The PermitOpen rule in sshd_config holds a list of TCP endpoints and port number tuples delimited by a space character. The endpoint can be specified as IP address or FQDN. FQDN are case insensitive, but sshd performs a case sensitiv check. The sshd configuration in sshd_config: PermitOpen=gitlab.company.de:80 lynq.company.de:3121 Here is the ssh client call: ssh -L 3121:Lynq.company.de:3121 remote.company.de Solution: Perform a case insensitive check.
It would be better to compare FQDNs case-insensitively. There are some corner cases that make implementation a bit more tricky: The same ForwardPermission members are used for FQDNs, addresses (which are treated as strings anyway) and Unix domain socket paths. FQDNs are the only ones of these that should be simply compared case-insensitively. Paths are obviously case-sensitive, but surprisingly addresses can be too: IPv6 addresses may have an interface scope that is case-sensitive on some platforms. See bug #2763 for an example of this. IMO the best way to approach this would be when we are parsing the configuration by doing something similar to what ssh does with hostnames. If it's a Unix domain socket path, leave it alone. If it looks like address, give it a round-trip through getaddrinfo w/AI_NUMERICHOST and getnameinfo. To render it as a canonical string. Otherwise, it's a fqdn and lowercase it.
Retarget remaining bugs planned for 7.8 release to 7.9
Retarget unfinished bugs to OpenSSH 8.0
Retarget outstanding bugs at next release
Retarget these bugs to 8.2 release
Prepare for 8.2 release; retarget bugs
Retarget bugs to 8.4 release
retarget after 8.6p1 release
actually, this is really fiddly to do properly. We can't reliably roundtrip through getaddrinfo/getnameinfo because the PermitOpen directives may refer to addresses scoped to interfaces that may happen not to be available at the time of sshd_config parsing (e.g. some sort of ephemeral tunnel interface). Attempting to scrub these addresses this way could cause them to be incorrectly rejected. So a better heuristic would be to detect the hostname case (i.e. not path and not address) and only lowercase those. We'd also need to do the same to hostnames coming in for forwarding requests, subject to similar rules.