1 files changed, 116 insertions, 66 deletions

diff --git a/readconf.c b/readconf.c
index 899ff3f0e..0a1788ba0 100644
--- a/readconf.c
+++ b/readconf.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: readconf.c,v 1.104 2003/04/01 10:22:21 markus Exp $");
+RCSID("$OpenBSD: readconf.c,v 1.121 2003/09/01 18:15:50 markus Exp $");
 
 #include "ssh.h"
 #include "xmalloc.h"
@@ -57,7 +57,6 @@ RCSID("$OpenBSD: readconf.c,v 1.104 2003/04/01 10:22:21 markus Exp $");
    Host fascist.blob.com
      Port 23123
      User tylonen
-     RhostsAuthentication no
      PasswordAuthentication no
 
    Host puukko.hut.fi
@@ -75,7 +74,6 @@ RCSID("$OpenBSD: readconf.c,v 1.104 2003/04/01 10:22:21 markus Exp $");
    Host *
      ForwardAgent no
      ForwardX11 no
-     RhostsAuthentication yes
      PasswordAuthentication yes
      RSAAuthentication yes
      RhostsRSAAuthentication yes
@@ -93,18 +91,9 @@ RCSID("$OpenBSD: readconf.c,v 1.104 2003/04/01 10:22:21 markus Exp $");
 
 typedef enum {
         oBadOption,
-        oForwardAgent, oForwardX11, oGatewayPorts, oRhostsAuthentication,
+        oForwardAgent, oForwardX11, oGatewayPorts,
         oPasswordAuthentication, oRSAAuthentication,
         oChallengeResponseAuthentication, oXAuthLocation,
-#if defined(KRB4) || defined(KRB5)
-        oKerberosAuthentication,
-#endif
-#if defined(AFS) || defined(KRB5)
-        oKerberosTgtPassing,
-#endif
-#ifdef AFS
-        oAFSTokenPassing,
-#endif
         oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
         oUser, oHost, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
         oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
@@ -116,9 +105,10 @@ typedef enum {
         oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
         oHostKeyAlgorithms, oBindAddress, oSmartcardDevice,
         oClearAllForwardings, oNoHostAuthenticationForLocalhost,
-        oEnableSSHKeysign,
+        oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
+        oAddressFamily, oGssAuthentication, oGssDelegateCreds,
         oProtocolKeepAlives, oSetupTimeOut,
-        oDeprecated
+        oDeprecated, oUnsupported
 } OpCodes;
 
 /* Textual representations of the tokens. */
@@ -132,7 +122,7 @@ static struct {
         { "xauthlocation", oXAuthLocation },
         { "gatewayports", oGatewayPorts },
         { "useprivilegedport", oUsePrivilegedPort },
-        { "rhostsauthentication", oRhostsAuthentication },
+        { "rhostsauthentication", oDeprecated },
         { "passwordauthentication", oPasswordAuthentication },
         { "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
         { "kbdinteractivedevices", oKbdInteractiveDevices },
@@ -144,14 +134,15 @@ static struct {
         { "challengeresponseauthentication", oChallengeResponseAuthentication },
         { "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
         { "tisauthentication", oChallengeResponseAuthentication },  /* alias */
-#if defined(KRB4) || defined(KRB5)
-        { "kerberosauthentication", oKerberosAuthentication },
-#endif
-#if defined(AFS) || defined(KRB5)
-        { "kerberostgtpassing", oKerberosTgtPassing },
-#endif
-#ifdef AFS
-        { "afstokenpassing", oAFSTokenPassing },
+        { "kerberosauthentication", oUnsupported },
+        { "kerberostgtpassing", oUnsupported },
+        { "afstokenpassing", oUnsupported },
+#if defined(GSSAPI)
+        { "gssapiauthentication", oGssAuthentication },
+        { "gssapidelegatecredentials", oGssDelegateCreds },
+#else
+        { "gssapiauthentication", oUnsupported },
+        { "gssapidelegatecredentials", oUnsupported },
 #endif
         { "fallbacktorsh", oDeprecated },
         { "usersh", oDeprecated },
@@ -187,10 +178,22 @@ static struct {
         { "preferredauthentications", oPreferredAuthentications },
         { "hostkeyalgorithms", oHostKeyAlgorithms },
         { "bindaddress", oBindAddress },
+#ifdef SMARTCARD
         { "smartcarddevice", oSmartcardDevice },
+#else
+        { "smartcarddevice", oUnsupported },
+#endif
         { "clearallforwardings", oClearAllForwardings },
         { "enablesshkeysign", oEnableSSHKeysign },
+#ifdef DNS
+        { "verifyhostkeydns", oVerifyHostKeyDNS },
+#else
+        { "verifyhostkeydns", oUnsupported },
+#endif
         { "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost },
+        { "rekeylimit", oRekeyLimit },
+        { "connecttimeout", oConnectTimeout },
+        { "addressfamily", oAddressFamily },
         { "protocolkeepalives", oProtocolKeepAlives },
         { "setuptimeout", oSetupTimeOut },
         { NULL, oBadOption }
@@ -309,6 +312,20 @@ process_config_line(Options *options, const char *host,
                 /* don't panic, but count bad options */
                 return -1;
                 /* NOTREACHED */
+        case oConnectTimeout:
+                intptr = &options->connection_timeout;
+/* parse_time: */
+                arg = strdelim(&s);
+                if (!arg || *arg == '\0')
+                        fatal("%s line %d: missing time value.",
+                            filename, linenum);
+                if ((value = convtime(arg)) == -1)
+                        fatal("%s line %d: invalid time value.",
+                            filename, linenum);
+                if (*intptr == -1)
+                        *intptr = value;
+                break;
+
         case oForwardAgent:
                 intptr = &options->forward_agent;
 parse_flag:
@@ -338,10 +355,6 @@ parse_flag:
                 intptr = &options->use_privileged_port;
                 goto parse_flag;
 
