Bug 3367 - ssh-keyscan with non-22 port does not hash correct host
Summary: ssh-keyscan with non-22 port does not hash correct host
Status: NEW
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh-keyscan (show other bugs)
Version: 8.8p1
Hardware: All All
: P3 normal
Assignee: Damien Miller
URL:
Keywords:
Depends on:
Blocks: V_9_4
  Show dependency treegraph
 
Reported: 2021-11-22 18:49 AEDT by James Z.M. Gao
Modified: 2023-03-17 13:33 AEDT (History)
2 users (show)

See Also:


Attachments
pass the fuill [host]:port for hashing (481 bytes, patch)
2021-12-03 10:41 AEDT, Damien Miller
dtucker: ok+
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description James Z.M. Gao 2021-11-22 18:49:56 AEDT
ssh-keyscan -H -p 1234 host > k.txt ## dump and hash hostkeys

ssh-keygen -f k.txt -F '[host]:1234' ## output nothing

ssh-keygen -f k.txt -F host ## output hostkeys for [host]:1234
Comment 1 Damien Miller 2021-12-03 10:41:04 AEDT
Created attachment 3556 [details]
pass the fuill [host]:port for hashing
Comment 2 Damien Miller 2021-12-03 10:46:00 AEDT
This has been committed and will be in OpenSSH 8.9 - thanks!
Comment 3 James Z.M. Gao 2021-12-03 14:07:41 AEDT
thanks very much.

@dtucker another minor issue of the KnownHosts matching of `ssh-keygen -F` is that 'host' and '[host]:22' are not equivalent.


ssh-keyscan host > k.txt # output: host key-type ...

ssh-keyscan -p 22 host # also output: host key-type ...

ssh-keygen -f k.txt -F host # found hostkey as expected

ssh-keygen -f k.txt -F '[host]:22' # found nothing, whereas we should also match the same key as previous command
Comment 4 Damien Miller 2021-12-03 15:13:48 AEDT
'host' and '[host]:22' aren't supposed to be equivalent - nothing in OpenSSH should ever write '[host]:22'.

We deliberately avoid appending the port if it's the default because to do so would multiply 2x the number of cases the search and hashing code needs to consider. It's too much work for no practical gain
Comment 5 James Z.M. Gao 2021-12-03 15:40:05 AEDT
yes, '[host]:22' should not be output to knownhosts. For matching a host, the `hostport` in ssh-keygen should also remove the default 22 port, that is '[host]:22' --> 'host'. Then the matching time remain the same, in the mean while the matching logic are consistent with generating.