oscerd opened a new pull request, #28218: URL: https://github.com/apache/camel/pull/28218
Backport of #27821 onto `camel-4.18.x`. **Original PR:** #27821 - CAMEL-25644: camel-ssh - match known_hosts entries by exact host pattern **Target branch:** `camel-4.18.x` [CAMEL-25644](https://issues.apache.org/jira/browse/CAMEL-25644) ## What it does As on main, when `knownHostsResource` is set, `ResourceBasedSSHKeyVerifier` matches the entries of the `known_hosts` resource as OpenSSH does: - Each host pattern is compared, ignoring case, with the host the client connects to: the host configured on the endpoint, or the `HostName` that `~/.ssh/config` gives for it, never resolved through DNS. It is written `host` for port 22 and `[host]:port` for another port. The producer and the consumer resolve the host configuration once per connection and hand it to the verifier. - `*` and `?` are wildcards, `!` excludes the hosts a pattern matches, and hashed `|1|` entries are supported. - Every entry for the host is considered, and the keys are compared with Apache MINA SSHD. - A key in a matching `@revoked` entry is rejected, and so is a key that none of the entries of a listed host has, whatever the value of `failOnUnknownHost`. `@cert-authority` entries are ignored. - A resource or a line that cannot be read makes every connection fail. - `ssh-component.adoc` has the new "Server host key verification" section. ## Adaptations for camel-4.18.x The verifier, `SshHelper`, the component doc and the tests are the same as in #27821. `SshConfiguration` differs on this branch, so this needs a review: - `knownHostsResource` and `failOnUnknownHost` have a bare `@UriParam` on this branch (no `label`, `security` or `description`), so their descriptions come from the setter javadoc. The `knownHostsResource` setter javadoc now carries the description that main has in the annotation. The `failOnUnknownHost` setter javadoc is updated as on main. - The generated files are regenerated for this branch: the component JSON, the catalog JSON, and the component and endpoint DSL builders. There is no catalog doc mirror on this branch. - The upgrade guide note for this branch is already on main, in the "Upgrading from 4.18.5 to 4.18.6" section of the 4.18 guide. ## Tests - camel-ssh: 68 tests, 0 failures, none skipped. This branch has fewer camel-ssh tests than main, and every known_hosts test of #27821 ran: 22 verifier tests, 12 `SshComponentKnownHostTest`, 8 `SshComponentKnownHostIPv6Test` and 1 `SshComponentKnownHostEdDSATest`. - A full reactor build of the branch: `mvn clean install -DskipTests -DskipITs`, BUILD SUCCESS, 657 modules. It regenerated only the three generated files above. _Claude Code on behalf of Andrea Cosentino_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
