ddn.net.ssh.known_hosts

known_hosts parsing and host trust matching.

Parses the OpenSSH known_hosts format - plain and hashed host patterns, wildcard and negated patterns, markers, comments - and answers whether a presented host key is trusted, unknown, changed, or revoked for a target (host, port) plus optional caller aliases.

Policy notes:

Parsing is strict: a malformed file throws instead of being
silently skipped, so trust decisions fail closed.

Entries whose key type has no enabled public-data parser -
ecdsa-sha2-nistp384/nistp521, certificate, and security-key types - are skipped the way OpenSSH ignores key types it does not use; the enabled profile never negotiates them, so they cannot match a presented key.

A matched @revoked entry marks the host revoked and
overrides everything else.

@cert-authority entries never act as plain trusted
keys; they surface as a distinct unsupported outcome while certificate validation is out of scope.

The file is never modified; there is no accept-new
behaviour here.

var edBlobBase64 otherBlobBase64

enum SshKnownHostsLimits SshKnownHostsResult

struct SshKnownHostsEntry

class SshKnownHosts SshPinnedHostKeys

fn base64Bytes edBlob otherBlob

Types 5

enumSshKnownHostsResult

Outcome of a known_hosts lookup for a presented key.

noMatchNo pattern matched the target

trustedA pattern matched and the presented key equals the stored key

changedA pattern matched but the stored key differs from the presented one

revokedA matching entry is marked revoked

certAuthorityOnly certificate-authority entries matched (unsupported here)

enumSshKnownHostsLimits

known_hosts limits from the support matrix.

lineMax = 16384Maximum bytes per line

entriesMax = 8192Maximum number of entries

structSshKnownHostsEntry

One parsed known_hosts entry.

Fields

bool revokedTrue when marked @revoked

bool certAuthorityTrue when marked @cert-authority

string[] patternsHost pattern field items, negation flags included

string keyTypeKey-format name from the line

const(ubyte)[] keyBlobDecoded key blob

classSshKnownHosts

A parsed known_hosts database.

Fields

private SshKnownHostsEntry[] entries_

Methods

SshKnownHosts parse(string contents) static @safeParses known_hosts contents strictly.

SshKnownHostsResult check(string host,  ushort  port,
          const(ubyte)[]  keyBlob,  string[]  aliases =  null)

const @safeLooks up a presented key for a target host.

size_t entryCount() @property const @safe pure nothrowReturns: the number of parsed entries.

private

SshKnownHostsEntry parseEntry(string line,
          size_t lineNo)

static @safe

private string[] splitPatterns(string field) static @safe pure

private

const(ubyte)[] decodeKeyBase64(string text,
          size_t lineNo)

static @trusted

private

string[] candidateStrings(string host,  ushort  port,
          string[]  aliases)

static @safe pure

private

bool entryMatches(
          scope  const  SshKnownHostsEntry entry,
          scope  const  string[]  candidates)

static @safe

private

bool hashedHostMatches(string field,
          string candidate)

static @trustedChecks a hashed host field of the form |1|salt|hash against one candidate using HMAC-SHA1 with the stored salt.

private

bool patternMatches(string pattern,
          string candidate)

static @safe pure nothrowMatches one non-hashed pattern against one candidate.

private bool globMatch(string p, string s) static @safe pure nothrow

private string[] splitByChar(string s, char sep) static @safe pure

private const(ubyte)[] decodeBase64(string text) static @trusted

private

ptrdiff_t indexOf(string haystack,  char  needle,
          size_t start)

static @safe pure nothrow

Constructors

this(SshKnownHostsEntry[] entries)

classSshPinnedHostKeys

A pinned set of host keys: exact blobs, nothing else matches.

Fields

private const(ubyte)[][] blobs_

Methods

bool isPinned(const(ubyte)[] keyBlob) const @safeChecks whether the presented blob is one of the pinned keys.

Constructors

this(scope const(ubyte)[][] blobs)Constructs a pinned-key set from exact key blobs.

Functions 3

private fnconst(ubyte)[] edBlob() @safe

private fnconst(ubyte)[] otherBlob() @safe

private fnconst(ubyte)[] base64Bytes(string text) @safe

Variables 2

private varstring edBlobBase64 = "AAAAC3NzaC1lZDI1NTE5AAAAIH2rdejW247PBfeVS8elmtXzRTcaAeqAff968XHgkai+"

private varstring otherBlobBase64 = "AAAAC3NzaC1lZDI1NTE5AAAAINhZZIMbIoqJYucBZG8cectL3avqcfVbMs9/vOjCQCHq"