[
https://issues.apache.org/jira/browse/CAMEL-25644?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-25644 started by Andrea Cosentino.
------------------------------------------------
> camel-ssh - match known_hosts entries by exact host pattern
> -----------------------------------------------------------
>
> Key: CAMEL-25644
> URL: https://issues.apache.org/jira/browse/CAMEL-25644
> Project: Camel
> Issue Type: Bug
> Components: camel-ssh
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.24.0
>
>
> When {{knownHostsResource}} is set, {{ResourceBasedSSHKeyVerifier}} parses
> the known_hosts resource with its own parser, which does not follow the
> OpenSSH known_hosts format:
> * the host field is compared with {{String.contains}} instead of matching
> each comma-separated host pattern;
> * only the first matching line is used, so a host listed with several keys
> (one line per key type, as {{ssh-keyscan}} writes them) fails unless the
> first line holds the negotiated key type;
> * {{[host]:port}} entries are not distinguished from plain entries;
> * wildcard and negated patterns, hashed entries, {{@revoked}} /
> {{@cert-authority}} markers, comments, repeated whitespace, CRLF line endings
> and upper-case host names are not handled;
> * for an endpoint configured with an IP address, the lookup name comes from a
> reverse DNS lookup of that address.
> Proposed change:
> * match entries with Apache MINA SSHD's {{KnownHostEntry}} (as
> camel-mina-sftp does) against the configured host and port;
> * consider every matching entry;
> * keep rejecting a listed host whose keys do not match, whatever
> {{failOnUnknownHost}} is set to;
> * document the supported format;
> * add an upgrade-guide note for entries that only matched through the old
> comparison.
> _Filed by Claude Code on behalf of Andrea Cosentino (@oscerd)._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
