848                 return -1;
 849                 /* NOTREACHED */
 850         case oIgnoredUnknownOption:
 851                 debug("%s line %d: Ignored unknown option \"%s\"",
 852                     filename, linenum, keyword);
 853                 return 0;
 854         case oConnectTimeout:
 855                 intptr = &options->connection_timeout;
 856 parse_time:
 857                 arg = strdelim(&s);
 858                 if (!arg || *arg == '\0')
 859                         fatal("%s line %d: missing time value.",
 860                             filename, linenum);
 861                 if (strcmp(arg, "none") == 0)
 862                         value = -1;
 863                 else if ((value = convtime(arg)) == -1)
 864                         fatal("%s line %d: invalid time value.",
 865                             filename, linenum);
 866                 if (*activep && *intptr == -1)
 867                         *intptr = value;
 868                 break;
 869
 870         case oForwardAgent:
 871                 intptr = &options->forward_agent;
 872  parse_flag:
 873                 multistate_ptr = multistate_flag;
 874  parse_multistate:
 875                 arg = strdelim(&s);
 876                 if (!arg || *arg == '\0')
 877                         fatal("%s line %d: missing argument.",
 878                             filename, linenum);
 879                 value = -1;
 880                 for (i = 0; multistate_ptr[i].key != NULL; i++) {
 881                         if (strcasecmp(arg, multistate_ptr[i].key) == 0) {
 882                                 value = multistate_ptr[i].value;
 883                                 break;
 884                         }
 885                 }
 886                 if (value == -1)
 887                         fatal("%s line %d: unsupported option \"%s\".",
 888                             filename, linenum, arg);
 889                 if (*activep && *intptr == -1)
 890                         *intptr = value;
 891                 break;
 892
 893         case oForwardX11:
 894                 intptr = &options->forward_x11;
 895                 goto parse_flag;
 896
 897         case oForwardX11Trusted:
 898                 intptr = &options->forward_x11_trusted;
 899                 goto parse_flag;
 900
 901         case oForwardX11Timeout:
 902                 intptr = &options->forward_x11_timeout;
 903                 goto parse_time;
 904
 905         case oGatewayPorts:
 906                 intptr = &options->fwd_opts.gateway_ports;
 907                 goto parse_flag;
 908
 909         case oExitOnForwardFailure:
 910                 intptr = &options->exit_on_forward_failure;
 911                 goto parse_flag;
 912
 913         case oUsePrivilegedPort:
 914                 intptr = &options->use_privileged_port;
 915                 goto parse_flag;
 916
 917         case oPasswordAuthentication:
 918                 intptr = &options->password_authentication;
 919                 goto parse_flag;
 920
 921         case oKbdInteractiveAuthentication:
 922                 intptr = &options->kbd_interactive_authentication;
 923                 goto parse_flag;
 924
 925         case oKbdInteractiveDevices:
 926                 charptr = &options->kbd_interactive_devices;
 927                 goto parse_string;
 928
 929         case oPubkeyAuthentication:
 930                 intptr = &options->pubkey_authentication;
 931                 goto parse_flag;
 932
 933         case oRSAAuthentication:
 934                 intptr = &options->rsa_authentication;
 935                 goto parse_flag;
 936
 937         case oRhostsRSAAuthentication:
 938                 intptr = &options->rhosts_rsa_authentication;
 939                 goto parse_flag;
 940
 941         case oHostbasedAuthentication:
 942                 intptr = &options->hostbased_authentication;
 943                 goto parse_flag;
 944
 945         case oChallengeResponseAuthentication:
 946                 intptr = &options->challenge_response_authentication;
 947                 goto parse_flag;
 948
 949         case oGssAuthentication:
 950                 intptr = &options->gss_authentication;
 951                 goto parse_flag;
 952
 953         case oGssDelegateCreds:
 954                 intptr = &options->gss_deleg_creds;
 955                 goto parse_flag;
 956
 957         case oBatchMode:
 958                 intptr = &options->batch_mode;
 959                 goto parse_flag;
 960
 961         case oCheckHostIP:
 962                 intptr = &options->check_host_ip;
 963                 goto parse_flag;
 964
 965         case oVerifyHostKeyDNS:
 966                 intptr = &options->verify_host_key_dns;
 967                 multistate_ptr = multistate_yesnoask;
 968                 goto parse_multistate;
 969
 970         case oStrictHostKeyChecking:
 971                 intptr = &options->strict_host_key_checking;
 972                 multistate_ptr = multistate_yesnoask;
 973                 goto parse_multistate;
 974
 975         case oCompression:
 976                 intptr = &options->compression;
 977                 goto parse_flag;
 978
 979         case oTCPKeepAlive:
 980                 intptr = &options->tcp_keep_alive;
 981                 goto parse_flag;
 982
 983         case oNoHostAuthenticationForLocalhost:
 984                 intptr = &options->no_host_authentication_for_localhost;
 985                 goto parse_flag;
 986
 987         case oNumberOfPasswordPrompts:
 988                 intptr = &options->number_of_password_prompts;
 989                 goto parse_int;
 990
 991         case oCompressionLevel:
 992                 intptr = &options->compression_level;
 993                 goto parse_int;
 994
 995         case oRekeyLimit:
 996                 arg = strdelim(&s);
 997                 if (!arg || *arg == '\0')
 998                         fatal("%.200s line %d: Missing argument.", filename,
 999                             linenum);
1000                 if (strcmp(arg, "default") == 0) {
1001                         val64 = 0;
1002                 } else {
1003                         if (scan_scaled(arg, &val64) == -1)
1004                                 fatal("%.200s line %d: Bad number '%s': %s",
1005                                     filename, linenum, arg, strerror(errno));
1006                         if (val64 != 0 && val64 < 16)
1007                                 fatal("%.200s line %d: RekeyLimit too small",
1008                                     filename, linenum);
1009                 }
1010                 if (*activep && options->rekey_limit == -1)
1011                         options->rekey_limit = val64;
1012                 if (s != NULL) { /* optional rekey interval present */
1013                         if (strcmp(s, "none") == 0) {
1014                                 (void)strdelim(&s);     /* discard */
1015                                 break;
1016                         }
1017                         intptr = &options->rekey_interval;
1018                         goto parse_time;
1019                 }
1020                 break;
1021
1022         case oIdentityFile:
1023                 arg = strdelim(&s);
1024                 if (!arg || *arg == '\0')
1025                         fatal("%.200s line %d: Missing argument.", filename, linenum);
1026                 if (*activep) {
1027                         intptr = &options->num_identity_files;
1028                         if (*intptr >= SSH_MAX_IDENTITY_FILES)
1029                                 fatal("%.200s line %d: Too many identity files specified (max %d).",
1030                                     filename, linenum, SSH_MAX_IDENTITY_FILES);
1031                         add_identity_file(options, NULL,
1032                             arg, flags & SSHCONF_USERCONF);
1033                 }
1034                 break;
1035
1036         case oCertificateFile:
1037                 arg = strdelim(&s);
1038                 if (!arg || *arg == '\0')
1039                         fatal("%.200s line %d: Missing argument.",
1040                             filename, linenum);
1041                 if (*activep) {
1042                         intptr = &options->num_certificate_files;
1043                         if (*intptr >= SSH_MAX_CERTIFICATE_FILES) {
1044                                 fatal("%.200s line %d: Too many certificate "
1045                                     "files specified (max %d).",
1046                                     filename, linenum,
1047                                     SSH_MAX_CERTIFICATE_FILES);
1048                         }
1049                         add_certificate_file(options, arg,
1050                             flags & SSHCONF_USERCONF);
1051                 }
1052                 break;
1053
1054         case oXAuthLocation:
1055                 charptr=&options->xauth_location;
1056                 goto parse_string;
1057
1058         case oUser:
1059                 charptr = &options->user;
1060 parse_string:
1061                 arg = strdelim(&s);
1062                 if (!arg || *arg == '\0')
1063                         fatal("%.200s line %d: Missing argument.",
1064                             filename, linenum);
1065                 if (*activep && *charptr == NULL)
1066                         *charptr = xstrdup(arg);
1067                 break;
1068
1069         case oGlobalKnownHostsFile:
1070                 cpptr = (char **)&options->system_hostfiles;
1071                 uintptr = &options->num_system_hostfiles;
1072                 max_entries = SSH_MAX_HOSTS_FILES;
1073 parse_char_array:
1074                 if (*activep && *uintptr == 0) {
1075                         while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1076                                 if ((*uintptr) >= max_entries)
1077                                         fatal("%s line %d: "
1078                                             "too many authorized keys files.",
1079                                             filename, linenum);
1080                                 cpptr[(*uintptr)++] = xstrdup(arg);
1081                         }
1082                 }
1083                 return 0;
1084
1085         case oUserKnownHostsFile:
1086                 cpptr = (char **)&options->user_hostfiles;
