Adding upstream version 1:8.4p1.upstream/1%8.4p1upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

35 files changed, 1272 insertions, 0 deletions

diff --git a/regress/unittests/hostkeys/Makefile b/regress/unittests/hostkeys/Makefile
new file mode 100644
index 0000000..d841d96
--- /dev/null
+++ b/regress/unittests/hostkeys/Makefile
@@ -0,0 +1,25 @@
+#	$OpenBSD: Makefile,v 1.8 2020/04/06 09:43:56 dtucker Exp $
+
+PROG=test_hostkeys
+SRCS=tests.c test_iterate.c
+
+# From usr.bin/ssh
+SRCS+=sshbuf-getput-basic.c sshbuf-getput-crypto.c sshbuf-misc.c sshbuf.c
+SRCS+=sshbuf-io.c atomicio.c sshkey.c authfile.c cipher.c log.c ssh-rsa.c
+SRCS+=ssh-dss.c ssh-ecdsa.c ssh-ed25519.c mac.c umac.c umac128.c hmac.c misc.c
+SRCS+=ssherr.c uidswap.c cleanup.c xmalloc.c match.c krl.c fatal.c
+SRCS+=addrmatch.c bitmap.c hostfile.c
+SRCS+=ed25519.c hash.c ge25519.c fe25519.c sc25519.c verify.c
+SRCS+=cipher-chachapoly.c chacha.c poly1305.c ssh-ecdsa-sk.c ssh-sk.c
+SRCS+=ssh-ed25519-sk.c sk-usbhid.c
+
+SRCS+=digest-openssl.c
+#SRCS+=digest-libc.c
+SRCS+=utf8.c
+
+REGRESS_TARGETS=run-regress-${PROG}
+
+run-regress-${PROG}: ${PROG}
+	env ${TEST_ENV} ./${PROG} -d ${.CURDIR}/testdata
+
+.include <bsd.regress.mk>
diff --git a/regress/unittests/hostkeys/mktestdata.sh b/regress/unittests/hostkeys/mktestdata.sh
new file mode 100644
index 0000000..5a46de9
--- /dev/null
+++ b/regress/unittests/hostkeys/mktestdata.sh
@@ -0,0 +1,86 @@
+#!/bin/sh
+# $OpenBSD: mktestdata.sh,v 1.2 2017/04/30 23:33:48 djm Exp $
+
+set -ex
+
+cd testdata
+
+rm -f rsa* dsa* ecdsa* ed25519*
+rm -f known_hosts*
+
+gen_all() {
+	_n=$1
+	_ecdsa_bits=256
+	test "x$_n" = "x1" && _ecdsa_bits=384
+	test "x$_n" = "x2" && _ecdsa_bits=521
+	ssh-keygen -qt rsa -b 1024 -C "RSA #$_n" -N "" -f rsa_$_n
+	ssh-keygen -qt dsa -b 1024 -C "DSA #$_n" -N "" -f dsa_$_n
+	ssh-keygen -qt ecdsa -b $_ecdsa_bits -C "ECDSA #$_n" -N "" -f ecdsa_$_n
+	ssh-keygen -qt ed25519 -C "ED25519 #$_n" -N "" -f ed25519_$_n
+	# Don't need private keys
+	rm -f rsa_$_n dsa_$_n ecdsa_$_n ed25519_$_n
+}
+
+hentries() {
+	_preamble=$1
+	_kspec=$2
+	for k in `ls -1 $_kspec | sort` ; do
+		printf "$_preamble "
+		cat $k
+	done
+	echo
+}
+
+gen_all 1
+gen_all 2
+gen_all 3
+gen_all 4
+gen_all 5
+gen_all 6
+
+# A section of known_hosts with hashed hostnames.
+(
+	hentries "sisyphus.example.com" "*_5.pub"
+	hentries "prometheus.example.com,192.0.2.1,2001:db8::1" "*_6.pub"
+) > known_hosts_hash_frag
+ssh-keygen -Hf known_hosts_hash_frag
+rm -f known_hosts_hash_frag.old
+
+# Populated known_hosts, including comments, hashed names and invalid lines
+(
+	echo "# Plain host keys, plain host names"
+	hentries "sisyphus.example.com" "*_1.pub"
+
+	echo "# Plain host keys, hostnames + addresses"
+	hentries "prometheus.example.com,192.0.2.1,2001:db8::1" "*_2.pub"
+
+	echo "# Some hosts with wildcard names / IPs"
+	hentries "*.example.com,192.0.2.*,2001:*" "*_3.pub"
+
+	echo "# Hashed hostname and address entries"
+	cat known_hosts_hash_frag
+	rm -f known_hosts_hash_frag
+	echo
+
+	echo "# Revoked and CA keys"
+	printf "@revoked sisyphus.example.com " ; cat ed25519_4.pub
+	printf "@cert-authority prometheus.example.com " ; cat ecdsa_4.pub
+	printf "@cert-authority *.example.com " ; cat dsa_4.pub
+
+	printf "\n"
+	echo "# Some invalid lines"
+	# Invalid marker
+	printf "@what sisyphus.example.com " ; cat dsa_1.pub
+	# Key missing
+	echo "sisyphus.example.com      "
+	# Key blob missing
+	echo "prometheus.example.com ssh-ed25519 "
+	# Key blob truncated
+	echo "sisyphus.example.com ssh-dsa AAAATgAAAAdz"
+	# Invalid type
+	echo "sisyphus.example.com ssh-XXX AAAATgAAAAdzc2gtWFhYAAAAP0ZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRg=="
+	# Type mismatch with blob
+	echo "prometheus.example.com ssh-rsa AAAATgAAAAdzc2gtWFhYAAAAP0ZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRg=="
+) > known_hosts
+
+echo OK
diff --git a/regress/unittests/hostkeys/test_iterate.c b/regress/unittests/hostkeys/test_iterate.c
new file mode 100644
index 0000000..5904121
--- /dev/null
+++ b/regress/unittests/hostkeys/test_iterate.c
@@ -0,0 +1,1065 @@
+/* 	$OpenBSD: test_iterate.c,v 1.6 2018/07/16 03:09:59 djm Exp $ */
+/*
+ * Regress test for hostfile.h hostkeys_foreach()
+ *
+ * Placed in the public domain
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <stdio.h>
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
+#include <stdlib.h>
+#include <string.h>
+
+#include "../test_helper/test_helper.h"
+
+#include "sshkey.h"
+#include "authfile.h"
+#include "hostfile.h"
+
+struct expected {
+	const char *key_file;		/* Path for key, NULL for none */
+	int no_parse_status;		/* Expected status w/o key parsing */
+	int no_parse_keytype;		/* Expected keytype w/o key parsing */
+	int match_host_p;		/* Match 'prometheus.example.com' */
+	int match_host_s;		/* Match 'sisyphus.example.com' */
+	int match_ipv4;			/* Match '192.0.2.1' */
+	int match_ipv6;			/* Match '2001:db8::1' */
+	int match_flags;		/* Expected flags from match */
+	struct hostkey_foreach_line l;	/* Expected line contents */
+};
+
+struct cbctx {
+	const struct expected *expected;
+	size_t nexpected;
+	size_t i;
+	int flags;
+	int match_host_p;
+	int match_host_s;
+	int match_ipv4;
+	int match_ipv6;
+};
+
+/*
+ * hostkeys_foreach() iterator callback that verifies the line passed
+ * against an array of expected entries.
+ */
+static int
+check(struct hostkey_foreach_line *l, void *_ctx)
+{
+	struct cbctx *ctx = (struct cbctx *)_ctx;
+	const struct expected *expected;
+	int parse_key = (ctx->flags & HKF_WANT_PARSE_KEY) != 0;
+	const int matching = (ctx->flags & HKF_WANT_MATCH) != 0;
+	u_int expected_status, expected_match;
+	int expected_keytype, skip = 0;
+
+	test_subtest_info("entry %zu/%zu, file line %ld",
+	    ctx->i + 1, ctx->nexpected, l->linenum);
+
+	for (;;) {
+		ASSERT_SIZE_T_LT(ctx->i, ctx->nexpected);
+		expected = ctx->expected + ctx->i++;
+		/* If we are matching host/IP then skip entries that don't */
+		if (!matching)
+			break;
+		if (ctx->match_host_p && expected->match_host_p)
+			break;
+		if (ctx->match_host_s && expected->match_host_s)
+			break;
+		if (ctx->match_ipv4 && expected->match_ipv4)
+			break;
+		if (ctx->match_ipv6 && expected->match_ipv6)
+			break;
+	}
+	expected_status = (parse_key || expected->no_parse_status < 0) ?
+	    expected->l.status : (u_int)expected->no_parse_status;
+	expected_match = expected->l.match;
+#define UPDATE_MATCH_STATUS(x) do { \
+		if (ctx->x && expected->x) { \
+			expected_match |= expected->x; \
+			if (expected_status == HKF_STATUS_OK) \
+				expected_status = HKF_STATUS_MATCHED; \
+		} \
+	} while (0)
+	expected_keytype = (parse_key || expected->no_parse_keytype < 0) ?
