1 files changed, 45 insertions, 5 deletions

diff --git a/readconf.c b/readconf.c
index 484db3e5f..be27e75bc 100644
--- a/readconf.c
+++ b/readconf.c
@@ -28,6 +28,8 @@
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
+#include <pwd.h>
+#include <grp.h>
 
 #include "xmalloc.h"
 #include "ssh.h"
@@ -123,6 +125,7 @@ typedef enum {
         oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
         oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
         oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
+        oUseBlacklistedKeys,
         oHostKeyAlgorithms, oBindAddress, oSmartcardDevice,
         oClearAllForwardings, oNoHostAuthenticationForLocalhost,
         oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
@@ -132,6 +135,7 @@ typedef enum {
         oSendEnv, oControlPath, oControlMaster, oHashKnownHosts,
         oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
         oVisualHostKey, oZeroKnowledgePasswordAuthentication,
+        oProtocolKeepAlives, oSetupTimeOut,
         oDeprecated, oUnsupported
 } OpCodes;
 
@@ -152,6 +156,7 @@ static struct {
         { "passwordauthentication", oPasswordAuthentication },
         { "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
         { "kbdinteractivedevices", oKbdInteractiveDevices },
+        { "useblacklistedkeys", oUseBlacklistedKeys },
         { "rsaauthentication", oRSAAuthentication },
         { "pubkeyauthentication", oPubkeyAuthentication },
         { "dsaauthentication", oPubkeyAuthentication },             /* alias */
@@ -243,6 +248,8 @@ static struct {
 #else
         { "zeroknowledgepasswordauthentication", oUnsupported },
 #endif
+        { "protocolkeepalives", oProtocolKeepAlives },
+        { "setuptimeout", oSetupTimeOut },
 
         { NULL, oBadOption }
 };
@@ -458,6 +465,10 @@ parse_flag:
                 intptr = &options->challenge_response_authentication;
                 goto parse_flag;
 
+        case oUseBlacklistedKeys:
+                intptr = &options->use_blacklisted_keys;
+                goto parse_flag;
+
         case oGssAuthentication:
                 intptr = &options->gss_authentication;
                 goto parse_flag;
@@ -838,6 +849,8 @@ parse_int:
                 goto parse_flag;
 
         case oServerAliveInterval:
+        case oProtocolKeepAlives: /* Debian-specific compatibility alias */
+        case oSetupTimeOut:       /* Debian-specific compatibility alias */
                 intptr = &options->server_alive_interval;
                 goto parse_time;
 
@@ -982,11 +995,30 @@ read_config_file(const char *filename, const char *host, Options *options,
 
         if (checkperm) {
                 struct stat sb;
+                int bad_modes = 0;
 
                 if (fstat(fileno(f), &sb) == -1)
                         fatal("fstat %s: %s", filename, strerror(errno));
-                if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
-                    (sb.st_mode & 022) != 0))
+                if (sb.st_uid != 0 && sb.st_uid != getuid())
+                        bad_modes = 1;
+                if ((sb.st_mode & 020) != 0) {
+                        /* If the file is group-writable, the group in
+                         * question must have at most one member, namely the
+                         * file's owner.
+                         */
+                        struct passwd *pw = getpwuid(sb.st_uid);
+                        struct group *gr = getgrgid(sb.st_gid);
+                        if (!pw || !gr)
+                                bad_modes = 1;
+                        else if (gr->gr_mem[0]) {
+                                if (strcmp(pw->pw_name, gr->gr_mem[0]) ||
+                                    gr->gr_mem[1])
+                                        bad_modes = 1;
+                        }
+                }
+                if ((sb.st_mode & 002) != 0)
+                        bad_modes = 1;
+                if (bad_modes)
                         fatal("Bad owner or permissions on %s", filename);
         }
 
@@ -1043,6 +1075,7 @@ initialize_options(Options * options)
         options->kbd_interactive_devices = NULL;
         options->rhosts_rsa_authentication = -1;
         options->hostbased_authentication = -1;
+        options->use_blacklisted_keys = -1;
         options->batch_mode = -1;
         options->check_host_ip = -1;
         options->strict_host_key_checking = -1;
@@ -1111,7 +1144,7 @@ fill_default_options(Options * options)
         if (options->forward_x11 == -1)
                 options->forward_x11 = 0;
         if (options->forward_x11_trusted == -1)
-                options->forward_x11_trusted = 0;
+                options->forward_x11_trusted = 1;
         if (options->exit_on_forward_failure == -1)
                 options->exit_on_forward_failure = 0;
         if (options->xauth_location == NULL)
@@ -1144,6 +1177,8 @@ fill_default_options(Options * options)
                 options->rhosts_rsa_authentication = 0;
         if (options->hostbased_authentication == -1)
                 options->hostbased_authentication = 0;
+        if (options->use_blacklisted_keys == -1)
+                options->use_blacklisted_keys = 0;
         if (options->batch_mode == -1)
                 options->batch_mode = 0;
         if (options->check_host_ip == -1)
@@ -1218,8 +1253,13 @@ fill_default_options(Options * options)
                 options->rekey_limit = 0;
         if (options->verify_host_key_dns == -1)
                 options->verify_host_key_dns = 0;
-        if (options->server_alive_interval == -1)
-                options->server_alive_interval = 0;
+        if (options->server_alive_interval == -1) {
+                /* in batch mode, default is 5mins */
+                if (options->batch_mode == 1)
+                        options->server_alive_interval = 300;
+                else
+                        options->server_alive_interval = 0;
+        }
         if (options->server_alive_count_max == -1)
                 options->server_alive_count_max = 3;
         if (options->control_master == -1)