1087                 uintptr = &options->num_user_hostfiles;
1088                 max_entries = SSH_MAX_HOSTS_FILES;
1089                 goto parse_char_array;
1090
1091         case oHostName:
1092                 charptr = &options->hostname;
1093                 goto parse_string;
1094
1095         case oHostKeyAlias:
1096                 charptr = &options->host_key_alias;
1097                 goto parse_string;
1098
1099         case oPreferredAuthentications:
1100                 charptr = &options->preferred_authentications;
1101                 goto parse_string;
1102
1103         case oBindAddress:
1104                 charptr = &options->bind_address;
1105                 goto parse_string;
1106
1107         case oPKCS11Provider:
1108                 charptr = &options->pkcs11_provider;
1109                 goto parse_string;
1110
1111         case oProxyCommand:
1112                 charptr = &options->proxy_command;
1113 parse_command:
1114                 if (s == NULL)
1115                         fatal("%.200s line %d: Missing argument.", filename, linenum);
1116                 len = strspn(s, WHITESPACE "=");
1117                 if (*activep && *charptr == NULL)
1118                         *charptr = xstrdup(s + len);
1119                 return 0;
1120
1121         case oPort:
1122                 intptr = &options->port;
1123 parse_int:
1124                 arg = strdelim(&s);
1125                 if (!arg || *arg == '\0')
1126                         fatal("%.200s line %d: Missing argument.", filename, linenum);
1127                 if (arg[0] < '0' || arg[0] > '9')
1128                         fatal("%.200s line %d: Bad number.", filename, linenum);
1129
1130                 /* Octal, decimal, or hex format? */
1131                 value = strtol(arg, &endofnumber, 0);
1132                 if (arg == endofnumber)
1133                         fatal("%.200s line %d: Bad number.", filename, linenum);
1134                 if (*activep && *intptr == -1)
1135                         *intptr = value;
1136                 break;
1137
1138         case oConnectionAttempts:
1139                 intptr = &options->connection_attempts;
1140                 goto parse_int;
1141
1142         case oCipher:
1143                 intptr = &options->cipher;
1144                 arg = strdelim(&s);
1145                 if (!arg || *arg == '\0')
1146                         fatal("%.200s line %d: Missing argument.", filename, linenum);
1147                 value = cipher_number(arg);
1148                 if (value == -1)
1149                         fatal("%.200s line %d: Bad cipher '%s'.",
1150                             filename, linenum, arg ? arg : "<NONE>");
1151                 if (*activep && *intptr == -1)
1152                         *intptr = value;
1153                 break;
1154
1155         case oCiphers:
1156                 arg = strdelim(&s);
1157                 if (!arg || *arg == '\0')
1158                         fatal("%.200s line %d: Missing argument.", filename, linenum);
1159                 if (!ciphers_valid(*arg == '+' ? arg + 1 : arg))
1160                         fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
1161                             filename, linenum, arg ? arg : "<NONE>");
1162                 if (*activep && options->ciphers == NULL)
1163                         options->ciphers = xstrdup(arg);
1164                 break;
1165
1166         case oMacs:
1167                 arg = strdelim(&s);
1168                 if (!arg || *arg == '\0')
1169                         fatal("%.200s line %d: Missing argument.", filename, linenum);
1170                 if (!mac_valid(*arg == '+' ? arg + 1 : arg))
1171                         fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.",
1172                             filename, linenum, arg ? arg : "<NONE>");
1173                 if (*activep && options->macs == NULL)
1174                         options->macs = xstrdup(arg);
1175                 break;
1176
1177         case oKexAlgorithms:
1178                 arg = strdelim(&s);
1179                 if (!arg || *arg == '\0')
1180                         fatal("%.200s line %d: Missing argument.",
1181                             filename, linenum);
1182                 if (!kex_names_valid(*arg == '+' ? arg + 1 : arg))
1183                         fatal("%.200s line %d: Bad SSH2 KexAlgorithms '%s'.",
1184                             filename, linenum, arg ? arg : "<NONE>");
1185                 if (*activep && options->kex_algorithms == NULL)
1186                         options->kex_algorithms = xstrdup(arg);
1187                 break;
1188
1189         case oHostKeyAlgorithms:
1190                 charptr = &options->hostkeyalgorithms;
1191 parse_keytypes:
1192                 arg = strdelim(&s);
1193                 if (!arg || *arg == '\0')
1194                         fatal("%.200s line %d: Missing argument.",
1195                             filename, linenum);
1196                 if (!sshkey_names_valid2(*arg == '+' ? arg + 1 : arg, 1))
1197                         fatal("%s line %d: Bad key types '%s'.",
1198                                 filename, linenum, arg ? arg : "<NONE>");
1199                 if (*activep && *charptr == NULL)
1200                         *charptr = xstrdup(arg);
1201                 break;
1202
1203         case oProtocol:
1204                 intptr = &options->protocol;
1205                 arg = strdelim(&s);
1206                 if (!arg || *arg == '\0')
1207                         fatal("%.200s line %d: Missing argument.", filename, linenum);
1208                 value = proto_spec(arg);
1209                 if (value == SSH_PROTO_UNKNOWN)
1210                         fatal("%.200s line %d: Bad protocol spec '%s'.",
1211                             filename, linenum, arg ? arg : "<NONE>");
1212                 if (*activep && *intptr == SSH_PROTO_UNKNOWN)
1213                         *intptr = value;
1214                 break;
1215
1216         case oLogLevel:
1217                 log_level_ptr = &options->log_level;
1218                 arg = strdelim(&s);
1219                 value = log_level_number(arg);
1220                 if (value == SYSLOG_LEVEL_NOT_SET)
1221                         fatal("%.200s line %d: unsupported log level '%s'",
1222                             filename, linenum, arg ? arg : "<NONE>");
1223                 if (*activep && *log_level_ptr == SYSLOG_LEVEL_NOT_SET)
1224                         *log_level_ptr = (LogLevel) value;
1225                 break;
1226
1227         case oLocalForward:
1228         case oRemoteForward:
1229         case oDynamicForward:
1230                 arg = strdelim(&s);
1231                 if (arg == NULL || *arg == '\0')
1232                         fatal("%.200s line %d: Missing port argument.",
1233                             filename, linenum);
1234
1235                 if (opcode == oLocalForward ||
1236                     opcode == oRemoteForward) {
1237                         arg2 = strdelim(&s);
1238                         if (arg2 == NULL || *arg2 == '\0')
1239                                 fatal("%.200s line %d: Missing target argument.",
1240                                     filename, linenum);
1241
1242                         /* construct a string for parse_forward */
1243                         snprintf(fwdarg, sizeof(fwdarg), "%s:%s", arg, arg2);
1244                 } else if (opcode == oDynamicForward) {
1245                         strlcpy(fwdarg, arg, sizeof(fwdarg));
1246                 }
1247
1248                 if (parse_forward(&fwd, fwdarg,
1249                     opcode == oDynamicForward ? 1 : 0,
1250                     opcode == oRemoteForward ? 1 : 0) == 0)
1251                         fatal("%.200s line %d: Bad forwarding specification.",
1252                             filename, linenum);
1253
1254                 if (*activep) {
1255                         if (opcode == oLocalForward ||
1256                             opcode == oDynamicForward)
1257                                 add_local_forward(options, &fwd);
1258                         else if (opcode == oRemoteForward)
1259                                 add_remote_forward(options, &fwd);
1260                 }
1261                 break;
1262
1263         case oClearAllForwardings:
1264                 intptr = &options->clear_forwardings;
1265                 goto parse_flag;
1266
1267         case oHost:
1268                 if (cmdline)
1269                         fatal("Host directive not supported as a command-line "
1270                             "option");
1271                 *activep = 0;
1272                 arg2 = NULL;
1273                 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1274                         negated = *arg == '!';
1275                         if (negated)
1276                                 arg++;
1277                         if (match_pattern(host, arg)) {
1278                                 if (negated) {
1279                                         debug("%.200s line %d: Skipping Host "
1280                                             "block because of negated match "
1281                                             "for %.100s", filename, linenum,
1282                                             arg);
1283                                         *activep = 0;
1284                                         break;
1285                                 }
1286                                 if (!*activep)
1287                                         arg2 = arg; /* logged below */
1288                                 *activep = 1;
1289                         }
1290                 }
1291                 if (*activep)
1292                         debug("%.200s line %d: Applying options for %.100s",
1293                             filename, linenum, arg2);
1294                 /* Avoid garbage check below, as strdelim is done. */
1295                 return 0;
1296
1297         case oMatch:
1298                 if (cmdline)
1299                         fatal("Host directive not supported as a command-line "
1300                             "option");
1301                 value = match_cfg_line(options, &s, pw, host, original_host,
1302                     flags & SSHCONF_POSTCANON, filename, linenum);
1303                 if (value < 0)
