Federico Mariani created CAMEL-24097:
----------------------------------------
Summary: camel-ftp: SFTP knownHostsUri/knownHosts silently
clobbered by unconditional ~/.ssh/known_hosts fallback - host key verification
uses the wrong database
Key: CAMEL-24097
URL: https://issues.apache.org/jira/browse/CAMEL-24097
Project: Camel
Issue Type: Bug
Components: camel-ftp
Affects Versions: 4.21.0
Reporter: Federico Mariani
Attachments: SftpKnownHostsUriClobberedTest.java
h3. Problem
{{SftpOperations.createSession}} (SftpOperations.java:314-343) applies
known-hosts sources in sequence: {{knownHostsFile}} (l.314), {{knownHostsUri}}
(l.319), {{knownHosts}} bytes (l.330). Then lines 335-343 run *unconditionally
afterwards*: if {{knownHostsFile == null}} and {{useUserKnownHostsFile}}
(default *true*), it calls {{jsch.setKnownHosts(HOME/.ssh/known_hosts)}}.
JSch's {{KnownHosts.setKnownHosts(String)}}, when the file *exists*, delegates
to {{setKnownHosts(InputStream)}} which starts with
{{pool.removeAllElements()}} - wiping whatever was loaded from
{{knownHostsUri}}/{{knownHosts}}.
h3. Failure scenario
{{sftp://...?strictHostKeyChecking=yes&knownHostsUri=classpath:known_hosts}} on
any machine where {{~/.ssh/known_hosts}} exists (any dev box, most servers):
verification runs against the *user's* file, not the configured one. Either
connections fail with "UnknownHostKey" although the key is in the configured
resource, or - worse - they succeed against an entry the deployer never
intended to trust. Even when the home file does not exist, the known-hosts
filename is repointed, changing where {{autoCreateKnownHostsFile}} writes.
h3. History
The user-file fallback block shape is from 2016 (924d3501485e);
{{knownHostsUri}} is CAMEL-6477 (2013); CAMEL-10727 (2017) only fixed an NPE
here. The option javadoc ("If knownHostFile has not been explicit
configured...") clearly intends a *fallback*, not an override of the other two
sources. Note {{knownHostsFile}}, when set, is applied twice (l.314 and l.342)
- harmless, but confirms the block was never reconciled with the earlier ones.
h3. Suggested fix
Skip the user-known-hosts fallback when any of
{{knownHostsFile}}/{{knownHostsUri}}/{{knownHosts}} is configured.
h3. Reproducer
Attached failing JUnit test (place in
{{components/camel-ftp/src/test/java/org/apache/camel/component/file/remote/}}).
Points {{user.home}} at a temp dir containing a {{.ssh/known_hosts}} for a
different host, configures {{knownHostsUri}} with the target host's key, calls
{{createSession}} and asserts the configured host key survived - on current
main it was wiped by the fallback load.
----
_This issue was researched and filed by Claude Code on behalf of [~croway]
(GitHub: Croway), as part of a deep code review of camel-file and camel-ftp. A
failing JUnit reproducer is attached; it fails deterministically on current
main (4.22.0-SNAPSHOT)._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
