xref: /freebsd/crypto/openssh/readconf.c (revision 1f4bcc459a76b7aa664f3fd557684cd0ba6da352)
1 /* $OpenBSD: readconf.c,v 1.239 2015/07/30 00:01:34 djm Exp $ */
2 /*
3  * Author: Tatu Ylonen <ylo@cs.hut.fi>
4  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5  *                    All rights reserved
6  * Functions for reading the configuration files.
7  *
8  * As far as I am concerned, the code I have written for this software
9  * can be used freely for any purpose.  Any derived versions of this
10  * software must be clearly marked as such, and if the derived work is
11  * incompatible with the protocol description in the RFC file, it must be
12  * called by a name other than "ssh" or "Secure Shell".
13  */
14 
15 #include "includes.h"
16 __RCSID("$FreeBSD$");
17 
18 #include <sys/types.h>
19 #include <sys/stat.h>
20 #include <sys/socket.h>
21 #include <sys/sysctl.h>
22 #include <sys/wait.h>
23 #include <sys/un.h>
24 
25 #include <netinet/in.h>
26 #include <netinet/in_systm.h>
27 #include <netinet/ip.h>
28 #include <arpa/inet.h>
29 
30 #include <ctype.h>
31 #include <errno.h>
32 #include <fcntl.h>
33 #include <limits.h>
34 #include <netdb.h>
35 #ifdef HAVE_PATHS_H
36 # include <paths.h>
37 #endif
38 #include <pwd.h>
39 #include <signal.h>
40 #include <stdarg.h>
41 #include <stdio.h>
42 #include <string.h>
43 #include <unistd.h>
44 #ifdef HAVE_UTIL_H
45 #include <util.h>
46 #endif
47 #if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
48 # include <vis.h>
49 #endif
50 
51 #include "xmalloc.h"
52 #include "ssh.h"
53 #include "compat.h"
54 #include "cipher.h"
55 #include "pathnames.h"
56 #include "log.h"
57 #include "sshkey.h"
58 #include "misc.h"
59 #include "readconf.h"
60 #include "match.h"
61 #include "kex.h"
62 #include "mac.h"
63 #include "uidswap.h"
64 #include "myproposal.h"
65 #include "digest.h"
66 #include "version.h"
67 
68 /* Format of the configuration file:
69 
70    # Configuration data is parsed as follows:
71    #  1. command line options
72    #  2. user-specific file
73    #  3. system-wide file
74    # Any configuration value is only changed the first time it is set.
75    # Thus, host-specific definitions should be at the beginning of the
76    # configuration file, and defaults at the end.
77 
78    # Host-specific declarations.  These may override anything above.  A single
79    # host may match multiple declarations; these are processed in the order
80    # that they are given in.
81 
82    Host *.ngs.fi ngs.fi
83      User foo
84 
85    Host fake.com
86      HostName another.host.name.real.org
87      User blaah
88      Port 34289
89      ForwardX11 no
90      ForwardAgent no
91 
92    Host books.com
93      RemoteForward 9999 shadows.cs.hut.fi:9999
94      Cipher 3des
95 
96    Host fascist.blob.com
97      Port 23123
98      User tylonen
99      PasswordAuthentication no
100 
101    Host puukko.hut.fi
102      User t35124p
103      ProxyCommand ssh-proxy %h %p
104 
105    Host *.fr
106      PublicKeyAuthentication no
107 
108    Host *.su
109      Cipher none
110      PasswordAuthentication no
111 
112    Host vpn.fake.com
113      Tunnel yes
114      TunnelDevice 3
115 
116    # Defaults for various options
117    Host *
118      ForwardAgent no
119      ForwardX11 no
120      PasswordAuthentication yes
121      RSAAuthentication yes
122      RhostsRSAAuthentication yes
123      StrictHostKeyChecking yes
124      TcpKeepAlive no
125      IdentityFile ~/.ssh/identity
126      Port 22
127      EscapeChar ~
128 
129 */
130 
131 /* Keyword tokens. */
132 
133 typedef enum {
134 	oBadOption,
135 	oVersionAddendum,
136 	oHost, oMatch,
137 	oForwardAgent, oForwardX11, oForwardX11Trusted, oForwardX11Timeout,
138 	oGatewayPorts, oExitOnForwardFailure,
139 	oPasswordAuthentication, oRSAAuthentication,
140 	oChallengeResponseAuthentication, oXAuthLocation,
141 	oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
142 	oUser, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
143 	oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
144 	oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
145 	oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts,
146 	oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,
147 	oPubkeyAuthentication,
148 	oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
149 	oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
150 	oHostKeyAlgorithms, oBindAddress, oPKCS11Provider,
151 	oClearAllForwardings, oNoHostAuthenticationForLocalhost,
152 	oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
153 	oAddressFamily, oGssAuthentication, oGssDelegateCreds,
154 	oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
155 	oSendEnv, oControlPath, oControlMaster, oControlPersist,
156 	oHashKnownHosts,
157 	oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
158 	oVisualHostKey, oUseRoaming,
159 	oKexAlgorithms, oIPQoS, oRequestTTY, oIgnoreUnknown, oProxyUseFdpass,
160 	oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots,
161 	oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs,
162 	oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys,
163 	oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes,
164 	oPubkeyAcceptedKeyTypes,
165 	oIgnoredUnknownOption, oDeprecated, oUnsupported
166 } OpCodes;
167 
168 /* Textual representations of the tokens. */
169 
170 static struct {
171 	const char *name;
172 	OpCodes opcode;
173 } keywords[] = {
174 	{ "forwardagent", oForwardAgent },
175 	{ "forwardx11", oForwardX11 },
176 	{ "forwardx11trusted", oForwardX11Trusted },
177 	{ "forwardx11timeout", oForwardX11Timeout },
178 	{ "exitonforwardfailure", oExitOnForwardFailure },
179 	{ "xauthlocation", oXAuthLocation },
180 	{ "gatewayports", oGatewayPorts },
181 	{ "useprivilegedport", oUsePrivilegedPort },
182 	{ "rhostsauthentication", oDeprecated },
183 	{ "passwordauthentication", oPasswordAuthentication },
184 	{ "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
185 	{ "kbdinteractivedevices", oKbdInteractiveDevices },
186 	{ "rsaauthentication", oRSAAuthentication },
187 	{ "pubkeyauthentication", oPubkeyAuthentication },
188 	{ "dsaauthentication", oPubkeyAuthentication },		    /* alias */
189 	{ "rhostsrsaauthentication", oRhostsRSAAuthentication },
190 	{ "hostbasedauthentication", oHostbasedAuthentication },
191 	{ "challengeresponseauthentication", oChallengeResponseAuthentication },
192 	{ "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
193 	{ "tisauthentication", oChallengeResponseAuthentication },  /* alias */
194 	{ "kerberosauthentication", oUnsupported },
195 	{ "kerberostgtpassing", oUnsupported },
196 	{ "afstokenpassing", oUnsupported },
197 #if defined(GSSAPI)
198 	{ "gssapiauthentication", oGssAuthentication },
199 	{ "gssapidelegatecredentials", oGssDelegateCreds },
200 #else
201 	{ "gssapiauthentication", oUnsupported },
202 	{ "gssapidelegatecredentials", oUnsupported },
203 #endif
204 	{ "fallbacktorsh", oDeprecated },
205 	{ "usersh", oDeprecated },
206 	{ "identityfile", oIdentityFile },
207 	{ "identityfile2", oIdentityFile },			/* obsolete */
208 	{ "identitiesonly", oIdentitiesOnly },
209 	{ "hostname", oHostName },
210 	{ "hostkeyalias", oHostKeyAlias },
211 	{ "proxycommand", oProxyCommand },
212 	{ "port", oPort },
213 	{ "cipher", oCipher },
214 	{ "ciphers", oCiphers },
215 	{ "macs", oMacs },
216 	{ "protocol", oProtocol },
217 	{ "remoteforward", oRemoteForward },
218 	{ "localforward", oLocalForward },
219 	{ "user", oUser },
220 	{ "host", oHost },
221 	{ "match", oMatch },
222 	{ "escapechar", oEscapeChar },
223 	{ "globalknownhostsfile", oGlobalKnownHostsFile },
224 	{ "globalknownhostsfile2", oDeprecated },
225 	{ "userknownhostsfile", oUserKnownHostsFile },
226 	{ "userknownhostsfile2", oDeprecated },
227 	{ "connectionattempts", oConnectionAttempts },
228 	{ "batchmode", oBatchMode },
229 	{ "checkhostip", oCheckHostIP },
230 	{ "stricthostkeychecking", oStrictHostKeyChecking },
231 	{ "compression", oCompression },
232 	{ "compressionlevel", oCompressionLevel },
233 	{ "tcpkeepalive", oTCPKeepAlive },
234 	{ "keepalive", oTCPKeepAlive },				/* obsolete */
235 	{ "numberofpasswordprompts", oNumberOfPasswordPrompts },
236 	{ "loglevel", oLogLevel },
237 	{ "dynamicforward", oDynamicForward },
238 	{ "preferredauthentications", oPreferredAuthentications },
239 	{ "hostkeyalgorithms", oHostKeyAlgorithms },
240 	{ "bindaddress", oBindAddress },
241 #ifdef ENABLE_PKCS11
242 	{ "smartcarddevice", oPKCS11Provider },
243 	{ "pkcs11provider", oPKCS11Provider },
244 #else
245 	{ "smartcarddevice", oUnsupported },
246 	{ "pkcs11provider", oUnsupported },
247 #endif
248 	{ "clearallforwardings", oClearAllForwardings },
249 	{ "enablesshkeysign", oEnableSSHKeysign },
250 	{ "verifyhostkeydns", oVerifyHostKeyDNS },
251 	{ "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost },
252 	{ "rekeylimit", oRekeyLimit },
253 	{ "connecttimeout", oConnectTimeout },
254 	{ "addressfamily", oAddressFamily },
255 	{ "serveraliveinterval", oServerAliveInterval },
256 	{ "serveralivecountmax", oServerAliveCountMax },
257 	{ "sendenv", oSendEnv },
258 	{ "controlpath", oControlPath },
259 	{ "controlmaster", oControlMaster },
260 	{ "controlpersist", oControlPersist },
261 	{ "hashknownhosts", oHashKnownHosts },
262 	{ "tunnel", oTunnel },
263 	{ "tunneldevice", oTunnelDevice },
264 	{ "localcommand", oLocalCommand },
265 	{ "permitlocalcommand", oPermitLocalCommand },
266 	{ "visualhostkey", oVisualHostKey },
267 	{ "useroaming", oUseRoaming },
268 	{ "kexalgorithms", oKexAlgorithms },
269 	{ "ipqos", oIPQoS },
270 	{ "requesttty", oRequestTTY },
271 	{ "proxyusefdpass", oProxyUseFdpass },
272 	{ "canonicaldomains", oCanonicalDomains },
273 	{ "canonicalizefallbacklocal", oCanonicalizeFallbackLocal },
274 	{ "canonicalizehostname", oCanonicalizeHostname },
275 	{ "canonicalizemaxdots", oCanonicalizeMaxDots },
276 	{ "canonicalizepermittedcnames", oCanonicalizePermittedCNAMEs },
277 	{ "streamlocalbindmask", oStreamLocalBindMask },
278 	{ "streamlocalbindunlink", oStreamLocalBindUnlink },
279 	{ "revokedhostkeys", oRevokedHostKeys },
280 	{ "fingerprinthash", oFingerprintHash },
281 	{ "updatehostkeys", oUpdateHostkeys },
282 	{ "hostbasedkeytypes", oHostbasedKeyTypes },
283 	{ "pubkeyacceptedkeytypes", oPubkeyAcceptedKeyTypes },
284 	{ "ignoreunknown", oIgnoreUnknown },
285 	{ "hpndisabled", oDeprecated },
286 	{ "hpnbuffersize", oDeprecated },
287 	{ "tcprcvbufpoll", oDeprecated },
288 	{ "tcprcvbuf", oDeprecated },
289 	{ "noneenabled", oUnsupported },
290 	{ "noneswitch", oUnsupported },
291 	{ "versionaddendum", oVersionAddendum },
292 
293 	{ NULL, oBadOption }
294 };
295 
296 /*
297  * Adds a local TCP/IP port forward to options.  Never returns if there is an
298  * error.