1304                         fatal("%.200s line %d: Bad Match condition", filename,
1305                             linenum);
1306                 *activep = value;
1307                 break;
1308
1309         case oEscapeChar:
1310                 intptr = &options->escape_char;
1311                 arg = strdelim(&s);
1312                 if (!arg || *arg == '\0')
1313                         fatal("%.200s line %d: Missing argument.", filename, linenum);
1314                 if (strcmp(arg, "none") == 0)
1315                         value = SSH_ESCAPECHAR_NONE;
1316                 else if (arg[1] == '\0')
1317                         value = (u_char) arg[0];
1318                 else if (arg[0] == '^' && arg[2] == 0 &&
1319                     (u_char) arg[1] >= 64 && (u_char) arg[1] < 128)
1320                         value = (u_char) arg[1] & 31;
1321                 else {
1322                         fatal("%.200s line %d: Bad escape character.",
1323                             filename, linenum);
1324                         /* NOTREACHED */
1325                         value = 0;      /* Avoid compiler warning. */
1326                 }
1327                 if (*activep && *intptr == -1)
1328                         *intptr = value;
1329                 break;
1330
1331         case oAddressFamily:
1332                 intptr = &options->address_family;
1333                 multistate_ptr = multistate_addressfamily;
1334                 goto parse_multistate;
1335
1336         case oEnableSSHKeysign:
1337                 intptr = &options->enable_ssh_keysign;
1338                 goto parse_flag;
1339
1340         case oIdentitiesOnly:
1341                 intptr = &options->identities_only;
1342                 goto parse_flag;
1343
1344         case oServerAliveInterval:
1345                 intptr = &options->server_alive_interval;
1346                 goto parse_time;
1347
1348         case oServerAliveCountMax:
1349                 intptr = &options->server_alive_count_max;
1350                 goto parse_int;
1351
1352         case oSendEnv:
1353                 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1354                         if (strchr(arg, '=') != NULL)
1355                                 fatal("%s line %d: Invalid environment name.",
1356                                     filename, linenum);
1357                         if (!*activep)
1358                                 continue;
1359                         if (options->num_send_env >= MAX_SEND_ENV)
1360                                 fatal("%s line %d: too many send env.",
1361                                     filename, linenum);
1362                         options->send_env[options->num_send_env++] =
1363                             xstrdup(arg);
1364                 }
1365                 break;
1366
1367         case oControlPath:
1368                 charptr = &options->control_path;
1369                 goto parse_string;
1370
1371         case oControlMaster:
1372                 intptr = &options->control_master;
1373                 multistate_ptr = multistate_controlmaster;
1374                 goto parse_multistate;
1375
1376         case oControlPersist:
1377                 /* no/false/yes/true, or a time spec */
1378                 intptr = &options->control_persist;
1379                 arg = strdelim(&s);
1380                 if (!arg || *arg == '\0')
1381                         fatal("%.200s line %d: Missing ControlPersist"
1382                             " argument.", filename, linenum);
1383                 value = 0;
1384                 value2 = 0;     /* timeout */
1385                 if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
1386                         value = 0;
1387                 else if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
1388                         value = 1;
1389                 else if ((value2 = convtime(arg)) >= 0)
1390                         value = 1;
1391                 else
1392                         fatal("%.200s line %d: Bad ControlPersist argument.",
1393                             filename, linenum);
1394                 if (*activep && *intptr == -1) {
1395                         *intptr = value;
1396                         options->control_persist_timeout = value2;
1397                 }
1398                 break;
1399
1400         case oHashKnownHosts:
1401                 intptr = &options->hash_known_hosts;
1402                 goto parse_flag;
1403
1404         case oTunnel:
1405                 intptr = &options->tun_open;
1406                 multistate_ptr = multistate_tunnel;
1407                 goto parse_multistate;
1408
1409         case oTunnelDevice:
1410                 arg = strdelim(&s);
1411                 if (!arg || *arg == '\0')
1412                         fatal("%.200s line %d: Missing argument.", filename, linenum);
1413                 value = a2tun(arg, &value2);
1414                 if (value == SSH_TUNID_ERR)
1415                         fatal("%.200s line %d: Bad tun device.", filename, linenum);
1416                 if (*activep) {
1417                         options->tun_local = value;
1418                         options->tun_remote = value2;
1419                 }
1420                 break;
1421
1422         case oLocalCommand:
1423                 charptr = &options->local_command;
1424                 goto parse_command;
1425
1426         case oPermitLocalCommand:
1427                 intptr = &options->permit_local_command;
1428                 goto parse_flag;
1429
1430         case oVisualHostKey:
1431                 intptr = &options->visual_host_key;
1432                 goto parse_flag;
1433
1434         case oIPQoS:
1435                 arg = strdelim(&s);
1436                 if ((value = parse_ipqos(arg)) == -1)
1437                         fatal("%s line %d: Bad IPQoS value: %s",
1438                             filename, linenum, arg);
1439                 arg = strdelim(&s);
1440                 if (arg == NULL)
1441                         value2 = value;
1442                 else if ((value2 = parse_ipqos(arg)) == -1)
1443                         fatal("%s line %d: Bad IPQoS value: %s",
1444                             filename, linenum, arg);
1445                 if (*activep) {
1446                         options->ip_qos_interactive = value;
1447                         options->ip_qos_bulk = value2;
1448                 }
1449                 break;
1450
1451         case oRequestTTY:
1452                 intptr = &options->request_tty;
1453                 multistate_ptr = multistate_requesttty;
1454                 goto parse_multistate;
1455
1456         case oVersionAddendum:
1457                 if (s == NULL)
1458                         fatal("%.200s line %d: Missing argument.", filename,
1459                             linenum);
1460                 len = strspn(s, WHITESPACE);
1461                 if (*activep && options->version_addendum == NULL) {
1462                         if (strcasecmp(s + len, "none") == 0)
1463                                 options->version_addendum = xstrdup("");
1464                         else if (strchr(s + len, '\r') != NULL)
1465                                 fatal("%.200s line %d: Invalid argument",
1466                                     filename, linenum);
1467                         else
1468                                 options->version_addendum = xstrdup(s + len);
1469                 }
1470                 return 0;
1471
1472         case oIgnoreUnknown:
1473                 charptr = &options->ignored_unknown;
1474                 goto parse_string;
1475
1476         case oProxyUseFdpass:
1477                 intptr = &options->proxy_use_fdpass;
1478                 goto parse_flag;
1479
1480         case oCanonicalDomains:
1481                 value = options->num_canonical_domains != 0;
1482                 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1483                         valid_domain(arg, filename, linenum);
1484                         if (!*activep || value)
1485                                 continue;
1486                         if (options->num_canonical_domains >= MAX_CANON_DOMAINS)
1487                                 fatal("%s line %d: too many hostname suffixes.",
1488                                     filename, linenum);
1489                         options->canonical_domains[
1490                             options->num_canonical_domains++] = xstrdup(arg);
1491                 }
1492                 break;
1493
1494         case oCanonicalizePermittedCNAMEs:
1495                 value = options->num_permitted_cnames != 0;
1496                 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1497                         /* Either '*' for everything or 'list:list' */
1498                         if (strcmp(arg, "*") == 0)
1499                                 arg2 = arg;
1500                         else {
1501                                 lowercase(arg);
1502                                 if ((arg2 = strchr(arg, ':')) == NULL ||
1503                                     arg2[1] == '\0') {
1504                                         fatal("%s line %d: "
1505                                             "Invalid permitted CNAME \"%s\"",
1506                                             filename, linenum, arg);
1507                                 }
1508                                 *arg2 = '\0';
1509                                 arg2++;
1510                         }
1511                         if (!*activep || value)
1512                                 continue;
1513                         if (options->num_permitted_cnames >= MAX_CANON_DOMAINS)
1514                                 fatal("%s line %d: too many permitted CNAMEs.",
1515                                     filename, linenum);
1516                         cname = options->permitted_cnames +
1517                             options->num_permitted_cnames++;
1518                         cname->source_list = xstrdup(arg);
1519                         cname->target_list = xstrdup(arg2);
1520                 }
1521                 break;
1522
1523         case oCanonicalizeHostname:
1524                 intptr = &options->canonicalize_hostname;
1525                 multistate_ptr = multistate_canonicalizehostname;
1526                 goto parse_multistate;
