* New upstream release (http://www.openssh.com/txt/release-5.6):

  - Added a ControlPersist option to ssh_config(5) that automatically
    starts a background ssh(1) multiplex master when connecting.  This
    connection can stay alive indefinitely, or can be set to automatically
    close after a user-specified duration of inactivity (closes: #335697,
    #350898, #454787, #500573, #550262).
  - Support AuthorizedKeysFile, AuthorizedPrincipalsFile,
    HostbasedUsesNameFromPacketOnly, and PermitTunnel in sshd_config(5)
    Match blocks (closes: #549858).
  - sftp(1): fix ls in working directories that contain globbing
    characters in their pathnames (LP: #530714).

1 files changed, 62 insertions, 9 deletions

diff --git a/readconf.c b/readconf.c
index 2a5a706ab..0e83f5809 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.183 2010/02/08 10:50:20 markus Exp $ */
+/* $OpenBSD: readconf.c,v 1.187 2010/07/19 09:15:12 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -112,8 +112,8 @@
 
 typedef enum {
         oBadOption,
-        oForwardAgent, oForwardX11, oForwardX11Trusted, oGatewayPorts,
-        oExitOnForwardFailure,
+        oForwardAgent, oForwardX11, oForwardX11Trusted, oForwardX11Timeout,
+        oGatewayPorts, oExitOnForwardFailure,
         oPasswordAuthentication, oRSAAuthentication,
         oChallengeResponseAuthentication, oXAuthLocation,
         oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
@@ -132,7 +132,8 @@ typedef enum {
         oAddressFamily, oGssAuthentication, oGssDelegateCreds,
         oGssTrustDns, oGssKeyEx, oGssClientIdentity, oGssRenewalRekey,
         oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
-        oSendEnv, oControlPath, oControlMaster, oHashKnownHosts,
+        oSendEnv, oControlPath, oControlMaster, oControlPersist,
+        oHashKnownHosts,
         oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
         oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication,
         oProtocolKeepAlives, oSetupTimeOut,
@@ -148,6 +149,7 @@ static struct {
         { "forwardagent", oForwardAgent },
         { "forwardx11", oForwardX11 },
         { "forwardx11trusted", oForwardX11Trusted },
+        { "forwardx11timeout", oForwardX11Timeout },
         { "exitonforwardfailure", oExitOnForwardFailure },
         { "xauthlocation", oXAuthLocation },
         { "gatewayports", oGatewayPorts },
@@ -238,6 +240,7 @@ static struct {
         { "sendenv", oSendEnv },
         { "controlpath", oControlPath },
         { "controlmaster", oControlMaster },
+        { "controlpersist", oControlPersist },
         { "hashknownhosts", oHashKnownHosts },
         { "tunnel", oTunnel },
         { "tunneldevice", oTunnelDevice },
@@ -271,8 +274,9 @@ add_local_forward(Options *options, const Forward *newfwd)
         if (newfwd->listen_port < IPPORT_RESERVED && original_real_uid != 0)
                 fatal("Privileged ports can only be forwarded by root.");
 #endif
-        if (options->num_local_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
-                fatal("Too many local forwards (max %d).", SSH_MAX_FORWARDS_PER_DIRECTION);
+        options->local_forwards = xrealloc(options->local_forwards,
+            options->num_local_forwards + 1,
+            sizeof(*options->local_forwards));
         fwd = &options->local_forwards[options->num_local_forwards++];
 
         fwd->listen_host = newfwd->listen_host;
@@ -290,15 +294,17 @@ void
 add_remote_forward(Options *options, const Forward *newfwd)
 {
         Forward *fwd;
-        if (options->num_remote_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
-                fatal("Too many remote forwards (max %d).",
-                    SSH_MAX_FORWARDS_PER_DIRECTION);
+
+        options->remote_forwards = xrealloc(options->remote_forwards,
+            options->num_remote_forwards + 1,
+            sizeof(*options->remote_forwards));
         fwd = &options->remote_forwards[options->num_remote_forwards++];
 
         fwd->listen_host = newfwd->listen_host;
         fwd->listen_port = newfwd->listen_port;
         fwd->connect_host = newfwd->connect_host;
         fwd->connect_port = newfwd->connect_port;
+        fwd->allocated_port = 0;
 }
 
