5 files changed, 59 insertions, 7 deletions

diff --git a/debian/.git-dpm b/debian/.git-dpm
index 0acd19a85..9ddb5b008 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-78800aa252da1ebbfb55f7e593f43c337e694cc3
-78800aa252da1ebbfb55f7e593f43c337e694cc3
+a0f9daa9c3cc2b37b9707b228263eb717d201371
+a0f9daa9c3cc2b37b9707b228263eb717d201371
 971a7653746a6972b907dfe0ce139c06e4a6f482
 971a7653746a6972b907dfe0ce139c06e4a6f482
 openssh_7.4p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index 0920286dd..b0a965c15 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,8 @@ openssh (1:7.4p1-8) UNRELEASED; urgency=medium
 
   * Fix ssh-keygen -H accidentally corrupting known_hosts that contained
     already-hashed entries (closes: #851734, LP: #1668093).
+  * Fix ssh-keyscan to correctly hash hosts with a port number (closes:
+    #857736, LP: #1670745).
 
  -- Colin Watson <cjwatson@debian.org>  Thu, 09 Mar 2017 11:25:55 +0000
 
diff --git a/debian/patches/series b/debian/patches/series
index 7ddc4a772..2d9d2bc12 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -31,3 +31,4 @@ sandbox-x32-workaround.patch
 no-dsa-host-key-by-default.patch
 restore-authorized_keys2.patch
 ssh-keygen-hash-corruption.patch
+ssh-keyscan-hash-port.patch
diff --git a/debian/patches/ssh-keyscan-hash-port.patch b/debian/patches/ssh-keyscan-hash-port.patch
new file mode 100644
index 000000000..32a2f6a01
--- /dev/null
+++ b/debian/patches/ssh-keyscan-hash-port.patch
@@ -0,0 +1,48 @@
+From a0f9daa9c3cc2b37b9707b228263eb717d201371 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Fri, 10 Mar 2017 03:18:24 +0000
+Subject: upstream commit
+
+correctly hash hosts with a port number. Reported by Josh
+Powers in bz#2692; ok dtucker@
+
+Upstream-ID: 468e357ff143e00acc05bdd2803a696b3d4b6442
+
+Origin: https://anongit.mindrot.org/openssh.git/commit/?id=8a2834454c73dfc1eb96453c0e97690595f3f4c2
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2692
+Bug-Debian: https://bugs.debian.org/857736
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1670745
+Last-Update: 2017-03-14
+
+Patch-Name: ssh-keyscan-hash-port.patch
+---
+ ssh-keyscan.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/ssh-keyscan.c b/ssh-keyscan.c
+index c30d54e6..24b51ff1 100644
+--- a/ssh-keyscan.c
++++ b/ssh-keyscan.c
+@@ -321,16 +321,17 @@ keygrab_ssh2(con *c)
+ }
+ 
+ static void
+-keyprint_one(char *host, struct sshkey *key)
++keyprint_one(const char *host, struct sshkey *key)
+ {
+        char *hostport;
+-
+-       if (hash_hosts && (host = host_hash(host, NULL, 0)) == NULL)
+-               fatal("host_hash failed");
++       const char *known_host, *hashed;
+ 
+        hostport = put_host_port(host, ssh_port);
++       if (hash_hosts && (hashed = host_hash(host, NULL, 0)) == NULL)
++               fatal("host_hash failed");
++       known_host = hash_hosts ? hashed : hostport;
+        if (!get_cert)
+-               fprintf(stdout, "%s ", hostport);
++               fprintf(stdout, "%s ", known_host);
+        sshkey_write(key, stdout);
+        fputs("\n", stdout);
+        free(hostport);
diff --git a/ssh-keyscan.c b/ssh-keyscan.c
index c30d54e62..24b51ff12 100644
--- a/ssh-keyscan.c
+++ b/ssh-keyscan.c
@@ -321,16 +321,17 @@ keygrab_ssh2(con *c)
 }
 
 static void
-keyprint_one(char *host, struct sshkey *key)
+keyprint_one(const char *host, struct sshkey *key)
 {
         char *hostport;
-
-        if (hash_hosts && (host = host_hash(host, NULL, 0)) == NULL)
-                fatal("host_hash failed");
+        const char *known_host, *hashed;
 
         hostport = put_host_port(host, ssh_port);
+        if (hash_hosts && (hashed = host_hash(host, NULL, 0)) == NULL)
+                fatal("host_hash failed");
+        known_host = hash_hosts ? hashed : hostport;
         if (!get_cert)
-                fprintf(stdout, "%s ", hostport);
+                fprintf(stdout, "%s ", known_host);
         sshkey_write(key, stdout);
         fputs("\n", stdout);
         free(hostport);