299  */
300 
301 void
302 add_local_forward(Options *options, const struct Forward *newfwd)
303 {
304 	struct Forward *fwd;
305 #ifndef NO_IPPORT_RESERVED_CONCEPT
306 	extern uid_t original_real_uid;
307 	int ipport_reserved;
308 #ifdef __FreeBSD__
309 	size_t len_ipport_reserved = sizeof(ipport_reserved);
310 
311 	if (sysctlbyname("net.inet.ip.portrange.reservedhigh",
312 	    &ipport_reserved, &len_ipport_reserved, NULL, 0) != 0)
313 		ipport_reserved = IPPORT_RESERVED;
314 	else
315 		ipport_reserved++;
316 #else
317 	ipport_reserved = IPPORT_RESERVED;
318 #endif
319 	if (newfwd->listen_port < ipport_reserved && original_real_uid != 0)
320 	if (newfwd->listen_port < ipport_reserved && original_real_uid != 0 &&
321 	    newfwd->listen_path == NULL)
322 		fatal("Privileged ports can only be forwarded by root.");
323 #endif
324 	options->local_forwards = xreallocarray(options->local_forwards,
325 	    options->num_local_forwards + 1,
326 	    sizeof(*options->local_forwards));
327 	fwd = &options->local_forwards[options->num_local_forwards++];
328 
329 	fwd->listen_host = newfwd->listen_host;
330 	fwd->listen_port = newfwd->listen_port;
331 	fwd->listen_path = newfwd->listen_path;
332 	fwd->connect_host = newfwd->connect_host;
333 	fwd->connect_port = newfwd->connect_port;
334 	fwd->connect_path = newfwd->connect_path;
335 }
336 
337 /*
338  * Adds a remote TCP/IP port forward to options.  Never returns if there is
339  * an error.
340  */
341 
342 void
343 add_remote_forward(Options *options, const struct Forward *newfwd)
344 {
345 	struct Forward *fwd;
346 
347 	options->remote_forwards = xreallocarray(options->remote_forwards,
348 	    options->num_remote_forwards + 1,
349 	    sizeof(*options->remote_forwards));
350 	fwd = &options->remote_forwards[options->num_remote_forwards++];
351 
352 	fwd->listen_host = newfwd->listen_host;
353 	fwd->listen_port = newfwd->listen_port;
354 	fwd->listen_path = newfwd->listen_path;
355 	fwd->connect_host = newfwd->connect_host;
356 	fwd->connect_port = newfwd->connect_port;
357 	fwd->connect_path = newfwd->connect_path;
358 	fwd->handle = newfwd->handle;
359 	fwd->allocated_port = 0;
360 }
361 
362 static void
363 clear_forwardings(Options *options)
364 {
365 	int i;
366 
367 	for (i = 0; i < options->num_local_forwards; i++) {
368 		free(options->local_forwards[i].listen_host);
369 		free(options->local_forwards[i].listen_path);
370 		free(options->local_forwards[i].connect_host);
371 		free(options->local_forwards[i].connect_path);
372 	}
373 	if (options->num_local_forwards > 0) {
374 		free(options->local_forwards);
375 		options->local_forwards = NULL;
376 	}
377 	options->num_local_forwards = 0;
378 	for (i = 0; i < options->num_remote_forwards; i++) {
379 		free(options->remote_forwards[i].listen_host);
380 		free(options->remote_forwards[i].listen_path);
381 		free(options->remote_forwards[i].connect_host);
382 		free(options->remote_forwards[i].connect_path);
383 	}
384 	if (options->num_remote_forwards > 0) {
385 		free(options->remote_forwards);
386 		options->remote_forwards = NULL;
387 	}
388 	options->num_remote_forwards = 0;
389 	options->tun_open = SSH_TUNMODE_NO;
390 }
391 
392 void
393 add_identity_file(Options *options, const char *dir, const char *filename,
394     int userprovided)
395 {
396 	char *path;
397 	int i;
398 
399 	if (options->num_identity_files >= SSH_MAX_IDENTITY_FILES)
400 		fatal("Too many identity files specified (max %d)",
401 		    SSH_MAX_IDENTITY_FILES);
402 
403 	if (dir == NULL) /* no dir, filename is absolute */
404 		path = xstrdup(filename);
405 	else
406 		(void)xasprintf(&path, "%.100s%.100s", dir, filename);
407 
408 	/* Avoid registering duplicates */
409 	for (i = 0; i < options->num_identity_files; i++) {
410 		if (options->identity_file_userprovided[i] == userprovided &&
411 		    strcmp(options->identity_files[i], path) == 0) {
412 			debug2("%s: ignoring duplicate key %s", __func__, path);
413 			free(path);
414 			return;
415 		}
416 	}
417 
418 	options->identity_file_userprovided[options->num_identity_files] =
419 	    userprovided;
420 	options->identity_files[options->num_identity_files++] = path;
421 }
422 
423 int
424 default_ssh_port(void)
425 {
426 	static int port;
427 	struct servent *sp;
428 
429 	if (port == 0) {
430 		sp = getservbyname(SSH_SERVICE_NAME, "tcp");
431 		port = sp ? ntohs(sp->s_port) : SSH_DEFAULT_PORT;
432 	}
433 	return port;
434 }
435 
436 /*
437  * Execute a command in a shell.
438  * Return its exit status or -1 on abnormal exit.
439  */
440 static int
441 execute_in_shell(const char *cmd)
442 {
443 	char *shell, *command_string;
444 	pid_t pid;
445 	int devnull, status;
446 	extern uid_t original_real_uid;
447 
448 	if ((shell = getenv("SHELL")) == NULL)
449 		shell = _PATH_BSHELL;
450 
451 	/*
452 	 * Use "exec" to avoid "sh -c" processes on some platforms
453 	 * (e.g. Solaris)
454 	 */
455 	xasprintf(&command_string, "exec %s", cmd);
456 
457 	/* Need this to redirect subprocess stdin/out */
458 	if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1)
459 		fatal("open(/dev/null): %s", strerror(errno));
460 
461 	debug("Executing command: '%.500s'", cmd);
462 
463 	/* Fork and execute the command. */
464 	if ((pid = fork()) == 0) {
465 		char *argv[4];
466 
467 		/* Child.  Permanently give up superuser privileges. */
468 		permanently_drop_suid(original_real_uid);
469 
470 		/* Redirect child stdin and stdout. Leave stderr */
471 		if (dup2(devnull, STDIN_FILENO) == -1)
472 			fatal("dup2: %s", strerror(errno));
473 		if (dup2(devnull, STDOUT_FILENO) == -1)
474 			fatal("dup2: %s", strerror(errno));
475 		if (devnull > STDERR_FILENO)
476 			close(devnull);
477 		closefrom(STDERR_FILENO + 1);
478 
479 		argv[0] = shell;
480 		argv[1] = "-c";
481 		argv[2] = command_string;
482 		argv[3] = NULL;
483 
484 		execv(argv[0], argv);
485 		error("Unable to execute '%.100s': %s", cmd, strerror(errno));
486 		/* Die with signal to make this error apparent to parent. */
487 		signal(SIGTERM, SIG_DFL);
488 		kill(getpid(), SIGTERM);
489 		_exit(1);
490 	}
491 	/* Parent. */
492 	if (pid < 0)
493 		fatal("%s: fork: %.100s", __func__, strerror(errno));
494 
495 	close(devnull);
496 	free(command_string);
497 
498 	while (waitpid(pid, &status, 0) == -1) {
499 		if (errno != EINTR && errno != EAGAIN)
500 			fatal("%s: waitpid: %s", __func__, strerror(errno));
501 	}
502 	if (!WIFEXITED(status)) {
503 		error("command '%.100s' exited abnormally", cmd);
504 		return -1;
505 	}
506 	debug3("command returned status %d", WEXITSTATUS(status));
507 	return WEXITSTATUS(status);
508 }
509 
510 /*
511  * Parse and execute a Match directive.
512  */
513 static int
514 match_cfg_line(Options *options, char **condition, struct passwd *pw,
515     const char *host_arg, const char *original_host, int post_canon,
516     const char *filename, int linenum)
517 {
518 	char *arg, *oattrib, *attrib, *cmd, *cp = *condition, *host, *criteria;
519 	const char *ruser;
520 	int r, port, this_result, result = 1, attributes = 0, negate;
521 	char thishost[NI_MAXHOST], shorthost[NI_MAXHOST], portstr[NI_MAXSERV];
522 
523 	/*
524 	 * Configuration is likely to be incomplete at this point so we
525 	 * must be prepared to use default values.
526 	 */
527 	port = options->port <= 0 ? default_ssh_port() : options->port;
528 	ruser = options->user == NULL ? pw->pw_name : options->user;
529 	if (options->hostname != NULL) {
530 		/* NB. Please keep in sync with ssh.c:main() */
531 		host = percent_expand(options->hostname,
532 		    "h", host_arg, (char *)NULL);
533 	} else
534 		host = xstrdup(host_arg);
535 
536 	debug2("checking match for '%s' host %s originally %s",
537 	    cp, host, original_host);
538 	while ((oattrib = attrib = strdelim(&cp)) && *attrib != '\0') {
539 		criteria = NULL;
540 		this_result = 1;
541 		if ((negate = attrib[0] == '!'))
542 			attrib++;
543 		/* criteria "all" and "canonical" have no argument */
544 		if (strcasecmp(attrib, "all") == 0) {
545 			if (attributes > 1 ||
546 			    ((arg = strdelim(&cp)) != NULL && *arg != '\0')) {
547 				error("%.200s line %d: '%s' cannot be combined "
548 				    "with other Match attributes",
549 				    filename, linenum, oattrib);
550 				result = -1;
551 				goto out;
552 			}
553 			if (result)
554 				result = negate ? 0 : 1;
555 			goto out;
556 		}
557 		attributes++;
558 		if (strcasecmp(attrib, "canonical") == 0) {
559 			r = !!post_canon;  /* force bitmask member to boolean */
560 			if (r == (negate ? 1 : 0))
561 				this_result = result = 0;
562 			debug3("%.200s line %d: %smatched '%s'",
563 			    filename, linenum,
564 			    this_result ? "" : "not ", oattrib);
565 			continue;
566 		}
567 		/* All other criteria require an argument */
568 		if ((arg = strdelim(&cp)) == NULL || *arg == '\0') {
569 			error("Missing Match criteria for %s", attrib);
570 			result = -1;
571 			goto out;
572 		}
573 		if (strcasecmp(attrib, "host") == 0) {
574 			criteria = xstrdup(host);
575 			r = match_hostname(host, arg) == 1;
576 			if (r == (negate ? 1 : 0))
577 				this_result = result = 0;
578 		} else if (strcasecmp(attrib, "originalhost") == 0) {
579 			criteria = xstrdup(original_host);
580 			r = match_hostname(original_host, arg) == 1;
581 			if (r == (negate ? 1 : 0))
582 				this_result = result = 0;
583 		} else if (strcasecmp(attrib, "user") == 0) {
584 			criteria = xstrdup(ruser);
585 			r = match_pattern_list(ruser, arg, 0) == 1;
586 			if (r == (negate ? 1 : 0))
587 				this_result = result = 0;
588 		} else if (strcasecmp(attrib, "localuser") == 0) {
589 			criteria = xstrdup(pw->pw_name);
590 			r = match_pattern_list(pw->pw_name, arg, 0) == 1;
591 			if (r == (negate ? 1 : 0))
592 				this_result = result = 0;
593 		} else if (strcasecmp(attrib, "exec") == 0) {
594 			if (gethostname(thishost, sizeof(thishost)) == -1)
595 				fatal("gethostname: %s", strerror(errno));
596 			strlcpy(shorthost, thishost, sizeof(shorthost));
597 			shorthost[strcspn(thishost, ".")] = '\0';
598 			snprintf(portstr, sizeof(portstr), "%d", port);
599 
600 			cmd = percent_expand(arg,
601 			    "L", shorthost,
602 			    "d", pw->pw_dir,
603 			    "h", host,
604 			    "l", thishost,
605 			    "n", original_host,
606 			    "p", portstr,
607 			    "r", ruser,
608 			    "u", pw->pw_name,
609 			    (char *)NULL);
610 			if (result != 1) {
611 				/* skip execution if prior predicate failed */
612 				debug3("%.200s line %d: skipped exec "
613 				    "\"%.100s\"", filename, linenum, cmd);
614 				free(cmd);
615 				continue;
616 			}
617 			r = execute_in_shell(cmd);
618 			if (r == -1) {
619 				fatal("%.200s line %d: match exec "
620 				    "'%.100s' error", filename,
621 				    linenum, cmd);
622 			}
623 			criteria = xstrdup(cmd);
624 			free(cmd);
625 			/* Force exit status to boolean */
626 			r = r == 0;
627 			if (r == (negate ? 1 : 0))
628 				this_result = result = 0;
629 		} else {
630 			error("Unsupported Match attribute %s", attrib);
631 			result = -1;
632 			goto out;
633 		}
634 		debug3("%.200s line %d: %smatched '%s \"%.100s\"' ",
635 		    filename, linenum, this_result ? "": "not ",
636 		    oattrib, criteria);
637 		free(criteria);
638 	}
639 	if (attributes == 0) {
640 		error("One or more attributes required for Match");
641 		result = -1;
642 		goto out;
643 	}
644  out:
645 	if (result != -1)
646 		debug2("match %sfound", result ? "" : "not ");
647 	*condition = cp;
648 	free(host);
649 	return result;
650 }
651 
652 /* Check and prepare a domain name: removes trailing '.' and lowercases */
653 static void
654 valid_domain(char *name, const char *filename, int linenum)
655 {
656 	size_t i, l = strlen(name);
657 	u_char c, last = '\0';
658 
659 	if (l == 0)
660 		fatal("%s line %d: empty hostname suffix", filename, linenum);
661 	if (!isalpha((u_char)name[0]) && !isdigit((u_char)name[0]))
662 		fatal("%s line %d: hostname suffix \"%.100s\" "
663 		    "starts with invalid character", filename, linenum, name);
664 	for (i = 0; i < l; i++) {
665 		c = tolower((u_char)name[i]);
666 		name[i] = (char)c;
667 		if (last == '.' && c == '.')
