merge 6.3p1

1 files changed, 68 insertions, 9 deletions

diff --git a/servconf.c b/servconf.c
index cdc029308..c938ae399 100644
--- a/servconf.c
+++ b/servconf.c
@@ -1,5 +1,5 @@
 
-/* $OpenBSD: servconf.c,v 1.234 2013/02/06 00:20:42 dtucker Exp $ */
+/* $OpenBSD: servconf.c,v 1.240 2013/07/19 07:37:48 markus Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -20,6 +20,7 @@
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
 
+#include <ctype.h>
 #include <netdb.h>
 #include <pwd.h>
 #include <stdio.h>
@@ -29,6 +30,9 @@
 #include <unistd.h>
 #include <stdarg.h>
 #include <errno.h>
+#ifdef HAVE_UTIL_H
+#include <util.h>
+#endif
 
 #include "openbsd-compat/sys-queue.h"
 #include "xmalloc.h"
@@ -75,6 +79,7 @@ initialize_server_options(ServerOptions *options)
         options->address_family = -1;
         options->num_host_key_files = 0;
         options->num_host_cert_files = 0;
+        options->host_key_agent = NULL;
         options->pid_file = NULL;
         options->server_key_bits = -1;
         options->login_grace_time = -1;
@@ -113,6 +118,8 @@ initialize_server_options(ServerOptions *options)
         options->permit_user_env = -1;
         options->use_login = -1;
         options->compression = -1;
+        options->rekey_limit = -1;
+        options->rekey_interval = -1;
         options->allow_tcp_forwarding = -1;
         options->allow_agent_forwarding = -1;
         options->num_allow_users = 0;
@@ -258,6 +265,10 @@ fill_default_server_options(ServerOptions *options)
                 options->use_login = 0;
         if (options->compression == -1)
                 options->compression = COMP_DELAYED;
+        if (options->rekey_limit == -1)
+                options->rekey_limit = 0;
+        if (options->rekey_interval == -1)
+                options->rekey_interval = 0;
         if (options->allow_tcp_forwarding == -1)
                 options->allow_tcp_forwarding = FORWARD_ALLOW;
         if (options->allow_agent_forwarding == -1)
@@ -329,7 +340,7 @@ typedef enum {
         sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
         sStrictModes, sEmptyPasswd, sTCPKeepAlive,
         sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
-        sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
+        sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
         sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
         sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
         sMaxStartups, sMaxAuthTries, sMaxSessions,
@@ -345,7 +356,7 @@ typedef enum {
         sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
         sKexAlgorithms, sIPQoS, sVersionAddendum,
         sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
-        sAuthenticationMethods,
+        sAuthenticationMethods, sHostKeyAgent,
         sDeprecated, sUnsupported
 } ServerOpCodes;
 
@@ -370,6 +381,7 @@ static struct {
         { "port", sPort, SSHCFG_GLOBAL },
         { "hostkey", sHostKeyFile, SSHCFG_GLOBAL },
         { "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL },          /* alias */
+        { "hostkeyagent", sHostKeyAgent, SSHCFG_GLOBAL },
         { "pidfile", sPidFile, SSHCFG_GLOBAL },
         { "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL },
         { "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL },
@@ -443,6 +455,7 @@ static struct {
         { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
         { "uselogin", sUseLogin, SSHCFG_GLOBAL },
         { "compression", sCompression, SSHCFG_GLOBAL },
+        { "rekeylimit", sRekeyLimit, SSHCFG_ALL },
         { "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL },
         { "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL },  /* obsolete alias */
         { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL },
@@ -530,7 +543,7 @@ derelativise_path(const char *path)
         if (getcwd(cwd, sizeof(cwd)) == NULL)
                 fatal("%s: getcwd: %s", __func__, strerror(errno));
         xasprintf(&ret, "%s/%s", cwd, expanded);
-        xfree(expanded);
+        free(expanded);
         return ret;
 }
 
@@ -822,13 +835,13 @@ process_server_config_line(ServerOptions *options, char *line,
     struct connection_info *connectinfo)
 {
         char *cp, **charptr, *arg, *p;
-        int cmdline = 0, *intptr, value, value2, n;
+        int cmdline = 0, *intptr, value, value2, n, port;
         SyslogFacility *log_facility_ptr;
         LogLevel *log_level_ptr;
         ServerOpCodes opcode;
-        int port;
         u_int i, flags = 0;
         size_t len;
+        long long val64;
         const struct multistate *multistate_ptr;
 
         cp = line;
@@ -988,6 +1001,17 @@ process_server_config_line(ServerOptions *options, char *line,
                 }
                 break;
 
