def verify_transport_key(t, hostname, port, sshconfig):
    add_host_entry = add_ip_entry = False
    hostkey = t.get_remote_server_key()
    sys_known_hosts = load(sshconfig.get('globalknownhostsfile', '/etc/ssh/ssh_known_hosts'))
    user_known_hosts = load(sshconfig.get('userknownhostsfile', '~/.ssh/known_hosts'))
    keys = list(sys_known_hosts.matching_keys(hostname, int(port)))
    keys.extend(user_known_hosts.matching_keys(hostname, int(port)))
    for x in keys:
        if x.key.get_name() == hostkey.get_name():
            if x.key.get_fingerprint() == hostkey.get_fingerprint():
                break
            # Key types match, but not fingerprint
            logging.getLogger('radssh.keys').warning('Host %s failed SSH key validation - conflicting entry [%s:%d]' % (hostname, x.filename, x.lineno))
            raise Exception('Host %s failed SSH key validation - conflicting entry [%s:%d]' % (hostname, x.filename, x.lineno))
    else:
        # No match found
        if sshconfig.get('stricthostkeychecking', 'ask') == 'yes':
            logging.getLogger('radssh.keys').warning('No host key found for %s and StrictHostKeyChecking=yes' % hostname)
            raise Exception('Missing known_hosts entry for: %s' % hostname)
        add_host_entry = True
    # Check key for IP entry as well?
    if sshconfig.get('checkhostip', 'no') == 'yes':
        verify_ip = t.getpeername()[0]
        keys = list(sys_known_hosts.matching_keys(verify_ip, int(port)))
        keys.extend(user_known_hosts.matching_keys(verify_ip, int(port)))
        for x in keys:
            if x.key.get_name() == hostkey.get_name():
                if x.key.get_fingerprint() == hostkey.get_fingerprint():
                    break
                logging.getLogger('radssh.keys').warning(
                    'Host %s (IP %s) failed SSH key validation - conflicting entry [%s:%d]' %
                    (hostname, verify_ip, x.filename, x.lineno))
                raise Exception(
                    'Host %s (IP %s) failed SSH key validation - conflicting entry [%s:%d]' %
                    (hostname, verify_ip, x.filename, x.lineno))
        else:
            # No match found for IP
            if sshconfig.get('stricthostkeychecking', 'ask') == 'yes':
                logging.getLogger('radssh.keys').warning('No host key found for IP %s (%s) and StrictHostKeyChecking=yes' % (verify_ip, hostname))
                raise Exception('Missing known_hosts entry for IP: %s (%s)' % (verify_ip, hostname))
            add_ip_entry = True

    if not add_host_entry and not add_ip_entry:
        return
    entries = []
    if add_host_entry:
        if int(port) == 22:
            entries.append(hostname)
        else:
            entries.append('[%s]:%s' % (hostname, port))
    if add_ip_entry:
        if int(port) == 22:
            entries.append(verify_ip)
        else:
            entries.append('[%s]:%s' % (verify_ip, port))
    if sshconfig.get('stricthostkeychecking', 'ask') == 'no':
        add_key = user_known_hosts.add
    else:
        add_key = user_known_hosts.conditional_add

    if sshconfig.get('hashknownhosts', 'no') == 'yes':
        # Each hashed entry must be added independently
        for keyval in entries:
            if not add_key(keyval, hostkey, True):
                raise Exception('Declined host key for %s - aborting connection' % keyval)
    else:
        # Add host and IP entry as a single line
        if not add_key(','.join(entries), hostkey, False):
            raise Exception('Declined host key for %s - aborting connection' % ','.join(entries))
Test makeelement handling.
dataset/ETHPy150Open radssh/radssh/radssh/known_hosts.py/verify_transport_key--crossover with--dataset/ETHPy150Open cloudera/hue/desktop/core/ext-py/lxml-3.3.6/selftest2.py/makeelement