668 			fatal("%s line %d: hostname suffix \"%.100s\" contains "
669 			    "consecutive separators", filename, linenum, name);
670 		if (c != '.' && c != '-' && !isalnum(c) &&
671 		    c != '_') /* technically invalid, but common */
672 			fatal("%s line %d: hostname suffix \"%.100s\" contains "
673 			    "invalid characters", filename, linenum, name);
674 		last = c;
675 	}
676 	if (name[l - 1] == '.')
677 		name[l - 1] = '\0';
678 }
679 
680 /*
681  * Returns the number of the token pointed to by cp or oBadOption.
682  */
683 static OpCodes
684 parse_token(const char *cp, const char *filename, int linenum,
685     const char *ignored_unknown)
686 {
687 	int i;
688 
689 	for (i = 0; keywords[i].name; i++)
690 		if (strcmp(cp, keywords[i].name) == 0)
691 			return keywords[i].opcode;
692 	if (ignored_unknown != NULL &&
693 	    match_pattern_list(cp, ignored_unknown, 1) == 1)
694 		return oIgnoredUnknownOption;
695 	error("%s: line %d: Bad configuration option: %s",
696 	    filename, linenum, cp);
697 	return oBadOption;
698 }
699 
700 /* Multistate option parsing */
701 struct multistate {
702 	char *key;
703 	int value;
704 };
705 static const struct multistate multistate_flag[] = {
706 	{ "true",			1 },
707 	{ "false",			0 },
708 	{ "yes",			1 },
709 	{ "no",				0 },
710 	{ NULL, -1 }
711 };
712 static const struct multistate multistate_yesnoask[] = {
713 	{ "true",			1 },
714 	{ "false",			0 },
715 	{ "yes",			1 },
716 	{ "no",				0 },
717 	{ "ask",			2 },
718 	{ NULL, -1 }
719 };
720 static const struct multistate multistate_addressfamily[] = {
721 	{ "inet",			AF_INET },
722 	{ "inet6",			AF_INET6 },
723 	{ "any",			AF_UNSPEC },
724 	{ NULL, -1 }
725 };
726 static const struct multistate multistate_controlmaster[] = {
727 	{ "true",			SSHCTL_MASTER_YES },
728 	{ "yes",			SSHCTL_MASTER_YES },
729 	{ "false",			SSHCTL_MASTER_NO },
730 	{ "no",				SSHCTL_MASTER_NO },
731 	{ "auto",			SSHCTL_MASTER_AUTO },
732 	{ "ask",			SSHCTL_MASTER_ASK },
733 	{ "autoask",			SSHCTL_MASTER_AUTO_ASK },
734 	{ NULL, -1 }
735 };
736 static const struct multistate multistate_tunnel[] = {
737 	{ "ethernet",			SSH_TUNMODE_ETHERNET },
738 	{ "point-to-point",		SSH_TUNMODE_POINTOPOINT },
739 	{ "true",			SSH_TUNMODE_DEFAULT },
740 	{ "yes",			SSH_TUNMODE_DEFAULT },
741 	{ "false",			SSH_TUNMODE_NO },
742 	{ "no",				SSH_TUNMODE_NO },
743 	{ NULL, -1 }
744 };
745 static const struct multistate multistate_requesttty[] = {
746 	{ "true",			REQUEST_TTY_YES },
747 	{ "yes",			REQUEST_TTY_YES },
748 	{ "false",			REQUEST_TTY_NO },
749 	{ "no",				REQUEST_TTY_NO },
750 	{ "force",			REQUEST_TTY_FORCE },
751 	{ "auto",			REQUEST_TTY_AUTO },
752 	{ NULL, -1 }
753 };
754 static const struct multistate multistate_canonicalizehostname[] = {
755 	{ "true",			SSH_CANONICALISE_YES },
756 	{ "false",			SSH_CANONICALISE_NO },
757 	{ "yes",			SSH_CANONICALISE_YES },
758 	{ "no",				SSH_CANONICALISE_NO },
759 	{ "always",			SSH_CANONICALISE_ALWAYS },
760 	{ NULL, -1 }
761 };
762 
763 /*
764  * Processes a single option line as used in the configuration files. This
765  * only sets those values that have not already been set.
766  */
767 #define WHITESPACE " \t\r\n"
768 int
769 process_config_line(Options *options, struct passwd *pw, const char *host,
770     const char *original_host, char *line, const char *filename,
771     int linenum, int *activep, int flags)
772 {
773 	char *s, **charptr, *endofnumber, *keyword, *arg, *arg2;
774 	char **cpptr, fwdarg[256];
775 	u_int i, *uintptr, max_entries = 0;
776 	int negated, opcode, *intptr, value, value2, cmdline = 0;
777 	LogLevel *log_level_ptr;
778 	long long val64;
779 	size_t len;
780 	struct Forward fwd;
781 	const struct multistate *multistate_ptr;
782 	struct allowed_cname *cname;
783 
784 	if (activep == NULL) { /* We are processing a command line directive */
785 		cmdline = 1;
786 		activep = &cmdline;
787 	}
788 
789 	/* Strip trailing whitespace */
790 	if ((len = strlen(line)) == 0)
791 		return 0;
792 	for (len--; len > 0; len--) {
793 		if (strchr(WHITESPACE, line[len]) == NULL)
794 			break;
795 		line[len] = '\0';
796 	}
797 
798 	s = line;
799 	/* Get the keyword. (Each line is supposed to begin with a keyword). */
800 	if ((keyword = strdelim(&s)) == NULL)
801 		return 0;
802 	/* Ignore leading whitespace. */
803 	if (*keyword == '\0')
804 		keyword = strdelim(&s);
805 	if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
806 		return 0;
807 	/* Match lowercase keyword */
808 	lowercase(keyword);
809 
810 	opcode = parse_token(keyword, filename, linenum,
811 	    options->ignored_unknown);
812 
813 	switch (opcode) {
814 	case oBadOption:
815 		/* don't panic, but count bad options */
816 		return -1;
817 		/* NOTREACHED */
818 	case oIgnoredUnknownOption:
819 		debug("%s line %d: Ignored unknown option \"%s\"",
820 		    filename, linenum, keyword);
821 		return 0;
822 	case oConnectTimeout:
823 		intptr = &options->connection_timeout;
824 parse_time:
825 		arg = strdelim(&s);
826 		if (!arg || *arg == '\0')
827 			fatal("%s line %d: missing time value.",
828 			    filename, linenum);
829 		if (strcmp(arg, "none") == 0)
830 			value = -1;
831 		else if ((value = convtime(arg)) == -1)
832 			fatal("%s line %d: invalid time value.",
833 			    filename, linenum);
834 		if (*activep && *intptr == -1)
835 			*intptr = value;
836 		break;
837 
838 	case oForwardAgent:
839 		intptr = &options->forward_agent;
840  parse_flag:
841 		multistate_ptr = multistate_flag;
842  parse_multistate:
843 		arg = strdelim(&s);
844 		if (!arg || *arg == '\0')
845 			fatal("%s line %d: missing argument.",
846 			    filename, linenum);
847 		value = -1;
848 		for (i = 0; multistate_ptr[i].key != NULL; i++) {
849 			if (strcasecmp(arg, multistate_ptr[i].key) == 0) {
850 				value = multistate_ptr[i].value;
851 				break;
852 			}
853 		}
854 		if (value == -1)
855 			fatal("%s line %d: unsupported option \"%s\".",
856 			    filename, linenum, arg);
857 		if (*activep && *intptr == -1)
858 			*intptr = value;
859 		break;
860 
861 	case oForwardX11:
862 		intptr = &options->forward_x11;
863 		goto parse_flag;
864 
865 	case oForwardX11Trusted:
866 		intptr = &options->forward_x11_trusted;
867 		goto parse_flag;
868 
869 	case oForwardX11Timeout:
870 		intptr = &options->forward_x11_timeout;
871 		goto parse_time;
872 
873 	case oGatewayPorts:
874 		intptr = &options->fwd_opts.gateway_ports;
875 		goto parse_flag;
876 
877 	case oExitOnForwardFailure:
878 		intptr = &options->exit_on_forward_failure;
879 		goto parse_flag;
880 
881 	case oUsePrivilegedPort:
882 		intptr = &options->use_privileged_port;
883 		goto parse_flag;
884 
885 	case oPasswordAuthentication:
886 		intptr = &options->password_authentication;
887 		goto parse_flag;
888 
889 	case oKbdInteractiveAuthentication:
890 		intptr = &options->kbd_interactive_authentication;
891 		goto parse_flag;
892 
893 	case oKbdInteractiveDevices:
894 		charptr = &options->kbd_interactive_devices;
895 		goto parse_string;
896 
897 	case oPubkeyAuthentication:
898 		intptr = &options->pubkey_authentication;
899 		goto parse_flag;
900 
901 	case oRSAAuthentication:
902 		intptr = &options->rsa_authentication;
903 		goto parse_flag;
904 
905 	case oRhostsRSAAuthentication:
906 		intptr = &options->rhosts_rsa_authentication;
907 		goto parse_flag;
908 
909 	case oHostbasedAuthentication:
910 		intptr = &options->hostbased_authentication;
911 		goto parse_flag;
912 
913 	case oChallengeResponseAuthentication:
914 		intptr = &options->challenge_response_authentication;
915 		goto parse_flag;
916 
917 	case oGssAuthentication:
918 		intptr = &options->gss_authentication;
919 		goto parse_flag;
920 
921 	case oGssDelegateCreds:
922 		intptr = &options->gss_deleg_creds;
923 		goto parse_flag;
924 
925 	case oBatchMode:
926 		intptr = &options->batch_mode;
927 		goto parse_flag;
928 
929 	case oCheckHostIP:
930 		intptr = &options->check_host_ip;
931 		goto parse_flag;
932 
933 	case oVerifyHostKeyDNS:
934 		intptr = &options->verify_host_key_dns;
935 		multistate_ptr = multistate_yesnoask;
936 		goto parse_multistate;
937 
938 	case oStrictHostKeyChecking:
939 		intptr = &options->strict_host_key_checking;
940 		multistate_ptr = multistate_yesnoask;
941 		goto parse_multistate;
942 
943 	case oCompression:
944 		intptr = &options->compression;
945 		goto parse_flag;
946 
947 	case oTCPKeepAlive:
948 		intptr = &options->tcp_keep_alive;
949 		goto parse_flag;
950 
951 	case oNoHostAuthenticationForLocalhost:
952 		intptr = &options->no_host_authentication_for_localhost;
953 		goto parse_flag;
954 
955 	case oNumberOfPasswordPrompts:
956 		intptr = &options->number_of_password_prompts;
957 		goto parse_int;
958 
959 	case oCompressionLevel:
960 		intptr = &options->compression_level;
961 		goto parse_int;
962 
963 	case oRekeyLimit:
964 		arg = strdelim(&s);
965 		if (!arg || *arg == '\0')
966 			fatal("%.200s line %d: Missing argument.", filename,
967 			    linenum);
968 		if (strcmp(arg, "default") == 0) {
969 			val64 = 0;
970 		} else {
971 			if (scan_scaled(arg, &val64) == -1)
972 				fatal("%.200s line %d: Bad number '%s': %s",
973 				    filename, linenum, arg, strerror(errno));
974 			/* check for too-large or too-small limits */
975 			if (val64 > UINT_MAX)
976 				fatal("%.200s line %d: RekeyLimit too large",
977 				    filename, linenum);
978 			if (val64 != 0 && val64 < 16)
979 				fatal("%.200s line %d: RekeyLimit too small",
980 				    filename, linenum);
981 		}
982 		if (*activep && options->rekey_limit == -1)
983 			options->rekey_limit = (u_int32_t)val64;
984 		if (s != NULL) { /* optional rekey interval present */
985 			if (strcmp(s, "none") == 0) {
986 				(void)strdelim(&s);	/* discard */
987 				break;
988 			}
989 			intptr = &options->rekey_interval;
990 			goto parse_time;
991 		}
992 		break;
993 
994 	case oIdentityFile:
995 		arg = strdelim(&s);
996 		if (!arg || *arg == '\0')
997 			fatal("%.200s line %d: Missing argument.", filename, linenum);
998 		if (*activep) {
999 			intptr = &options->num_identity_files;
1000 			if (*intptr >= SSH_MAX_IDENTITY_FILES)