+	    expected->l.keytype : expected->no_parse_keytype;
+
+#ifndef OPENSSL_HAS_ECC
+	if (expected->l.keytype == KEY_ECDSA ||
+	    expected->no_parse_keytype == KEY_ECDSA)
+		skip = 1;
+#endif /* OPENSSL_HAS_ECC */
+#ifndef WITH_OPENSSL
+	if (expected->l.keytype == KEY_DSA ||
+	    expected->no_parse_keytype == KEY_DSA ||
+	    expected->l.keytype == KEY_RSA ||
+	    expected->no_parse_keytype == KEY_RSA ||
+	    expected->l.keytype == KEY_ECDSA ||
+	    expected->no_parse_keytype == KEY_ECDSA)
+		skip = 1;
+#endif /* WITH_OPENSSL */
+	if (skip) {
+		expected_status = HKF_STATUS_INVALID;
+		expected_keytype = KEY_UNSPEC;
+		parse_key = 0;
+	}
+	UPDATE_MATCH_STATUS(match_host_p);
+	UPDATE_MATCH_STATUS(match_host_s);
+	UPDATE_MATCH_STATUS(match_ipv4);
+	UPDATE_MATCH_STATUS(match_ipv6);
+
+	ASSERT_PTR_NE(l->path, NULL); /* Don't care about path */
+	ASSERT_LONG_LONG_EQ(l->linenum, expected->l.linenum);
+	ASSERT_U_INT_EQ(l->status, expected_status);
+	ASSERT_U_INT_EQ(l->match, expected_match);
+	/* Not all test entries contain fulltext */
+	if (expected->l.line != NULL)
+		ASSERT_STRING_EQ(l->line, expected->l.line);
+	ASSERT_INT_EQ(l->marker, expected->l.marker);
+	/* XXX we skip hashed hostnames for now; implement checking */
+	if (expected->l.hosts != NULL)
+		ASSERT_STRING_EQ(l->hosts, expected->l.hosts);
+	/* Not all test entries contain raw keys */
+	if (expected->l.rawkey != NULL)
+		ASSERT_STRING_EQ(l->rawkey, expected->l.rawkey);
+	/* XXX synthesise raw key for cases lacking and compare */
+	ASSERT_INT_EQ(l->keytype, expected_keytype);
+	if (parse_key) {
+		if (expected->l.key == NULL)
+			ASSERT_PTR_EQ(l->key, NULL);
+		if (expected->l.key != NULL) {
+			ASSERT_PTR_NE(l->key, NULL);
+			ASSERT_INT_EQ(sshkey_equal(l->key, expected->l.key), 1);
+		}
+	}
+	if (parse_key && !(l->comment == NULL && expected->l.comment == NULL))
+		ASSERT_STRING_EQ(l->comment, expected->l.comment);
+	return 0;
+}
+
+/* Loads public keys for a set of expected results */
+static void
+prepare_expected(struct expected *expected, size_t n)
+{
+	size_t i;
+
+	for (i = 0; i < n; i++) {
+		if (expected[i].key_file == NULL)
+			continue;
+#ifndef OPENSSL_HAS_ECC
+		if (expected[i].l.keytype == KEY_ECDSA)
+			continue;
+#endif /* OPENSSL_HAS_ECC */
+#ifndef WITH_OPENSSL
+		switch (expected[i].l.keytype) {
+		case KEY_RSA:
+		case KEY_DSA:
+		case KEY_ECDSA:
+			continue;
+		}
+#endif /* WITH_OPENSSL */
+		ASSERT_INT_EQ(sshkey_load_public(
+		    test_data_file(expected[i].key_file), &expected[i].l.key,
+		    NULL), 0);
+	}
+}
+
+static void
+cleanup_expected(struct expected *expected, size_t n)
+{
+	size_t i;
+
+	for (i = 0; i < n; i++) {
+		sshkey_free(expected[i].l.key);
+		expected[i].l.key = NULL;
+	}
+}
+
+struct expected expected_full[] = {
+	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
+		NULL,				/* path, don't care */
+		1,				/* line number */
+		HKF_STATUS_COMMENT,		/* status */
+		0,				/* match flags */
+		"# Plain host keys, plain host names", /* full line, optional */
+		MRK_NONE,			/* marker (CA / revoked) */
+		NULL,				/* hosts text */
+		NULL,				/* raw key, optional */
+		KEY_UNSPEC,			/* key type */
+		NULL,				/* deserialised key */
+		NULL,				/* comment */
+	} },
+	{ "dsa_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
+		NULL,
+		2,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		"sisyphus.example.com",
+		NULL,
+		KEY_DSA,
+		NULL,	/* filled at runtime */
+		"DSA #1",
+	} },
+	{ "ecdsa_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
+		NULL,
+		3,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		"sisyphus.example.com",
+		NULL,
+		KEY_ECDSA,
+		NULL,	/* filled at runtime */
+		"ECDSA #1",
+	} },
+	{ "ed25519_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
+		NULL,
+		4,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		"sisyphus.example.com",
+		NULL,
+		KEY_ED25519,
+		NULL,	/* filled at runtime */
+		"ED25519 #1",
+	} },
+	{ "rsa_1.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
+		NULL,
+		5,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		"sisyphus.example.com",
+		NULL,
+		KEY_RSA,
+		NULL,	/* filled at runtime */
+		"RSA #1",
+	} },
+	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
+		NULL,
+		6,
+		HKF_STATUS_COMMENT,
+		0,
+		"",
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
+		NULL,
+		7,
+		HKF_STATUS_COMMENT,
+		0,
+		"# Plain host keys, hostnames + addresses",
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	{ "dsa_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
+		NULL,
+		8,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		"prometheus.example.com,192.0.2.1,2001:db8::1",
+		NULL,
+		KEY_DSA,
+		NULL,	/* filled at runtime */
+		"DSA #2",
+	} },
+	{ "ecdsa_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
+		NULL,
+		9,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		"prometheus.example.com,192.0.2.1,2001:db8::1",
+		NULL,
+		KEY_ECDSA,
+		NULL,	/* filled at runtime */
+		"ECDSA #2",
+	} },
+	{ "ed25519_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
+		NULL,
+		10,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		"prometheus.example.com,192.0.2.1,2001:db8::1",
+		NULL,
+		KEY_ED25519,
+		NULL,	/* filled at runtime */
+		"ED25519 #2",
+	} },
+	{ "rsa_2.pub" , -1, -1, HKF_MATCH_HOST, 0, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
+		NULL,
+		11,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		"prometheus.example.com,192.0.2.1,2001:db8::1",
+		NULL,
+		KEY_RSA,
+		NULL,	/* filled at runtime */
+		"RSA #2",
+	} },
+	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
+		NULL,
+		12,
+		HKF_STATUS_COMMENT,
+		0,
+		"",
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
+		NULL,
+		13,
+		HKF_STATUS_COMMENT,
+		0,
+		"# Some hosts with wildcard names / IPs",
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	{ "dsa_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
+		NULL,
+		14,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		"*.example.com,192.0.2.*,2001:*",
+		NULL,
+		KEY_DSA,
+		NULL,	/* filled at runtime */
+		"DSA #3",
+	} },
+	{ "ecdsa_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
+		NULL,
+		15,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		"*.example.com,192.0.2.*,2001:*",
+		NULL,
+		KEY_ECDSA,
+		NULL,	/* filled at runtime */
+		"ECDSA #3",
+	} },
+	{ "ed25519_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
+		NULL,
+		16,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		"*.example.com,192.0.2.*,2001:*",
+		NULL,
+		KEY_ED25519,
+		NULL,	/* filled at runtime */
+		"ED25519 #3",
+	} },
+	{ "rsa_3.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, HKF_MATCH_IP, HKF_MATCH_IP, -1, {
+		NULL,
+		17,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		"*.example.com,192.0.2.*,2001:*",
+		NULL,
+		KEY_RSA,
+		NULL,	/* filled at runtime */
+		"RSA #3",
+	} },
+	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
+		NULL,
+		18,
+		HKF_STATUS_COMMENT,
+		0,
+		"",
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
+		NULL,
+		19,
+		HKF_STATUS_COMMENT,
+		0,
+		"# Hashed hostname and address entries",
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	{ "dsa_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, {
+		NULL,
+		20,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_DSA,
+		NULL,	/* filled at runtime */
+		"DSA #5",
+	} },
+	{ "ecdsa_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, {
+		NULL,
+		21,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_ECDSA,
+		NULL,	/* filled at runtime */
+		"ECDSA #5",
+	} },
+	{ "ed25519_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, {
+		NULL,
+		22,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_ED25519,
+		NULL,	/* filled at runtime */
+		"ED25519 #5",
+	} },
+	{ "rsa_5.pub" , -1, -1, 0, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, -1, {
+		NULL,
+		23,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_RSA,
+		NULL,	/* filled at runtime */
+		"RSA #5",
+	} },
+	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
+		NULL,
+		24,
+		HKF_STATUS_COMMENT,
+		0,
+		"",
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	/*
+	 * The next series have each key listed multiple times, as the
+	 * hostname and addresses in the pre-hashed known_hosts are split
+	 * to separate lines.
