[BUG] - Configuration under Match statements with invalid or unknown Match criteria words is
Author: kre9Created Jun 12, 2026Updated Jun 12, 2026
LabelsBug
Are you using paramiko as a client or server?
Client
What feature(s) aren't working right?
sshconfig
What version(s) of paramiko are you using?
5.0.0
What version(s) of Python are you using?
3.14.5
What operating system and version are you using?
Tested on Ubuntu 24.04 and CachyOS
If you're connecting as a client, which SSH server are you connecting to?
Not relevant (bug is before connection)
If you're using paramiko as part of another tool, which tool/version?
No response
Expected/desired behavior
If paramiko doesn't understand a Match criteria it should not read its configuration (and probably even error or at least warn)
Actual behavior
Paramiko still reads the configuration, even though it can't verify if the Match statement actually matches
How to reproduce
Config
Match localnetwork 9.8.7.6/32
ProxyJump THISSHOULDNOTMATCHTest program
import paramiko
print(paramiko.SSHConfig.from_path("/tmp/poc/config").lookup("1.2.3.4")["proxyjump"])Anything else?
The wrong logic is in the function _does_match in paramiko/config.py
I found this error because I had a localnetwork match in the config, which is a valid keyword in OpenSSH, but not handled by paramiko.
Source: paramiko/paramiko