1527
1528         case oCanonicalizeMaxDots:
1529                 intptr = &options->canonicalize_max_dots;
1530                 goto parse_int;
1531
1532         case oCanonicalizeFallbackLocal:
1533                 intptr = &options->canonicalize_fallback_local;
1534                 goto parse_flag;
1535
1536         case oStreamLocalBindMask:
1537                 arg = strdelim(&s);
1538                 if (!arg || *arg == '\0')
1539                         fatal("%.200s line %d: Missing StreamLocalBindMask argument.", filename, linenum);
1540                 /* Parse mode in octal format */
1541                 value = strtol(arg, &endofnumber, 8);
1542                 if (arg == endofnumber || value < 0 || value > 0777)
1543                         fatal("%.200s line %d: Bad mask.", filename, linenum);
1544                 options->fwd_opts.streamlocal_bind_mask = (mode_t)value;
1545                 break;
1546
1547         case oStreamLocalBindUnlink:
1548                 intptr = &options->fwd_opts.streamlocal_bind_unlink;
1549                 goto parse_flag;
1550
1551         case oRevokedHostKeys:
1552                 charptr = &options->revoked_host_keys;
1553                 goto parse_string;
1554
1555         case oFingerprintHash:
1556                 intptr = &options->fingerprint_hash;
1557                 arg = strdelim(&s);
1558                 if (!arg || *arg == '\0')
1559                         fatal("%.200s line %d: Missing argument.",
1560                             filename, linenum);
1561                 if ((value = ssh_digest_alg_by_name(arg)) == -1)
1562                         fatal("%.200s line %d: Invalid hash algorithm \"%s\".",
1563                             filename, linenum, arg);
1564                 if (*activep && *intptr == -1)
1565                         *intptr = value;
1566                 break;
1567
1568         case oUpdateHostkeys:
1569                 intptr = &options->update_hostkeys;
1570                 multistate_ptr = multistate_yesnoask;
1571                 goto parse_multistate;
1572
1573         case oHostbasedKeyTypes:
1574                 charptr = &options->hostbased_key_types;
1575                 goto parse_keytypes;
1576
1577         case oPubkeyAcceptedKeyTypes:
1578                 charptr = &options->pubkey_key_types;
1579                 goto parse_keytypes;
1580
1581         case oAddKeysToAgent:
1582                 intptr = &options->add_keys_to_agent;
1583                 multistate_ptr = multistate_yesnoaskconfirm;
1584                 goto parse_multistate;
1585
1586         case oDeprecated:
1587                 debug("%s line %d: Deprecated option \"%s\"",
1588                     filename, linenum, keyword);
1589                 return 0;
1590
1591         case oUnsupported:
1592                 error("%s line %d: Unsupported option \"%s\"",
1593                     filename, linenum, keyword);
1594                 return 0;
1595
1596         default:
1597                 fatal("%s: Unimplemented opcode %d", __func__, opcode);
1598         }
1599
1600         /* Check that there is no garbage at end of line. */
1601         if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1602                 fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
1603                     filename, linenum, arg);
1604         }
1605         return 0;
1606 }
1607
1608
1609 /*
1610  * Reads the config file and modifies the options accordingly.  Options
1611  * should already be initialized before this call.  This never returns if
1612  * there is an error.  If the file does not exist, this returns 0.
1613  */
1614
1615 int
1616 read_config_file(const char *filename, struct passwd *pw, const char *host,
1617     const char *original_host, Options *options, int flags)
1618 {
1619         FILE *f;
1620         char line[1024];
1621         int active, linenum;
1622         int bad_options = 0;
1623
1624         if ((f = fopen(filename, "r")) == NULL)
1625                 return 0;
1626
1627         if (flags & SSHCONF_CHECKPERM) {
1628                 struct stat sb;
1629
1630                 if (fstat(fileno(f), &sb) == -1)
1631                         fatal("fstat %s: %s", filename, strerror(errno));
1632                 if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
1633                     (sb.st_mode & 022) != 0))
1634                         fatal("Bad owner or permissions on %s", filename);
1635         }
1636
1637         debug("Reading configuration data %.200s", filename);
1638
1639         /*
1640          * Mark that we are now processing the options.  This flag is turned
1641          * on/off by Host specifications.
1642          */
1643         active = 1;
1644         linenum = 0;
1645         while (fgets(line, sizeof(line), f)) {
1646                 /* Update line number counter. */
1647                 linenum++;
1648                 if (process_config_line(options, pw, host, original_host,
1649                     line, filename, linenum, &active, flags) != 0)
1650                         bad_options++;
1651         }
1652         fclose(f);
1653         if (bad_options > 0)
1654                 fatal("%s: terminating, %d bad configuration options",
1655                     filename, bad_options);
1656         return 1;
1657 }
1658
1659 /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
1660 int
1661 option_clear_or_none(const char *o)
1662 {
1663         return o == NULL || strcasecmp(o, "none") == 0;
1664 }
1665
1666 /*
1667  * Initializes options to special values that indicate that they have not yet
1668  * been set.  Read_config_file will only set options with this value. Options
1669  * are processed in the following order: command line, user config file,
1670  * system config file.  Last, fill_default_options is called.
1671  */
1672
1673 void
1674 initialize_options(Options * options)
1675 {
1676         memset(options, 'X', sizeof(*options));
1677         options->version_addendum = NULL;
1678         options->forward_agent = -1;
1679         options->forward_x11 = -1;
1680         options->forward_x11_trusted = -1;
1681         options->forward_x11_timeout = -1;
1682         options->exit_on_forward_failure = -1;
1683         options->xauth_location = NULL;
1684         options->fwd_opts.gateway_ports = -1;
1685         options->fwd_opts.streamlocal_bind_mask = (mode_t)-1;
1686         options->fwd_opts.streamlocal_bind_unlink = -1;
1687         options->use_privileged_port = -1;
1688         options->rsa_authentication = -1;
1689         options->pubkey_authentication = -1;
1690         options->challenge_response_authentication = -1;
1691         options->gss_authentication = -1;
1692         options->gss_deleg_creds = -1;
1693         options->password_authentication = -1;
1694         options->kbd_interactive_authentication = -1;
1695         options->kbd_interactive_devices = NULL;
1696         options->rhosts_rsa_authentication = -1;
1697         options->hostbased_authentication = -1;
1698         options->batch_mode = -1;
1699         options->check_host_ip = -1;
1700         options->strict_host_key_checking = -1;
1701         options->compression = -1;
1702         options->tcp_keep_alive = -1;
1703         options->compression_level = -1;
1704         options->port = -1;
1705         options->address_family = -1;
1706         options->connection_attempts = -1;
1707         options->connection_timeout = -1;
1708         options->number_of_password_prompts = -1;
1709         options->cipher = -1;
1710         options->ciphers = NULL;
1711         options->macs = NULL;
1712         options->kex_algorithms = NULL;
1713         options->hostkeyalgorithms = NULL;
1714         options->protocol = SSH_PROTO_UNKNOWN;
1715         options->num_identity_files = 0;
1716         options->num_certificate_files = 0;
1717         options->hostname = NULL;
1718         options->host_key_alias = NULL;
1719         options->proxy_command = NULL;
1720         options->user = NULL;
1721         options->escape_char = -1;
1722         options->num_system_hostfiles = 0;
1723         options->num_user_hostfiles = 0;
1724         options->local_forwards = NULL;
1725         options->num_local_forwards = 0;
1726         options->remote_forwards = NULL;
1727         options->num_remote_forwards = 0;
1728         options->clear_forwardings = -1;
1729         options->log_level = SYSLOG_LEVEL_NOT_SET;
1730         options->preferred_authentications = NULL;
1731         options->bind_address = NULL;
1732         options->pkcs11_provider = NULL;
1733         options->enable_ssh_keysign = - 1;
1734         options->no_host_authentication_for_localhost = - 1;
1735         options->identities_only = - 1;
1736         options->rekey_limit = - 1;
1737         options->rekey_interval = -1;
1738         options->verify_host_key_dns = -1;
1739         options->server_alive_interval = -1;
1740         options->server_alive_count_max = -1;
1741         options->num_send_env = 0;
1742         options->control_path = NULL;
1743         options->control_master = -1;
1744         options->control_persist = -1;
1745         options->control_persist_timeout = 0;
1746         options->hash_known_hosts = -1;
1747         options->tun_open = -1;
1748         options->tun_local = -1;
1749         options->tun_remote = -1;
1750         options->local_command = NULL;
1751         options->permit_local_command = -1;
1752         options->add_keys_to_agent = -1;
1753         options->visual_host_key = -1;
1754         options->ip_qos_interactive = -1;
1755         options->ip_qos_bulk = -1;
1756         options->request_tty = -1;
1757         options->proxy_use_fdpass = -1;
1758         options->ignored_unknown = NULL;
1759         options->num_canonical_domains = 0;
1760         options->num_permitted_cnames = 0;
1761         options->canonicalize_max_dots = -1;
1762         options->canonicalize_fallback_local = -1;
1763         options->canonicalize_hostname = -1;
1764         options->revoked_host_keys = NULL;
1765         options->fingerprint_hash = -1;
1766         options->update_hostkeys = -1;
1767         options->hostbased_key_types = NULL;
1768         options->pubkey_key_types = NULL;
1769 }
1770
1771 /*
1772  * A petite version of fill_default_options() that just fills the options
1773  * needed for hostname canonicalization to proceed.