-        case oRhostsAuthentication:
-                intptr = &options->rhosts_authentication;
-                goto parse_flag;
-
         case oPasswordAuthentication:
                 intptr = &options->password_authentication;
                 goto parse_flag;
@@ -373,21 +386,15 @@ parse_flag:
         case oChallengeResponseAuthentication:
                 intptr = &options->challenge_response_authentication;
                 goto parse_flag;
-#if defined(KRB4) || defined(KRB5)
-        case oKerberosAuthentication:
-                intptr = &options->kerberos_authentication;
-                goto parse_flag;
-#endif
-#if defined(AFS) || defined(KRB5)
-        case oKerberosTgtPassing:
-                intptr = &options->kerberos_tgt_passing;
+
+        case oGssAuthentication:
+                intptr = &options->gss_authentication;
                 goto parse_flag;
-#endif
-#ifdef AFS
-        case oAFSTokenPassing:
-                intptr = &options->afs_token_passing;
+
+        case oGssDelegateCreds:
+                intptr = &options->gss_deleg_creds;
                 goto parse_flag;
-#endif
+
         case oBatchMode:
                 intptr = &options->batch_mode;
                 goto parse_flag;
@@ -396,6 +403,10 @@ parse_flag:
                 intptr = &options->check_host_ip;
                 goto parse_flag;
 
+        case oVerifyHostKeyDNS:
+                intptr = &options->verify_host_key_dns;
+                goto parse_flag;
+
         case oStrictHostKeyChecking:
                 intptr = &options->strict_host_key_checking;
                 arg = strdelim(&s);
@@ -443,6 +454,31 @@ parse_flag:
                 intptr = &options->compression_level;
                 goto parse_int;
 
+        case oRekeyLimit:
+                intptr = &options->rekey_limit;
+                arg = strdelim(&s);
+                if (!arg || *arg == '\0')
+                        fatal("%.200s line %d: Missing argument.", filename, linenum);
+                if (arg[0] < '0' || arg[0] > '9')
+                        fatal("%.200s line %d: Bad number.", filename, linenum);
+                value = strtol(arg, &endofnumber, 10);
+                if (arg == endofnumber)
+                        fatal("%.200s line %d: Bad number.", filename, linenum);
+                switch (toupper(*endofnumber)) {
+                case 'K':
+                        value *= 1<<10;
+                        break;
+                case 'M':
+                        value *= 1<<20;
+                        break;
+                case 'G':
+                        value *= 1<<30;
+                        break;
+                }
+                if (*activep && *intptr == -1)
+                        *intptr = value;
+                break;
+
         case oIdentityFile:
                 arg = strdelim(&s);
                 if (!arg || *arg == '\0')
@@ -509,6 +545,8 @@ parse_string:
                 goto parse_string;
 
         case oProxyCommand:
+                if (s == NULL)
+                        fatal("%.200s line %d: Missing argument.", filename, linenum);
                 charptr = &options->proxy_command;
                 len = strspn(s, WHITESPACE "=");
                 if (*activep && *charptr == NULL)
@@ -646,7 +684,7 @@ parse_int:
                         fatal("%.200s line %d: Badly formatted port number.",
                             filename, linenum);
                 if (*activep)
-                        add_local_forward(options, fwd_port, "socks4", 0);
+                        add_local_forward(options, fwd_port, "socks", 0);
                 break;
 
         case oClearAllForwardings:
@@ -686,6 +724,21 @@ parse_int:
                         *intptr = value;
                 break;
 