1001 				fatal("%.200s line %d: Too many identity files specified (max %d).",
1002 				    filename, linenum, SSH_MAX_IDENTITY_FILES);
1003 			add_identity_file(options, NULL,
1004 			    arg, flags & SSHCONF_USERCONF);
1005 		}
1006 		break;
1007 
1008 	case oXAuthLocation:
1009 		charptr=&options->xauth_location;
1010 		goto parse_string;
1011 
1012 	case oUser:
1013 		charptr = &options->user;
1014 parse_string:
1015 		arg = strdelim(&s);
1016 		if (!arg || *arg == '\0')
1017 			fatal("%.200s line %d: Missing argument.",
1018 			    filename, linenum);
1019 		if (*activep && *charptr == NULL)
1020 			*charptr = xstrdup(arg);
1021 		break;
1022 
1023 	case oGlobalKnownHostsFile:
1024 		cpptr = (char **)&options->system_hostfiles;
1025 		uintptr = &options->num_system_hostfiles;
1026 		max_entries = SSH_MAX_HOSTS_FILES;
1027 parse_char_array:
1028 		if (*activep && *uintptr == 0) {
1029 			while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1030 				if ((*uintptr) >= max_entries)
1031 					fatal("%s line %d: "
1032 					    "too many authorized keys files.",
1033 					    filename, linenum);
1034 				cpptr[(*uintptr)++] = xstrdup(arg);
1035 			}
1036 		}
1037 		return 0;
1038 
1039 	case oUserKnownHostsFile:
1040 		cpptr = (char **)&options->user_hostfiles;
1041 		uintptr = &options->num_user_hostfiles;
1042 		max_entries = SSH_MAX_HOSTS_FILES;
1043 		goto parse_char_array;
1044 
1045 	case oHostName:
1046 		charptr = &options->hostname;
1047 		goto parse_string;
1048 
1049 	case oHostKeyAlias:
1050 		charptr = &options->host_key_alias;
1051 		goto parse_string;
1052 
1053 	case oPreferredAuthentications:
1054 		charptr = &options->preferred_authentications;
1055 		goto parse_string;
1056 
1057 	case oBindAddress:
1058 		charptr = &options->bind_address;
1059 		goto parse_string;
1060 
1061 	case oPKCS11Provider:
1062 		charptr = &options->pkcs11_provider;
1063 		goto parse_string;
1064 
1065 	case oProxyCommand:
1066 		charptr = &options->proxy_command;
1067 parse_command:
1068 		if (s == NULL)
1069 			fatal("%.200s line %d: Missing argument.", filename, linenum);
1070 		len = strspn(s, WHITESPACE "=");
1071 		if (*activep && *charptr == NULL)
1072 			*charptr = xstrdup(s + len);
1073 		return 0;
1074 
1075 	case oPort:
1076 		intptr = &options->port;
1077 parse_int:
1078 		arg = strdelim(&s);
1079 		if (!arg || *arg == '\0')
1080 			fatal("%.200s line %d: Missing argument.", filename, linenum);
1081 		if (arg[0] < '0' || arg[0] > '9')
1082 			fatal("%.200s line %d: Bad number.", filename, linenum);
1083 
1084 		/* Octal, decimal, or hex format? */
1085 		value = strtol(arg, &endofnumber, 0);
1086 		if (arg == endofnumber)
1087 			fatal("%.200s line %d: Bad number.", filename, linenum);
1088 		if (*activep && *intptr == -1)
1089 			*intptr = value;
1090 		break;
1091 
1092 	case oConnectionAttempts:
1093 		intptr = &options->connection_attempts;
1094 		goto parse_int;
1095 
1096 	case oCipher:
1097 		intptr = &options->cipher;
1098 		arg = strdelim(&s);
1099 		if (!arg || *arg == '\0')
1100 			fatal("%.200s line %d: Missing argument.", filename, linenum);
1101 		value = cipher_number(arg);
1102 		if (value == -1)
1103 			fatal("%.200s line %d: Bad cipher '%s'.",
1104 			    filename, linenum, arg ? arg : "<NONE>");
1105 		if (*activep && *intptr == -1)
1106 			*intptr = value;
1107 		break;
1108 
1109 	case oCiphers:
1110 		arg = strdelim(&s);
1111 		if (!arg || *arg == '\0')
1112 			fatal("%.200s line %d: Missing argument.", filename, linenum);
1113 		if (!ciphers_valid(*arg == '+' ? arg + 1 : arg))
1114 			fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
1115 			    filename, linenum, arg ? arg : "<NONE>");
1116 		if (*activep && options->ciphers == NULL)
1117 			options->ciphers = xstrdup(arg);
1118 		break;
1119 
1120 	case oMacs:
1121 		arg = strdelim(&s);
1122 		if (!arg || *arg == '\0')
1123 			fatal("%.200s line %d: Missing argument.", filename, linenum);
1124 		if (!mac_valid(*arg == '+' ? arg + 1 : arg))
1125 			fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.",
1126 			    filename, linenum, arg ? arg : "<NONE>");
1127 		if (*activep && options->macs == NULL)
1128 			options->macs = xstrdup(arg);
1129 		break;
1130 
1131 	case oKexAlgorithms:
1132 		arg = strdelim(&s);
1133 		if (!arg || *arg == '\0')
1134 			fatal("%.200s line %d: Missing argument.",
1135 			    filename, linenum);
1136 		if (!kex_names_valid(*arg == '+' ? arg + 1 : arg))
1137 			fatal("%.200s line %d: Bad SSH2 KexAlgorithms '%s'.",
1138 			    filename, linenum, arg ? arg : "<NONE>");
1139 		if (*activep && options->kex_algorithms == NULL)
1140 			options->kex_algorithms = xstrdup(arg);
1141 		break;
1142 
1143 	case oHostKeyAlgorithms:
1144 		charptr = &options->hostkeyalgorithms;
1145 parse_keytypes:
1146 		arg = strdelim(&s);
1147 		if (!arg || *arg == '\0')
1148 			fatal("%.200s line %d: Missing argument.",
1149 			    filename, linenum);
1150 		if (!sshkey_names_valid2(*arg == '+' ? arg + 1 : arg, 1))
1151 			fatal("%s line %d: Bad key types '%s'.",
1152 				filename, linenum, arg ? arg : "<NONE>");
1153 		if (*activep && *charptr == NULL)
1154 			*charptr = xstrdup(arg);
1155 		break;
1156 
1157 	case oProtocol:
1158 		intptr = &options->protocol;
1159 		arg = strdelim(&s);
1160 		if (!arg || *arg == '\0')
1161 			fatal("%.200s line %d: Missing argument.", filename, linenum);
1162 		value = proto_spec(arg);
1163 		if (value == SSH_PROTO_UNKNOWN)
1164 			fatal("%.200s line %d: Bad protocol spec '%s'.",
1165 			    filename, linenum, arg ? arg : "<NONE>");
1166 		if (*activep && *intptr == SSH_PROTO_UNKNOWN)
1167 			*intptr = value;
1168 		break;
1169 
1170 	case oLogLevel:
1171 		log_level_ptr = &options->log_level;
1172 		arg = strdelim(&s);
1173 		value = log_level_number(arg);
1174 		if (value == SYSLOG_LEVEL_NOT_SET)
1175 			fatal("%.200s line %d: unsupported log level '%s'",
1176 			    filename, linenum, arg ? arg : "<NONE>");
1177 		if (*activep && *log_level_ptr == SYSLOG_LEVEL_NOT_SET)
1178 			*log_level_ptr = (LogLevel) value;
1179 		break;
1180 
1181 	case oLocalForward:
1182 	case oRemoteForward:
1183 	case oDynamicForward:
1184 		arg = strdelim(&s);
1185 		if (arg == NULL || *arg == '\0')
1186 			fatal("%.200s line %d: Missing port argument.",
1187 			    filename, linenum);
1188 
1189 		if (opcode == oLocalForward ||
1190 		    opcode == oRemoteForward) {
1191 			arg2 = strdelim(&s);
1192 			if (arg2 == NULL || *arg2 == '\0')
1193 				fatal("%.200s line %d: Missing target argument.",
1194 				    filename, linenum);
1195 
1196 			/* construct a string for parse_forward */
1197 			snprintf(fwdarg, sizeof(fwdarg), "%s:%s", arg, arg2);
1198 		} else if (opcode == oDynamicForward) {
1199 			strlcpy(fwdarg, arg, sizeof(fwdarg));
1200 		}
1201 
1202 		if (parse_forward(&fwd, fwdarg,
1203 		    opcode == oDynamicForward ? 1 : 0,
1204 		    opcode == oRemoteForward ? 1 : 0) == 0)
1205 			fatal("%.200s line %d: Bad forwarding specification.",
1206 			    filename, linenum);
1207 
1208 		if (*activep) {
1209 			if (opcode == oLocalForward ||
1210 			    opcode == oDynamicForward)
1211 				add_local_forward(options, &fwd);
1212 			else if (opcode == oRemoteForward)
1213 				add_remote_forward(options, &fwd);
1214 		}
1215 		break;
1216 
1217 	case oClearAllForwardings:
1218 		intptr = &options->clear_forwardings;
1219 		goto parse_flag;
1220 
1221 	case oHost:
1222 		if (cmdline)
1223 			fatal("Host directive not supported as a command-line "
1224 			    "option");
1225 		*activep = 0;
1226 		arg2 = NULL;
1227 		while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1228 			negated = *arg == '!';
1229 			if (negated)
1230 				arg++;
1231 			if (match_pattern(host, arg)) {
1232 				if (negated) {
1233 					debug("%.200s line %d: Skipping Host "
1234 					    "block because of negated match "
1235 					    "for %.100s", filename, linenum,
1236 					    arg);
1237 					*activep = 0;
1238 					break;
1239 				}
1240 				if (!*activep)
1241 					arg2 = arg; /* logged below */
1242 				*activep = 1;
1243 			}
1244 		}
1245 		if (*activep)
1246 			debug("%.200s line %d: Applying options for %.100s",
1247 			    filename, linenum, arg2);
1248 		/* Avoid garbage check below, as strdelim is done. */
1249 		return 0;
1250 
1251 	case oMatch:
1252 		if (cmdline)
1253 			fatal("Host directive not supported as a command-line "
1254 			    "option");
1255 		value = match_cfg_line(options, &s, pw, host, original_host,
1256 		    flags & SSHCONF_POSTCANON, filename, linenum);
1257 		if (value < 0)
1258 			fatal("%.200s line %d: Bad Match condition", filename,
1259 			    linenum);
1260 		*activep = value;
1261 		break;
1262 
1263 	case oEscapeChar:
1264 		intptr = &options->escape_char;
1265 		arg = strdelim(&s);
1266 		if (!arg || *arg == '\0')
1267 			fatal("%.200s line %d: Missing argument.", filename, linenum);
1268 		if (strcmp(arg, "none") == 0)
1269 			value = SSH_ESCAPECHAR_NONE;
1270 		else if (arg[1] == '\0')
1271 			value = (u_char) arg[0];
1272 		else if (arg[0] == '^' && arg[2] == 0 &&
1273 		    (u_char) arg[1] >= 64 && (u_char) arg[1] < 128)
1274 			value = (u_char) arg[1] & 31;
1275 		else {
1276 			fatal("%.200s line %d: Bad escape character.",
1277 			    filename, linenum);
1278 			/* NOTREACHED */
1279 			value = 0;	/* Avoid compiler warning. */
1280 		}
1281 		if (*activep && *intptr == -1)
1282 			*intptr = value;
1283 		break;
1284 
1285 	case oAddressFamily:
1286 		intptr = &options->address_family;
1287 		multistate_ptr = multistate_addressfamily;
1288 		goto parse_multistate;
1289 
1290 	case oEnableSSHKeysign:
1291 		intptr = &options->enable_ssh_keysign;
1292 		goto parse_flag;
1293 
1294 	case oIdentitiesOnly:
1295 		intptr = &options->identities_only;
1296 		goto parse_flag;
1297 
1298 	case oServerAliveInterval:
1299 		intptr = &options->server_alive_interval;
1300 		goto parse_time;
1301 
1302 	case oServerAliveCountMax:
1303 		intptr = &options->server_alive_count_max;
1304 		goto parse_int;
1305 
1306 	case oSendEnv:
1307 		while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1308 			if (strchr(arg, '=') != NULL)
