Import debian 5.9p1-1

[openssh.git] / readconf.c

diff --git a/readconf.c b/readconf.c
index 91dfa56..7a26e92 100644 (file)
--- a/readconf.c
+++ b/readconf.c
@@ -30,6 +30,8 @@
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
+#include <pwd.h>
+#include <grp.h>
 
 #include "xmalloc.h"
 #include "ssh.h"
@@ -125,16 +127,20 @@ typedef enum {
        oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
        oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
        oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
+       oUseBlacklistedKeys,
        oHostKeyAlgorithms, oBindAddress, oPKCS11Provider,
        oClearAllForwardings, oNoHostAuthenticationForLocalhost,
        oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
        oAddressFamily, oGssAuthentication, oGssDelegateCreds,
+       oGssTrustDns, oGssKeyEx, oGssClientIdentity, oGssRenewalRekey,
+       oGssServerIdentity, 
        oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
        oSendEnv, oControlPath, oControlMaster, oControlPersist,
        oHashKnownHosts,
        oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
        oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication,
        oKexAlgorithms, oIPQoS, oRequestTTY,
+       oProtocolKeepAlives, oSetupTimeOut,
        oDeprecated, oUnsupported
 } OpCodes;
 
@@ -156,6 +162,7 @@ static struct {
        { "passwordauthentication", oPasswordAuthentication },
        { "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
        { "kbdinteractivedevices", oKbdInteractiveDevices },
+       { "useblacklistedkeys", oUseBlacklistedKeys },
        { "rsaauthentication", oRSAAuthentication },
        { "pubkeyauthentication", oPubkeyAuthentication },
        { "dsaauthentication", oPubkeyAuthentication },             /* alias */
@@ -169,10 +176,19 @@ static struct {
        { "afstokenpassing", oUnsupported },
 #if defined(GSSAPI)
        { "gssapiauthentication", oGssAuthentication },
+       { "gssapikeyexchange", oGssKeyEx },
        { "gssapidelegatecredentials", oGssDelegateCreds },
+       { "gssapitrustdns", oGssTrustDns },
+       { "gssapiclientidentity", oGssClientIdentity },
+       { "gssapiserveridentity", oGssServerIdentity },
+       { "gssapirenewalforcesrekey", oGssRenewalRekey },
 #else
        { "gssapiauthentication", oUnsupported },
+       { "gssapikeyexchange", oUnsupported },
        { "gssapidelegatecredentials", oUnsupported },
+       { "gssapitrustdns", oUnsupported },
+       { "gssapiclientidentity", oUnsupported },
+       { "gssapirenewalforcesrekey", oUnsupported },
 #endif
        { "fallbacktorsh", oDeprecated },
        { "usersh", oDeprecated },
@@ -246,6 +262,8 @@ static struct {
        { "kexalgorithms", oKexAlgorithms },
        { "ipqos", oIPQoS },
        { "requesttty", oRequestTTY },
+       { "protocolkeepalives", oProtocolKeepAlives },
+       { "setuptimeout", oSetupTimeOut },
 
        { NULL, oBadOption }
 };
@@ -478,14 +496,38 @@ parse_flag:
                intptr = &options->challenge_response_authentication;
                goto parse_flag;
 
+       case oUseBlacklistedKeys:
+               intptr = &options->use_blacklisted_keys;
+               goto parse_flag;
+
        case oGssAuthentication:
                intptr = &options->gss_authentication;
                goto parse_flag;
 
+       case oGssKeyEx:
+               intptr = &options->gss_keyex;
+               goto parse_flag;
+
        case oGssDelegateCreds:
                intptr = &options->gss_deleg_creds;
                goto parse_flag;
 
