Repository: go
Issue: x/crypto/ssh/knownhosts: Should "*" match ports other than 22?
Labels: NeedsInvestigation

### What version of Go are you using (`go version`)?

<pre>
go version go1.16 darwin/amd64
</pre>

### Does this issue reproduce with the latest release?
yes


### What operating system and processor architecture are you using (`go env`)?
<details><summary><code>go env</code> Output</summary><br><pre>
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/jgold/Library/Caches/go-build"
GOENV="/Users/jgold/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/jgold/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/jgold/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/Cellar/go/1.16/libexec"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/Cellar/go/1.16/libexec/pkg/tool/darwin_amd64"
GOVCS=""
GOVERSION="go1.16"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/jgold/redact/crypto/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/11/02nsw83j2_3gcdzdxs193t300000gn/T/go-build3880178866=/tmp/go-build -gno-record-gcc-switches -fno-common"
</pre></details>

### What did you do?
I tried to use `knownhosts.New` along with a file using `@cert-authority` wildcards that are intended to match a server listening on a port other than 22. In short, I believe the following unit test should pass (it does not in current version):
```go
// in ssh/knownhosts/knownhosts_test.go
func TestWildcardNon22Port(t *testing.T) {
	str := fmt.Sprintf("* %s", edKeyStr)
	db := testDB(t, str)

	want := &KeyError{
		Want: []KnownKey{{
			Filename: "testdb",
			Line:     1,
			Key:      edKey,
		}},
	}

	got := db.check("server.domain:2222", &net.TCPAddr{}, ecKey)
	if !reflect.DeepEqual(got, want) {
		t.Errorf("got %s, want %s", got, want)
	}
}
```

### What did you expect to see?
I was expecting this to pass. It appears that the formulation is allowed by OpenSSH at least (I tried to find that in the BSD source code but don't read C well enough to navigate that codebase).


### What did you see instead?
Host key matching in `ssh/knownhosts/knownhosts.go` currently fails for such a wildcard. I believe this is because [`newHostnameMatcher`](https://cs.opensource.google/go/x/crypto/+/master:ssh/knownhosts/knownhosts.go;l=249-286), when provided the input pattern `*`, gets an error (as expected) in [the call to `SplitHostPort`](https://cs.opensource.google/go/x/crypto/+/master:ssh/knownhosts/knownhosts.go;l=274), which leads it to [supply an explicit expectation of port 22](https://cs.opensource.google/go/x/crypto/+/master:ssh/knownhosts/knownhosts.go;l=277) in the generated matcher. That subsequently will fail the port check in [the `p.addr.port == a.port` expression](https://cs.opensource.google/go/x/crypto/+/master:ssh/knownhosts/knownhosts.go;l=110) used to test matches.

I'm happy to propose changes, but wonder if perhaps I'm misunderstanding OpenSSH (it being the reference implementation, IIUC).