[Bug 4014] ssh-keygen -R and -F miss a hashed known_hosts entry when the host name's case differs

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=4014

--- Comment #2 from hello at tatryfab.com ---
I had a look at where this goes wrong.

The diagnosis in the report is right, but the fix belongs one level
lower than -F and -R. Everything that writes known_hosts already
lowercases the name before hashing it (format_host_entry(), ssh-keygen
-H, ssh-keyscan -H, all since bz#2591), and plain entries are compared
through match_hostname(), which lowercases first (bz#2685). The one
place that doesn't is match_maybe_hashed() in hostfile.c: it hashes the
lookup name exactly as given. So the hashed branch is the last
case-sensitive spot in known_hosts matching, and ssh-keygen isn't the
only thing that goes through it.

ssh itself is fine, because it lowercases the destination before it
looks anything up. But ssh-add -h hits the same wall ("No host keys
found for destination" when the name's case differs from a hashed
entry), and so does sshd with HostbasedUsesNameFromPacketOnly=yes,
where the name from the client is used as-is. Hashed IP entries looked
up with upper-case hex (2001:DB8::1) miss the same way.

The attached patch lowercases the name in match_maybe_hashed() before
hashing, so all of those get fixed at once and hashed entries behave
the same as plain ones. It also adds -F and -R checks with a mixed-case
name to regress/keygen-knownhosts.sh; they fail on master and pass with
the patch. make unit and make t-exec pass against current master here
(Linux x86_64, OpenSSL 3.0).

Two things I deliberately left alone. I didn't change the exit status
of -R when nothing is removed: "ssh-keygen -R host" under set -e is
common in scripts and the host is often legitimately absent, and with
the case bug fixed the reported scenario doesn't reach that path
anyway. There is also a small compatibility wrinkle. An entry hashed
from mixed-case input by ssh-keygen -H or ssh-keyscan -H before 7.5
could until now be removed by -R with that exact spelling, and after
this it can't be matched by any spelling. ssh hasn't been able to match
those entries since 7.5, so they are already dead, and I didn't think a
second exact-case hash was worth the code. Happy to add it if you'd
rather keep that working.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.