1774  */
1775 void
1776 fill_default_options_for_canonicalization(Options *options)
1777 {
1778         if (options->canonicalize_max_dots == -1)
1779                 options->canonicalize_max_dots = 1;
1780         if (options->canonicalize_fallback_local == -1)
1781                 options->canonicalize_fallback_local = 1;
1782         if (options->canonicalize_hostname == -1)
1783                 options->canonicalize_hostname = SSH_CANONICALISE_NO;
1784 }
1785
1786 /*
1787  * Called after processing other sources of option data, this fills those
1788  * options for which no value has been specified with their default values.
1789  */
1790 void
1791 fill_default_options(Options * options)
1792 {
1793         if (options->forward_agent == -1)
1794                 options->forward_agent = 0;
1795         if (options->forward_x11 == -1)
1796                 options->forward_x11 = 0;
1797         if (options->forward_x11_trusted == -1)
1798                 options->forward_x11_trusted = 0;
1799         if (options->forward_x11_timeout == -1)
1800                 options->forward_x11_timeout = 1200;
1801         if (options->exit_on_forward_failure == -1)
1802                 options->exit_on_forward_failure = 0;
1803         if (options->xauth_location == NULL)
1804                 options->xauth_location = _PATH_XAUTH;
1805         if (options->fwd_opts.gateway_ports == -1)
1806                 options->fwd_opts.gateway_ports = 0;
1807         if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
1808                 options->fwd_opts.streamlocal_bind_mask = 0177;
1809         if (options->fwd_opts.streamlocal_bind_unlink == -1)
1810                 options->fwd_opts.streamlocal_bind_unlink = 0;
1811         if (options->use_privileged_port == -1)
1812                 options->use_privileged_port = 0;
1813         if (options->rsa_authentication == -1)
1814                 options->rsa_authentication = 1;
1815         if (options->pubkey_authentication == -1)
1816                 options->pubkey_authentication = 1;
1817         if (options->challenge_response_authentication == -1)
1818                 options->challenge_response_authentication = 1;
1819         if (options->gss_authentication == -1)
1820                 options->gss_authentication = 0;
1821         if (options->gss_deleg_creds == -1)
1822                 options->gss_deleg_creds = 0;
1823         if (options->password_authentication == -1)
1824                 options->password_authentication = 1;
1825         if (options->kbd_interactive_authentication == -1)
1826                 options->kbd_interactive_authentication = 1;
1827         if (options->rhosts_rsa_authentication == -1)
1828                 options->rhosts_rsa_authentication = 0;
1829         if (options->hostbased_authentication == -1)
1830                 options->hostbased_authentication = 0;
1831         if (options->batch_mode == -1)
1832                 options->batch_mode = 0;
1833         if (options->check_host_ip == -1)
1834                 options->check_host_ip = 0;
1835         if (options->strict_host_key_checking == -1)
1836                 options->strict_host_key_checking = 2;  /* 2 is default */
1837         if (options->compression == -1)
1838                 options->compression = 0;
1839         if (options->tcp_keep_alive == -1)
1840                 options->tcp_keep_alive = 1;
1841         if (options->compression_level == -1)
1842                 options->compression_level = 6;
1843         if (options->port == -1)
1844                 options->port = 0;      /* Filled in ssh_connect. */
1845         if (options->address_family == -1)
1846                 options->address_family = AF_UNSPEC;
1847         if (options->connection_attempts == -1)
1848                 options->connection_attempts = 1;
1849         if (options->number_of_password_prompts == -1)
1850                 options->number_of_password_prompts = 3;
1851         /* Selected in ssh_login(). */
1852         if (options->cipher == -1)
1853                 options->cipher = SSH_CIPHER_NOT_SET;
1854         /* options->hostkeyalgorithms, default set in myproposals.h */
1855         if (options->protocol == SSH_PROTO_UNKNOWN)
1856                 options->protocol = SSH_PROTO_2;
1857         if (options->add_keys_to_agent == -1)
1858                 options->add_keys_to_agent = 0;
1859         if (options->num_identity_files == 0) {
1860                 if (options->protocol & SSH_PROTO_1) {
1861                         add_identity_file(options, "~/",
1862                             _PATH_SSH_CLIENT_IDENTITY, 0);
1863                 }
1864                 if (options->protocol & SSH_PROTO_2) {
1865                         add_identity_file(options, "~/",
1866                             _PATH_SSH_CLIENT_ID_RSA, 0);
1867                         add_identity_file(options, "~/",
1868                             _PATH_SSH_CLIENT_ID_DSA, 0);
1869 #ifdef OPENSSL_HAS_ECC
1870                         add_identity_file(options, "~/",
1871                             _PATH_SSH_CLIENT_ID_ECDSA, 0);
1872 #endif
1873                         add_identity_file(options, "~/",
1874                             _PATH_SSH_CLIENT_ID_ED25519, 0);
1875                 }
1876         }
1877         if (options->escape_char == -1)
1878                 options->escape_char = '~';
1879         if (options->num_system_hostfiles == 0) {
1880                 options->system_hostfiles[options->num_system_hostfiles++] =
1881                     xstrdup(_PATH_SSH_SYSTEM_HOSTFILE);
1882                 options->system_hostfiles[options->num_system_hostfiles++] =
1883                     xstrdup(_PATH_SSH_SYSTEM_HOSTFILE2);
1884         }
1885         if (options->num_user_hostfiles == 0) {
1886                 options->user_hostfiles[options->num_user_hostfiles++] =
1887                     xstrdup(_PATH_SSH_USER_HOSTFILE);
1888                 options->user_hostfiles[options->num_user_hostfiles++] =
1889                     xstrdup(_PATH_SSH_USER_HOSTFILE2);
1890         }
1891         if (options->log_level == SYSLOG_LEVEL_NOT_SET)
1892                 options->log_level = SYSLOG_LEVEL_INFO;
1893         if (options->clear_forwardings == 1)
1894                 clear_forwardings(options);
1895         if (options->no_host_authentication_for_localhost == - 1)
1896                 options->no_host_authentication_for_localhost = 0;
1897         if (options->identities_only == -1)
1898                 options->identities_only = 0;
1899         if (options->enable_ssh_keysign == -1)
1900                 options->enable_ssh_keysign = 0;
1901         if (options->rekey_limit == -1)
1902                 options->rekey_limit = 0;
1903         if (options->rekey_interval == -1)
1904                 options->rekey_interval = 0;
1905 #if HAVE_LDNS
1906         if (options->verify_host_key_dns == -1)
1907                 /* automatically trust a verified SSHFP record */
1908                 options->verify_host_key_dns = 1;
1909 #else
1910         if (options->verify_host_key_dns == -1)
1911                 options->verify_host_key_dns = 0;
1912 #endif
1913         if (options->server_alive_interval == -1)
1914                 options->server_alive_interval = 0;
1915         if (options->server_alive_count_max == -1)
1916                 options->server_alive_count_max = 3;
1917         if (options->control_master == -1)
1918                 options->control_master = 0;
1919         if (options->control_persist == -1) {
1920                 options->control_persist = 0;
1921                 options->control_persist_timeout = 0;
1922         }
1923         if (options->hash_known_hosts == -1)
1924                 options->hash_known_hosts = 0;
1925         if (options->tun_open == -1)
1926                 options->tun_open = SSH_TUNMODE_NO;
1927         if (options->tun_local == -1)
1928                 options->tun_local = SSH_TUNID_ANY;
1929         if (options->tun_remote == -1)
1930                 options->tun_remote = SSH_TUNID_ANY;
1931         if (options->permit_local_command == -1)