+	 */
+	{ "dsa_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, {
+		NULL,
+		25,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_DSA,
+		NULL,	/* filled at runtime */
+		"DSA #6",
+	} },
+	{ "dsa_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, {
+		NULL,
+		26,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_DSA,
+		NULL,	/* filled at runtime */
+		"DSA #6",
+	} },
+	{ "dsa_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, {
+		NULL,
+		27,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_DSA,
+		NULL,	/* filled at runtime */
+		"DSA #6",
+	} },
+	{ "ecdsa_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, {
+		NULL,
+		28,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_ECDSA,
+		NULL,	/* filled at runtime */
+		"ECDSA #6",
+	} },
+	{ "ecdsa_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, {
+		NULL,
+		29,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_ECDSA,
+		NULL,	/* filled at runtime */
+		"ECDSA #6",
+	} },
+	{ "ecdsa_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, {
+		NULL,
+		30,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_ECDSA,
+		NULL,	/* filled at runtime */
+		"ECDSA #6",
+	} },
+	{ "ed25519_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, {
+		NULL,
+		31,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_ED25519,
+		NULL,	/* filled at runtime */
+		"ED25519 #6",
+	} },
+	{ "ed25519_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, {
+		NULL,
+		32,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_ED25519,
+		NULL,	/* filled at runtime */
+		"ED25519 #6",
+	} },
+	{ "ed25519_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, {
+		NULL,
+		33,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_ED25519,
+		NULL,	/* filled at runtime */
+		"ED25519 #6",
+	} },
+	{ "rsa_6.pub" , -1, -1, HKF_MATCH_HOST|HKF_MATCH_HOST_HASHED, 0, 0, 0, -1, {
+		NULL,
+		34,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_RSA,
+		NULL,	/* filled at runtime */
+		"RSA #6",
+	} },
+	{ "rsa_6.pub" , -1, -1, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, 0, -1, {
+		NULL,
+		35,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_RSA,
+		NULL,	/* filled at runtime */
+		"RSA #6",
+	} },
+	{ "rsa_6.pub" , -1, -1, 0, 0, 0, HKF_MATCH_IP|HKF_MATCH_IP_HASHED, -1, {
+		NULL,
+		36,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_RSA,
+		NULL,	/* filled at runtime */
+		"RSA #6",
+	} },
+	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
+		NULL,
+		37,
+		HKF_STATUS_COMMENT,
+		0,
+		"",
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
+		NULL,
+		38,
+		HKF_STATUS_COMMENT,
+		0,
+		"",
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
+		NULL,
+		39,
+		HKF_STATUS_COMMENT,
+		0,
+		"# Revoked and CA keys",
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	{ "ed25519_4.pub" , -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
+		NULL,
+		40,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_REVOKE,
+		"sisyphus.example.com",
+		NULL,
+		KEY_ED25519,
+		NULL,	/* filled at runtime */
+		"ED25519 #4",
+	} },
+	{ "ecdsa_4.pub" , -1, -1, HKF_MATCH_HOST, 0, 0, 0, -1, {
+		NULL,
+		41,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_CA,
+		"prometheus.example.com",
+		NULL,
+		KEY_ECDSA,
+		NULL,	/* filled at runtime */
+		"ECDSA #4",
+	} },
+	{ "dsa_4.pub" , -1, -1, HKF_MATCH_HOST, HKF_MATCH_HOST, 0, 0, -1, {
+		NULL,
+		42,
+		HKF_STATUS_OK,
+		0,
+		NULL,
+		MRK_CA,
+		"*.example.com",
+		NULL,
+		KEY_DSA,
+		NULL,	/* filled at runtime */
+		"DSA #4",
+	} },
+	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
+		NULL,
+		43,
+		HKF_STATUS_COMMENT,
+		0,
+		"",
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
+		NULL,
+		44,
+		HKF_STATUS_COMMENT,
+		0,
+		"# Some invalid lines",
+		MRK_NONE,
+		NULL,
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	{ NULL, -1, -1, 0, 0, 0, 0, -1, {
+		NULL,
+		45,
+		HKF_STATUS_INVALID,
+		0,
+		NULL,
+		MRK_ERROR,
+		NULL,
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	{ NULL, -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
+		NULL,
+		46,
+		HKF_STATUS_INVALID,
+		0,
+		NULL,
+		MRK_NONE,
+		"sisyphus.example.com",
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	{ NULL, -1, -1, HKF_MATCH_HOST, 0, 0, 0, -1, {
+		NULL,
+		47,
+		HKF_STATUS_INVALID,
+		0,
+		NULL,
+		MRK_NONE,
+		"prometheus.example.com",
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	{ NULL, -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
+		NULL,
+		48,
+		HKF_STATUS_INVALID,	/* Would be ok if key not parsed */
+		0,
+		NULL,
+		MRK_NONE,
+		"sisyphus.example.com",
+		NULL,
+		KEY_UNSPEC,
+		NULL,
+		NULL,
+	} },
+	{ NULL, -1, -1, 0, HKF_MATCH_HOST, 0, 0, -1, {
+		NULL,
+		49,
+		HKF_STATUS_INVALID,
+		0,
+		NULL,
+		MRK_NONE,
+		"sisyphus.example.com",
+		NULL,
+		KEY_UNSPEC,
+		NULL,	/* filled at runtime */
+		NULL,
+	} },
+	{ NULL, HKF_STATUS_OK, KEY_RSA, HKF_MATCH_HOST, 0, 0, 0, -1, {
+		NULL,
+		50,
+		HKF_STATUS_INVALID,	/* Would be ok if key not parsed */
+		0,
+		NULL,
+		MRK_NONE,
+		"prometheus.example.com",
+		NULL,
+		KEY_UNSPEC,
+		NULL,	/* filled at runtime */
+		NULL,
+	} },
+};
+
+void test_iterate(void);
+
+void
+test_iterate(void)
+{
+	struct cbctx ctx;
+
+	TEST_START("hostkeys_iterate all with key parse");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = HKF_WANT_PARSE_KEY;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, NULL, NULL, ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate all without key parse");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = 0;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, NULL, NULL, ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate specify host 1");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = 0;
+	ctx.match_host_p = 1;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "prometheus.example.com", NULL, ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate specify host 2");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = 0;
+	ctx.match_host_s = 1;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "sisyphus.example.com", NULL, ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate match host 1");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = HKF_WANT_MATCH;
