1 files changed, 67 insertions, 5 deletions

diff --git a/readconf.c b/readconf.c
index d57d4551d..0999f28e3 100644
--- a/readconf.c
+++ b/readconf.c
@@ -28,6 +28,8 @@
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
+#include <pwd.h>
+#include <grp.h>
 
 #include "xmalloc.h"
 #include "ssh.h"
@@ -127,9 +129,12 @@ typedef enum {
         oClearAllForwardings, oNoHostAuthenticationForLocalhost,
         oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
         oAddressFamily, oGssAuthentication, oGssDelegateCreds,
+        oGssKeyEx,
+        oGssTrustDns,
         oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
         oSendEnv, oControlPath, oControlMaster, oHashKnownHosts,
         oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
+        oProtocolKeepAlives, oSetupTimeOut,
         oDeprecated, oUnsupported
 } OpCodes;
 
@@ -163,10 +168,14 @@ static struct {
         { "afstokenpassing", oUnsupported },
 #if defined(GSSAPI)
         { "gssapiauthentication", oGssAuthentication },
+        { "gssapikeyexchange", oGssKeyEx },
         { "gssapidelegatecredentials", oGssDelegateCreds },
+        { "gssapitrustdns", oGssTrustDns },
 #else
         { "gssapiauthentication", oUnsupported },
+        { "gssapikeyexchange", oUnsupported },
         { "gssapidelegatecredentials", oUnsupported },
+        { "gssapitrustdns", oUnsupported },
 #endif
         { "fallbacktorsh", oDeprecated },
         { "usersh", oDeprecated },
@@ -226,6 +235,8 @@ static struct {
         { "tunneldevice", oTunnelDevice },
         { "localcommand", oLocalCommand },
         { "permitlocalcommand", oPermitLocalCommand },
+        { "protocolkeepalives", oProtocolKeepAlives },
+        { "setuptimeout", oSetupTimeOut },
         { NULL, oBadOption }
 };
 
@@ -441,10 +452,18 @@ parse_flag:
                 intptr = &options->gss_authentication;
                 goto parse_flag;
 
+        case oGssKeyEx:
+                intptr = &options->gss_keyex;
+                goto parse_flag;
+
         case oGssDelegateCreds:
                 intptr = &options->gss_deleg_creds;
                 goto parse_flag;
 
+        case oGssTrustDns:
+                intptr = &options->gss_trust_dns;
+                goto parse_flag;
+
         case oBatchMode:
                 intptr = &options->batch_mode;
                 goto parse_flag;
@@ -818,6 +837,7 @@ parse_int:
                 goto parse_flag;
 
         case oServerAliveInterval:
+        case oProtocolKeepAlives: /* Debian-specific compatibility alias */
                 intptr = &options->server_alive_interval;
                 goto parse_time;
 
@@ -915,6 +935,10 @@ parse_int:
                 intptr = &options->permit_local_command;
                 goto parse_flag;
 
+        case oSetupTimeOut:
+                intptr = &options->setuptimeout;
+                goto parse_int;
+
         case oDeprecated:
                 debug("%s line %d: Deprecated option \"%s\"",
                     filename, linenum, keyword);
@@ -959,11 +983,30 @@ read_config_file(const char *filename, const char *host, Options *options,
 
         if (checkperm) {
                 struct stat sb;
+                int bad_modes = 0;
 
                 if (fstat(fileno(f), &sb) == -1)
                         fatal("fstat %s: %s", filename, strerror(errno));
-                if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
-                    (sb.st_mode & 022) != 0))
+                if (sb.st_uid != 0 && sb.st_uid != getuid())
+                        bad_modes = 1;
+                if ((sb.st_mode & 020) != 0) {
+                        /* If the file is group-writable, the group in
+                         * question must have at most one member, namely the
+                         * file's owner.
+                         */
+                        struct passwd *pw = getpwuid(sb.st_uid);
+                        struct group *gr = getgrgid(sb.st_gid);
+                        if (!pw || !gr)
+                                bad_modes = 1;
+                        else if (gr->gr_mem[0]) {
+                                if (strcmp(pw->pw_name, gr->gr_mem[0]) ||
+                                    gr->gr_mem[1])
+                                        bad_modes = 1;
+                        }
+                }
+                if ((sb.st_mode & 002) != 0)
+                        bad_modes = 1;
+                if (bad_modes)
                         fatal("Bad owner or permissions on %s", filename);
         }
 
@@ -1010,7 +1053,9 @@ initialize_options(Options * options)
         options->pubkey_authentication = -1;
         options->challenge_response_authentication = -1;
         options->gss_authentication = -1;
+        options->gss_keyex = -1;
         options->gss_deleg_creds = -1;
+        options->gss_trust_dns = -1;
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->kbd_interactive_devices = NULL;
@@ -1021,6 +1066,7 @@ initialize_options(Options * options)
         options->strict_host_key_checking = -1;
         options->compression = -1;
         options->tcp_keep_alive = -1;
+        options->setuptimeout = -1;
         options->compression_level = -1;
         options->port = -1;
         options->address_family = -1;
@@ -1082,7 +1128,7 @@ fill_default_options(Options * options)
         if (options->forward_x11 == -1)
                 options->forward_x11 = 0;
         if (options->forward_x11_trusted == -1)
-                options->forward_x11_trusted = 0;
+                options->forward_x11_trusted = 1;
         if (options->exit_on_forward_failure == -1)
                 options->exit_on_forward_failure = 0;
         if (options->xauth_location == NULL)
@@ -1099,8 +1145,12 @@ fill_default_options(Options * options)
                 options->challenge_response_authentication = 1;
         if (options->gss_authentication == -1)
                 options->gss_authentication = 0;
+        if (options->gss_keyex == -1)
+                options->gss_keyex = 0;
         if (options->gss_deleg_creds == -1)
                 options->gss_deleg_creds = 0;
+        if (options->gss_trust_dns == -1)
+                options->gss_trust_dns = 0;
         if (options->password_authentication == -1)
                 options->password_authentication = 1;
         if (options->kbd_interactive_authentication == -1)
@@ -1183,8 +1233,13 @@ fill_default_options(Options * options)
                 options->rekey_limit = 0;
         if (options->verify_host_key_dns == -1)
                 options->verify_host_key_dns = 0;
-        if (options->server_alive_interval == -1)
-                options->server_alive_interval = 0;
+        if (options->server_alive_interval == -1) {
+                /* in batch mode, default is 5mins */
+                if (options->batch_mode == 1)
+                        options->server_alive_interval = 300;
+                else
+                        options->server_alive_interval = 0;
+        }
         if (options->server_alive_count_max == -1)
                 options->server_alive_count_max = 3;
         if (options->control_master == -1)
@@ -1199,6 +1254,13 @@ fill_default_options(Options * options)
                 options->tun_remote = SSH_TUNID_ANY;
         if (options->permit_local_command == -1)
                 options->permit_local_command = 0;
+        if (options->setuptimeout == -1) {
+                /* in batch mode, default is 5mins */
+                if (options->batch_mode == 1)
+                        options->setuptimeout = 300;
+                else
+                        options->setuptimeout = 0;
+        }
         /* options->local_command should not be set by default */
         /* options->proxy_command should not be set by default */
         /* options->user will be set in the main program if appropriate */