1932                 options->permit_local_command = 0;
1933         if (options->visual_host_key == -1)
1934                 options->visual_host_key = 0;
1935         if (options->ip_qos_interactive == -1)
1936                 options->ip_qos_interactive = IPTOS_LOWDELAY;
1937         if (options->ip_qos_bulk == -1)
1938                 options->ip_qos_bulk = IPTOS_THROUGHPUT;
1939         if (options->request_tty == -1)
1940                 options->request_tty = REQUEST_TTY_AUTO;
1941         if (options->proxy_use_fdpass == -1)
1942                 options->proxy_use_fdpass = 0;
1943         if (options->canonicalize_max_dots == -1)
1944                 options->canonicalize_max_dots = 1;
1945         if (options->canonicalize_fallback_local == -1)
1946                 options->canonicalize_fallback_local = 1;
1947         if (options->canonicalize_hostname == -1)
1948                 options->canonicalize_hostname = SSH_CANONICALISE_NO;
1949         if (options->fingerprint_hash == -1)
1950                 options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
1951         if (options->update_hostkeys == -1)
1952                 options->update_hostkeys = 0;
1953         if (kex_assemble_names(KEX_CLIENT_ENCRYPT, &options->ciphers) != 0 ||
1954             kex_assemble_names(KEX_CLIENT_MAC, &options->macs) != 0 ||
1955             kex_assemble_names(KEX_CLIENT_KEX, &options->kex_algorithms) != 0 ||
1956             kex_assemble_names(KEX_DEFAULT_PK_ALG,
1957             &options->hostbased_key_types) != 0 ||
1958             kex_assemble_names(KEX_DEFAULT_PK_ALG,
1959             &options->pubkey_key_types) != 0)
1960                 fatal("%s: kex_assemble_names failed", __func__);
1961
1962 #define CLEAR_ON_NONE(v) \
1963         do { \
1964                 if (option_clear_or_none(v)) { \
1965                         free(v); \
1966                         v = NULL; \
1967                 } \
1968         } while(0)
1969         CLEAR_ON_NONE(options->local_command);
1970         CLEAR_ON_NONE(options->proxy_command);
1971         CLEAR_ON_NONE(options->control_path);
1972         CLEAR_ON_NONE(options->revoked_host_keys);
1973         /* options->user will be set in the main program if appropriate */
1974         /* options->hostname will be set in the main program if appropriate */
1975         /* options->host_key_alias should not be set by default */
1976         /* options->preferred_authentications will be set in ssh */
1977         if (options->version_addendum == NULL)
1978                 options->version_addendum = xstrdup(SSH_VERSION_FREEBSD);
1979 }
1980
1981 struct fwdarg {
1982         char *arg;
1983         int ispath;
1984 };
1985
1986 /*
1987  * parse_fwd_field
1988  * parses the next field in a port forwarding specification.
1989  * sets fwd to the parsed field and advances p past the colon
1990  * or sets it to NULL at end of string.
1991  * returns 0 on success, else non-zero.
1992  */
1993 static int
1994 parse_fwd_field(char **p, struct fwdarg *fwd)
1995 {
1996         char *ep, *cp = *p;
1997         int ispath = 0;
1998
1999         if (*cp == '\0') {
2000                 *p = NULL;
2001                 return -1;      /* end of string */
2002         }
2003
2004         /*
2005          * A field escaped with square brackets is used literally.
2006          * XXX - allow ']' to be escaped via backslash?
2007          */
2008         if (*cp == '[') {
2009                 /* find matching ']' */
2010                 for (ep = cp + 1; *ep != ']' && *ep != '\0'; ep++) {
2011                         if (*ep == '/')
2012                                 ispath = 1;
2013                 }
2014                 /* no matching ']' or not at end of field. */
2015                 if (ep[0] != ']' || (ep[1] != ':' && ep[1] != '\0'))
2016                         return -1;
2017                 /* NUL terminate the field and advance p past the colon */
2018                 *ep++ = '\0';
2019                 if (*ep != '\0')
2020                         *ep++ = '\0';
2021                 fwd->arg = cp + 1;
2022                 fwd->ispath = ispath;
2023                 *p = ep;
2024                 return 0;
2025         }
2026
2027         for (cp = *p; *cp != '\0'; cp++) {
2028                 switch (*cp) {
2029                 case '\\':
2030                         memmove(cp, cp + 1, strlen(cp + 1) + 1);
2031                         if (*cp == '\0')
2032                                 return -1;
2033                         break;
2034                 case '/':
2035                         ispath = 1;
2036                         break;
2037                 case ':':
2038                         *cp++ = '\0';
2039                         goto done;
2040                 }
2041         }
2042 done:
2043         fwd->arg = *p;
2044         fwd->ispath = ispath;
2045         *p = cp;
2046         return 0;
2047 }
2048
2049 /*
2050  * parse_forward
2051  * parses a string containing a port forwarding specification of the form:
2052  *   dynamicfwd == 0
2053  *      [listenhost:]listenport|listenpath:connecthost:connectport|connectpath
2054  *      listenpath:connectpath
2055  *   dynamicfwd == 1
2056  *      [listenhost:]listenport
2057  * returns number of arguments parsed or zero on error
2058  */
2059 int
2060 parse_forward(struct Forward *fwd, const char *fwdspec, int dynamicfwd, int remotefwd)
2061 {
2062         struct fwdarg fwdargs[4];
2063         char *p, *cp;
2064         int i;
2065
2066         memset(fwd, 0, sizeof(*fwd));
2067         memset(fwdargs, 0, sizeof(fwdargs));
2068
2069         cp = p = xstrdup(fwdspec);
2070
2071         /* skip leading spaces */
2072         while (isspace((u_char)*cp))
2073                 cp++;
2074
2075         for (i = 0; i < 4; ++i) {
2076                 if (parse_fwd_field(&cp, &fwdargs[i]) != 0)
2077                         break;
2078         }
2079
2080         /* Check for trailing garbage */
2081         if (cp != NULL && *cp != '\0') {
2082                 i = 0;  /* failure */
2083         }
2084
2085         switch (i) {
2086         case 1:
2087                 if (fwdargs[0].ispath) {
2088                         fwd->listen_path = xstrdup(fwdargs[0].arg);
2089                         fwd->listen_port = PORT_STREAMLOCAL;
2090                 } else {
2091                         fwd->listen_host = NULL;
2092                         fwd->listen_port = a2port(fwdargs[0].arg);
2093                 }
2094                 fwd->connect_host = xstrdup("socks");
2095                 break;
2096
2097         case 2:
2098                 if (fwdargs[0].ispath && fwdargs[1].ispath) {
2099                         fwd->listen_path = xstrdup(fwdargs[0].arg);
2100                         fwd->listen_port = PORT_STREAMLOCAL;
2101                         fwd->connect_path = xstrdup(fwdargs[1].arg);
2102                         fwd->connect_port = PORT_STREAMLOCAL;
2103                 } else if (fwdargs[1].ispath) {
2104                         fwd->listen_host = NULL;
2105                         fwd->listen_port = a2port(fwdargs[0].arg);
2106                         fwd->connect_path = xstrdup(fwdargs[1].arg);
2107                         fwd->connect_port = PORT_STREAMLOCAL;
2108                 } else {
2109                         fwd->listen_host = xstrdup(fwdargs[0].arg);
2110                         fwd->listen_port = a2port(fwdargs[1].arg);
2111                         fwd->connect_host = xstrdup("socks");
2112                 }
2113                 break;
2114
2115         case 3:
2116                 if (fwdargs[0].ispath) {
2117                         fwd->listen_path = xstrdup(fwdargs[0].arg);
2118                         fwd->listen_port = PORT_STREAMLOCAL;
2119                         fwd->connect_host = xstrdup(fwdargs[1].arg);
2120                         fwd->connect_port = a2port(fwdargs[2].arg);
2121                 } else if (fwdargs[2].ispath) {
2122                         fwd->listen_host = xstrdup(fwdargs[0].arg);
2123                         fwd->listen_port = a2port(fwdargs[1].arg);
