[
https://issues.apache.org/jira/browse/CAMEL-24097?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Federico Mariani updated CAMEL-24097:
-------------------------------------
Attachment: SftpKnownHostsUriClobberedTest.java
> camel-ftp: SFTP knownHostsUri/knownHosts silently clobbered by unconditional
> ~/.ssh/known_hosts fallback - host key verification uses the wrong database
> --------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24097
> URL: https://issues.apache.org/jira/browse/CAMEL-24097
> Project: Camel
> Issue Type: Bug
> Components: camel-ftp
> Affects Versions: 4.21.0
> Reporter: Federico Mariani
> Priority: Major
> Labels: code-review
> Attachments: SftpKnownHostsUriClobberedTest.java
>
>
> h3. Problem
> {{SftpOperations.createSession}} (SftpOperations.java:314-343) applies
> known-hosts sources in sequence: {{knownHostsFile}} (l.314),
> {{knownHostsUri}} (l.319), {{knownHosts}} bytes (l.330). Then lines 335-343
> run *unconditionally afterwards*: if {{knownHostsFile == null}} and
> {{useUserKnownHostsFile}} (default *true*), it calls
> {{jsch.setKnownHosts(HOME/.ssh/known_hosts)}}. JSch's
> {{KnownHosts.setKnownHosts(String)}}, when the file *exists*, delegates to
> {{setKnownHosts(InputStream)}} which starts with {{pool.removeAllElements()}}
> - wiping whatever was loaded from {{knownHostsUri}}/{{knownHosts}}.
> h3. Failure scenario
> {{sftp://...?strictHostKeyChecking=yes&knownHostsUri=classpath:known_hosts}}
> on any machine where {{~/.ssh/known_hosts}} exists (any dev box, most
> servers): verification runs against the *user's* file, not the configured
> one. Either connections fail with "UnknownHostKey" although the key is in the
> configured resource, or - worse - they succeed against an entry the deployer
> never intended to trust. Even when the home file does not exist, the
> known-hosts filename is repointed, changing where
> {{autoCreateKnownHostsFile}} writes.
> h3. History
> The user-file fallback block shape is from 2016 (924d3501485e);
> {{knownHostsUri}} is CAMEL-6477 (2013); CAMEL-10727 (2017) only fixed an NPE
> here. The option javadoc ("If knownHostFile has not been explicit
> configured...") clearly intends a *fallback*, not an override of the other
> two sources. Note {{knownHostsFile}}, when set, is applied twice (l.314 and
> l.342) - harmless, but confirms the block was never reconciled with the
> earlier ones.
> h3. Suggested fix
> Skip the user-known-hosts fallback when any of
> {{knownHostsFile}}/{{knownHostsUri}}/{{knownHosts}} is configured.
> h3. Reproducer
> Attached failing JUnit test (place in
> {{components/camel-ftp/src/test/java/org/apache/camel/component/file/remote/}}).
> Points {{user.home}} at a temp dir containing a {{.ssh/known_hosts}} for a
> different host, configures {{knownHostsUri}} with the target host's key,
> calls {{createSession}} and asserts the configured host key survived - on
> current main it was wiped by the fallback load.
> ----
> _This issue was researched and filed by Claude Code on behalf of [~croway]
> (GitHub: Croway), as part of a deep code review of camel-file and camel-ftp.
> A failing JUnit reproducer is attached; it fails deterministically on current
> main (4.22.0-SNAPSHOT)._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