+	ctx.match_host_p = 1;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "prometheus.example.com", NULL, ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate match host 2");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = HKF_WANT_MATCH;
+	ctx.match_host_s = 1;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "sisyphus.example.com", NULL, ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate specify host missing");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = 0;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "actaeon.example.org", NULL, ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate match host missing");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = HKF_WANT_MATCH;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "actaeon.example.org", NULL, ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate specify IPv4");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = 0;
+	ctx.match_ipv4 = 1;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "tiresias.example.org", "192.0.2.1", ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate specify IPv6");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = 0;
+	ctx.match_ipv6 = 1;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "tiresias.example.org", "2001:db8::1", ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate match IPv4");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = HKF_WANT_MATCH;
+	ctx.match_ipv4 = 1;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "tiresias.example.org", "192.0.2.1", ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate match IPv6");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = HKF_WANT_MATCH;
+	ctx.match_ipv6 = 1;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "tiresias.example.org", "2001:db8::1", ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate specify addr missing");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = 0;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "tiresias.example.org", "192.168.0.1", ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate match addr missing");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = HKF_WANT_MATCH;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "tiresias.example.org", "::1", ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate specify host 2 and IPv4");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = 0;
+	ctx.match_host_s = 1;
+	ctx.match_ipv4 = 1;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "sisyphus.example.com", "192.0.2.1", ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate match host 1 and IPv6");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = HKF_WANT_MATCH;
+	ctx.match_host_p = 1;
+	ctx.match_ipv6 = 1;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "prometheus.example.com",
+	    "2001:db8::1", ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate specify host 2 and IPv4 w/ key parse");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = HKF_WANT_PARSE_KEY;
+	ctx.match_host_s = 1;
+	ctx.match_ipv4 = 1;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "sisyphus.example.com", "192.0.2.1", ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+
+	TEST_START("hostkeys_iterate match host 1 and IPv6 w/ key parse");
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.expected = expected_full;
+	ctx.nexpected = sizeof(expected_full)/sizeof(*expected_full);
+	ctx.flags = HKF_WANT_MATCH|HKF_WANT_PARSE_KEY;
+	ctx.match_host_p = 1;
+	ctx.match_ipv6 = 1;
+	prepare_expected(expected_full, ctx.nexpected);
+	ASSERT_INT_EQ(hostkeys_foreach(test_data_file("known_hosts"),
+	    check, &ctx, "prometheus.example.com",
+	    "2001:db8::1", ctx.flags), 0);
+	cleanup_expected(expected_full, ctx.nexpected);
+	TEST_DONE();
+}
+
diff --git a/regress/unittests/hostkeys/testdata/dsa_1.pub b/regress/unittests/hostkeys/testdata/dsa_1.pub
new file mode 100644
index 0000000..56e1e37
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/dsa_1.pub
@@ -0,0 +1 @@
+ssh-dss AAAAB3NzaC1kc3MAAACBAOqffHxEW4c+Z9q/r3l4sYK8F7qrBsU8XF9upGsW62T9InROFFq9IO0x3pQ6mDA0Wtw0sqcDmkPCHPyP4Ok/fU3/drLaZusHoVYu8pBBrWsIDrKgkeX9TEodBsSrYdl4Sqtqq9EZv9+DttV6LStZrgYyUTOKwOF95wGantpLynX5AAAAFQDdt+zjRNlETDsgmxcSYFgREirJrQAAAIBQlrPaiPhR24FhnMLcHH4016vL7AqDDID6Qw7PhbXGa4/XlxWMIigjBKrIPKvnZ6p712LSnCKtcbfdx0MtmJlNa01CYqPaRhgRaf+uGdvTkTUcdaq8R5lLJL+JMNwUhcC8ijm3NqEjXjffuebGe1EzIeiITbA7Nndcd+GytwRDegAAAIEAkRYPjSVcUxfUHhHdpP6V8CuY1+CYSs9EPJ7iiWTDuXWVIBTU32oJLAnrmAcOwtIzEfPvm+rff5FI/Yhon2pB3VTXhPPEBjYzE5qANanAT4e6tzAVc5f3DUhHaDknwRYfDz86GFvuLtDjeE/UZ9t6OofYoEsCBpYozLAprBvNIQY= DSA #1
diff --git a/regress/unittests/hostkeys/testdata/dsa_2.pub b/regress/unittests/hostkeys/testdata/dsa_2.pub
new file mode 100644
index 0000000..394e0bf
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/dsa_2.pub
@@ -0,0 +1 @@
+ssh-dss AAAAB3NzaC1kc3MAAACBAI38Hy/61/O5Bp6yUG8J5XQCeNjRS0xvjlCdzKLyXCueMa+L+X2L/u9PWUsy5SVbTjGgpB8sF6UkCNsV+va7S8zCCHas2MZ7GPlxP6GZBkRPTIFR0N/Pu7wfBzDQz0t0iL4VmxBfTBQv/SxkGWZg+yHihIQP9fwdSAwD/7aVh6ItAAAAFQDSyihIUlINlswM0PJ8wXSti3yIMwAAAIB+oqzaB6ozqs8YxpN5oQOBa/9HEBQEsp8RSIlQmVubXRNgktp42n+Ii1waU9UUk8DX5ahhIeR6B7ojWkqmDAji4SKpoHf4kmr6HvYo85ZSTSx0W4YK/gJHSpDJwhlT52tAfb1JCbWSObjl09B4STv7KedCHcR5oXQvvrV+XoKOSAAAAIAue/EXrs2INw1RfaKNHC0oqOMxmRitv0BFMuNVPo1VDj39CE5kA7AHjwvS1TNeaHtK5Hhgeb6vsmLmNPTOc8xCob0ilyQbt9O0GbONeF2Ge7D2UJyULA/hxql+tCYFIC6yUrmo35fF9XiNisXLoaflk9fjp7ROWWVwnki/jstaQw== DSA #2
diff --git a/regress/unittests/hostkeys/testdata/dsa_3.pub b/regress/unittests/hostkeys/testdata/dsa_3.pub
new file mode 100644
index 0000000..e506ea4
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/dsa_3.pub
@@ -0,0 +1 @@
+ssh-dss AAAAB3NzaC1kc3MAAACBAI6lz2Ip9bzE7TGuDD4SjO9S4Ac90gq0h6ai1O06eI8t/Ot2uJ5Jk2QyVr2jvIZHDl/5bwBx7+5oyjlwRoUrAPPD814wf5tU2tSnmdu1Wbf0cBswif5q0r4tevzmopp/AtgH11QHo3u0/pfyJd10qBDLV2FaYSKMmZvyPfZJ0s9pAAAAFQD5Eqjl6Rx2qVePodD9OwAPT0bU6wAAAIAfnDm6csZF0sFaJR3NIJvaYgSGr8s7cqlsk2gLltB/1wOOO2yX+NeEC+B0H93hlMfaUsPa08bwgmYxnavSMqEBpmtPceefJiEd68zwYqXd38f88wyWZ9Z5iwaI/6OVZPHzCbDxOa4ewVTevRNYUKP1xUTZNT8/gSMfZLYPk4T2AQAAAIAUKroozRMyV+3V/rxt0gFnNxRXBKk+9cl3vgsQ7ktkI9cYg7V1T2K0XF21AVMK9gODszy6PBJjV6ruXBV6TRiqIbQauivp3bHHKYsG6wiJNqwdbVwIjfvv8nn1qFoZQLXG3sdONr9NwN8KzrX89OV0BlR2dVM5qqp+YxOXymP9yg== DSA #3
