Andrea Cosentino created CAMEL-25644:
----------------------------------------
Summary: camel-ssh - match known_hosts entries by exact host
pattern
Key: CAMEL-25644
URL: https://issues.apache.org/jira/browse/CAMEL-25644
Project: Camel
Issue Type: Bug
Components: camel-ssh
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.24.0
When {{knownHostsResource}} is set, {{ResourceBasedSSHKeyVerifier}} parses the
known_hosts resource with its own parser, which does not follow the OpenSSH
known_hosts format:
* the host field is compared with {{String.contains}} instead of matching each
comma-separated host pattern;
* only the first matching line is used, so a host listed with several keys (one
line per key type, as {{ssh-keyscan}} writes them) fails unless the first line
holds the negotiated key type;
* {{[host]:port}} entries are not distinguished from plain entries;
* wildcard and negated patterns, hashed entries, {{@revoked}} /
{{@cert-authority}} markers, comments, repeated whitespace, CRLF line endings
and upper-case host names are not handled;
* for an endpoint configured with an IP address, the lookup name comes from a
reverse DNS lookup of that address.
Proposed change:
* match entries with Apache MINA SSHD's {{KnownHostEntry}} (as camel-mina-sftp
does) against the configured host and port;
* consider every matching entry;
* keep rejecting a listed host whose keys do not match, whatever
{{failOnUnknownHost}} is set to;
* document the supported format;
* add an upgrade-guide note for entries that only matched through the old
comparison.
_Filed by Claude Code on behalf of Andrea Cosentino (@oscerd)._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
