| package ssh_config |
| |
| import ( |
| "fmt" |
| "strconv" |
| "strings" |
| ) |
| |
| // Default returns the default value for the given keyword, for example "22" if |
| // the keyword is "Port". Default returns the empty string if the keyword has no |
| // default, or if the keyword is unknown. Keyword matching is case-insensitive. |
| // |
| // Default values are sourced from the openssh-portable source code. To |
| // validate or update these defaults, check fill_default_options() in |
| // readconf.c and the algorithm lists in myproposal.h: |
| // |
| // https://github.com/openssh/openssh-portable/blob/master/readconf.c |
| // https://github.com/openssh/openssh-portable/blob/master/myproposal.h |
| func Default(keyword string) string { |
| return defaults[strings.ToLower(keyword)] |
| } |
| |
| // Arguments where the value must be "yes" or "no" and *only* yes or no. |
| var yesnos = map[string]bool{ |
| strings.ToLower("BatchMode"): true, |
| strings.ToLower("CanonicalizeFallbackLocal"): true, |
| strings.ToLower("CheckHostIP"): true, |
| strings.ToLower("ClearAllForwardings"): true, |
| strings.ToLower("Compression"): true, |
| strings.ToLower("EnableSSHKeysign"): true, |
| strings.ToLower("ExitOnForwardFailure"): true, |
| strings.ToLower("ForwardX11"): true, |
| strings.ToLower("ForwardX11Trusted"): true, |
| strings.ToLower("GatewayPorts"): true, |
| strings.ToLower("GSSAPIAuthentication"): true, |
| strings.ToLower("GSSAPIDelegateCredentials"): true, |
| strings.ToLower("HostbasedAuthentication"): true, |
| strings.ToLower("IdentitiesOnly"): true, |
| strings.ToLower("KbdInteractiveAuthentication"): true, |
| strings.ToLower("NoHostAuthenticationForLocalhost"): true, |
| strings.ToLower("PasswordAuthentication"): true, |
| strings.ToLower("PermitLocalCommand"): true, |
| strings.ToLower("PubkeyAuthentication"): true, |
| strings.ToLower("StreamLocalBindUnlink"): true, |
| strings.ToLower("TCPKeepAlive"): true, |
| strings.ToLower("UseKeychain"): true, |
| strings.ToLower("VisualHostKey"): true, |
| } |
| |
| var uints = map[string]bool{ |
| strings.ToLower("CanonicalizeMaxDots"): true, |
| strings.ToLower("ConnectionAttempts"): true, |
| strings.ToLower("ConnectTimeout"): true, |
| strings.ToLower("NumberOfPasswordPrompts"): true, |
| strings.ToLower("Port"): true, |
| strings.ToLower("ServerAliveCountMax"): true, |
| strings.ToLower("ServerAliveInterval"): true, |
| } |
| |
| func mustBeYesOrNo(lkey string) bool { |
| return yesnos[lkey] |
| } |
| |
| func mustBeUint(lkey string) bool { |
| return uints[lkey] |
| } |
| |
| func validate(key, val string) error { |
| lkey := strings.ToLower(key) |
| if mustBeYesOrNo(lkey) && (val != "yes" && val != "no") { |
| return fmt.Errorf("ssh_config: value for key %q must be 'yes' or 'no', got %q", key, val) |
| } |
| if mustBeUint(lkey) { |
| _, err := strconv.ParseUint(val, 10, 64) |
| if err != nil { |
| return fmt.Errorf("ssh_config: %v", err) |
| } |
| } |
| return nil |
| } |
| |
| // defaultPKAlg is the default value for HostKeyAlgorithms, |
| // HostbasedAcceptedAlgorithms, and PubkeyAcceptedAlgorithms. |
| // Sourced from KEX_DEFAULT_PK_ALG in myproposal.h. |
| var defaultPKAlg = strings.Join([]string{ |
| "ssh-ed25519-cert-v01@openssh.com", |
| "ecdsa-sha2-nistp256-cert-v01@openssh.com", |
| "ecdsa-sha2-nistp384-cert-v01@openssh.com", |
| "ecdsa-sha2-nistp521-cert-v01@openssh.com", |
| "sk-ssh-ed25519-cert-v01@openssh.com", |
| "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com", |
| "webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com", |
| "rsa-sha2-512-cert-v01@openssh.com", |
| "rsa-sha2-256-cert-v01@openssh.com", |
| "ssh-ed25519", |
| "ecdsa-sha2-nistp256", |
| "ecdsa-sha2-nistp384", |
| "ecdsa-sha2-nistp521", |
| "sk-ssh-ed25519@openssh.com", |
| "sk-ecdsa-sha2-nistp256@openssh.com", |
| "webauthn-sk-ecdsa-sha2-nistp256@openssh.com", |
| "rsa-sha2-512", |
| "rsa-sha2-256", |
| }, ",") |
| |
| var defaults = map[string]string{ |
| strings.ToLower("AddKeysToAgent"): "no", |
| strings.ToLower("AddressFamily"): "any", |
| strings.ToLower("BatchMode"): "no", |
| strings.ToLower("CanonicalizeFallbackLocal"): "yes", |
| strings.ToLower("CanonicalizeHostname"): "no", |
| strings.ToLower("CanonicalizeMaxDots"): "1", |
| strings.ToLower("CheckHostIP"): "no", |