2124                         fwd->connect_path = xstrdup(fwdargs[2].arg);
2125                         fwd->connect_port = PORT_STREAMLOCAL;
2126                 } else {
2127                         fwd->listen_host = NULL;
2128                         fwd->listen_port = a2port(fwdargs[0].arg);
2129                         fwd->connect_host = xstrdup(fwdargs[1].arg);
2130                         fwd->connect_port = a2port(fwdargs[2].arg);
2131                 }
2132                 break;
2133
2134         case 4:
2135                 fwd->listen_host = xstrdup(fwdargs[0].arg);
2136                 fwd->listen_port = a2port(fwdargs[1].arg);
2137                 fwd->connect_host = xstrdup(fwdargs[2].arg);
2138                 fwd->connect_port = a2port(fwdargs[3].arg);
2139                 break;
2140         default:
2141                 i = 0; /* failure */
2142         }
2143
2144         free(p);
2145
2146         if (dynamicfwd) {
2147                 if (!(i == 1 || i == 2))
2148                         goto fail_free;
2149         } else {
2150                 if (!(i == 3 || i == 4)) {
2151                         if (fwd->connect_path == NULL &&
2152                             fwd->listen_path == NULL)
2153                                 goto fail_free;
2154                 }
2155                 if (fwd->connect_port <= 0 && fwd->connect_path == NULL)
2156                         goto fail_free;
2157         }
2158
2159         if ((fwd->listen_port < 0 && fwd->listen_path == NULL) ||
2160             (!remotefwd && fwd->listen_port == 0))
2161                 goto fail_free;
2162         if (fwd->connect_host != NULL &&
2163             strlen(fwd->connect_host) >= NI_MAXHOST)
2164                 goto fail_free;
2165         /* XXX - if connecting to a remote socket, max sun len may not match this host */
2166         if (fwd->connect_path != NULL &&
2167             strlen(fwd->connect_path) >= PATH_MAX_SUN)
2168                 goto fail_free;
2169         if (fwd->listen_host != NULL &&
2170             strlen(fwd->listen_host) >= NI_MAXHOST)
2171                 goto fail_free;
2172         if (fwd->listen_path != NULL &&
2173             strlen(fwd->listen_path) >= PATH_MAX_SUN)
2174                 goto fail_free;
2175
2176         return (i);
2177
2178  fail_free:
2179         free(fwd->connect_host);
2180         fwd->connect_host = NULL;
2181         free(fwd->connect_path);
2182         fwd->connect_path = NULL;
2183         free(fwd->listen_host);
2184         fwd->listen_host = NULL;
2185         free(fwd->listen_path);
2186         fwd->listen_path = NULL;
2187         return (0);
2188 }
2189
2190 /* XXX the following is a near-vebatim copy from servconf.c; refactor */
2191 static const char *
2192 fmt_multistate_int(int val, const struct multistate *m)
2193 {
2194         u_int i;
2195
2196         for (i = 0; m[i].key != NULL; i++) {
2197                 if (m[i].value == val)
2198                         return m[i].key;
2199         }
2200         return "UNKNOWN";
2201 }
2202
2203 static const char *
2204 fmt_intarg(OpCodes code, int val)
2205 {
2206         if (val == -1)
2207                 return "unset";
2208         switch (code) {
2209         case oAddressFamily:
2210                 return fmt_multistate_int(val, multistate_addressfamily);
2211         case oVerifyHostKeyDNS:
2212         case oStrictHostKeyChecking:
2213         case oUpdateHostkeys:
2214                 return fmt_multistate_int(val, multistate_yesnoask);
2215         case oControlMaster:
2216                 return fmt_multistate_int(val, multistate_controlmaster);
2217         case oTunnel:
2218                 return fmt_multistate_int(val, multistate_tunnel);
2219         case oRequestTTY:
2220                 return fmt_multistate_int(val, multistate_requesttty);
2221         case oCanonicalizeHostname:
2222                 return fmt_multistate_int(val, multistate_canonicalizehostname);
2223         case oFingerprintHash:
2224                 return ssh_digest_alg_name(val);
2225         case oProtocol:
2226                 switch (val) {
2227                 case SSH_PROTO_1:
2228                         return "1";
2229                 case SSH_PROTO_2:
2230                         return "2";
2231                 case (SSH_PROTO_1|SSH_PROTO_2):
2232                         return "2,1";
2233                 default:
2234                         return "UNKNOWN";
2235                 }
2236         default:
2237                 switch (val) {
2238                 case 0:
2239                         return "no";
2240                 case 1:
2241                         return "yes";
2242                 default:
2243                         return "UNKNOWN";
2244                 }
2245         }
2246 }
2247
2248 static const char *
2249 lookup_opcode_name(OpCodes code)
2250 {
2251         u_int i;
2252
2253         for (i = 0; keywords[i].name != NULL; i++)
2254                 if (keywords[i].opcode == code)
2255                         return(keywords[i].name);
2256         return "UNKNOWN";
2257 }
2258
2259 static void
2260 dump_cfg_int(OpCodes code, int val)
2261 {
2262         printf("%s %d\n", lookup_opcode_name(code), val);
2263 }
2264
2265 static void
2266 dump_cfg_fmtint(OpCodes code, int val)
2267 {
2268         printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
2269 }
2270
2271 static void
2272 dump_cfg_string(OpCodes code, const char *val)
2273 {
2274         if (val == NULL)
2275                 return;
2276         printf("%s %s\n", lookup_opcode_name(code), val);
2277 }
2278
2279 static void
2280 dump_cfg_strarray(OpCodes code, u_int count, char **vals)
2281 {
2282         u_int i;
2283
2284         for (i = 0; i < count; i++)
2285                 printf("%s %s\n", lookup_opcode_name(code), vals[i]);
2286 }
2287
2288 static void
2289 dump_cfg_strarray_oneline(OpCodes code, u_int count, char **vals)
2290 {
2291         u_int i;
2292
2293         printf("%s", lookup_opcode_name(code));
2294         for (i = 0; i < count; i++)
2295                 printf(" %s",  vals[i]);
2296         printf("\n");
2297 }
2298
2299 static void
2300 dump_cfg_forwards(OpCodes code, u_int count, const struct Forward *fwds)
2301 {
2302         const struct Forward *fwd;
2303         u_int i;
2304
2305         /* oDynamicForward */
2306         for (i = 0; i < count; i++) {
2307                 fwd = &fwds[i];
2308                 if (code == oDynamicForward &&
2309                     strcmp(fwd->connect_host, "socks") != 0)
2310                         continue;
2311                 if (code == oLocalForward &&
2312                     strcmp(fwd->connect_host, "socks") == 0)
2313                         continue;
2314                 printf("%s", lookup_opcode_name(code));
2315                 if (fwd->listen_port == PORT_STREAMLOCAL)
2316                         printf(" %s", fwd->listen_path);
2317                 else if (fwd->listen_host == NULL)
2318                         printf(" %d", fwd->listen_port);
2319                 else {
2320                         printf(" [%s]:%d",
2321                             fwd->listen_host, fwd->listen_port);
2322                 }
2323                 if (code != oDynamicForward) {
2324                         if (fwd->connect_port == PORT_STREAMLOCAL)
2325                                 printf(" %s", fwd->connect_path);
2326                         else if (fwd->connect_host == NULL)
2327                                 printf(" %d", fwd->connect_port);
2328                         else {
2329                                 printf(" [%s]:%d",
2330                                     fwd->connect_host, fwd->connect_port);
2331                         }
2332                 }
2333                 printf("\n");
2334         }
2335 }
2336
2337 void
2338 dump_client_config(Options *o, const char *host)
2339 {
2340         int i;
2341         char vbuf[5];
2342
2343         /* This is normally prepared in ssh_kex2 */
2344         if (kex_assemble_names(KEX_DEFAULT_PK_ALG, &o->hostkeyalgorithms) != 0)