1309 				fatal("%s line %d: Invalid environment name.",
1310 				    filename, linenum);
1311 			if (!*activep)
1312 				continue;
1313 			if (options->num_send_env >= MAX_SEND_ENV)
1314 				fatal("%s line %d: too many send env.",
1315 				    filename, linenum);
1316 			options->send_env[options->num_send_env++] =
1317 			    xstrdup(arg);
1318 		}
1319 		break;
1320 
1321 	case oControlPath:
1322 		charptr = &options->control_path;
1323 		goto parse_string;
1324 
1325 	case oControlMaster:
1326 		intptr = &options->control_master;
1327 		multistate_ptr = multistate_controlmaster;
1328 		goto parse_multistate;
1329 
1330 	case oControlPersist:
1331 		/* no/false/yes/true, or a time spec */
1332 		intptr = &options->control_persist;
1333 		arg = strdelim(&s);
1334 		if (!arg || *arg == '\0')
1335 			fatal("%.200s line %d: Missing ControlPersist"
1336 			    " argument.", filename, linenum);
1337 		value = 0;
1338 		value2 = 0;	/* timeout */
1339 		if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
1340 			value = 0;
1341 		else if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
1342 			value = 1;
1343 		else if ((value2 = convtime(arg)) >= 0)
1344 			value = 1;
1345 		else
1346 			fatal("%.200s line %d: Bad ControlPersist argument.",
1347 			    filename, linenum);
1348 		if (*activep && *intptr == -1) {
1349 			*intptr = value;
1350 			options->control_persist_timeout = value2;
1351 		}
1352 		break;
1353 
1354 	case oHashKnownHosts:
1355 		intptr = &options->hash_known_hosts;
1356 		goto parse_flag;
1357 
1358 	case oTunnel:
1359 		intptr = &options->tun_open;
1360 		multistate_ptr = multistate_tunnel;
1361 		goto parse_multistate;
1362 
1363 	case oTunnelDevice:
1364 		arg = strdelim(&s);
1365 		if (!arg || *arg == '\0')
1366 			fatal("%.200s line %d: Missing argument.", filename, linenum);
1367 		value = a2tun(arg, &value2);
1368 		if (value == SSH_TUNID_ERR)
1369 			fatal("%.200s line %d: Bad tun device.", filename, linenum);
1370 		if (*activep) {
1371 			options->tun_local = value;
1372 			options->tun_remote = value2;
1373 		}
1374 		break;
1375 
1376 	case oLocalCommand:
1377 		charptr = &options->local_command;
1378 		goto parse_command;
1379 
1380 	case oPermitLocalCommand:
1381 		intptr = &options->permit_local_command;
1382 		goto parse_flag;
1383 
1384 	case oVisualHostKey:
1385 		intptr = &options->visual_host_key;
1386 		goto parse_flag;
1387 
1388 	case oIPQoS:
1389 		arg = strdelim(&s);
1390 		if ((value = parse_ipqos(arg)) == -1)
1391 			fatal("%s line %d: Bad IPQoS value: %s",
1392 			    filename, linenum, arg);
1393 		arg = strdelim(&s);
1394 		if (arg == NULL)
1395 			value2 = value;
1396 		else if ((value2 = parse_ipqos(arg)) == -1)
1397 			fatal("%s line %d: Bad IPQoS value: %s",
1398 			    filename, linenum, arg);
1399 		if (*activep) {
1400 			options->ip_qos_interactive = value;
1401 			options->ip_qos_bulk = value2;
1402 		}
1403 		break;
1404 
1405 	case oUseRoaming:
1406 		intptr = &options->use_roaming;
1407 		goto parse_flag;
1408 
1409 	case oRequestTTY:
1410 		intptr = &options->request_tty;
1411 		multistate_ptr = multistate_requesttty;
1412 		goto parse_multistate;
1413 
1414 	case oVersionAddendum:
1415 		if (s == NULL)
1416 			fatal("%.200s line %d: Missing argument.", filename,
1417 			    linenum);
1418 		len = strspn(s, WHITESPACE);
1419 		if (*activep && options->version_addendum == NULL) {
1420 			if (strcasecmp(s + len, "none") == 0)
1421 				options->version_addendum = xstrdup("");
1422 			else if (strchr(s + len, '\r') != NULL)
1423 				fatal("%.200s line %d: Invalid argument",
1424 				    filename, linenum);
1425 			else
1426 				options->version_addendum = xstrdup(s + len);
1427 		}
1428 		return 0;
1429 
1430 	case oIgnoreUnknown:
1431 		charptr = &options->ignored_unknown;
1432 		goto parse_string;
1433 
1434 	case oProxyUseFdpass:
1435 		intptr = &options->proxy_use_fdpass;
1436 		goto parse_flag;
1437 
1438 	case oCanonicalDomains:
1439 		value = options->num_canonical_domains != 0;
1440 		while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1441 			valid_domain(arg, filename, linenum);
1442 			if (!*activep || value)
1443 				continue;
1444 			if (options->num_canonical_domains >= MAX_CANON_DOMAINS)
1445 				fatal("%s line %d: too many hostname suffixes.",
1446 				    filename, linenum);
1447 			options->canonical_domains[
1448 			    options->num_canonical_domains++] = xstrdup(arg);
1449 		}
1450 		break;
1451 
1452 	case oCanonicalizePermittedCNAMEs:
1453 		value = options->num_permitted_cnames != 0;
1454 		while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1455 			/* Either '*' for everything or 'list:list' */
1456 			if (strcmp(arg, "*") == 0)
1457 				arg2 = arg;
1458 			else {
1459 				lowercase(arg);
1460 				if ((arg2 = strchr(arg, ':')) == NULL ||
1461 				    arg2[1] == '\0') {
1462 					fatal("%s line %d: "
1463 					    "Invalid permitted CNAME \"%s\"",
1464 					    filename, linenum, arg);
1465 				}
1466 				*arg2 = '\0';
1467 				arg2++;
1468 			}
1469 			if (!*activep || value)
1470 				continue;
1471 			if (options->num_permitted_cnames >= MAX_CANON_DOMAINS)
1472 				fatal("%s line %d: too many permitted CNAMEs.",
1473 				    filename, linenum);
1474 			cname = options->permitted_cnames +
1475 			    options->num_permitted_cnames++;
1476 			cname->source_list = xstrdup(arg);
1477 			cname->target_list = xstrdup(arg2);
1478 		}
1479 		break;
1480 
1481 	case oCanonicalizeHostname:
1482 		intptr = &options->canonicalize_hostname;
1483 		multistate_ptr = multistate_canonicalizehostname;
1484 		goto parse_multistate;
1485 
1486 	case oCanonicalizeMaxDots:
1487 		intptr = &options->canonicalize_max_dots;
1488 		goto parse_int;
1489 
1490 	case oCanonicalizeFallbackLocal:
1491 		intptr = &options->canonicalize_fallback_local;
1492 		goto parse_flag;
1493 
1494 	case oStreamLocalBindMask:
1495 		arg = strdelim(&s);
1496 		if (!arg || *arg == '\0')
1497 			fatal("%.200s line %d: Missing StreamLocalBindMask argument.", filename, linenum);
1498 		/* Parse mode in octal format */
1499 		value = strtol(arg, &endofnumber, 8);
1500 		if (arg == endofnumber || value < 0 || value > 0777)
1501 			fatal("%.200s line %d: Bad mask.", filename, linenum);
1502 		options->fwd_opts.streamlocal_bind_mask = (mode_t)value;
1503 		break;
1504 
1505 	case oStreamLocalBindUnlink:
1506 		intptr = &options->fwd_opts.streamlocal_bind_unlink;
1507 		goto parse_flag;
1508 
1509 	case oRevokedHostKeys:
1510 		charptr = &options->revoked_host_keys;
1511 		goto parse_string;
1512 
1513 	case oFingerprintHash:
1514 		intptr = &options->fingerprint_hash;
1515 		arg = strdelim(&s);
1516 		if (!arg || *arg == '\0')
1517 			fatal("%.200s line %d: Missing argument.",
1518 			    filename, linenum);
1519 		if ((value = ssh_digest_alg_by_name(arg)) == -1)
1520 			fatal("%.200s line %d: Invalid hash algorithm \"%s\".",
1521 			    filename, linenum, arg);
1522 		if (*activep && *intptr == -1)
1523 			*intptr = value;
1524 		break;
1525 
1526 	case oUpdateHostkeys:
1527 		intptr = &options->update_hostkeys;
1528 		multistate_ptr = multistate_yesnoask;
1529 		goto parse_multistate;
1530 
1531 	case oHostbasedKeyTypes:
1532 		charptr = &options->hostbased_key_types;
1533 		goto parse_keytypes;
1534 
1535 	case oPubkeyAcceptedKeyTypes:
1536 		charptr = &options->pubkey_key_types;
1537 		goto parse_keytypes;
1538 
1539 	case oDeprecated:
1540 		debug("%s line %d: Deprecated option \"%s\"",
1541 		    filename, linenum, keyword);
1542 		return 0;
1543 
1544 	case oUnsupported:
1545 		error("%s line %d: Unsupported option \"%s\"",
1546 		    filename, linenum, keyword);
1547 		return 0;
1548 
1549 	default:
1550 		fatal("%s: Unimplemented opcode %d", __func__, opcode);
1551 	}
1552 
1553 	/* Check that there is no garbage at end of line. */
1554 	if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
1555 		fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
1556 		    filename, linenum, arg);
1557 	}
1558 	return 0;
1559 }
1560 
1561 
1562 /*
1563  * Reads the config file and modifies the options accordingly.  Options
1564  * should already be initialized before this call.  This never returns if
1565  * there is an error.  If the file does not exist, this returns 0.
1566  */
1567 
1568 int
1569 read_config_file(const char *filename, struct passwd *pw, const char *host,
1570     const char *original_host, Options *options, int flags)
1571 {
1572 	FILE *f;
1573 	char line[1024];
1574 	int active, linenum;
1575 	int bad_options = 0;
1576 
1577 	if ((f = fopen(filename, "r")) == NULL)
1578 		return 0;
1579 
1580 	if (flags & SSHCONF_CHECKPERM) {
1581 		struct stat sb;
1582 
1583 		if (fstat(fileno(f), &sb) == -1)
1584 			fatal("fstat %s: %s", filename, strerror(errno));
1585 		if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
1586 		    (sb.st_mode & 022) != 0))
1587 			fatal("Bad owner or permissions on %s", filename);
1588 	}
1589 
1590 	debug("Reading configuration data %.200s", filename);
1591 
1592 	/*
1593 	 * Mark that we are now processing the options.  This flag is turned
1594 	 * on/off by Host specifications.
1595 	 */
1596 	active = 1;
1597 	linenum = 0;
1598 	while (fgets(line, sizeof(line), f)) {
1599 		/* Update line number counter. */
1600 		linenum++;
1601 		if (process_config_line(options, pw, host, original_host,
1602 		    line, filename, linenum, &active, flags) != 0)
1603 			bad_options++;
1604 	}
1605 	fclose(f);
1606 	if (bad_options > 0)
1607 		fatal("%s: terminating, %d bad configuration options",
1608 		    filename, bad_options);
1609 	return 1;
1610 }
1611 
1612 /* Returns 1 if a string option is unset or set to "none" or 0 otherwise. */
1613 int
1614 option_clear_or_none(const char *o)
1615 {
1616 	return o == NULL || strcasecmp(o, "none") == 0;
1617 }
1618 
1619 /*
1620  * Initializes options to special values that indicate that they have not yet
1621  * been set.  Read_config_file will only set options with this value. Options
1622  * are processed in the following order: command line, user config file,
1623  * system config file.  Last, fill_default_options is called.
