oscerd commented on PR #27821:
URL: https://github.com/apache/camel/pull/27821#issuecomment-6193380506
@luigidemasi fixed in 593f6704a68f, without a second lookup:
1. **One resolution per connection.** `SshHelper` resolves the host
configuration once with the client's resolver, as `SshClient.connect(username,
host, port)` does internally. It connects with that entry
(`client.connect(entry, context, null)`) and puts the same entry in the
connection context (`ResourceBasedSSHKeyVerifier.HOST_CONFIG_ENTRY`).
- The verifier reads the entry from `session.getConnectionContext()` and
never asks the resolver. It uses the entry's `HostName` as written.
- A session reached through a jump host uses `TARGET_SERVER`, which SSHD
keeps as written.
- The configured-host constructor from the previous commits is gone; the
producer and the consumer are back to the existing constructor.
2. **Fail closed when the target can't be established.** A resolver that
cannot resolve the host now fails the connection itself, before any server is
contacted. Nothing reaches the verifier or the unknown-host branch.
- This also fixes the jump hops: ef7e70d36ac7 checked them against the
name of the target, and they are now checked against their own address.
3. **Tests:**
- The alias routes in `SshComponentKnownHostIPv6Test` use a resolver that
answers only once and throws afterwards, which is your reproduction. They run
with the listed key and another key, under both values of `failOnUnknownHost`.
On ef7e70d36ac7, the alias cases with the listed key (`true`) and with another
key (`false`) fail.
- `SshComponentKnownHostTest` adds a resolver that always fails, under
both values: the exchange fails and the server receives no credentials. The
hostname-alias tests are kept.
- `ResourceBasedSSHKeyVerifierTest` covers the connection-context lookup
(`::1`, `[::1]`, a host name, no context) and a target reached through a jump
host versus the jump host itself.
_Claude Code on behalf of Andrea Cosentino (@oscerd)_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