+        case oAddressFamily:
+                arg = strdelim(&s);
+                intptr = &options->address_family;
+                if (strcasecmp(arg, "inet") == 0)
+                        value = AF_INET;
+                else if (strcasecmp(arg, "inet6") == 0)
+                        value = AF_INET6;
+                else if (strcasecmp(arg, "any") == 0)
+                        value = AF_UNSPEC;
+                else
+                        fatal("Unsupported AddressFamily \"%s\"", arg);
+                if (*activep && *intptr == -1)
+                        *intptr = value;
+                break;
+
         case oEnableSSHKeysign:
                 intptr = &options->enable_ssh_keysign;
                 goto parse_flag;
@@ -695,6 +748,11 @@ parse_int:
                     filename, linenum, keyword);
                 return 0;
 
+        case oUnsupported:
+                error("%s line %d: Unsupported option \"%s\"",
+                    filename, linenum, keyword);
+                return 0;
+
         default:
                 fatal("process_config_line: Unimplemented opcode %d", opcode);
         }
@@ -764,19 +822,11 @@ initialize_options(Options * options)
         options->xauth_location = NULL;
         options->gateway_ports = -1;
         options->use_privileged_port = -1;
-        options->rhosts_authentication = -1;
         options->rsa_authentication = -1;
         options->pubkey_authentication = -1;
         options->challenge_response_authentication = -1;
-#if defined(KRB4) || defined(KRB5)
-        options->kerberos_authentication = -1;
-#endif
-#if defined(AFS) || defined(KRB5)
-        options->kerberos_tgt_passing = -1;
-#endif
-#ifdef AFS
-        options->afs_token_passing = -1;
-#endif
+        options->gss_authentication = -1;
+        options->gss_deleg_creds = -1;
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->kbd_interactive_devices = NULL;
@@ -791,7 +841,9 @@ initialize_options(Options * options)
         options->setuptimeout = -1;
         options->compression_level = -1;
         options->port = -1;
+        options->address_family = -1;
         options->connection_attempts = -1;
+        options->connection_timeout = -1;
         options->number_of_password_prompts = -1;
         options->cipher = -1;
         options->ciphers = NULL;
@@ -817,6 +869,8 @@ initialize_options(Options * options)
         options->smartcard_device = NULL;
         options->enable_ssh_keysign = - 1;
         options->no_host_authentication_for_localhost = - 1;
+        options->rekey_limit = - 1;
+        options->verify_host_key_dns = -1;
 }
 
 /*
@@ -839,26 +893,16 @@ fill_default_options(Options * options)
                 options->gateway_ports = 0;
         if (options->use_privileged_port == -1)
                 options->use_privileged_port = 0;
-        if (options->rhosts_authentication == -1)
-                options->rhosts_authentication = 0;
         if (options->rsa_authentication == -1)
                 options->rsa_authentication = 1;
         if (options->pubkey_authentication == -1)
                 options->pubkey_authentication = 1;
         if (options->challenge_response_authentication == -1)
                 options->challenge_response_authentication = 1;
-#if defined(KRB4) || defined(KRB5)
-        if (options->kerberos_authentication == -1)
-                options->kerberos_authentication = 1;
-#endif
-#if defined(AFS) || defined(KRB5)
-        if (options->kerberos_tgt_passing == -1)
-                options->kerberos_tgt_passing = 1;
-#endif
-#ifdef AFS
-        if (options->afs_token_passing == -1)
-                options->afs_token_passing = 1;
-#endif
+        if (options->gss_authentication == -1)
+                options->gss_authentication = 1;
+        if (options->gss_deleg_creds == -1)
+                options->gss_deleg_creds = 0;
         if (options->password_authentication == -1)
                 options->password_authentication = 1;
         if (options->kbd_interactive_authentication == -1)
@@ -889,6 +933,8 @@ fill_default_options(Options * options)
                 options->compression_level = 6;
         if (options->port == -1)
                 options->port = 0;      /* Filled in ssh_connect. */
+        if (options->address_family == -1)
+                options->address_family = AF_UNSPEC;
         if (options->connection_attempts == -1)
                 options->connection_attempts = 1;
         if (options->number_of_password_prompts == -1)
@@ -941,6 +987,10 @@ fill_default_options(Options * options)
                 options->no_host_authentication_for_localhost = 0;
         if (options->enable_ssh_keysign == -1)
                 options->enable_ssh_keysign = 0;
+        if (options->rekey_limit == -1)
+                options->rekey_limit = 0;
+        if (options->verify_host_key_dns == -1)
+                options->verify_host_key_dns = 0;
         /* options->proxy_command should not be set by default */
         /* options->user will be set in the main program if appropriate */
         /* options->hostname will be set in the main program if appropriate */