+        case sHostKeyAgent:
+                charptr = &options->host_key_agent;
+                arg = strdelim(&cp);
+                if (!arg || *arg == '\0')
+                        fatal("%s line %d: missing socket name.",
+                            filename, linenum);
+                if (*activep && *charptr == NULL)
+                        *charptr = !strcmp(arg, SSH_AUTHSOCKET_ENV_NAME) ?
+                            xstrdup(arg) : derelativise_path(arg);
+                break;
+
         case sHostCertificate:
                 intptr = &options->num_host_cert_files;
                 if (*intptr >= MAX_HOSTKEYS)
@@ -1151,6 +1175,37 @@ process_server_config_line(ServerOptions *options, char *line,
                 multistate_ptr = multistate_compression;
                 goto parse_multistate;
 
+        case sRekeyLimit:
+                arg = strdelim(&cp);
+                if (!arg || *arg == '\0')
+                        fatal("%.200s line %d: Missing argument.", filename,
+                            linenum);
+                if (strcmp(arg, "default") == 0) {
+                        val64 = 0;
+                } else {
+                        if (scan_scaled(arg, &val64) == -1)
+                                fatal("%.200s line %d: Bad number '%s': %s",
+                                    filename, linenum, arg, strerror(errno));
+                        /* check for too-large or too-small limits */
+                        if (val64 > UINT_MAX)
+                                fatal("%.200s line %d: RekeyLimit too large",
+                                    filename, linenum);
+                        if (val64 != 0 && val64 < 16)
+                                fatal("%.200s line %d: RekeyLimit too small",
+                                    filename, linenum);
+                }
+                if (*activep && options->rekey_limit == -1)
+                        options->rekey_limit = (u_int32_t)val64;
+                if (cp != NULL) { /* optional rekey interval present */
+                        if (strcmp(cp, "none") == 0) {
+                                (void)strdelim(&cp);    /* discard */
+                                break;
+                        }
+                        intptr = &options->rekey_interval;
+                        goto parse_time;
+                }
+                break;
+
         case sGatewayPorts:
                 intptr = &options->gateway_ports;
                 multistate_ptr = multistate_gatewayports;
@@ -1704,8 +1759,7 @@ int server_match_spec_complete(struct connection_info *ci)
 } while (0)
 #define M_CP_STROPT(n) do {\
         if (src->n != NULL) { \
-                if (dst->n != NULL) \
-                        xfree(dst->n); \
+                free(dst->n); \
                 dst->n = src->n; \
         } \
 } while(0)
@@ -1751,6 +1805,8 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
         M_CP_INTOPT(max_authtries);
         M_CP_INTOPT(ip_qos_interactive);
         M_CP_INTOPT(ip_qos_bulk);
+        M_CP_INTOPT(rekey_limit);
+        M_CP_INTOPT(rekey_interval);
 
         /* See comment in servconf.h */
         COPY_MATCH_STRING_OPTS();
@@ -1787,7 +1843,7 @@ parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
                     linenum++, &active, connectinfo) != 0)
                         bad_options++;
         }
-        xfree(obuf);
+        free(obuf);
         if (bad_options > 0)
                 fatal("%s: terminating, %d bad configuration options",
                     filename, bad_options);
@@ -2004,6 +2060,7 @@ dump_config(ServerOptions *o)
         dump_cfg_string(sVersionAddendum, o->version_addendum);
         dump_cfg_string(sAuthorizedKeysCommand, o->authorized_keys_command);
         dump_cfg_string(sAuthorizedKeysCommandUser, o->authorized_keys_command_user);
+        dump_cfg_string(sHostKeyAgent, o->host_key_agent);
 
         /* string arguments requiring a lookup */
         dump_cfg_string(sLogLevel, log_level_name(o->log_level));
@@ -2042,5 +2099,7 @@ dump_config(ServerOptions *o)
         printf("ipqos %s ", iptos2str(o->ip_qos_interactive));
         printf("%s\n", iptos2str(o->ip_qos_bulk));
 
+        printf("rekeylimit %lld %d\n", o->rekey_limit, o->rekey_interval);
+
         channel_print_adm_permitted_opens();
 }