[liangzaihuanyv]

Problem

The supported, deprecated cakey_size_* directives refer to hostkey_size, a local variable assigned only in the separate hostkey_size_* parser branch. This has two consequences:

• A CA-size directive encountered before any host-key-size directive raises UnboundLocalError while loading the policy.
• If an earlier host-key-size directive belongs to another key type, its value becomes an unintended host-key-size requirement for the certificate entry and can produce a false policy failure.

There is also an ordering problem for the same key type: a later hostkey_size_* directive replaces the whole entry, discarding an earlier CA constraint.

Change

• Merge each legacy directive into its own key-type entry, preserving explicitly supplied host-key and CA constraints in either order.
• Let CA-only entries omit hostkey_size; do not infer it from another directive or invent a default.
• Skip only the host-size comparison when no host-size requirement was supplied. CA signature type/size checks and exact/allow_larger_keys comparisons remain enforced.

This is a focused policy-loading/evaluation bug fix, not a new option or algorithm. The optional-host-key subset/reordering logic is unchanged; this does not address or reimplement #385.

Testing

Windows, Python 3.12.10, pytest 9.1.1, with PYTHONDONTWRITEBYTECODE=1. The focused command was run with PYTHONPATH selecting the actual source tree under test:

python -B -m pytest test/test_policy.py -q -p no:cacheprovider

• Pinned original module with the final test bytes: 7 failed, 25 passed, exit 1. All seven failures reached the original parser's UnboundLocalError, not an import/collection failure.
• Patched module with the same test bytes: 32 passed, exit 0 (22 existing tests and 10 added regressions).
• Original module with the original tests: 22 passed, exit 0.
• An independent local verification rebuilt a pristine snapshot from the pinned commit and reproduced the same focused RED/GREEN results.

The added regressions use product WriteBuf / SSH2_Kex.parse() fixtures and set_host_key() without network connections. They cover CA-only policies, foreign-type isolation, both same-type directive orders, multiple certificate types, CA type/size mismatches, exact/larger key semantics, and the existing host_key_sizes format.

Additional existing-suite command:

python -B -m pytest test/ -q -p no:cacheprovider

Result: 132 passed, 1 failed, exit 1. The failure is the existing test_audit_conf_process_commandline color assertion under the ambient NO_COLOR=1 environment variable. The same failure occurs with the original module. Independent point-runs of test/test_auditconf.py produced 7 passed with NO_COLOR removed and 1 failed, 6 passed with it set. A supplemental suite run deselecting the affected node produced 131 passed, 2 deselected; pytest's prefix matching also deselected its passing SOCKS5 sibling.

No all-green full-suite or upstream-CI claim is made. flake8, pylint, and mypy were unavailable and were not run. No live SSH server/client audit or end-to-end network test was performed.

Assistance

AI assistance was used for investigation, implementation, testing, and review. The changes and test evidence were reviewed before submission.