diff --git a/regress/unittests/hostkeys/testdata/dsa_4.pub b/regress/unittests/hostkeys/testdata/dsa_4.pub
new file mode 100644
index 0000000..8552c38
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/dsa_4.pub
@@ -0,0 +1 @@
+ssh-dss AAAAB3NzaC1kc3MAAACBAKvjnFHm0VvMr5h2Zu3nURsxQKGoxm+DCzYDxRYcilK07Cm5c4XTrFbA2X86+9sGs++W7QRMcTJUYIg0a+UtIMtAjwORd6ZPXM2K5dBW+gh1oHyvKi767tWX7I2c+1ZPJDY95mUUfZQUEfdy9eGDSBmw/pSsveQ1ur6XNUh/MtP/AAAAFQDHnXk/9jBJAdce1pHtLWnbdPSGdQAAAIEAm2OLy8tZBfiEO3c3X1yyB/GTcDwrQCqRMDkhnsmrliec3dWkOfNTzu+MrdvF8ymTWLEqPpbMheYtvNyZ3TF0HO5W7aVBpdGZbOdOAIfB+6skqGbI8A5Up1d7dak/bSsqL2r5NjwbDOdq+1hBzzvbl/qjh+sQarV2zHrpKoQaV28AAACANtkBVedBbqIAdphCrN/LbUi9WlyuF9UZz+tlpVLYrj8GJVwnplV2tvOmUw6yP5/pzCimTsao8dpL5PWxm7fKxLWVxA+lEsA4WeC885CiZn8xhdaJOCN+NyJ2bqkz+4VPI7oDGBm0aFwUqJn+M1PiSgvI50XdF2dBsFRTRNY0wzA= DSA #4
diff --git a/regress/unittests/hostkeys/testdata/dsa_5.pub b/regress/unittests/hostkeys/testdata/dsa_5.pub
new file mode 100644
index 0000000..149e1ef
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/dsa_5.pub
@@ -0,0 +1 @@
+ssh-dss AAAAB3NzaC1kc3MAAACBALrFy7w5ihlaOG+qR+6fj+vm5EQaO3qwxgACLcgH+VfShuOG4mkx8qFJmf+OZ3fh5iKngjNZfKtfcqI7zHWdk6378TQfQC52/kbZukjNXOLCpyNkogahcjA00onIoTK1RUDuMW28edAHwPFbpttXDTaqis+8JPMY8hZwsZGENCzTAAAAFQD6+It5vozwGgaN9ROYPMlByhi6jwAAAIBz2mcAC694vNzz9b6614gkX9d9E99PzJYfU1MPkXDziKg7MrjBw7Opd5y1jL09S3iL6lSTlHkKwVKvQ3pOwWRwXXRrKVus4I0STveoApm526jmp6mY0YEtqR98vMJ0v97h1ydt8FikKlihefCsnXVicb8887PXs2Y8C6GuFT3tfQAAAIBbmHtV5tPcrMRDkULhaQ/Whap2VKvT2DUhIHA7lx6oy/KpkltOpxDZOIGUHKqffGbiR7Jh01/y090AY5L2eCf0S2Ytx93+eADwVVpJbFJo6zSwfeey2Gm6L2oA+rCz9zTdmtZoekpD3/RAOQjnJIAPwbs7mXwabZTw4xRtiYIRrw== DSA #5
diff --git a/regress/unittests/hostkeys/testdata/dsa_6.pub b/regress/unittests/hostkeys/testdata/dsa_6.pub
new file mode 100644
index 0000000..edbb976
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/dsa_6.pub
@@ -0,0 +1 @@
+ssh-dss AAAAB3NzaC1kc3MAAACBAIutigAse65TCW6hHDOEGXenE9L4L0talHbs65hj3UUNtWflKdQeXLofqXgW8AwaDKmnuRPrxRoxVNXj84n45wtBEdt4ztmdAZteAbXSnHqpcxME3jDxh3EtxzGPXLs+RUmKPVguraSgo7W2oN7KFx6VM+AcAtxANSTlvDid3s47AAAAFQCd9Q3kkHSLWe77sW0eRaayI45ovwAAAIAw6srGF6xvFasI44Y3r9JJ2K+3ezozl3ldL3p2+p2HG3iWafC4SdV8pB6ZIxKlYAywiiFb3LzH/JweGFq1jtoFDRM3MlYORBevydU4zPz7b5QLDVB0sY4evYtWmg2BFJvoWRfhLnlZVW7h5N8v4fNIwdVmVsw4Ljes7iF2HRGhHgAAAIBDFT3fww2Oby1xUA6G9pDAcVikrQFqp1sJRylNTUyeyQ37SNAGzYxwHJFgQr8gZLdRQ1UW+idYpqVbVNcYFMOiw/zSqK2OfVwPZ9U+TTKdc992ChSup6vJEKM/ZVIyDWDbJr7igQ4ahy7jo9mFvm8ljN926EnspQzCvs0Dxk6tHA== DSA #6
diff --git a/regress/unittests/hostkeys/testdata/ecdsa_1.pub b/regress/unittests/hostkeys/testdata/ecdsa_1.pub
new file mode 100644
index 0000000..16a535b
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/ecdsa_1.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBF6yQEtD9yBw9gmDRf477WBBzvWhAa0ioBI3nbA4emKykj0RbuQd5C4XdQAEOZGzE7v//FcCjwB2wi+JH5eKkxCtN6CjohDASZ1huoIV2UVyYIicZJEEOg1IWjjphvaxtw== ECDSA #1
diff --git a/regress/unittests/hostkeys/testdata/ecdsa_2.pub b/regress/unittests/hostkeys/testdata/ecdsa_2.pub
new file mode 100644
index 0000000..d2bad11
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/ecdsa_2.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAB8qVcXwgBM92NCmReQlPrZAoui4Bz/mW0VUBFOpHXXW1n+15b/Y7Pc6UBd/ITTZmaBciXY+PWaSBGdwc5GdqGdLgFyJ/QAGrFMPNpVutm/82gNQzlxpNwjbMcKyiZEXzSgnjS6DzMQ0WuSMdzIBXq8OW/Kafxg4ZkU6YqALUXxlQMZuQ== ECDSA #2
diff --git a/regress/unittests/hostkeys/testdata/ecdsa_3.pub b/regress/unittests/hostkeys/testdata/ecdsa_3.pub
new file mode 100644
index 0000000..e3ea925
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/ecdsa_3.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIb3BhJZk+vUQPg5TQc1koIzuGqloCq7wjr9LjlhG24IBeiFHLsdWw74HDlH4DrOmlxToVYk2lTdnjARleRByjk= ECDSA #3
diff --git a/regress/unittests/hostkeys/testdata/ecdsa_4.pub b/regress/unittests/hostkeys/testdata/ecdsa_4.pub
new file mode 100644
index 0000000..2d616f5
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/ecdsa_4.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHZd0OXHIWwK3xnjAdMZ1tojxWycdu38pORO/UX5cqsKMgGCKQVBWWO3TFk1ePkGIE9VMWT1hCGqWRRwYlH+dSE= ECDSA #4
diff --git a/regress/unittests/hostkeys/testdata/ecdsa_5.pub b/regress/unittests/hostkeys/testdata/ecdsa_5.pub
new file mode 100644
index 0000000..a3df9b3
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/ecdsa_5.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIudcagzq4QPtP1jkpje34+0POLB0jwT64hqrbCqhTH2T800KDZ0h2vwlJYa3OP3Oqru9AB5pnuHsKw7mAhUGY= ECDSA #5
diff --git a/regress/unittests/hostkeys/testdata/ecdsa_6.pub b/regress/unittests/hostkeys/testdata/ecdsa_6.pub
new file mode 100644
index 0000000..139f5a7
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/ecdsa_6.pub
@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK1wRLyKtvK3Mmhd0XPkKwW4ev1KBVf8J4aG8lESq1TsaqqfOXYGyxMq5pN8fCGiD5UPOqyTYz/ZNzClRhJRHao= ECDSA #6
diff --git a/regress/unittests/hostkeys/testdata/ed25519_1.pub b/regress/unittests/hostkeys/testdata/ed25519_1.pub
new file mode 100644
index 0000000..0b12efe
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/ed25519_1.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK9ks7jkua5YWIwByRnnnc6UPJQWI75O0e/UJdPYU1JI ED25519 #1
diff --git a/regress/unittests/hostkeys/testdata/ed25519_2.pub b/regress/unittests/hostkeys/testdata/ed25519_2.pub
new file mode 100644
index 0000000..78e262b
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/ed25519_2.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBp6PVW0z2o9C4Ukv/JOgmK7QMFe1pD1s3ADFF7IQob ED25519 #2
diff --git a/regress/unittests/hostkeys/testdata/ed25519_3.pub b/regress/unittests/hostkeys/testdata/ed25519_3.pub
new file mode 100644
index 0000000..64e5f12
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/ed25519_3.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBlYfExtYZAPqYvYdrlpGlSWhh/XNHcH3v3c2JzsVNbB ED25519 #3
diff --git a/regress/unittests/hostkeys/testdata/ed25519_4.pub b/regress/unittests/hostkeys/testdata/ed25519_4.pub
new file mode 100644
index 0000000..47b6724
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/ed25519_4.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDFP8L9REfN/iYy1KIRtFqSCn3V2+vOCpoZYENFGLdOF ED25519 #4