+       case oGssTrustDns:
+               intptr = &options->gss_trust_dns;
+               goto parse_flag;
+
+       case oGssClientIdentity:
+               charptr = &options->gss_client_identity;
+               goto parse_string;
+
+       case oGssServerIdentity:
+               charptr = &options->gss_server_identity;
+               goto parse_string;
+
+       case oGssRenewalRekey:
+               intptr = &options->gss_renewal_rekey;
+               goto parse_flag;
+
        case oBatchMode:
                intptr = &options->batch_mode;
                goto parse_flag;
@@ -877,6 +919,8 @@ parse_int:
                goto parse_flag;
 
        case oServerAliveInterval:
+       case oProtocolKeepAlives: /* Debian-specific compatibility alias */
+       case oSetupTimeOut:       /* Debian-specific compatibility alias */
                intptr = &options->server_alive_interval;
                goto parse_time;
 
@@ -1089,8 +1133,7 @@ read_config_file(const char *filename, const char *host, Options *options,
 
                if (fstat(fileno(f), &sb) == -1)
                        fatal("fstat %s: %s", filename, strerror(errno));
-               if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
-                   (sb.st_mode & 022) != 0))
+               if (!secure_permissions(&sb, getuid()))
                        fatal("Bad owner or permissions on %s", filename);
        }
 
@@ -1138,12 +1181,18 @@ initialize_options(Options * options)
        options->pubkey_authentication = -1;
        options->challenge_response_authentication = -1;
        options->gss_authentication = -1;
+       options->gss_keyex = -1;
        options->gss_deleg_creds = -1;
+       options->gss_trust_dns = -1;
+       options->gss_renewal_rekey = -1;
+       options->gss_client_identity = NULL;
+       options->gss_server_identity = NULL;
        options->password_authentication = -1;
        options->kbd_interactive_authentication = -1;
        options->kbd_interactive_devices = NULL;
        options->rhosts_rsa_authentication = -1;
        options->hostbased_authentication = -1;
+       options->use_blacklisted_keys = -1;
        options->batch_mode = -1;
        options->check_host_ip = -1;
        options->strict_host_key_checking = -1;
@@ -1219,7 +1268,7 @@ fill_default_options(Options * options)
        if (options->forward_x11 == -1)
                options->forward_x11 = 0;
        if (options->forward_x11_trusted == -1)
-               options->forward_x11_trusted = 0;
+               options->forward_x11_trusted = 1;
        if (options->forward_x11_timeout == -1)
                options->forward_x11_timeout = 1200;
        if (options->exit_on_forward_failure == -1)
@@ -1238,8 +1287,14 @@ fill_default_options(Options * options)
                options->challenge_response_authentication = 1;
        if (options->gss_authentication == -1)
                options->gss_authentication = 0;
+       if (options->gss_keyex == -1)
+               options->gss_keyex = 0;
        if (options->gss_deleg_creds == -1)
                options->gss_deleg_creds = 0;
+       if (options->gss_trust_dns == -1)
+               options->gss_trust_dns = 0;
+       if (options->gss_renewal_rekey == -1)
+               options->gss_renewal_rekey = 0;
        if (options->password_authentication == -1)
                options->password_authentication = 1;
        if (options->kbd_interactive_authentication == -1)
@@ -1248,6 +1303,8 @@ fill_default_options(Options * options)
                options->rhosts_rsa_authentication = 0;
        if (options->hostbased_authentication == -1)
                options->hostbased_authentication = 0;
+       if (options->use_blacklisted_keys == -1)
+               options->use_blacklisted_keys = 0;
        if (options->batch_mode == -1)
                options->batch_mode = 0;
        if (options->check_host_ip == -1)
@@ -1334,8 +1391,13 @@ fill_default_options(Options * options)
                options->rekey_limit = 0;
        if (options->verify_host_key_dns == -1)
                options->verify_host_key_dns = 0;
-       if (options->server_alive_interval == -1)
-               options->server_alive_interval = 0;
+       if (options->server_alive_interval == -1) {
+               /* in batch mode, default is 5mins */
+               if (options->batch_mode == 1)
+                       options->server_alive_interval = 300;
+               else
+                       options->server_alive_interval = 0;
+       }
        if (options->server_alive_count_max == -1)
                options->server_alive_count_max = 3;
        if (options->control_master == -1)