2345                 fatal("%s: kex_assemble_names failed", __func__);
2346
2347         /* Most interesting options first: user, host, port */
2348         dump_cfg_string(oUser, o->user);
2349         dump_cfg_string(oHostName, host);
2350         dump_cfg_int(oPort, o->port);
2351
2352         /* Flag options */
2353         dump_cfg_fmtint(oAddressFamily, o->address_family);
2354         dump_cfg_fmtint(oBatchMode, o->batch_mode);
2355         dump_cfg_fmtint(oCanonicalizeFallbackLocal, o->canonicalize_fallback_local);
2356         dump_cfg_fmtint(oCanonicalizeHostname, o->canonicalize_hostname);
2357         dump_cfg_fmtint(oChallengeResponseAuthentication, o->challenge_response_authentication);
2358         dump_cfg_fmtint(oCheckHostIP, o->check_host_ip);
2359         dump_cfg_fmtint(oCompression, o->compression);
2360         dump_cfg_fmtint(oControlMaster, o->control_master);
2361         dump_cfg_fmtint(oEnableSSHKeysign, o->enable_ssh_keysign);
2362         dump_cfg_fmtint(oExitOnForwardFailure, o->exit_on_forward_failure);
2363         dump_cfg_fmtint(oFingerprintHash, o->fingerprint_hash);
2364         dump_cfg_fmtint(oForwardAgent, o->forward_agent);
2365         dump_cfg_fmtint(oForwardX11, o->forward_x11);
2366         dump_cfg_fmtint(oForwardX11Trusted, o->forward_x11_trusted);
2367         dump_cfg_fmtint(oGatewayPorts, o->fwd_opts.gateway_ports);
2368 #ifdef GSSAPI
2369         dump_cfg_fmtint(oGssAuthentication, o->gss_authentication);
2370         dump_cfg_fmtint(oGssDelegateCreds, o->gss_deleg_creds);
2371 #endif /* GSSAPI */
2372         dump_cfg_fmtint(oHashKnownHosts, o->hash_known_hosts);
2373         dump_cfg_fmtint(oHostbasedAuthentication, o->hostbased_authentication);
2374         dump_cfg_fmtint(oIdentitiesOnly, o->identities_only);
2375         dump_cfg_fmtint(oKbdInteractiveAuthentication, o->kbd_interactive_authentication);
2376         dump_cfg_fmtint(oNoHostAuthenticationForLocalhost, o->no_host_authentication_for_localhost);
2377         dump_cfg_fmtint(oPasswordAuthentication, o->password_authentication);
2378         dump_cfg_fmtint(oPermitLocalCommand, o->permit_local_command);
2379         dump_cfg_fmtint(oProtocol, o->protocol);
2380         dump_cfg_fmtint(oProxyUseFdpass, o->proxy_use_fdpass);
2381         dump_cfg_fmtint(oPubkeyAuthentication, o->pubkey_authentication);
2382         dump_cfg_fmtint(oRequestTTY, o->request_tty);
2383         dump_cfg_fmtint(oRhostsRSAAuthentication, o->rhosts_rsa_authentication);
2384         dump_cfg_fmtint(oRSAAuthentication, o->rsa_authentication);
2385         dump_cfg_fmtint(oStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink);
2386         dump_cfg_fmtint(oStrictHostKeyChecking, o->strict_host_key_checking);
2387         dump_cfg_fmtint(oTCPKeepAlive, o->tcp_keep_alive);
2388         dump_cfg_fmtint(oTunnel, o->tun_open);
2389         dump_cfg_fmtint(oUsePrivilegedPort, o->use_privileged_port);
2390         dump_cfg_fmtint(oVerifyHostKeyDNS, o->verify_host_key_dns);
2391         dump_cfg_fmtint(oVisualHostKey, o->visual_host_key);
2392         dump_cfg_fmtint(oUpdateHostkeys, o->update_hostkeys);
2393
2394         /* Integer options */
2395         dump_cfg_int(oCanonicalizeMaxDots, o->canonicalize_max_dots);
2396         dump_cfg_int(oCompressionLevel, o->compression_level);
2397         dump_cfg_int(oConnectionAttempts, o->connection_attempts);
2398         dump_cfg_int(oForwardX11Timeout, o->forward_x11_timeout);
2399         dump_cfg_int(oNumberOfPasswordPrompts, o->number_of_password_prompts);
2400         dump_cfg_int(oServerAliveCountMax, o->server_alive_count_max);
2401         dump_cfg_int(oServerAliveInterval, o->server_alive_interval);
2402
2403         /* String options */
2404         dump_cfg_string(oBindAddress, o->bind_address);
2405         dump_cfg_string(oCiphers, o->ciphers ? o->ciphers : KEX_CLIENT_ENCRYPT);
2406         dump_cfg_string(oControlPath, o->control_path);
2407         dump_cfg_string(oHostKeyAlgorithms, o->hostkeyalgorithms);
2408         dump_cfg_string(oHostKeyAlias, o->host_key_alias);
2409         dump_cfg_string(oHostbasedKeyTypes, o->hostbased_key_types);
2410         dump_cfg_string(oKbdInteractiveDevices, o->kbd_interactive_devices);
2411         dump_cfg_string(oKexAlgorithms, o->kex_algorithms ? o->kex_algorithms : KEX_CLIENT_KEX);
2412         dump_cfg_string(oLocalCommand, o->local_command);
2413         dump_cfg_string(oLogLevel, log_level_name(o->log_level));
2414         dump_cfg_string(oMacs, o->macs ? o->macs : KEX_CLIENT_MAC);
2415         dump_cfg_string(oPKCS11Provider, o->pkcs11_provider);
2416         dump_cfg_string(oPreferredAuthentications, o->preferred_authentications);
2417         dump_cfg_string(oProxyCommand, o->proxy_command);
2418         dump_cfg_string(oPubkeyAcceptedKeyTypes, o->pubkey_key_types);
2419         dump_cfg_string(oRevokedHostKeys, o->revoked_host_keys);
2420         dump_cfg_string(oXAuthLocation, o->xauth_location);
2421
2422         /* Forwards */
2423         dump_cfg_forwards(oDynamicForward, o->num_local_forwards, o->local_forwards);
2424         dump_cfg_forwards(oLocalForward, o->num_local_forwards, o->local_forwards);
2425         dump_cfg_forwards(oRemoteForward, o->num_remote_forwards, o->remote_forwards);
2426
2427         /* String array options */
2428         dump_cfg_strarray(oIdentityFile, o->num_identity_files, o->identity_files);
2429         dump_cfg_strarray_oneline(oCanonicalDomains, o->num_canonical_domains, o->canonical_domains);
2430         dump_cfg_strarray_oneline(oGlobalKnownHostsFile, o->num_system_hostfiles, o->system_hostfiles);
2431         dump_cfg_strarray_oneline(oUserKnownHostsFile, o->num_user_hostfiles, o->user_hostfiles);
2432         dump_cfg_strarray(oSendEnv, o->num_send_env, o->send_env);
2433
2434         /* Special cases */
2435
2436         /* oConnectTimeout */
2437         if (o->connection_timeout == -1)
2438                 printf("connecttimeout none\n");
2439         else
2440                 dump_cfg_int(oConnectTimeout, o->connection_timeout);
2441
2442         /* oTunnelDevice */
2443         printf("tunneldevice");
2444         if (o->tun_local == SSH_TUNID_ANY)
2445                 printf(" any");
2446         else
2447                 printf(" %d", o->tun_local);
2448         if (o->tun_remote == SSH_TUNID_ANY)
2449                 printf(":any");
2450         else
2451                 printf(":%d", o->tun_remote);
2452         printf("\n");
2453
2454         /* oCanonicalizePermittedCNAMEs */
2455         if ( o->num_permitted_cnames > 0) {
2456                 printf("canonicalizePermittedcnames");
2457                 for (i = 0; i < o->num_permitted_cnames; i++) {
2458                         printf(" %s:%s", o->permitted_cnames[i].source_list,
2459                             o->permitted_cnames[i].target_list);
2460                 }
2461                 printf("\n");
2462         }
2463
2464         /* oCipher */
2465         if (o->cipher != SSH_CIPHER_NOT_SET)
2466                 printf("Cipher %s\n", cipher_name(o->cipher));
2467
2468         /* oControlPersist */
2469         if (o->control_persist == 0 || o->control_persist_timeout == 0)
2470                 dump_cfg_fmtint(oControlPersist, o->control_persist);
2471         else
2472                 dump_cfg_int(oControlPersist, o->control_persist_timeout);
2473
2474         /* oEscapeChar */
2475         if (o->escape_char == SSH_ESCAPECHAR_NONE)
2476                 printf("escapechar none\n");
2477         else {
2478                 vis(vbuf, o->escape_char, VIS_WHITE, 0);
2479                 printf("escapechar %s\n", vbuf);
2480         }
2481
2482         /* oIPQoS */
2483         printf("ipqos %s ", iptos2str(o->ip_qos_interactive));
2484         printf("%s\n", iptos2str(o->ip_qos_bulk));
2485
2486         /* oRekeyLimit */
2487         printf("rekeylimit %llu %d\n",
2488             (unsigned long long)o->rekey_limit, o->rekey_interval);
2489
2490         /* oStreamLocalBindMask */
2491         printf("streamlocalbindmask 0%o\n",
2492             o->fwd_opts.streamlocal_bind_mask);
2493 }