diff --git a/regress/unittests/hostkeys/testdata/ed25519_5.pub b/regress/unittests/hostkeys/testdata/ed25519_5.pub
new file mode 100644
index 0000000..72ccae6
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/ed25519_5.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINf63qSV8rD57N+digID8t28WVhd3Yf2K2UhaoG8TsWQ ED25519 #5
diff --git a/regress/unittests/hostkeys/testdata/ed25519_6.pub b/regress/unittests/hostkeys/testdata/ed25519_6.pub
new file mode 100644
index 0000000..0f71973
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/ed25519_6.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLW0ZwCkRQldpLa4I5BpwGa/om+WE6OgC8jdVqakt0Z ED25519 #6
diff --git a/regress/unittests/hostkeys/testdata/known_hosts b/regress/unittests/hostkeys/testdata/known_hosts
new file mode 100644
index 0000000..4446f45
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/known_hosts
@@ -0,0 +1,50 @@
+# Plain host keys, plain host names
+sisyphus.example.com ssh-dss AAAAB3NzaC1kc3MAAACBAOqffHxEW4c+Z9q/r3l4sYK8F7qrBsU8XF9upGsW62T9InROFFq9IO0x3pQ6mDA0Wtw0sqcDmkPCHPyP4Ok/fU3/drLaZusHoVYu8pBBrWsIDrKgkeX9TEodBsSrYdl4Sqtqq9EZv9+DttV6LStZrgYyUTOKwOF95wGantpLynX5AAAAFQDdt+zjRNlETDsgmxcSYFgREirJrQAAAIBQlrPaiPhR24FhnMLcHH4016vL7AqDDID6Qw7PhbXGa4/XlxWMIigjBKrIPKvnZ6p712LSnCKtcbfdx0MtmJlNa01CYqPaRhgRaf+uGdvTkTUcdaq8R5lLJL+JMNwUhcC8ijm3NqEjXjffuebGe1EzIeiITbA7Nndcd+GytwRDegAAAIEAkRYPjSVcUxfUHhHdpP6V8CuY1+CYSs9EPJ7iiWTDuXWVIBTU32oJLAnrmAcOwtIzEfPvm+rff5FI/Yhon2pB3VTXhPPEBjYzE5qANanAT4e6tzAVc5f3DUhHaDknwRYfDz86GFvuLtDjeE/UZ9t6OofYoEsCBpYozLAprBvNIQY= DSA #1
+sisyphus.example.com ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBF6yQEtD9yBw9gmDRf477WBBzvWhAa0ioBI3nbA4emKykj0RbuQd5C4XdQAEOZGzE7v//FcCjwB2wi+JH5eKkxCtN6CjohDASZ1huoIV2UVyYIicZJEEOg1IWjjphvaxtw== ECDSA #1
+sisyphus.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK9ks7jkua5YWIwByRnnnc6UPJQWI75O0e/UJdPYU1JI ED25519 #1
+sisyphus.example.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDg4hB4vAZHJ0PVRiJajOv/GlytFWNpv5/9xgB9+5BIbvp8LOrFZ5D9K0Gsmwpd4G4rfaAz8j896DhMArg0vtkilIPPGt/6VzWMERgvaIQPJ/IE99X3+fjcAG56oAWwy29JX10lQMzBPU6XJIaN/zqpkb6qUBiAHBdLpxrFBBU0/w== RSA #1
+
+# Plain host keys, hostnames + addresses
+prometheus.example.com,192.0.2.1,2001:db8::1 ssh-dss AAAAB3NzaC1kc3MAAACBAI38Hy/61/O5Bp6yUG8J5XQCeNjRS0xvjlCdzKLyXCueMa+L+X2L/u9PWUsy5SVbTjGgpB8sF6UkCNsV+va7S8zCCHas2MZ7GPlxP6GZBkRPTIFR0N/Pu7wfBzDQz0t0iL4VmxBfTBQv/SxkGWZg+yHihIQP9fwdSAwD/7aVh6ItAAAAFQDSyihIUlINlswM0PJ8wXSti3yIMwAAAIB+oqzaB6ozqs8YxpN5oQOBa/9HEBQEsp8RSIlQmVubXRNgktp42n+Ii1waU9UUk8DX5ahhIeR6B7ojWkqmDAji4SKpoHf4kmr6HvYo85ZSTSx0W4YK/gJHSpDJwhlT52tAfb1JCbWSObjl09B4STv7KedCHcR5oXQvvrV+XoKOSAAAAIAue/EXrs2INw1RfaKNHC0oqOMxmRitv0BFMuNVPo1VDj39CE5kA7AHjwvS1TNeaHtK5Hhgeb6vsmLmNPTOc8xCob0ilyQbt9O0GbONeF2Ge7D2UJyULA/hxql+tCYFIC6yUrmo35fF9XiNisXLoaflk9fjp7ROWWVwnki/jstaQw== DSA #2
+prometheus.example.com,192.0.2.1,2001:db8::1 ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAB8qVcXwgBM92NCmReQlPrZAoui4Bz/mW0VUBFOpHXXW1n+15b/Y7Pc6UBd/ITTZmaBciXY+PWaSBGdwc5GdqGdLgFyJ/QAGrFMPNpVutm/82gNQzlxpNwjbMcKyiZEXzSgnjS6DzMQ0WuSMdzIBXq8OW/Kafxg4ZkU6YqALUXxlQMZuQ== ECDSA #2
+prometheus.example.com,192.0.2.1,2001:db8::1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBp6PVW0z2o9C4Ukv/JOgmK7QMFe1pD1s3ADFF7IQob ED25519 #2
+prometheus.example.com,192.0.2.1,2001:db8::1 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDmbUhNabB5AmBDX6GNHZ3lbn7pRxqfpW+f53QqNGlK0sLV+0gkMIrOfUp1kdE2ZLE6tfzdicatj/RlH6/wuo4yyYb+Pyx3G0vxdmAIiA4aANq38XweDucBC0TZkRWVHK+Gs5V/uV0z7N0axJvkkJujMLvST3CRiiWwlficBc6yVQ== RSA #2
+
+# Some hosts with wildcard names / IPs
+*.example.com,192.0.2.*,2001:* ssh-dss AAAAB3NzaC1kc3MAAACBAI6lz2Ip9bzE7TGuDD4SjO9S4Ac90gq0h6ai1O06eI8t/Ot2uJ5Jk2QyVr2jvIZHDl/5bwBx7+5oyjlwRoUrAPPD814wf5tU2tSnmdu1Wbf0cBswif5q0r4tevzmopp/AtgH11QHo3u0/pfyJd10qBDLV2FaYSKMmZvyPfZJ0s9pAAAAFQD5Eqjl6Rx2qVePodD9OwAPT0bU6wAAAIAfnDm6csZF0sFaJR3NIJvaYgSGr8s7cqlsk2gLltB/1wOOO2yX+NeEC+B0H93hlMfaUsPa08bwgmYxnavSMqEBpmtPceefJiEd68zwYqXd38f88wyWZ9Z5iwaI/6OVZPHzCbDxOa4ewVTevRNYUKP1xUTZNT8/gSMfZLYPk4T2AQAAAIAUKroozRMyV+3V/rxt0gFnNxRXBKk+9cl3vgsQ7ktkI9cYg7V1T2K0XF21AVMK9gODszy6PBJjV6ruXBV6TRiqIbQauivp3bHHKYsG6wiJNqwdbVwIjfvv8nn1qFoZQLXG3sdONr9NwN8KzrX89OV0BlR2dVM5qqp+YxOXymP9yg== DSA #3
+*.example.com,192.0.2.*,2001:* ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIb3BhJZk+vUQPg5TQc1koIzuGqloCq7wjr9LjlhG24IBeiFHLsdWw74HDlH4DrOmlxToVYk2lTdnjARleRByjk= ECDSA #3
+*.example.com,192.0.2.*,2001:* ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBlYfExtYZAPqYvYdrlpGlSWhh/XNHcH3v3c2JzsVNbB ED25519 #3
+*.example.com,192.0.2.*,2001:* ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDX8F93W3SH4ZSus4XUQ2cw9dqcuyUETTlKEeGv3zlknV3YCoe2Mp04naDhiuwj8sOsytrZSESzLY1ZEyzrjxE6ZFVv8NKgck/AbRjcwlRFOcx9oKUxOrXRa0IoXlTq0kyjKCJfaHBKnGitZThknCPTbVmpATkm5xx6J0WEDozfoQ== RSA #3
+
+# Hashed hostname and address entries
+|1|z3xOIdT5ue3Vuf3MzT67kaioqjw=|GZhhe5uwDOBQrC9N4cCjpbLpSn4= ssh-dss AAAAB3NzaC1kc3MAAACBALrFy7w5ihlaOG+qR+6fj+vm5EQaO3qwxgACLcgH+VfShuOG4mkx8qFJmf+OZ3fh5iKngjNZfKtfcqI7zHWdk6378TQfQC52/kbZukjNXOLCpyNkogahcjA00onIoTK1RUDuMW28edAHwPFbpttXDTaqis+8JPMY8hZwsZGENCzTAAAAFQD6+It5vozwGgaN9ROYPMlByhi6jwAAAIBz2mcAC694vNzz9b6614gkX9d9E99PzJYfU1MPkXDziKg7MrjBw7Opd5y1jL09S3iL6lSTlHkKwVKvQ3pOwWRwXXRrKVus4I0STveoApm526jmp6mY0YEtqR98vMJ0v97h1ydt8FikKlihefCsnXVicb8887PXs2Y8C6GuFT3tfQAAAIBbmHtV5tPcrMRDkULhaQ/Whap2VKvT2DUhIHA7lx6oy/KpkltOpxDZOIGUHKqffGbiR7Jh01/y090AY5L2eCf0S2Ytx93+eADwVVpJbFJo6zSwfeey2Gm6L2oA+rCz9zTdmtZoekpD3/RAOQjnJIAPwbs7mXwabZTw4xRtiYIRrw== DSA #5
+|1|B7t/AYabn8zgwU47Cb4A/Nqt3eI=|arQPZyRphkzisr7w6wwikvhaOyE= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIudcagzq4QPtP1jkpje34+0POLB0jwT64hqrbCqhTH2T800KDZ0h2vwlJYa3OP3Oqru9AB5pnuHsKw7mAhUGY= ECDSA #5
+|1|JR81WxEocTP5d7goIRkl8fHBbno=|l6sj6FOsoXxgEZMzn/BnOfPKN68= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINf63qSV8rD57N+digID8t28WVhd3Yf2K2UhaoG8TsWQ ED25519 #5
+|1|W7x4zY6KtTZJgsopyOusJqvVPag=|QauLt7hKezBZFZi2i4Xopho7Nsk= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC/C15Q4sfnk7BZff1er8bscay+5s51oD4eWArlHWMK/ZfYeeTAccTy+7B7Jv+MS4nKCpflrvJI2RQz4kS8vF0ATdBbi4jeWefStlHNg0HLhnCY7NAfDIlRdaN9lm3Pqm2vmr+CkqwcJaSpycDg8nPN9yNAuD6pv7NDuUnECezojQ== RSA #5
+