 static void
@@ -311,12 +317,20 @@ clear_forwardings(Options *options)
                         xfree(options->local_forwards[i].listen_host);
                 xfree(options->local_forwards[i].connect_host);
         }
+        if (options->num_local_forwards > 0) {
+                xfree(options->local_forwards);
+                options->local_forwards = NULL;
+        }
         options->num_local_forwards = 0;
         for (i = 0; i < options->num_remote_forwards; i++) {
                 if (options->remote_forwards[i].listen_host != NULL)
                         xfree(options->remote_forwards[i].listen_host);
                 xfree(options->remote_forwards[i].connect_host);
         }
+        if (options->num_remote_forwards > 0) {
+                xfree(options->remote_forwards);
+                options->remote_forwards = NULL;
+        }
         options->num_remote_forwards = 0;
         options->tun_open = SSH_TUNMODE_NO;
 }
@@ -419,6 +433,10 @@ parse_flag:
         case oForwardX11Trusted:
                 intptr = &options->forward_x11_trusted;
                 goto parse_flag;
+        
+        case oForwardX11Timeout:
+                intptr = &options->forward_x11_timeout;
+                goto parse_time;
 
         case oGatewayPorts:
                 intptr = &options->gateway_ports;
@@ -904,6 +922,30 @@ parse_int:
                         *intptr = value;
                 break;
 
+        case oControlPersist:
+                /* no/false/yes/true, or a time spec */
+                intptr = &options->control_persist;
+                arg = strdelim(&s);
+                if (!arg || *arg == '\0')
+                        fatal("%.200s line %d: Missing ControlPersist"
+                            " argument.", filename, linenum);
+                value = 0;
+                value2 = 0;     /* timeout */
+                if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
+                        value = 0;
+                else if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
+                        value = 1;
+                else if ((value2 = convtime(arg)) >= 0)
+                        value = 1;
+                else
+                        fatal("%.200s line %d: Bad ControlPersist argument.",
+                            filename, linenum);
+                if (*activep && *intptr == -1) {
+                        *intptr = value;
+                        options->control_persist_timeout = value2;
+                }
+                break;
+
         case oHashKnownHosts:
                 intptr = &options->hash_known_hosts;
                 goto parse_flag;
@@ -1044,6 +1086,7 @@ initialize_options(Options * options)
         options->forward_agent = -1;
         options->forward_x11 = -1;
         options->forward_x11_trusted = -1;
+        options->forward_x11_timeout = -1;
         options->exit_on_forward_failure = -1;
         options->xauth_location = NULL;
         options->gateway_ports = -1;
@@ -1089,7 +1132,9 @@ initialize_options(Options * options)
         options->user_hostfile = NULL;
         options->system_hostfile2 = NULL;
         options->user_hostfile2 = NULL;
+        options->local_forwards = NULL;
         options->num_local_forwards = 0;
+        options->remote_forwards = NULL;
         options->num_remote_forwards = 0;
         options->clear_forwardings = -1;
         options->log_level = SYSLOG_LEVEL_NOT_SET;
@@ -1106,6 +1151,8 @@ initialize_options(Options * options)
         options->num_send_env = 0;
         options->control_path = NULL;
         options->control_master = -1;
+        options->control_persist = -1;
+        options->control_persist_timeout = 0;
         options->hash_known_hosts = -1;
         options->tun_open = -1;
         options->tun_local = -1;
@@ -1133,6 +1180,8 @@ fill_default_options(Options * options)
                 options->forward_x11 = 0;
         if (options->forward_x11_trusted == -1)
                 options->forward_x11_trusted = 1;
+        if (options->forward_x11_timeout == -1)
+                options->forward_x11_timeout = 1200;
         if (options->exit_on_forward_failure == -1)
                 options->exit_on_forward_failure = 0;
         if (options->xauth_location == NULL)
@@ -1252,6 +1301,10 @@ fill_default_options(Options * options)
                 options->server_alive_count_max = 3;
         if (options->control_master == -1)
                 options->control_master = 0;
+        if (options->control_persist == -1) {
+                options->control_persist = 0;
+                options->control_persist_timeout = 0;
+        }
         if (options->hash_known_hosts == -1)
                 options->hash_known_hosts = 0;
         if (options->tun_open == -1)