1624  */
1625 
1626 void
1627 initialize_options(Options * options)
1628 {
1629 	memset(options, 'X', sizeof(*options));
1630 	options->version_addendum = NULL;
1631 	options->forward_agent = -1;
1632 	options->forward_x11 = -1;
1633 	options->forward_x11_trusted = -1;
1634 	options->forward_x11_timeout = -1;
1635 	options->exit_on_forward_failure = -1;
1636 	options->xauth_location = NULL;
1637 	options->fwd_opts.gateway_ports = -1;
1638 	options->fwd_opts.streamlocal_bind_mask = (mode_t)-1;
1639 	options->fwd_opts.streamlocal_bind_unlink = -1;
1640 	options->use_privileged_port = -1;
1641 	options->rsa_authentication = -1;
1642 	options->pubkey_authentication = -1;
1643 	options->challenge_response_authentication = -1;
1644 	options->gss_authentication = -1;
1645 	options->gss_deleg_creds = -1;
1646 	options->password_authentication = -1;
1647 	options->kbd_interactive_authentication = -1;
1648 	options->kbd_interactive_devices = NULL;
1649 	options->rhosts_rsa_authentication = -1;
1650 	options->hostbased_authentication = -1;
1651 	options->batch_mode = -1;
1652 	options->check_host_ip = -1;
1653 	options->strict_host_key_checking = -1;
1654 	options->compression = -1;
1655 	options->tcp_keep_alive = -1;
1656 	options->compression_level = -1;
1657 	options->port = -1;
1658 	options->address_family = -1;
1659 	options->connection_attempts = -1;
1660 	options->connection_timeout = -1;
1661 	options->number_of_password_prompts = -1;
1662 	options->cipher = -1;
1663 	options->ciphers = NULL;
1664 	options->macs = NULL;
1665 	options->kex_algorithms = NULL;
1666 	options->hostkeyalgorithms = NULL;
1667 	options->protocol = SSH_PROTO_UNKNOWN;
1668 	options->num_identity_files = 0;
1669 	options->hostname = NULL;
1670 	options->host_key_alias = NULL;
1671 	options->proxy_command = NULL;
1672 	options->user = NULL;
1673 	options->escape_char = -1;
1674 	options->num_system_hostfiles = 0;
1675 	options->num_user_hostfiles = 0;
1676 	options->local_forwards = NULL;
1677 	options->num_local_forwards = 0;
1678 	options->remote_forwards = NULL;
1679 	options->num_remote_forwards = 0;
1680 	options->clear_forwardings = -1;
1681 	options->log_level = SYSLOG_LEVEL_NOT_SET;
1682 	options->preferred_authentications = NULL;
1683 	options->bind_address = NULL;
1684 	options->pkcs11_provider = NULL;
1685 	options->enable_ssh_keysign = - 1;
1686 	options->no_host_authentication_for_localhost = - 1;
1687 	options->identities_only = - 1;
1688 	options->rekey_limit = - 1;
1689 	options->rekey_interval = -1;
1690 	options->verify_host_key_dns = -1;
1691 	options->server_alive_interval = -1;
1692 	options->server_alive_count_max = -1;
1693 	options->num_send_env = 0;
1694 	options->control_path = NULL;
1695 	options->control_master = -1;
1696 	options->control_persist = -1;
1697 	options->control_persist_timeout = 0;
1698 	options->hash_known_hosts = -1;
1699 	options->tun_open = -1;
1700 	options->tun_local = -1;
1701 	options->tun_remote = -1;
1702 	options->local_command = NULL;
1703 	options->permit_local_command = -1;
1704 	options->use_roaming = 0;
1705 	options->visual_host_key = -1;
1706 	options->ip_qos_interactive = -1;
1707 	options->ip_qos_bulk = -1;
1708 	options->request_tty = -1;
1709 	options->proxy_use_fdpass = -1;
1710 	options->ignored_unknown = NULL;
1711 	options->num_canonical_domains = 0;
1712 	options->num_permitted_cnames = 0;
1713 	options->canonicalize_max_dots = -1;
1714 	options->canonicalize_fallback_local = -1;
1715 	options->canonicalize_hostname = -1;
1716 	options->revoked_host_keys = NULL;
1717 	options->fingerprint_hash = -1;
1718 	options->update_hostkeys = -1;
1719 	options->hostbased_key_types = NULL;
1720 	options->pubkey_key_types = NULL;
1721 }
1722 
1723 /*
1724  * A petite version of fill_default_options() that just fills the options
1725  * needed for hostname canonicalization to proceed.
1726  */
1727 void
1728 fill_default_options_for_canonicalization(Options *options)
1729 {
1730 	if (options->canonicalize_max_dots == -1)
1731 		options->canonicalize_max_dots = 1;
1732 	if (options->canonicalize_fallback_local == -1)
1733 		options->canonicalize_fallback_local = 1;
1734 	if (options->canonicalize_hostname == -1)
1735 		options->canonicalize_hostname = SSH_CANONICALISE_NO;
1736 }
1737 
1738 /*
1739  * Called after processing other sources of option data, this fills those
1740  * options for which no value has been specified with their default values.
1741  */
1742 void
1743 fill_default_options(Options * options)
1744 {
1745 	if (options->forward_agent == -1)
1746 		options->forward_agent = 0;
1747 	if (options->forward_x11 == -1)
1748 		options->forward_x11 = 0;
1749 	if (options->forward_x11_trusted == -1)
1750 		options->forward_x11_trusted = 0;
1751 	if (options->forward_x11_timeout == -1)
1752 		options->forward_x11_timeout = 1200;
1753 	if (options->exit_on_forward_failure == -1)
1754 		options->exit_on_forward_failure = 0;
1755 	if (options->xauth_location == NULL)
1756 		options->xauth_location = _PATH_XAUTH;
1757 	if (options->fwd_opts.gateway_ports == -1)
1758 		options->fwd_opts.gateway_ports = 0;
1759 	if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
1760 		options->fwd_opts.streamlocal_bind_mask = 0177;
1761 	if (options->fwd_opts.streamlocal_bind_unlink == -1)
1762 		options->fwd_opts.streamlocal_bind_unlink = 0;
1763 	if (options->use_privileged_port == -1)
1764 		options->use_privileged_port = 0;
1765 	if (options->rsa_authentication == -1)
1766 		options->rsa_authentication = 1;
1767 	if (options->pubkey_authentication == -1)
1768 		options->pubkey_authentication = 1;
1769 	if (options->challenge_response_authentication == -1)
1770 		options->challenge_response_authentication = 1;
1771 	if (options->gss_authentication == -1)
1772 		options->gss_authentication = 0;
1773 	if (options->gss_deleg_creds == -1)
1774 		options->gss_deleg_creds = 0;
1775 	if (options->password_authentication == -1)
1776 		options->password_authentication = 1;
1777 	if (options->kbd_interactive_authentication == -1)
1778 		options->kbd_interactive_authentication = 1;
1779 	if (options->rhosts_rsa_authentication == -1)
1780 		options->rhosts_rsa_authentication = 0;
1781 	if (options->hostbased_authentication == -1)
1782 		options->hostbased_authentication = 0;
1783 	if (options->batch_mode == -1)
1784 		options->batch_mode = 0;
1785 	if (options->check_host_ip == -1)
1786 		options->check_host_ip = 0;
1787 	if (options->strict_host_key_checking == -1)
1788 		options->strict_host_key_checking = 2;	/* 2 is default */
1789 	if (options->compression == -1)
1790 		options->compression = 0;
1791 	if (options->tcp_keep_alive == -1)
1792 		options->tcp_keep_alive = 1;
1793 	if (options->compression_level == -1)
1794 		options->compression_level = 6;
1795 	if (options->port == -1)
1796 		options->port = 0;	/* Filled in ssh_connect. */
1797 	if (options->address_family == -1)
1798 		options->address_family = AF_UNSPEC;
1799 	if (options->connection_attempts == -1)
1800 		options->connection_attempts = 1;
1801 	if (options->number_of_password_prompts == -1)
1802 		options->number_of_password_prompts = 3;
1803 	/* Selected in ssh_login(). */
1804 	if (options->cipher == -1)
1805 		options->cipher = SSH_CIPHER_NOT_SET;
1806 	/* options->hostkeyalgorithms, default set in myproposals.h */
1807 	if (options->protocol == SSH_PROTO_UNKNOWN)
1808 		options->protocol = SSH_PROTO_2;
1809 	if (options->num_identity_files == 0) {
1810 		if (options->protocol & SSH_PROTO_1) {
1811 			add_identity_file(options, "~/",
1812 			    _PATH_SSH_CLIENT_IDENTITY, 0);
1813 		}
1814 		if (options->protocol & SSH_PROTO_2) {
1815 			add_identity_file(options, "~/",
1816 			    _PATH_SSH_CLIENT_ID_RSA, 0);
1817 			add_identity_file(options, "~/",
1818 			    _PATH_SSH_CLIENT_ID_DSA, 0);
1819 #ifdef OPENSSL_HAS_ECC
1820 			add_identity_file(options, "~/",
1821 			    _PATH_SSH_CLIENT_ID_ECDSA, 0);
1822 #endif
1823 			add_identity_file(options, "~/",
1824 			    _PATH_SSH_CLIENT_ID_ED25519, 0);
1825 		}
1826 	}
1827 	if (options->escape_char == -1)
1828 		options->escape_char = '~';
1829 	if (options->num_system_hostfiles == 0) {
1830 		options->system_hostfiles[options->num_system_hostfiles++] =
1831 		    xstrdup(_PATH_SSH_SYSTEM_HOSTFILE);
1832 		options->system_hostfiles[options->num_system_hostfiles++] =
1833 		    xstrdup(_PATH_SSH_SYSTEM_HOSTFILE2);
1834 	}
1835 	if (options->num_user_hostfiles == 0) {
1836 		options->user_hostfiles[options->num_user_hostfiles++] =
1837 		    xstrdup(_PATH_SSH_USER_HOSTFILE);
1838 		options->user_hostfiles[options->num_user_hostfiles++] =
1839 		    xstrdup(_PATH_SSH_USER_HOSTFILE2);
1840 	}
1841 	if (options->log_level == SYSLOG_LEVEL_NOT_SET)
1842 		options->log_level = SYSLOG_LEVEL_INFO;
1843 	if (options->clear_forwardings == 1)
1844 		clear_forwardings(options);
1845 	if (options->no_host_authentication_for_localhost == - 1)
1846 		options->no_host_authentication_for_localhost = 0;
1847 	if (options->identities_only == -1)
1848 		options->identities_only = 0;
1849 	if (options->enable_ssh_keysign == -1)
1850 		options->enable_ssh_keysign = 0;
1851 	if (options->rekey_limit == -1)
1852 		options->rekey_limit = 0;
1853 	if (options->rekey_interval == -1)
1854 		options->rekey_interval = 0;
1855 #if HAVE_LDNS
1856 	if (options->verify_host_key_dns == -1)
1857 		/* automatically trust a verified SSHFP record */
1858 		options->verify_host_key_dns = 1;
1859 #else
1860 	if (options->verify_host_key_dns == -1)
1861 		options->verify_host_key_dns = 0;
1862 #endif
1863 	if (options->server_alive_interval == -1)
1864 		options->server_alive_interval = 0;
1865 	if (options->server_alive_count_max == -1)
1866 		options->server_alive_count_max = 3;
1867 	if (options->control_master == -1)
1868 		options->control_master = 0;
1869 	if (options->control_persist == -1) {
1870 		options->control_persist = 0;
1871 		options->control_persist_timeout = 0;
1872 	}
1873 	if (options->hash_known_hosts == -1)
1874 		options->hash_known_hosts = 0;
1875 	if (options->tun_open == -1)
1876 		options->tun_open = SSH_TUNMODE_NO;
1877 	if (options->tun_local == -1)
1878 		options->tun_local = SSH_TUNID_ANY;
1879 	if (options->tun_remote == -1)
1880 		options->tun_remote = SSH_TUNID_ANY;
1881 	if (options->permit_local_command == -1)
1882 		options->permit_local_command = 0;
1883 	options->use_roaming = 0;
1884 	if (options->visual_host_key == -1)
1885 		options->visual_host_key = 0;
1886 	if (options->ip_qos_interactive == -1)
1887 		options->ip_qos_interactive = IPTOS_LOWDELAY;
1888 	if (options->ip_qos_bulk == -1)
1889 		options->ip_qos_bulk = IPTOS_THROUGHPUT;
1890 	if (options->request_tty == -1)
1891 		options->request_tty = REQUEST_TTY_AUTO;
1892 	if (options->proxy_use_fdpass == -1)
1893 		options->proxy_use_fdpass = 0;
1894 	if (options->canonicalize_max_dots == -1)
1895 		options->canonicalize_max_dots = 1;
1896 	if (options->canonicalize_fallback_local == -1)
1897 		options->canonicalize_fallback_local = 1;
1898 	if (options->canonicalize_hostname == -1)
1899 		options->canonicalize_hostname = SSH_CANONICALISE_NO;
1900 	if (options->fingerprint_hash == -1)
1901 		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
1902 	if (options->update_hostkeys == -1)
1903 		options->update_hostkeys = 0;
1904 	if (kex_assemble_names(KEX_CLIENT_ENCRYPT, &options->ciphers) != 0 ||
1905 	    kex_assemble_names(KEX_CLIENT_MAC, &options->macs) != 0 ||
1906 	    kex_assemble_names(KEX_CLIENT_KEX, &options->kex_algorithms) != 0 ||
1907 	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
1908 	    &options->hostbased_key_types) != 0 ||
1909 	    kex_assemble_names(KEX_DEFAULT_PK_ALG,
1910 	    &options->pubkey_key_types) != 0)
1911 		fatal("%s: kex_assemble_names failed", __func__);
1912 
1913 #define CLEAR_ON_NONE(v) \
1914 	do { \
1915 		if (option_clear_or_none(v)) { \
1916 			free(v); \
1917 			v = NULL; \
1918 		} \
1919 	} while(0)
1920 	CLEAR_ON_NONE(options->local_command);
1921 	CLEAR_ON_NONE(options->proxy_command);
1922 	CLEAR_ON_NONE(options->control_path);
1923 	CLEAR_ON_NONE(options->revoked_host_keys);
1924 	/* options->user will be set in the main program if appropriate */
1925 	/* options->hostname will be set in the main program if appropriate */
1926 	/* options->host_key_alias should not be set by default */
1927 	/* options->preferred_authentications will be set in ssh */
1928 	if (options->version_addendum == NULL)
1929 		options->version_addendum = xstrdup(SSH_VERSION_FREEBSD);
1930 }
1931 
1932 struct fwdarg {
1933 	char *arg;
1934 	int ispath;
1935 };
1936 
1937 /*
1938  * parse_fwd_field
1939  * parses the next field in a port forwarding specification.
