Apply %h tokenization to HostName

This was another spot that incidentally occurred in older (and moved)
code, but was made incorrect after cleanup

paramiko/config.py

@@ -60,6 +60,7 @@ class SSHConfig(object):
     # compatible across the board, e.g. OpenSSH 8.1 added %n to ProxyCommand.
     TOKENS_BY_CONFIG_KEY = {
         "controlpath": ["%h", "%l", "%L", "%n", "%p", "%r", "%u"],
+        "hostname": ["%h"],
         "identityfile": ["~", "%d", "%h", "%l", "%u", "%r"],
         "proxycommand": ["~", "%h", "%p", "%r"],
         # Doesn't seem worth making this 'special' for now, it will fit well
@@ -412,13 +413,12 @@ def _tokenize(self, config, target_hostname, key, value):
         # Short-circuit if no tokenization possible
         if not allowed_tokens:
             return value
-        # Obtain potentially configured (and even possibly itself tokenized)
-        # hostname, for use with %h in other values.
+        # Obtain potentially configured hostname, for use with %h.
+        # Special-case where we are tokenizing the hostname itself, to avoid
+        # replacing %h with a %h-bearing value, etc.
         configured_hostname = target_hostname
-        if "hostname" in config:
-            configured_hostname = config["hostname"].replace(
-                "%h", target_hostname
-            )
+        if key != "hostname":
+            configured_hostname = config.get("hostname", configured_hostname)
         # Ditto the rest of the source values
         if "port" in config:
             port = config["port"]

tests/configs/hostname-exec-tokenized

@@ -0,0 +1,2 @@
+Match exec "ping %h"
+    HostName pingable.%h

tests/configs/hostname-tokenized

@@ -0,0 +1 @@
+HostName prefix.%h

tests/test_config.py

@@ -467,6 +467,10 @@ def test_proxycommand_none_masking(self):
         cmd = config.lookup("some-random-host")["proxycommand"]
         assert cmd == "default-proxy"
 
+    def test_hostname_tokenization(self):
+        result = load_config("hostname-tokenized").lookup("whatever")
+        assert result["hostname"] == "prefix.whatever"
+
 
 class TestSSHConfigDict(object):
     def test_SSHConfigDict_construct_empty(self):
@@ -774,6 +778,12 @@ def test_requires_an_argument(self):
         with raises(ConfigParseError):
             load_config("match-exec-no-arg")
 
+    @patch("paramiko.config.invoke.run")
+    def test_works_with_tokenized_hostname(self, run):
+        run.side_effect = _expect("ping target")
+        result = load_config("hostname-exec-tokenized").lookup("target")
+        assert result["hostname"] == "pingable.target"
+
 
 class TestMatchHost(object):
     def test_matches_target_name_when_no_hostname(self):