oscerd opened a new pull request, #27821: URL: https://github.com/apache/camel/pull/27821
[CAMEL-25644](https://issues.apache.org/jira/browse/CAMEL-25644) When `knownHostsResource` is set, `ResourceBasedSSHKeyVerifier` parsed the `known_hosts` resource with its own parser: - it compared the host field with `String.contains` and used only the first matching line; - it did not tell `[host]:port` entries from plain ones; - it skipped every line that was not exactly `host type key` (comments, markers, extra whitespace, CRLF); - it had no support for wildcard, negated or hashed patterns; - it looked up an endpoint configured with an address by the name that a reverse lookup of that address returns. ### Changes - The entries are read with Apache MINA SSHD's `KnownHostEntry`, the parser behind SSHD's `KnownHostsServerKeyVerifier` that camel-mina-sftp uses. They are matched with `KnownHostEntry.isHostMatch` against the host and port the client connects to, as configured on the endpoint. The host is taken with `getHostString()`, so no reverse lookup happens. - Every entry for the host is considered. The keys are resolved and compared with SSHD (`KeyUtils.compareKeys`), the same code that decodes the key the server presents. - A key listed in a matching `@revoked` entry is rejected. `@cert-authority` entries are ignored: host certificates are not supported, as before. - A host that has entries is rejected when it presents a key that none of them lists, whatever the value of `failOnUnknownHost`. `failOnUnknownHost` only applies to a host without any entry, as before. - The verifier's own key decoding (`loadKey`) is removed. `SSHPublicKeyHolder` is no longer used by the verifier; it is kept because it is a public class. - The descriptions of `knownHostsResource` and `failOnUnknownHost` now state these rules, and `ssh-component.adoc` has a new "Server host key verification" section. ### Behaviour changes The upgrade-guide note is added on `main` in three places: the 4.24 guide, and the 4.22.2 and 4.18.6 sections, since the fix is to be backported to `camel-4.22.x` and `camel-4.18.x`. The note covers these changes: - an entry without a port only applies to port 22, so a server on another port needs a `[host]:port` entry; - an endpoint configured with a host name no longer uses entries listed only under its address, and an endpoint configured with an address no longer uses entries listed under its reverse-lookup name; - an entry for another host whose name or address contains the configured one is no longer used. ### Tests - `ResourceBasedSSHKeyVerifierTest` is rewritten. It covers: - exact host patterns and addresses, and ports; - wildcard, negated, upper-case and hashed patterns; - several keys per host, comments and CRLF line endings; - `@revoked` and `@cert-authority` entries; - unknown versus listed hosts with both values of `failOnUnknownHost`; - an endpoint configured with an address; - every key type of `known_hosts_types` (RSA, DSA, ECDSA 256/384/521, Ed25519). 11 of its 14 tests fail on the previous verifier; the other 3 are controls. - `SshComponentKnownHostTest` and `SshComponentKnownHostEdDSATest`: - The test server listens on a random port, so the known_hosts files are now written at runtime, with `[localhost]:<port>` entries for the server's own host key. The `known_hosts_valid` and `known_hosts_eddsa` fixtures are removed. - Two new end-to-end tests fail on the previous verifier: a key listed only for another host is rejected, and a server listed with several keys is accepted. - camel-ssh: 54 tests, 0 failures. - Full reactor `mvn clean install -DskipTests -DskipITs`: BUILD SUCCESS, 703 modules. The regenerated catalog (component JSON and doc mirror) and the component and endpoint DSL builders are included. _Claude Code on behalf of Andrea Cosentino (@oscerd)_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