1940  * sets fwd to the parsed field and advances p past the colon
1941  * or sets it to NULL at end of string.
1942  * returns 0 on success, else non-zero.
1943  */
1944 static int
1945 parse_fwd_field(char **p, struct fwdarg *fwd)
1946 {
1947 	char *ep, *cp = *p;
1948 	int ispath = 0;
1949 
1950 	if (*cp == '\0') {
1951 		*p = NULL;
1952 		return -1;	/* end of string */
1953 	}
1954 
1955 	/*
1956 	 * A field escaped with square brackets is used literally.
1957 	 * XXX - allow ']' to be escaped via backslash?
1958 	 */
1959 	if (*cp == '[') {
1960 		/* find matching ']' */
1961 		for (ep = cp + 1; *ep != ']' && *ep != '\0'; ep++) {
1962 			if (*ep == '/')
1963 				ispath = 1;
1964 		}
1965 		/* no matching ']' or not at end of field. */
1966 		if (ep[0] != ']' || (ep[1] != ':' && ep[1] != '\0'))
1967 			return -1;
1968 		/* NUL terminate the field and advance p past the colon */
1969 		*ep++ = '\0';
1970 		if (*ep != '\0')
1971 			*ep++ = '\0';
1972 		fwd->arg = cp + 1;
1973 		fwd->ispath = ispath;
1974 		*p = ep;
1975 		return 0;
1976 	}
1977 
1978 	for (cp = *p; *cp != '\0'; cp++) {
1979 		switch (*cp) {
1980 		case '\\':
1981 			memmove(cp, cp + 1, strlen(cp + 1) + 1);
1982 			if (*cp == '\0')
1983 				return -1;
1984 			break;
1985 		case '/':
1986 			ispath = 1;
1987 			break;
1988 		case ':':
1989 			*cp++ = '\0';
1990 			goto done;
1991 		}
1992 	}
1993 done:
1994 	fwd->arg = *p;
1995 	fwd->ispath = ispath;
1996 	*p = cp;
1997 	return 0;
1998 }
1999 
2000 /*
2001  * parse_forward
2002  * parses a string containing a port forwarding specification of the form:
2003  *   dynamicfwd == 0
2004  *	[listenhost:]listenport|listenpath:connecthost:connectport|connectpath
2005  *	listenpath:connectpath
2006  *   dynamicfwd == 1
2007  *	[listenhost:]listenport
2008  * returns number of arguments parsed or zero on error
2009  */
2010 int
2011 parse_forward(struct Forward *fwd, const char *fwdspec, int dynamicfwd, int remotefwd)
2012 {
2013 	struct fwdarg fwdargs[4];
2014 	char *p, *cp;
2015 	int i;
2016 
2017 	memset(fwd, 0, sizeof(*fwd));
2018 	memset(fwdargs, 0, sizeof(fwdargs));
2019 
2020 	cp = p = xstrdup(fwdspec);
2021 
2022 	/* skip leading spaces */
2023 	while (isspace((u_char)*cp))
2024 		cp++;
2025 
2026 	for (i = 0; i < 4; ++i) {
2027 		if (parse_fwd_field(&cp, &fwdargs[i]) != 0)
2028 			break;
2029 	}
2030 
2031 	/* Check for trailing garbage */
2032 	if (cp != NULL && *cp != '\0') {
2033 		i = 0;	/* failure */
2034 	}
2035 
2036 	switch (i) {
2037 	case 1:
2038 		if (fwdargs[0].ispath) {
2039 			fwd->listen_path = xstrdup(fwdargs[0].arg);
2040 			fwd->listen_port = PORT_STREAMLOCAL;
2041 		} else {
2042 			fwd->listen_host = NULL;
2043 			fwd->listen_port = a2port(fwdargs[0].arg);
2044 		}
2045 		fwd->connect_host = xstrdup("socks");
2046 		break;
2047 
2048 	case 2:
2049 		if (fwdargs[0].ispath && fwdargs[1].ispath) {
2050 			fwd->listen_path = xstrdup(fwdargs[0].arg);
2051 			fwd->listen_port = PORT_STREAMLOCAL;
2052 			fwd->connect_path = xstrdup(fwdargs[1].arg);
2053 			fwd->connect_port = PORT_STREAMLOCAL;
2054 		} else if (fwdargs[1].ispath) {
2055 			fwd->listen_host = NULL;
2056 			fwd->listen_port = a2port(fwdargs[0].arg);
2057 			fwd->connect_path = xstrdup(fwdargs[1].arg);
2058 			fwd->connect_port = PORT_STREAMLOCAL;
2059 		} else {
2060 			fwd->listen_host = xstrdup(fwdargs[0].arg);
2061 			fwd->listen_port = a2port(fwdargs[1].arg);
2062 			fwd->connect_host = xstrdup("socks");
2063 		}
2064 		break;
2065 
2066 	case 3:
2067 		if (fwdargs[0].ispath) {
2068 			fwd->listen_path = xstrdup(fwdargs[0].arg);
2069 			fwd->listen_port = PORT_STREAMLOCAL;
2070 			fwd->connect_host = xstrdup(fwdargs[1].arg);
2071 			fwd->connect_port = a2port(fwdargs[2].arg);
2072 		} else if (fwdargs[2].ispath) {
2073 			fwd->listen_host = xstrdup(fwdargs[0].arg);
2074 			fwd->listen_port = a2port(fwdargs[1].arg);
2075 			fwd->connect_path = xstrdup(fwdargs[2].arg);
2076 			fwd->connect_port = PORT_STREAMLOCAL;
2077 		} else {
2078 			fwd->listen_host = NULL;
2079 			fwd->listen_port = a2port(fwdargs[0].arg);
2080 			fwd->connect_host = xstrdup(fwdargs[1].arg);
2081 			fwd->connect_port = a2port(fwdargs[2].arg);
2082 		}
2083 		break;
2084 
2085 	case 4:
2086 		fwd->listen_host = xstrdup(fwdargs[0].arg);
2087 		fwd->listen_port = a2port(fwdargs[1].arg);
2088 		fwd->connect_host = xstrdup(fwdargs[2].arg);
2089 		fwd->connect_port = a2port(fwdargs[3].arg);
2090 		break;
2091 	default:
2092 		i = 0; /* failure */
2093 	}
2094 
2095 	free(p);
2096 
2097 	if (dynamicfwd) {
2098 		if (!(i == 1 || i == 2))
2099 			goto fail_free;
2100 	} else {
2101 		if (!(i == 3 || i == 4)) {
2102 			if (fwd->connect_path == NULL &&
2103 			    fwd->listen_path == NULL)
2104 				goto fail_free;
2105 		}
2106 		if (fwd->connect_port <= 0 && fwd->connect_path == NULL)
2107 			goto fail_free;
2108 	}
2109 
2110 	if ((fwd->listen_port < 0 && fwd->listen_path == NULL) ||
2111 	    (!remotefwd && fwd->listen_port == 0))
2112 		goto fail_free;
2113 	if (fwd->connect_host != NULL &&
2114 	    strlen(fwd->connect_host) >= NI_MAXHOST)
2115 		goto fail_free;
2116 	/* XXX - if connecting to a remote socket, max sun len may not match this host */
2117 	if (fwd->connect_path != NULL &&
2118 	    strlen(fwd->connect_path) >= PATH_MAX_SUN)
2119 		goto fail_free;
2120 	if (fwd->listen_host != NULL &&
2121 	    strlen(fwd->listen_host) >= NI_MAXHOST)
2122 		goto fail_free;
2123 	if (fwd->listen_path != NULL &&
2124 	    strlen(fwd->listen_path) >= PATH_MAX_SUN)
2125 		goto fail_free;
2126 
2127 	return (i);
2128 
2129  fail_free:
2130 	free(fwd->connect_host);
2131 	fwd->connect_host = NULL;
2132 	free(fwd->connect_path);
2133 	fwd->connect_path = NULL;
2134 	free(fwd->listen_host);
2135 	fwd->listen_host = NULL;
2136 	free(fwd->listen_path);
2137 	fwd->listen_path = NULL;
2138 	return (0);
2139 }
2140 
2141 /* XXX the following is a near-vebatim copy from servconf.c; refactor */
2142 static const char *
2143 fmt_multistate_int(int val, const struct multistate *m)
2144 {
2145 	u_int i;
2146 
2147 	for (i = 0; m[i].key != NULL; i++) {
2148 		if (m[i].value == val)
2149 			return m[i].key;
2150 	}
2151 	return "UNKNOWN";
2152 }
2153 
2154 static const char *
2155 fmt_intarg(OpCodes code, int val)
2156 {
2157 	if (val == -1)
2158 		return "unset";
2159 	switch (code) {
2160 	case oAddressFamily:
2161 		return fmt_multistate_int(val, multistate_addressfamily);
2162 	case oVerifyHostKeyDNS:
2163 	case oStrictHostKeyChecking:
2164 	case oUpdateHostkeys:
2165 		return fmt_multistate_int(val, multistate_yesnoask);
2166 	case oControlMaster:
2167 		return fmt_multistate_int(val, multistate_controlmaster);
2168 	case oTunnel:
2169 		return fmt_multistate_int(val, multistate_tunnel);
2170 	case oRequestTTY:
2171 		return fmt_multistate_int(val, multistate_requesttty);
2172 	case oCanonicalizeHostname:
2173 		return fmt_multistate_int(val, multistate_canonicalizehostname);
2174 	case oFingerprintHash:
2175 		return ssh_digest_alg_name(val);
2176 	case oProtocol:
2177 		switch (val) {
2178 		case SSH_PROTO_1:
2179 			return "1";
2180 		case SSH_PROTO_2:
2181 			return "2";
2182 		case (SSH_PROTO_1|SSH_PROTO_2):
2183 			return "2,1";
2184 		default:
2185 			return "UNKNOWN";
2186 		}
2187 	default:
2188 		switch (val) {
2189 		case 0:
2190 			return "no";
2191 		case 1:
2192 			return "yes";
2193 		default:
2194 			return "UNKNOWN";
2195 		}
2196 	}
2197 }
2198 
2199 static const char *
2200 lookup_opcode_name(OpCodes code)
2201 {
2202 	u_int i;
2203 
2204 	for (i = 0; keywords[i].name != NULL; i++)
2205 		if (keywords[i].opcode == code)
2206 			return(keywords[i].name);
2207 	return "UNKNOWN";
2208 }
2209 
2210 static void
2211 dump_cfg_int(OpCodes code, int val)
2212 {
2213 	printf("%s %d\n", lookup_opcode_name(code), val);
2214 }
2215 
2216 static void
2217 dump_cfg_fmtint(OpCodes code, int val)
2218 {
2219 	printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val));
2220 }
2221 
2222 static void
2223 dump_cfg_string(OpCodes code, const char *val)
2224 {
2225 	if (val == NULL)
2226 		return;
2227 	printf("%s %s\n", lookup_opcode_name(code), val);
2228 }
2229 
2230 static void
2231 dump_cfg_strarray(OpCodes code, u_int count, char **vals)
2232 {
2233 	u_int i;
2234 
2235 	for (i = 0; i < count; i++)
2236 		printf("%s %s\n", lookup_opcode_name(code), vals[i]);
2237 }
2238 
2239 static void
2240 dump_cfg_strarray_oneline(OpCodes code, u_int count, char **vals)