+|1|mxnU8luzqWLvfVi5qBm5xVIyCRM=|9Epopft7LBd80Bf6RmWPIpwa8yU= ssh-dss AAAAB3NzaC1kc3MAAACBAIutigAse65TCW6hHDOEGXenE9L4L0talHbs65hj3UUNtWflKdQeXLofqXgW8AwaDKmnuRPrxRoxVNXj84n45wtBEdt4ztmdAZteAbXSnHqpcxME3jDxh3EtxzGPXLs+RUmKPVguraSgo7W2oN7KFx6VM+AcAtxANSTlvDid3s47AAAAFQCd9Q3kkHSLWe77sW0eRaayI45ovwAAAIAw6srGF6xvFasI44Y3r9JJ2K+3ezozl3ldL3p2+p2HG3iWafC4SdV8pB6ZIxKlYAywiiFb3LzH/JweGFq1jtoFDRM3MlYORBevydU4zPz7b5QLDVB0sY4evYtWmg2BFJvoWRfhLnlZVW7h5N8v4fNIwdVmVsw4Ljes7iF2HRGhHgAAAIBDFT3fww2Oby1xUA6G9pDAcVikrQFqp1sJRylNTUyeyQ37SNAGzYxwHJFgQr8gZLdRQ1UW+idYpqVbVNcYFMOiw/zSqK2OfVwPZ9U+TTKdc992ChSup6vJEKM/ZVIyDWDbJr7igQ4ahy7jo9mFvm8ljN926EnspQzCvs0Dxk6tHA== DSA #6
+|1|klvLmvh2vCpkNMDEjVvrE8SJWTg=|e/dqEEBLnbgqmwEesl4cDRu/7TM= ssh-dss AAAAB3NzaC1kc3MAAACBAIutigAse65TCW6hHDOEGXenE9L4L0talHbs65hj3UUNtWflKdQeXLofqXgW8AwaDKmnuRPrxRoxVNXj84n45wtBEdt4ztmdAZteAbXSnHqpcxME3jDxh3EtxzGPXLs+RUmKPVguraSgo7W2oN7KFx6VM+AcAtxANSTlvDid3s47AAAAFQCd9Q3kkHSLWe77sW0eRaayI45ovwAAAIAw6srGF6xvFasI44Y3r9JJ2K+3ezozl3ldL3p2+p2HG3iWafC4SdV8pB6ZIxKlYAywiiFb3LzH/JweGFq1jtoFDRM3MlYORBevydU4zPz7b5QLDVB0sY4evYtWmg2BFJvoWRfhLnlZVW7h5N8v4fNIwdVmVsw4Ljes7iF2HRGhHgAAAIBDFT3fww2Oby1xUA6G9pDAcVikrQFqp1sJRylNTUyeyQ37SNAGzYxwHJFgQr8gZLdRQ1UW+idYpqVbVNcYFMOiw/zSqK2OfVwPZ9U+TTKdc992ChSup6vJEKM/ZVIyDWDbJr7igQ4ahy7jo9mFvm8ljN926EnspQzCvs0Dxk6tHA== DSA #6
+|1|wsk3ddB3UjuxEsoeNCeZjZ6NvZs=|O3O/q2Z/u7DrxoTiIq6kzCevQT0= ssh-dss AAAAB3NzaC1kc3MAAACBAIutigAse65TCW6hHDOEGXenE9L4L0talHbs65hj3UUNtWflKdQeXLofqXgW8AwaDKmnuRPrxRoxVNXj84n45wtBEdt4ztmdAZteAbXSnHqpcxME3jDxh3EtxzGPXLs+RUmKPVguraSgo7W2oN7KFx6VM+AcAtxANSTlvDid3s47AAAAFQCd9Q3kkHSLWe77sW0eRaayI45ovwAAAIAw6srGF6xvFasI44Y3r9JJ2K+3ezozl3ldL3p2+p2HG3iWafC4SdV8pB6ZIxKlYAywiiFb3LzH/JweGFq1jtoFDRM3MlYORBevydU4zPz7b5QLDVB0sY4evYtWmg2BFJvoWRfhLnlZVW7h5N8v4fNIwdVmVsw4Ljes7iF2HRGhHgAAAIBDFT3fww2Oby1xUA6G9pDAcVikrQFqp1sJRylNTUyeyQ37SNAGzYxwHJFgQr8gZLdRQ1UW+idYpqVbVNcYFMOiw/zSqK2OfVwPZ9U+TTKdc992ChSup6vJEKM/ZVIyDWDbJr7igQ4ahy7jo9mFvm8ljN926EnspQzCvs0Dxk6tHA== DSA #6
+|1|B8epmkLSni+vGZDijr/EwxeR2k4=|7ct8yzNOVJhKm3ZD2w0XIT7df8E= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK1wRLyKtvK3Mmhd0XPkKwW4ev1KBVf8J4aG8lESq1TsaqqfOXYGyxMq5pN8fCGiD5UPOqyTYz/ZNzClRhJRHao= ECDSA #6
+|1|JojD885UhYhbCu571rgyM/5PpYU=|BJaU2aE1FebQZy3B5tzTDRWFRG0= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK1wRLyKtvK3Mmhd0XPkKwW4ev1KBVf8J4aG8lESq1TsaqqfOXYGyxMq5pN8fCGiD5UPOqyTYz/ZNzClRhJRHao= ECDSA #6
+|1|5t7UDHDybVrDZVQPCpwdnr6nk4k=|EqJ73W/veIL3H2x+YWHcJxI5ETA= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK1wRLyKtvK3Mmhd0XPkKwW4ev1KBVf8J4aG8lESq1TsaqqfOXYGyxMq5pN8fCGiD5UPOqyTYz/ZNzClRhJRHao= ECDSA #6
+|1|OCcBfGc/b9+ip+W6Gp+3ftdluO4=|VbrKUdzOOtIBOOmEE+jlK4SD3Xc= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLW0ZwCkRQldpLa4I5BpwGa/om+WE6OgC8jdVqakt0Z ED25519 #6
+|1|9fLN0YdP+BJ25lKuKvYuOdUo93w=|vZyr0rOiX01hv5XbghhHMW+Zb3U= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLW0ZwCkRQldpLa4I5BpwGa/om+WE6OgC8jdVqakt0Z ED25519 #6
+|1|nc9RoaaQ0s5jdPxwlUmluGHU3uk=|un6OsJajokKQ3MgyS9mfDNeyP6U= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLW0ZwCkRQldpLa4I5BpwGa/om+WE6OgC8jdVqakt0Z ED25519 #6
+|1|rsHB6juT9q6GOY91qOeOwL6TSJE=|ps/vXF9Izuues5PbOn887Gw/2Dg= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQClu/3I6GG1Ai89Imnw0vXmWJ2OW0ftQwRrsbIAD0qzLFYpkJ76QWnzpCehvK9u0L5hcw7z2Y6mRLcSBsqONc+HVU73Qi7M4zHRvtjprPs3SOyLpf0J9sL1WiHBDwg2P0miHMCdqHDd5nVXkJB2d4eeecmgezGLa29NOHZjbza5yw== RSA #6
+|1|BsckdLH2aRyWQooRmv+Yo3t4dKg=|Lf3tJc5Iyx0KxNwAG89FsImsfEE= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQClu/3I6GG1Ai89Imnw0vXmWJ2OW0ftQwRrsbIAD0qzLFYpkJ76QWnzpCehvK9u0L5hcw7z2Y6mRLcSBsqONc+HVU73Qi7M4zHRvtjprPs3SOyLpf0J9sL1WiHBDwg2P0miHMCdqHDd5nVXkJB2d4eeecmgezGLa29NOHZjbza5yw== RSA #6
+|1|plqkBA4hq7UATyd5+/Xl+zL7ghw=|stacofaUed46666mfqxp9gJFjt4= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQClu/3I6GG1Ai89Imnw0vXmWJ2OW0ftQwRrsbIAD0qzLFYpkJ76QWnzpCehvK9u0L5hcw7z2Y6mRLcSBsqONc+HVU73Qi7M4zHRvtjprPs3SOyLpf0J9sL1WiHBDwg2P0miHMCdqHDd5nVXkJB2d4eeecmgezGLa29NOHZjbza5yw== RSA #6
+
+
+# Revoked and CA keys
+@revoked sisyphus.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDFP8L9REfN/iYy1KIRtFqSCn3V2+vOCpoZYENFGLdOF ED25519 #4
+@cert-authority prometheus.example.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHZd0OXHIWwK3xnjAdMZ1tojxWycdu38pORO/UX5cqsKMgGCKQVBWWO3TFk1ePkGIE9VMWT1hCGqWRRwYlH+dSE= ECDSA #4
+@cert-authority *.example.com ssh-dss AAAAB3NzaC1kc3MAAACBAKvjnFHm0VvMr5h2Zu3nURsxQKGoxm+DCzYDxRYcilK07Cm5c4XTrFbA2X86+9sGs++W7QRMcTJUYIg0a+UtIMtAjwORd6ZPXM2K5dBW+gh1oHyvKi767tWX7I2c+1ZPJDY95mUUfZQUEfdy9eGDSBmw/pSsveQ1ur6XNUh/MtP/AAAAFQDHnXk/9jBJAdce1pHtLWnbdPSGdQAAAIEAm2OLy8tZBfiEO3c3X1yyB/GTcDwrQCqRMDkhnsmrliec3dWkOfNTzu+MrdvF8ymTWLEqPpbMheYtvNyZ3TF0HO5W7aVBpdGZbOdOAIfB+6skqGbI8A5Up1d7dak/bSsqL2r5NjwbDOdq+1hBzzvbl/qjh+sQarV2zHrpKoQaV28AAACANtkBVedBbqIAdphCrN/LbUi9WlyuF9UZz+tlpVLYrj8GJVwnplV2tvOmUw6yP5/pzCimTsao8dpL5PWxm7fKxLWVxA+lEsA4WeC885CiZn8xhdaJOCN+NyJ2bqkz+4VPI7oDGBm0aFwUqJn+M1PiSgvI50XdF2dBsFRTRNY0wzA= DSA #4
+
+# Some invalid lines
+@what sisyphus.example.com ssh-dss AAAAB3NzaC1kc3MAAACBAOqffHxEW4c+Z9q/r3l4sYK8F7qrBsU8XF9upGsW62T9InROFFq9IO0x3pQ6mDA0Wtw0sqcDmkPCHPyP4Ok/fU3/drLaZusHoVYu8pBBrWsIDrKgkeX9TEodBsSrYdl4Sqtqq9EZv9+DttV6LStZrgYyUTOKwOF95wGantpLynX5AAAAFQDdt+zjRNlETDsgmxcSYFgREirJrQAAAIBQlrPaiPhR24FhnMLcHH4016vL7AqDDID6Qw7PhbXGa4/XlxWMIigjBKrIPKvnZ6p712LSnCKtcbfdx0MtmJlNa01CYqPaRhgRaf+uGdvTkTUcdaq8R5lLJL+JMNwUhcC8ijm3NqEjXjffuebGe1EzIeiITbA7Nndcd+GytwRDegAAAIEAkRYPjSVcUxfUHhHdpP6V8CuY1+CYSs9EPJ7iiWTDuXWVIBTU32oJLAnrmAcOwtIzEfPvm+rff5FI/Yhon2pB3VTXhPPEBjYzE5qANanAT4e6tzAVc5f3DUhHaDknwRYfDz86GFvuLtDjeE/UZ9t6OofYoEsCBpYozLAprBvNIQY= DSA #1
+sisyphus.example.com      
+prometheus.example.com ssh-ed25519 
+sisyphus.example.com ssh-dsa AAAATgAAAAdz
+sisyphus.example.com ssh-XXX AAAATgAAAAdzc2gtWFhYAAAAP0ZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRg==
+prometheus.example.com ssh-rsa AAAATgAAAAdzc2gtWFhYAAAAP0ZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRkZVQ0tPRkZGVUNLT0ZGRlVDS09GRg==
diff --git a/regress/unittests/hostkeys/testdata/rsa1_1.pub b/regress/unittests/hostkeys/testdata/rsa1_1.pub
new file mode 100644
index 0000000..772ce9c
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/rsa1_1.pub
@@ -0,0 +1 @@