| strings.ToLower("Ciphers"): "chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr", |
| strings.ToLower("ClearAllForwardings"): "no", |
| strings.ToLower("Compression"): "no", |
| strings.ToLower("ConnectionAttempts"): "1", |
| strings.ToLower("ControlMaster"): "no", |
| strings.ToLower("ControlPersist"): "no", |
| strings.ToLower("EnableSSHKeysign"): "no", |
| strings.ToLower("EscapeChar"): "~", |
| strings.ToLower("ExitOnForwardFailure"): "no", |
| strings.ToLower("FingerprintHash"): "sha256", |
| strings.ToLower("ForwardAgent"): "no", |
| strings.ToLower("ForwardX11"): "no", |
| strings.ToLower("ForwardX11Timeout"): "1200", |
| strings.ToLower("ForwardX11Trusted"): "no", |
| strings.ToLower("GatewayPorts"): "no", |
| strings.ToLower("GlobalKnownHostsFile"): "/etc/ssh/ssh_known_hosts /etc/ssh/ssh_known_hosts2", |
| strings.ToLower("GSSAPIAuthentication"): "no", |
| strings.ToLower("GSSAPIDelegateCredentials"): "no", |
| strings.ToLower("HashKnownHosts"): "no", |
| strings.ToLower("HostbasedAuthentication"): "no", |
| |
| strings.ToLower("CASignatureAlgorithms"): "ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256", |
| |
| // HostbasedAcceptedAlgorithms and HostbasedKeyTypes (obsolete alias) |
| // both default to KEX_DEFAULT_PK_ALG. |
| strings.ToLower("HostbasedAcceptedAlgorithms"): defaultPKAlg, |
| strings.ToLower("HostbasedKeyTypes"): defaultPKAlg, |
| |
| strings.ToLower("HostKeyAlgorithms"): defaultPKAlg, |
| // HostName has a dynamic default (the value passed at the command line). |
| |
| strings.ToLower("IdentitiesOnly"): "no", |
| |
| // IPQoS has a dynamic default based on interactive or non-interactive |
| // sessions. |
| |
| strings.ToLower("KbdInteractiveAuthentication"): "yes", |
| |
| strings.ToLower("KexAlgorithms"): "mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256", |
| strings.ToLower("LogLevel"): "INFO", |
| strings.ToLower("MACs"): "umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1", |
| |
| strings.ToLower("NoHostAuthenticationForLocalhost"): "no", |
| strings.ToLower("NumberOfPasswordPrompts"): "3", |
| strings.ToLower("PasswordAuthentication"): "yes", |
| strings.ToLower("PermitLocalCommand"): "no", |
| strings.ToLower("Port"): "22", |
| |
| strings.ToLower("PreferredAuthentications"): "gssapi-with-mic,hostbased,publickey,keyboard-interactive,password", |
| strings.ToLower("ProxyUseFdpass"): "no", |
| |
| // PubkeyAcceptedAlgorithms and PubkeyAcceptedKeyTypes (obsolete alias) |
| // both default to KEX_DEFAULT_PK_ALG. |
| strings.ToLower("PubkeyAcceptedAlgorithms"): defaultPKAlg, |
| strings.ToLower("PubkeyAcceptedKeyTypes"): defaultPKAlg, |
| |
| strings.ToLower("PubkeyAuthentication"): "yes", |
| strings.ToLower("RekeyLimit"): "default none", |
| strings.ToLower("RequestTTY"): "auto", |
| |
| strings.ToLower("ServerAliveCountMax"): "3", |
| strings.ToLower("ServerAliveInterval"): "0", |
| strings.ToLower("SessionType"): "default", |
| strings.ToLower("StreamLocalBindMask"): "0177", |
| strings.ToLower("StreamLocalBindUnlink"): "no", |
| strings.ToLower("StrictHostKeyChecking"): "ask", |
| strings.ToLower("TCPKeepAlive"): "yes", |
| strings.ToLower("Tunnel"): "no", |
| strings.ToLower("TunnelDevice"): "any:any", |
| strings.ToLower("UpdateHostKeys"): "yes", |
| strings.ToLower("UseKeychain"): "no", |
| |
| strings.ToLower("UserKnownHostsFile"): "~/.ssh/known_hosts ~/.ssh/known_hosts2", |
| strings.ToLower("VerifyHostKeyDNS"): "no", |
| strings.ToLower("VisualHostKey"): "no", |
| strings.ToLower("XAuthLocation"): "/usr/X11R6/bin/xauth", |
| } |
| |
| // defaultIdentityFiles are the default IdentityFile values. |
| // Sourced from fill_default_options() in readconf.c. |
| var defaultIdentityFiles = []string{ |
| "~/.ssh/id_rsa", |
| "~/.ssh/id_ecdsa", |
| "~/.ssh/id_ecdsa_sk", |
| "~/.ssh/id_ed25519", |
| "~/.ssh/id_ed25519_sk", |
| } |
| |
| // these directives support multiple items that can be collected |
| // across multiple files |
| var pluralDirectives = map[string]bool{ |
| "CertificateFile": true, |
| "IdentityFile": true, |
| "DynamicForward": true, |
| "RemoteForward": true, |
| "SendEnv": true, |
| "SetEnv": true, |
| } |
| |
| // SupportsMultiple reports whether a directive can be specified multiple times. |
| func SupportsMultiple(key string) bool { |
| return pluralDirectives[strings.ToLower(key)] |
| } |
