Bug 198043

Summary:	Updated OpenSSH no longer uses FQDN in known_hosts
Product:	Base System	Reporter:	eric
Component:	bin	Assignee:	Eric van Gyzen <vangyzen>
Status:	Closed FIXED
Severity:	Affects Many People	CC:	des, vangyzen
Priority:	---
Version:	10.1-RELEASE
Hardware:	Any
OS:	Any

Description eric 2015-02-25 20:27:42 UTC

The update to OpenSSH 6.5p1 (r261320) removed FreeBSD's customization to use the canonical hostname (FQDN) in the known_hosts file.  Was this intentional?  Could it be restored?

Conveniently, patch-ssh.c from security/openssh-portable applies cleanly to
releng/10.1 (and to head, I expect).

The new CanonicalizeHostname and related options can be used to get the old behavior, but only by manually configuring the DNS search path in an ssh client config file.  It would be unfortunate if this were required in order to preserve the long-standing behavior.

Comment 1 Glen Barber freebsd_committer

2015-07-08 13:46:34 UTC

DES, any comments on this?

Comment 2 Dag-Erling Smørgrav freebsd_committer

2015-07-09 12:10:43 UTC

I remember discussing this out of band but I forgot to follow up.  As far as I recall, the patch was removed because upstream introduced a similar mechanism, but apparently it is not entirely equivalent.  Since 10.2 is right around the corner and has the same issue, I guess the simplest solution is to adopt the patch from the port and revisit the issue later.

Comment 3 Eric van Gyzen freebsd_committer

2015-07-09 14:28:45 UTC

Dag-Erling's memory is correct.

https://lists.freebsd.org/pipermail/freebsd-stable/2015-April/082206.html
https://lists.freebsd.org/pipermail/freebsd-stable/2015-February/081813.html

It would be _very_ nice to apply the patch from the port before 10.2.  I'll try, but I'm still recovering from a cross-country relocation and don't have my environments set up.

Comment 4 Eric van Gyzen freebsd_committer

2015-07-16 14:09:38 UTC

https://reviews.freebsd.org/D3103

Comment 5 commit-hook freebsd_committer

2015-07-16 18:45:12 UTC

A commit references this bug:

Author: vangyzen
Date: Thu Jul 16 18:44:19 UTC 2015
New revision: 285642
URL: https://svnweb.freebsd.org/changeset/base/285642

Log:
  ssh: canonicize the host name before looking it up in the host file

  Re-apply r99054 by des in 2002.  This was accidentally dropped
  by the update to OpenSSH 6.5p1 (r261320).

  This change is actually taken from r387082 of
  ports/security/openssh-portable/files/patch-ssh.c

  PR:		198043
  Differential Revision:	https://reviews.freebsd.org/D3103
  Reviewed by:	des
  Approved by:	kib (mentor)
  MFC after:	3 days
  Relnotes:	yes
  Sponsored by:	Dell Inc.

Changes:
  head/crypto/openssh/ssh.c

Comment 6 commit-hook freebsd_committer

2015-07-21 14:36:40 UTC

A commit references this bug:

Author: vangyzen
Date: Tue Jul 21 14:36:34 UTC 2015
New revision: 285750
URL: https://svnweb.freebsd.org/changeset/base/285750

Log:
  MFC r285642

  ssh: canonicize the host name before looking it up in the host file

  Re-apply r99054 by des in 2002. This was accidentally dropped
  by the update to OpenSSH 6.5p1 (r261320).

  This change is actually taken from r387082 of
  ports/security/openssh-portable/files/patch-ssh.c

  Differential Revision: https://reviews.freebsd.org/D3103
  PR:		198043
  Approved by:	re (gjb), kib (mentor)
  Sponsored by:	Dell Inc.
  Relnotes:	yes

Changes:
_U  stable/10/
  stable/10/crypto/openssh/ssh.c

Comment 7 commit-hook freebsd_committer

2015-07-21 18:55:34 UTC

A commit references this bug:

Author: vangyzen
Date: Tue Jul 21 18:54:39 UTC 2015
New revision: 285763
URL: https://svnweb.freebsd.org/changeset/base/285763

Log:
  MFC r285642

  ssh: canonicize the host name before looking it up in the host file

  Re-apply r99054 by des in 2002. This was accidentally dropped
  by the update to OpenSSH 6.5p1 (r261320).

  This change is actually taken from r387082 of
  ports/security/openssh-portable/files/patch-ssh.c

  Differential Revision: https://reviews.freebsd.org/D3103
  PR:             198043
  Approved by:    kib (mentor)
  Sponsored by:   Dell Inc.
  Relnotes:       yes

Changes:
_U  stable/9/crypto/openssh/
  stable/9/crypto/openssh/ssh.c