Bug 3367

Summary:

ssh-keyscan with non-22 port does not hash correct host

Product:

Portable OpenSSH

Reporter:

James Z.M. Gao <gaozm55>

Component:

ssh-keyscan

Assignee:

Damien Miller <djm>

Status:

NEW ---

Severity:

normal

CC:

djm, dtucker

Priority:

Version:

8.8p1

Hardware:

All

OS:

All

Bug Depends on:

Bug Blocks:

3549

Attachments:

Description	Flags
pass the fuill [host]:port for hashing	dtucker: ok+

Description James Z.M. Gao 2021-11-22 18:49:56 AEDT

ssh-keyscan -H -p 1234 host > k.txt ## dump and hash hostkeys

ssh-keygen -f k.txt -F '[host]:1234' ## output nothing

ssh-keygen -f k.txt -F host ## output hostkeys for [host]:1234

Comment 1 Damien Miller 2021-12-03 10:41:04 AEDT

Created attachment 3556 [details]
pass the fuill [host]:port for hashing

Comment 2 Damien Miller 2021-12-03 10:46:00 AEDT

This has been committed and will be in OpenSSH 8.9 - thanks!

Comment 3 James Z.M. Gao 2021-12-03 14:07:41 AEDT

thanks very much.

@dtucker another minor issue of the KnownHosts matching of `ssh-keygen -F` is that 'host' and '[host]:22' are not equivalent.


ssh-keyscan host > k.txt # output: host key-type ...

ssh-keyscan -p 22 host # also output: host key-type ...

ssh-keygen -f k.txt -F host # found hostkey as expected

ssh-keygen -f k.txt -F '[host]:22' # found nothing, whereas we should also match the same key as previous command

Comment 4 Damien Miller 2021-12-03 15:13:48 AEDT

'host' and '[host]:22' aren't supposed to be equivalent - nothing in OpenSSH should ever write '[host]:22'.

We deliberately avoid appending the port if it's the default because to do so would multiply 2x the number of cases the search and hashing code needs to consider. It's too much work for no practical gain

Comment 5 James Z.M. Gao 2021-12-03 15:40:05 AEDT

yes, '[host]:22' should not be output to knownhosts. For matching a host, the `hostport` in ssh-keygen should also remove the default 22 port, that is '[host]:22' --> 'host'. Then the matching time remain the same, in the mean while the matching logic are consistent with generating.