1 files changed, 29 insertions, 25 deletions

diff --git a/readconf.c b/readconf.c
index f0769b574..e4e1cbae3 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.237 2015/06/26 05:13:20 djm Exp $ */
+/* $OpenBSD: readconf.c,v 1.239 2015/07/30 00:01:34 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -161,6 +161,7 @@ typedef enum {
         oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs,
         oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys,
         oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes,
+        oPubkeyAcceptedKeyTypes,
         oProtocolKeepAlives, oSetupTimeOut,
         oIgnoredUnknownOption, oDeprecated, oUnsupported
 } OpCodes;
@@ -290,6 +291,7 @@ static struct {
         { "fingerprinthash", oFingerprintHash },
         { "updatehostkeys", oUpdateHostkeys },
         { "hostbasedkeytypes", oHostbasedKeyTypes },
+        { "pubkeyacceptedkeytypes", oPubkeyAcceptedKeyTypes },
         { "ignoreunknown", oIgnoreUnknown },
         { "protocolkeepalives", oProtocolKeepAlives },
         { "setuptimeout", oSetupTimeOut },
@@ -1121,7 +1123,7 @@ parse_int:
                 arg = strdelim(&s);
                 if (!arg || *arg == '\0')
                         fatal("%.200s line %d: Missing argument.", filename, linenum);
-                if (!ciphers_valid(arg))
+                if (!ciphers_valid(*arg == '+' ? arg + 1 : arg))
                         fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
                             filename, linenum, arg ? arg : "<NONE>");
                 if (*activep && options->ciphers == NULL)
@@ -1132,7 +1134,7 @@ parse_int:
                 arg = strdelim(&s);
                 if (!arg || *arg == '\0')
                         fatal("%.200s line %d: Missing argument.", filename, linenum);
-                if (!mac_valid(arg))
+                if (!mac_valid(*arg == '+' ? arg + 1 : arg))
                         fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.",
                             filename, linenum, arg ? arg : "<NONE>");
                 if (*activep && options->macs == NULL)
@@ -1144,7 +1146,7 @@ parse_int:
                 if (!arg || *arg == '\0')
                         fatal("%.200s line %d: Missing argument.",
                             filename, linenum);
-                if (!kex_names_valid(arg))
+                if (!kex_names_valid(*arg == '+' ? arg + 1 : arg))
                         fatal("%.200s line %d: Bad SSH2 KexAlgorithms '%s'.",
                             filename, linenum, arg ? arg : "<NONE>");
                 if (*activep && options->kex_algorithms == NULL)
@@ -1152,14 +1154,17 @@ parse_int:
                 break;
 
         case oHostKeyAlgorithms:
+                charptr = &options->hostkeyalgorithms;
+parse_keytypes:
                 arg = strdelim(&s);
                 if (!arg || *arg == '\0')
-                        fatal("%.200s line %d: Missing argument.", filename, linenum);
-                if (!sshkey_names_valid2(arg, 1))
-                        fatal("%.200s line %d: Bad protocol 2 host key algorithms '%s'.",
-                            filename, linenum, arg ? arg : "<NONE>");
-                if (*activep && options->hostkeyalgorithms == NULL)
-                        options->hostkeyalgorithms = xstrdup(arg);
+                        fatal("%.200s line %d: Missing argument.",
+                            filename, linenum);
+                if (!sshkey_names_valid2(*arg == '+' ? arg + 1 : arg, 1))
+                        fatal("%s line %d: Bad key types '%s'.",
+                                filename, linenum, arg ? arg : "<NONE>");
+                if (*activep && *charptr == NULL)
+                        *charptr = xstrdup(arg);
                 break;
 
         case oProtocol:
@@ -1524,16 +1529,11 @@ parse_int:
 
         case oHostbasedKeyTypes:
                 charptr = &options->hostbased_key_types;
-                arg = strdelim(&s);
-                if (!arg || *arg == '\0')
-                        fatal("%.200s line %d: Missing argument.",
-                            filename, linenum);
-                if (!sshkey_names_valid2(arg, 1))
-                        fatal("%s line %d: Bad key types '%s'.",
-                                filename, linenum, arg ? arg : "<NONE>");
-                if (*activep && *charptr == NULL)
-                        *charptr = xstrdup(arg);
-                break;
+                goto parse_keytypes;
+
+        case oPubkeyAcceptedKeyTypes:
+                charptr = &options->pubkey_key_types;
+                goto parse_keytypes;
 
         case oDeprecated:
                 debug("%s line %d: Deprecated option \"%s\"",
@@ -1719,6 +1719,7 @@ initialize_options(Options * options)
         options->fingerprint_hash = -1;
         options->update_hostkeys = -1;
         options->hostbased_key_types = NULL;
+        options->pubkey_key_types = NULL;
 }
 
 /*
@@ -1810,9 +1811,6 @@ fill_default_options(Options * options)
         /* Selected in ssh_login(). */
         if (options->cipher == -1)
                 options->cipher = SSH_CIPHER_NOT_SET;
-        /* options->ciphers, default set in myproposals.h */
-        /* options->macs, default set in myproposals.h */
-        /* options->kex_algorithms, default set in myproposals.h */
         /* options->hostkeyalgorithms, default set in myproposals.h */
         if (options->protocol == SSH_PROTO_UNKNOWN)
                 options->protocol = SSH_PROTO_2;
@@ -1911,8 +1909,14 @@ fill_default_options(Options * options)
                 options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
         if (options->update_hostkeys == -1)
                 options->update_hostkeys = 0;
-        if (options->hostbased_key_types == NULL)
-                options->hostbased_key_types = xstrdup("*");
+        if (kex_assemble_names(KEX_CLIENT_ENCRYPT, &options->ciphers) != 0 ||
+            kex_assemble_names(KEX_CLIENT_MAC, &options->macs) != 0 ||
+            kex_assemble_names(KEX_CLIENT_KEX, &options->kex_algorithms) != 0 ||
+            kex_assemble_names(KEX_DEFAULT_PK_ALG,
+            &options->hostbased_key_types) != 0 ||
+            kex_assemble_names(KEX_DEFAULT_PK_ALG,
+            &options->pubkey_key_types) != 0)
+                fatal("%s: kex_assemble_names failed", __func__);
 
 #define CLEAR_ON_NONE(v) \
         do { \