1 files changed, 45 insertions, 5 deletions

diff --git a/readconf.c b/readconf.c
index cf27a9f41..d2c5a77f7 100644
--- a/readconf.c
+++ b/readconf.c
@@ -107,6 +107,7 @@ typedef enum {
         oAddressFamily, oGssAuthentication, oGssDelegateCreds,
         oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
         oSendEnv, oControlPath, oControlMaster, oHashKnownHosts,
+        oProtocolKeepAlives, oSetupTimeOut,
         oDeprecated, oUnsupported
 } OpCodes;
 
@@ -198,6 +199,8 @@ static struct {
         { "controlpath", oControlPath },
         { "controlmaster", oControlMaster },
         { "hashknownhosts", oHashKnownHosts },
+        { "protocolkeepalives", oProtocolKeepAlives },
+        { "setuptimeout", oSetupTimeOut },
         { NULL, oBadOption }
 };
 
@@ -768,6 +771,7 @@ parse_int:
                 goto parse_flag;
 
         case oServerAliveInterval:
+        case oProtocolKeepAlives: /* Debian-specific compatibility alias */
                 intptr = &options->server_alive_interval;
                 goto parse_time;
 
@@ -822,6 +826,10 @@ parse_int:
                 intptr = &options->hash_known_hosts;
                 goto parse_flag;
 
+        case oSetupTimeOut:
+                intptr = &options->setuptimeout;
+                goto parse_int;
+
         case oDeprecated:
                 debug("%s line %d: Deprecated option \"%s\"",
                     filename, linenum, keyword);
@@ -866,11 +874,30 @@ read_config_file(const char *filename, const char *host, Options *options,
 
         if (checkperm) {
                 struct stat sb;
+                int bad_modes = 0;
 
                 if (fstat(fileno(f), &sb) == -1)
                         fatal("fstat %s: %s", filename, strerror(errno));
-                if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
-                    (sb.st_mode & 022) != 0))
+                if (sb.st_uid != 0 && sb.st_uid != getuid())
+                        bad_modes = 1;
+                if ((sb.st_mode & 020) != 0) {
+                        /* If the file is group-writable, the group in
+                         * question must have at most one member, namely the
+                         * file's owner.
+                         */
+                        struct passwd *pw = getpwuid(sb.st_uid);
+                        struct group *gr = getgrgid(sb.st_gid);
+                        if (!pw || !gr)
+                                bad_modes = 1;
+                        else if (gr->gr_mem[0]) {
+                                if (strcmp(pw->pw_name, gr->gr_mem[0]) ||
+                                    gr->gr_mem[1])
+                                        bad_modes = 1;
+                        }
+                }
+                if ((sb.st_mode & 002) != 0)
+                        bad_modes = 1;
+                if (bad_modes)
                         fatal("Bad owner or permissions on %s", filename);
         }
 
@@ -927,6 +954,7 @@ initialize_options(Options * options)
         options->strict_host_key_checking = -1;
         options->compression = -1;
         options->tcp_keep_alive = -1;
+        options->setuptimeout = -1;
         options->compression_level = -1;
         options->port = -1;
         options->address_family = -1;
@@ -983,7 +1011,7 @@ fill_default_options(Options * options)
         if (options->forward_x11 == -1)
                 options->forward_x11 = 0;
         if (options->forward_x11_trusted == -1)
-                options->forward_x11_trusted = 0;
+                options->forward_x11_trusted = 1;
         if (options->xauth_location == NULL)
                 options->xauth_location = _PATH_XAUTH;
         if (options->gateway_ports == -1)
@@ -1082,14 +1110,26 @@ fill_default_options(Options * options)
                 options->rekey_limit = 0;
         if (options->verify_host_key_dns == -1)
                 options->verify_host_key_dns = 0;
-        if (options->server_alive_interval == -1)
-                options->server_alive_interval = 0;
+        if (options->server_alive_interval == -1) {
+                /* in batch mode, default is 5mins */
+                if (options->batch_mode == 1)
+                        options->server_alive_interval = 300;
+                else
+                        options->server_alive_interval = 0;
+        }
         if (options->server_alive_count_max == -1)
                 options->server_alive_count_max = 3;
         if (options->control_master == -1)
                 options->control_master = 0;
         if (options->hash_known_hosts == -1)
                 options->hash_known_hosts = 0;
+        if (options->setuptimeout == -1) {
+                /* in batch mode, default is 5mins */
+                if (options->batch_mode == 1)
+                        options->setuptimeout = 300;
+                else
+                        options->setuptimeout = 0;
+        }
         /* options->proxy_command should not be set by default */
         /* options->user will be set in the main program if appropriate */
         /* options->hostname will be set in the main program if appropriate */