From db7b8171ee084cbbe3a5ec5ef26df88e17aa3905 Mon Sep 17 00:00:00 2001
From: Damien Miller <djm@mindrot.org>
Date: Tue, 1 Mar 2005 21:48:03 +1100
Subject: [PATCH]    - djm@cvs.openbsd.org 2005/03/01 10:41:28     
 [ssh-keyscan.1 ssh-keyscan.c]      option to hash hostnames output by
 ssh-keyscan; ok markus@ deraadt@

---
 ChangeLog     |  5 ++++-
 ssh-keyscan.1 | 12 ++++++++++--
 ssh-keyscan.c | 18 ++++++++++++++----
 3 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index b69fe2f51..fd3076220 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -33,6 +33,9 @@
      add support for hashing host names and addresses added to known_hosts
      files, to improve privacy of which hosts user have been visiting; ok 
      markus@ deraadt@
+   - djm@cvs.openbsd.org 2005/03/01 10:41:28
+     [ssh-keyscan.1 ssh-keyscan.c]
+     option to hash hostnames output by ssh-keyscan; ok markus@ deraadt@
 
 20050226
  - (dtucker) [openbsd-compat/bsd-openpty.c openbsd-compat/inet_ntop.c]
@@ -2209,4 +2212,4 @@
    - (djm) Trim deprecated options from INSTALL. Mention UsePAM
    - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
 
-$Id: ChangeLog,v 1.3673 2005/03/01 10:47:37 djm Exp $
+$Id: ChangeLog,v 1.3674 2005/03/01 10:48:03 djm Exp $
diff --git a/ssh-keyscan.1 b/ssh-keyscan.1
index 9efcf5213..63427e727 100644
--- a/ssh-keyscan.1
+++ b/ssh-keyscan.1
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ssh-keyscan.1,v 1.18 2004/07/12 23:34:25 brad Exp $
+.\"	$OpenBSD: ssh-keyscan.1,v 1.19 2005/03/01 10:41:28 djm Exp $
 .\"
 .\" Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
 .\"
@@ -15,7 +15,7 @@
 .Sh SYNOPSIS
 .Nm ssh-keyscan
 .Bk -words
-.Op Fl v46
+.Op Fl Hv46
 .Op Fl p Ar port
 .Op Fl T Ar timeout
 .Op Fl t Ar type
@@ -46,6 +46,14 @@ scanning process involve any encryption.
 .Pp
 The options are as follows:
 .Bl -tag -width Ds
+.It Fl H
+Hash all hostnames and addresses in the output.
+Hashed names may be used normally by
+.Nm ssh
+and
+.Nm sshd ,
+but they do not reveal identifying information should the file's contents
+be disclosed.
 .It Fl p Ar port
 Port to connect to on the remote host.
 .It Fl T Ar timeout
diff --git a/ssh-keyscan.c b/ssh-keyscan.c
index 3cb52ac2e..e94867004 100644
--- a/ssh-keyscan.c
+++ b/ssh-keyscan.c
@@ -7,7 +7,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keyscan.c,v 1.50 2004/08/11 21:44:32 avsm Exp $");
+RCSID("$OpenBSD: ssh-keyscan.c,v 1.51 2005/03/01 10:41:28 djm Exp $");
 
 #include "openbsd-compat/sys-queue.h"
 
@@ -28,6 +28,7 @@ RCSID("$OpenBSD: ssh-keyscan.c,v 1.50 2004/08/11 21:44:32 avsm Exp $");
 #include "log.h"
 #include "atomicio.h"
 #include "misc.h"
+#include "hostfile.h"
 
 /* Flag indicating whether IPv4 or IPv6.  This can be set on the command line.
    Default value is AF_UNSPEC means both IPv4 and IPv6. */
@@ -41,6 +42,8 @@ int ssh_port = SSH_DEFAULT_PORT;
 
 int get_keytypes = KT_RSA1;	/* Get only RSA1 keys by default */
 
+int hash_hosts = 0;		/* Hash hostname on output */
+
 #define MAXMAXFD 256
 
 /* The number of seconds after which to give up on a TCP connection */
@@ -366,10 +369,14 @@ keygrab_ssh2(con *c)
 static void
 keyprint(con *c, Key *key)
 {
+	char *host = c->c_output_name ? c->c_output_name : c->c_name;
+
 	if (!key)
 		return;
+	if (hash_hosts && (host = host_hash(host, NULL, 0)) == NULL)
+		fatal("host_hash failed");
 
-	fprintf(stdout, "%s ", c->c_output_name ? c->c_output_name : c->c_name);
+	fprintf(stdout, "%s ", host);
 	key_write(key, stdout);
 	fputs("\n", stdout);
 }
@@ -676,7 +683,7 @@ fatal(const char *fmt,...)
 static void
 usage(void)
 {
-	fprintf(stderr, "usage: %s [-v46] [-p port] [-T timeout] [-t type] [-f file]\n"
+	fprintf(stderr, "usage: %s [-Hv46] [-p port] [-T timeout] [-t type] [-f file]\n"
 	    "\t\t   [host | addrlist namelist] [...]\n",
 	    __progname);
 	exit(1);
@@ -700,8 +707,11 @@ main(int argc, char **argv)
 	if (argc <= 1)
 		usage();
 
-	while ((opt = getopt(argc, argv, "v46p:T:t:f:")) != -1) {
+	while ((opt = getopt(argc, argv, "Hv46p:T:t:f:")) != -1) {
 		switch (opt) {
+		case 'H':
+			hash_hosts = 1;
+			break;
 		case 'p':
 			ssh_port = a2port(optarg);
 			if (ssh_port == 0) {