+1024 65537 153895431603677073925890314548566704948446776958334195280085080329934839226701954473292358821568047724356487621573742372399387931887004184139835510820577359977148363519970774657801798872789118894962853659233045778161859413980935372685480527355016624825696983269800574755126132814333241868538220824608980319407 RSA1 #1
diff --git a/regress/unittests/hostkeys/testdata/rsa1_2.pub b/regress/unittests/hostkeys/testdata/rsa1_2.pub
new file mode 100644
index 0000000..78794b9
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/rsa1_2.pub
@@ -0,0 +1 @@
+1024 65537 135970715082947442639683969597180728933388298633245835186618852623800675939308729462220235058285909679252157995530180587329132927339620517781785310829060832352381015614725360278571924286986474946772141568893116432268565829418506866604294073334978275702221949783314402806080929601995102334442541344606109853641 RSA1 #2
diff --git a/regress/unittests/hostkeys/testdata/rsa1_3.pub b/regress/unittests/hostkeys/testdata/rsa1_3.pub
new file mode 100644
index 0000000..0c035fe
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/rsa1_3.pub
@@ -0,0 +1 @@
+1024 65537 125895605498029643697051635076028105429632810811904702876152645261610759866299221305725069141163240694267669117205342283569102183636228981857946763978553664895308762890072813014496700601576921921752482059207749978374872713540759920335553799711267170948655579130584031555334229966603000896364091459595522912269 RSA1 #3
diff --git a/regress/unittests/hostkeys/testdata/rsa1_4.pub b/regress/unittests/hostkeys/testdata/rsa1_4.pub
new file mode 100644
index 0000000..0006442
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/rsa1_4.pub
@@ -0,0 +1 @@
+1024 65537 174143366122697048196335388217056770310345753698079464367148030836533360510864881734142526411160017107552815906024399248049666856133771656680462456979369587903909343046704480897527203474513676654933090991684252819423129896444427656841613263783484827101210734799449281639493127615902427443211183258155381810593 RSA1 #4
diff --git a/regress/unittests/hostkeys/testdata/rsa1_5.pub b/regress/unittests/hostkeys/testdata/rsa1_5.pub
new file mode 100644
index 0000000..bb53c26
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/rsa1_5.pub
@@ -0,0 +1 @@
+1024 65537 127931411493401587586867047972295564331543694182352197506125410692673654572057908999642645524647232712160516076508316152810117209181150078352725299319149726341058893406440426414316276977768958023952319602422835879783057966985348561111880658922724668687074412548487722084792283453716871417610020757212399252171 RSA1 #5
diff --git a/regress/unittests/hostkeys/testdata/rsa1_6.pub b/regress/unittests/hostkeys/testdata/rsa1_6.pub
new file mode 100644
index 0000000..85d6576
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/rsa1_6.pub
@@ -0,0 +1 @@
+1024 65537 140883028436203600354693376066567741282115117509696517282419557936340193768851493584179972504103033755515036493433917203732876685813283050574208967197963391667532902202382549275760997891673884333346000558018002659506756213191532156293935482587878596032743105911487673274674568768638010598205190227631909167257 RSA1 #6
diff --git a/regress/unittests/hostkeys/testdata/rsa_1.pub b/regress/unittests/hostkeys/testdata/rsa_1.pub
new file mode 100644
index 0000000..2b87885
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/rsa_1.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDg4hB4vAZHJ0PVRiJajOv/GlytFWNpv5/9xgB9+5BIbvp8LOrFZ5D9K0Gsmwpd4G4rfaAz8j896DhMArg0vtkilIPPGt/6VzWMERgvaIQPJ/IE99X3+fjcAG56oAWwy29JX10lQMzBPU6XJIaN/zqpkb6qUBiAHBdLpxrFBBU0/w== RSA #1
diff --git a/regress/unittests/hostkeys/testdata/rsa_2.pub b/regress/unittests/hostkeys/testdata/rsa_2.pub
new file mode 100644
index 0000000..33f1fd9
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/rsa_2.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDmbUhNabB5AmBDX6GNHZ3lbn7pRxqfpW+f53QqNGlK0sLV+0gkMIrOfUp1kdE2ZLE6tfzdicatj/RlH6/wuo4yyYb+Pyx3G0vxdmAIiA4aANq38XweDucBC0TZkRWVHK+Gs5V/uV0z7N0axJvkkJujMLvST3CRiiWwlficBc6yVQ== RSA #2
diff --git a/regress/unittests/hostkeys/testdata/rsa_3.pub b/regress/unittests/hostkeys/testdata/rsa_3.pub
new file mode 100644
index 0000000..c2f6b20
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/rsa_3.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDX8F93W3SH4ZSus4XUQ2cw9dqcuyUETTlKEeGv3zlknV3YCoe2Mp04naDhiuwj8sOsytrZSESzLY1ZEyzrjxE6ZFVv8NKgck/AbRjcwlRFOcx9oKUxOrXRa0IoXlTq0kyjKCJfaHBKnGitZThknCPTbVmpATkm5xx6J0WEDozfoQ== RSA #3
diff --git a/regress/unittests/hostkeys/testdata/rsa_4.pub b/regress/unittests/hostkeys/testdata/rsa_4.pub
new file mode 100644
index 0000000..35545a7
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/rsa_4.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDI8AdjBAozcdRnIikVlt69iyDHKyrtxmpdkbRy9bWaL86OH+PTmLUk5e+T/ufiakpeE2pm0hkE3e4Sh/FsY+rsQdRoraWVNFfchcMeVlKvuy5RZN0ElvmaQebOJUeNeBn2LLw8aL8bJ4CP/bQRKrmrSSqjz3+4H9YNVyyk1OGBPQ== RSA #4
diff --git a/regress/unittests/hostkeys/testdata/rsa_5.pub b/regress/unittests/hostkeys/testdata/rsa_5.pub
new file mode 100644
index 0000000..befbaa7
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/rsa_5.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC/C15Q4sfnk7BZff1er8bscay+5s51oD4eWArlHWMK/ZfYeeTAccTy+7B7Jv+MS4nKCpflrvJI2RQz4kS8vF0ATdBbi4jeWefStlHNg0HLhnCY7NAfDIlRdaN9lm3Pqm2vmr+CkqwcJaSpycDg8nPN9yNAuD6pv7NDuUnECezojQ== RSA #5
diff --git a/regress/unittests/hostkeys/testdata/rsa_6.pub b/regress/unittests/hostkeys/testdata/rsa_6.pub
new file mode 100644
index 0000000..393e116
--- /dev/null
+++ b/regress/unittests/hostkeys/testdata/rsa_6.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQClu/3I6GG1Ai89Imnw0vXmWJ2OW0ftQwRrsbIAD0qzLFYpkJ76QWnzpCehvK9u0L5hcw7z2Y6mRLcSBsqONc+HVU73Qi7M4zHRvtjprPs3SOyLpf0J9sL1WiHBDwg2P0miHMCdqHDd5nVXkJB2d4eeecmgezGLa29NOHZjbza5yw== RSA #6
diff --git a/regress/unittests/hostkeys/tests.c b/regress/unittests/hostkeys/tests.c
new file mode 100644
index 0000000..92c7646
--- /dev/null
+++ b/regress/unittests/hostkeys/tests.c
@@ -0,0 +1,16 @@
+/* 	$OpenBSD: tests.c,v 1.1 2015/02/16 22:18:34 djm Exp $ */
+/*
+ * Regress test for known_hosts-related API.
+ *
+ * Placed in the public domain
+ */
+
+void tests(void);
+void test_iterate(void); /* test_iterate.c */
+
+void
+tests(void)
+{
+	test_iterate();
+}
+