1 files changed, 34 insertions, 42 deletions

diff --git a/readconf.c b/readconf.c
index f63894f9c..88051db57 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.279 2017/09/21 19:16:53 markus Exp $ */
+/* $OpenBSD: readconf.c,v 1.283 2018/02/23 15:58:37 markus Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -156,7 +156,7 @@ typedef enum {
         oPubkeyAuthentication,
         oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
         oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
-        oHostKeyAlgorithms, oBindAddress, oPKCS11Provider,
+        oHostKeyAlgorithms, oBindAddress, oBindInterface, oPKCS11Provider,
         oClearAllForwardings, oNoHostAuthenticationForLocalhost,
         oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
         oAddressFamily, oGssAuthentication, oGssDelegateCreds,
@@ -266,6 +266,7 @@ static struct {
         { "preferredauthentications", oPreferredAuthentications },
         { "hostkeyalgorithms", oHostKeyAlgorithms },
         { "bindaddress", oBindAddress },
+        { "bindinterface", oBindInterface },
         { "clearallforwardings", oClearAllForwardings },
         { "enablesshkeysign", oEnableSSHKeysign },
         { "verifyhostkeydns", oVerifyHostKeyDNS },
@@ -683,34 +684,6 @@ match_cfg_line(Options *options, char **condition, struct passwd *pw,
         return result;
 }
 
-/* Check and prepare a domain name: removes trailing '.' and lowercases */
-static void
-valid_domain(char *name, const char *filename, int linenum)
-{
-        size_t i, l = strlen(name);
-        u_char c, last = '\0';
-
-        if (l == 0)
-                fatal("%s line %d: empty hostname suffix", filename, linenum);
-        if (!isalpha((u_char)name[0]) && !isdigit((u_char)name[0]))
-                fatal("%s line %d: hostname suffix \"%.100s\" "
-                    "starts with invalid character", filename, linenum, name);
-        for (i = 0; i < l; i++) {
-                c = tolower((u_char)name[i]);
-                name[i] = (char)c;
-                if (last == '.' && c == '.')
-                        fatal("%s line %d: hostname suffix \"%.100s\" contains "
-                            "consecutive separators", filename, linenum, name);
-                if (c != '.' && c != '-' && !isalnum(c) &&
-                    c != '_') /* technically invalid, but common */
-                        fatal("%s line %d: hostname suffix \"%.100s\" contains "
-                            "invalid characters", filename, linenum, name);
-                last = c;
-        }
-        if (name[l - 1] == '.')
-                name[l - 1] = '\0';
-}
-
 /*
  * Returns the number of the token pointed to by cp or oBadOption.
  */
@@ -845,6 +818,7 @@ process_config_line_depth(Options *options, struct passwd *pw, const char *host,
         const struct multistate *multistate_ptr;
         struct allowed_cname *cname;
         glob_t gl;
+        const char *errstr;
 
         if (activep == NULL) { /* We are processing a command line directive */
                 cmdline = 1;
@@ -1126,6 +1100,10 @@ parse_char_array:
                 charptr = &options->bind_address;
                 goto parse_string;
 
+        case oBindInterface:
+                charptr = &options->bind_interface;
+                goto parse_string;
+
         case oPKCS11Provider:
                 charptr = &options->pkcs11_provider;
                 goto parse_string;
@@ -1159,15 +1137,9 @@ parse_command:
                 intptr = &options->port;
 parse_int:
                 arg = strdelim(&s);
-                if (!arg || *arg == '\0')
-                        fatal("%.200s line %d: Missing argument.", filename, linenum);
-                if (arg[0] < '0' || arg[0] > '9')
-                        fatal("%.200s line %d: Bad number.", filename, linenum);
-
-                /* Octal, decimal, or hex format? */
-                value = strtol(arg, &endofnumber, 0);
-                if (arg == endofnumber)
-                        fatal("%.200s line %d: Bad number.", filename, linenum);
+                if ((errstr = atoi_err(arg, &value)) != NULL)
+                        fatal("%s line %d: integer value %s.",
+                            filename, linenum, errstr);
                 if (*activep && *intptr == -1)
                         *intptr = value;
                 break;
@@ -1562,7 +1534,10 @@ parse_keytypes:
         case oCanonicalDomains:
                 value = options->num_canonical_domains != 0;
                 while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
-                        valid_domain(arg, filename, linenum);
+                        if (!valid_domain(arg, 1, &errstr)) {
+                                fatal("%s line %d: %s", filename, linenum,
+                                    errstr);
+                        }
                         if (!*activep || value)
                                 continue;
                         if (options->num_canonical_domains >= MAX_CANON_DOMAINS)
@@ -1830,6 +1805,7 @@ initialize_options(Options * options)
         options->log_level = SYSLOG_LEVEL_NOT_SET;
         options->preferred_authentications = NULL;
         options->bind_address = NULL;
+        options->bind_interface = NULL;
         options->pkcs11_provider = NULL;
         options->enable_ssh_keysign = - 1;
         options->no_host_authentication_for_localhost = - 1;
@@ -1967,6 +1943,7 @@ fill_default_options(Options * options)
 #endif
                 add_identity_file(options, "~/",
                     _PATH_SSH_CLIENT_ID_ED25519, 0);
+                add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_XMSS, 0);
         }
         if (options->escape_char == -1)
                 options->escape_char = '~';
@@ -2294,11 +2271,13 @@ parse_jump(const char *s, Options *o, int active)
 
                 if (first) {
                         /* First argument and configuration is active */
-                        if (parse_user_host_port(cp, &user, &host, &port) != 0)
+                        if (parse_ssh_uri(cp, &user, &host, &port) == -1 ||
+                            parse_user_host_port(cp, &user, &host, &port) != 0)
                                 goto out;
                 } else {
                         /* Subsequent argument or inactive configuration */
-                        if (parse_user_host_port(cp, NULL, NULL, NULL) != 0)
+                        if (parse_ssh_uri(cp, NULL, NULL, NULL) == -1 ||
+                            parse_user_host_port(cp, NULL, NULL, NULL) != 0)
                                 goto out;
                 }
                 first = 0; /* only check syntax for subsequent hosts */
@@ -2323,6 +2302,18 @@ parse_jump(const char *s, Options *o, int active)
         return ret;
 }
 
+int
+parse_ssh_uri(const char *uri, char **userp, char **hostp, int *portp)
+{
+        char *path;
+        int r;
+
+        r = parse_uri("ssh", uri, userp, hostp, portp, &path);
+        if (r == 0 && path != NULL)
+                r = -1;         /* path not allowed */
+        return r;
+}
+
 /* XXX the following is a near-vebatim copy from servconf.c; refactor */
 static const char *
 fmt_multistate_int(int val, const struct multistate *m)
@@ -2525,6 +2516,7 @@ dump_client_config(Options *o, const char *host)
 
         /* String options */
         dump_cfg_string(oBindAddress, o->bind_address);
+        dump_cfg_string(oBindInterface, o->bind_interface);
         dump_cfg_string(oCiphers, o->ciphers ? o->ciphers : KEX_CLIENT_ENCRYPT);
         dump_cfg_string(oControlPath, o->control_path);
         dump_cfg_string(oHostKeyAlgorithms, o->hostkeyalgorithms);