2241 {
2242 	u_int i;
2243 
2244 	printf("%s", lookup_opcode_name(code));
2245 	for (i = 0; i < count; i++)
2246 		printf(" %s",  vals[i]);
2247 	printf("\n");
2248 }
2249 
2250 static void
2251 dump_cfg_forwards(OpCodes code, u_int count, const struct Forward *fwds)
2252 {
2253 	const struct Forward *fwd;
2254 	u_int i;
2255 
2256 	/* oDynamicForward */
2257 	for (i = 0; i < count; i++) {
2258 		fwd = &fwds[i];
2259 		if (code == oDynamicForward &&
2260 		    strcmp(fwd->connect_host, "socks") != 0)
2261 			continue;
2262 		if (code == oLocalForward &&
2263 		    strcmp(fwd->connect_host, "socks") == 0)
2264 			continue;
2265 		printf("%s", lookup_opcode_name(code));
2266 		if (fwd->listen_port == PORT_STREAMLOCAL)
2267 			printf(" %s", fwd->listen_path);
2268 		else if (fwd->listen_host == NULL)
2269 			printf(" %d", fwd->listen_port);
2270 		else {
2271 			printf(" [%s]:%d",
2272 			    fwd->listen_host, fwd->listen_port);
2273 		}
2274 		if (code != oDynamicForward) {
2275 			if (fwd->connect_port == PORT_STREAMLOCAL)
2276 				printf(" %s", fwd->connect_path);
2277 			else if (fwd->connect_host == NULL)
2278 				printf(" %d", fwd->connect_port);
2279 			else {
2280 				printf(" [%s]:%d",
2281 				    fwd->connect_host, fwd->connect_port);
2282 			}
2283 		}
2284 		printf("\n");
2285 	}
2286 }
2287 
2288 void
2289 dump_client_config(Options *o, const char *host)
2290 {
2291 	int i;
2292 	char vbuf[5];
2293 
2294 	/* Most interesting options first: user, host, port */
2295 	dump_cfg_string(oUser, o->user);
2296 	dump_cfg_string(oHostName, host);
2297 	dump_cfg_int(oPort, o->port);
2298 
2299 	/* Flag options */
2300 	dump_cfg_fmtint(oAddressFamily, o->address_family);
2301 	dump_cfg_fmtint(oBatchMode, o->batch_mode);
2302 	dump_cfg_fmtint(oCanonicalizeFallbackLocal, o->canonicalize_fallback_local);
2303 	dump_cfg_fmtint(oCanonicalizeHostname, o->canonicalize_hostname);
2304 	dump_cfg_fmtint(oChallengeResponseAuthentication, o->challenge_response_authentication);
2305 	dump_cfg_fmtint(oCheckHostIP, o->check_host_ip);
2306 	dump_cfg_fmtint(oCompression, o->compression);
2307 	dump_cfg_fmtint(oControlMaster, o->control_master);
2308 	dump_cfg_fmtint(oEnableSSHKeysign, o->enable_ssh_keysign);
2309 	dump_cfg_fmtint(oExitOnForwardFailure, o->exit_on_forward_failure);
2310 	dump_cfg_fmtint(oFingerprintHash, o->fingerprint_hash);
2311 	dump_cfg_fmtint(oForwardAgent, o->forward_agent);
2312 	dump_cfg_fmtint(oForwardX11, o->forward_x11);
2313 	dump_cfg_fmtint(oForwardX11Trusted, o->forward_x11_trusted);
2314 	dump_cfg_fmtint(oGatewayPorts, o->fwd_opts.gateway_ports);
2315 #ifdef GSSAPI
2316 	dump_cfg_fmtint(oGssAuthentication, o->gss_authentication);
2317 	dump_cfg_fmtint(oGssDelegateCreds, o->gss_deleg_creds);
2318 #endif /* GSSAPI */
2319 	dump_cfg_fmtint(oHashKnownHosts, o->hash_known_hosts);
2320 	dump_cfg_fmtint(oHostbasedAuthentication, o->hostbased_authentication);
2321 	dump_cfg_fmtint(oIdentitiesOnly, o->identities_only);
2322 	dump_cfg_fmtint(oKbdInteractiveAuthentication, o->kbd_interactive_authentication);
2323 	dump_cfg_fmtint(oNoHostAuthenticationForLocalhost, o->no_host_authentication_for_localhost);
2324 	dump_cfg_fmtint(oPasswordAuthentication, o->password_authentication);
2325 	dump_cfg_fmtint(oPermitLocalCommand, o->permit_local_command);
2326 	dump_cfg_fmtint(oProtocol, o->protocol);
2327 	dump_cfg_fmtint(oProxyUseFdpass, o->proxy_use_fdpass);
2328 	dump_cfg_fmtint(oPubkeyAuthentication, o->pubkey_authentication);
2329 	dump_cfg_fmtint(oRequestTTY, o->request_tty);
2330 	dump_cfg_fmtint(oRhostsRSAAuthentication, o->rhosts_rsa_authentication);
2331 	dump_cfg_fmtint(oRSAAuthentication, o->rsa_authentication);
2332 	dump_cfg_fmtint(oStreamLocalBindUnlink, o->fwd_opts.streamlocal_bind_unlink);
2333 	dump_cfg_fmtint(oStrictHostKeyChecking, o->strict_host_key_checking);
2334 	dump_cfg_fmtint(oTCPKeepAlive, o->tcp_keep_alive);
2335 	dump_cfg_fmtint(oTunnel, o->tun_open);
2336 	dump_cfg_fmtint(oUsePrivilegedPort, o->use_privileged_port);
2337 	dump_cfg_fmtint(oVerifyHostKeyDNS, o->verify_host_key_dns);
2338 	dump_cfg_fmtint(oVisualHostKey, o->visual_host_key);
2339 	dump_cfg_fmtint(oUpdateHostkeys, o->update_hostkeys);
2340 
2341 	/* Integer options */
2342 	dump_cfg_int(oCanonicalizeMaxDots, o->canonicalize_max_dots);
2343 	dump_cfg_int(oCompressionLevel, o->compression_level);
2344 	dump_cfg_int(oConnectionAttempts, o->connection_attempts);
2345 	dump_cfg_int(oForwardX11Timeout, o->forward_x11_timeout);
2346 	dump_cfg_int(oNumberOfPasswordPrompts, o->number_of_password_prompts);
2347 	dump_cfg_int(oServerAliveCountMax, o->server_alive_count_max);
2348 	dump_cfg_int(oServerAliveInterval, o->server_alive_interval);
2349 
2350 	/* String options */
2351 	dump_cfg_string(oBindAddress, o->bind_address);
2352 	dump_cfg_string(oCiphers, o->ciphers ? o->ciphers : KEX_CLIENT_ENCRYPT);
2353 	dump_cfg_string(oControlPath, o->control_path);
2354 	dump_cfg_string(oHostKeyAlgorithms, o->hostkeyalgorithms ? o->hostkeyalgorithms : KEX_DEFAULT_PK_ALG);
2355 	dump_cfg_string(oHostKeyAlias, o->host_key_alias);
2356 	dump_cfg_string(oHostbasedKeyTypes, o->hostbased_key_types);
2357 	dump_cfg_string(oKbdInteractiveDevices, o->kbd_interactive_devices);
2358 	dump_cfg_string(oKexAlgorithms, o->kex_algorithms ? o->kex_algorithms : KEX_CLIENT_KEX);
2359 	dump_cfg_string(oLocalCommand, o->local_command);
2360 	dump_cfg_string(oLogLevel, log_level_name(o->log_level));
2361 	dump_cfg_string(oMacs, o->macs ? o->macs : KEX_CLIENT_MAC);
2362 	dump_cfg_string(oPKCS11Provider, o->pkcs11_provider);
2363 	dump_cfg_string(oPreferredAuthentications, o->preferred_authentications);
2364 	dump_cfg_string(oProxyCommand, o->proxy_command);
2365 	dump_cfg_string(oRevokedHostKeys, o->revoked_host_keys);
2366 	dump_cfg_string(oXAuthLocation, o->xauth_location);
2367 
2368 	/* Forwards */
2369 	dump_cfg_forwards(oDynamicForward, o->num_local_forwards, o->local_forwards);
2370 	dump_cfg_forwards(oLocalForward, o->num_local_forwards, o->local_forwards);
2371 	dump_cfg_forwards(oRemoteForward, o->num_remote_forwards, o->remote_forwards);
2372 
2373 	/* String array options */
2374 	dump_cfg_strarray(oIdentityFile, o->num_identity_files, o->identity_files);
2375 	dump_cfg_strarray_oneline(oCanonicalDomains, o->num_canonical_domains, o->canonical_domains);
2376 	dump_cfg_strarray_oneline(oGlobalKnownHostsFile, o->num_system_hostfiles, o->system_hostfiles);
2377 	dump_cfg_strarray_oneline(oUserKnownHostsFile, o->num_user_hostfiles, o->user_hostfiles);
2378 	dump_cfg_strarray(oSendEnv, o->num_send_env, o->send_env);
2379 
2380 	/* Special cases */
2381 
2382 	/* oConnectTimeout */
2383 	if (o->connection_timeout == -1)
2384 		printf("connecttimeout none\n");
2385 	else
2386 		dump_cfg_int(oConnectTimeout, o->connection_timeout);
2387 
2388 	/* oTunnelDevice */
2389 	printf("tunneldevice");
2390 	if (o->tun_local == SSH_TUNID_ANY)
2391 		printf(" any");
2392 	else
2393 		printf(" %d", o->tun_local);
2394 	if (o->tun_remote == SSH_TUNID_ANY)
2395 		printf(":any");
2396 	else
2397 		printf(":%d", o->tun_remote);
2398 	printf("\n");
2399 
2400 	/* oCanonicalizePermittedCNAMEs */
2401 	if ( o->num_permitted_cnames > 0) {
2402 		printf("canonicalizePermittedcnames");
2403 		for (i = 0; i < o->num_permitted_cnames; i++) {
2404 			printf(" %s:%s", o->permitted_cnames[i].source_list,
2405 			    o->permitted_cnames[i].target_list);
2406 		}
2407 		printf("\n");
2408 	}
2409 
2410 	/* oCipher */
2411 	if (o->cipher != SSH_CIPHER_NOT_SET)
2412 		printf("Cipher %s\n", cipher_name(o->cipher));
2413 
2414 	/* oControlPersist */
2415 	if (o->control_persist == 0 || o->control_persist_timeout == 0)
2416 		dump_cfg_fmtint(oControlPersist, o->control_persist);
2417 	else
2418 		dump_cfg_int(oControlPersist, o->control_persist_timeout);
2419 
2420 	/* oEscapeChar */
2421 	if (o->escape_char == SSH_ESCAPECHAR_NONE)
2422 		printf("escapechar none\n");
2423 	else {
2424 		vis(vbuf, o->escape_char, VIS_WHITE, 0);
2425 		printf("escapechar %s\n", vbuf);
2426 	}
2427 
2428 	/* oIPQoS */
2429 	printf("ipqos %s ", iptos2str(o->ip_qos_interactive));
2430 	printf("%s\n", iptos2str(o->ip_qos_bulk));
2431 
2432 	/* oRekeyLimit */
2433 	printf("rekeylimit %lld %d\n",
2434 	    (long long)o->rekey_limit, o->rekey_interval);
2435 
2436 	/* oStreamLocalBindMask */
2437 	printf("streamlocalbindmask 0%o\n",
2438 	    o->fwd_opts.streamlocal_bind_mask);
2439 }
2440