[jira] [Updated] (CAMEL-24097) camel-ftp: SFTP knownHostsUri/knownHosts silently clobbered by unconditional ~/.ssh/known_hosts fallback - host key verification uses the wrong database

["Federico Mariani (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24097?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Federico Mariani updated CAMEL-24097:
-------------------------------------
    Attachment: SftpKnownHostsUriClobberedTest.java

> camel-ftp: SFTP knownHostsUri/knownHosts silently clobbered by unconditional ~/.ssh/known_hosts fallback - host key verification uses the wrong database
> --------------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24097
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24097
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-ftp
>    Affects Versions: 4.21.0
>            Reporter: Federico Mariani
>            Priority: Major
>              Labels: code-review
>         Attachments: SftpKnownHostsUriClobberedTest.java
>
>
> h3. Problem
> {{SftpOperations.createSession}} (SftpOperations.java:314-343) applies known-hosts sources in sequence: {{knownHostsFile}} (l.314), {{knownHostsUri}} (l.319), {{knownHosts}} bytes (l.330). Then lines 335-343 run *unconditionally afterwards*: if {{knownHostsFile == null}} and {{useUserKnownHostsFile}} (default *true*), it calls {{jsch.setKnownHosts(HOME/.ssh/known_hosts)}}. JSch's {{KnownHosts.setKnownHosts(String)}}, when the file *exists*, delegates to {{setKnownHosts(InputStream)}} which starts with {{pool.removeAllElements()}} - wiping whatever was loaded from {{knownHostsUri}}/{{knownHosts}}.
> h3. Failure scenario
> {{sftp://...?strictHostKeyChecking=yes&knownHostsUri=classpath:known_hosts}} on any machine where {{~/.ssh/known_hosts}} exists (any dev box, most servers): verification runs against the *user's* file, not the configured one. Either connections fail with "UnknownHostKey" although the key is in the configured resource, or - worse - they succeed against an entry the deployer never intended to trust. Even when the home file does not exist, the known-hosts filename is repointed, changing where {{autoCreateKnownHostsFile}} writes.
> h3. History
> The user-file fallback block shape is from 2016 (924d3501485e); {{knownHostsUri}} is CAMEL-6477 (2013); CAMEL-10727 (2017) only fixed an NPE here. The option javadoc ("If knownHostFile has not been explicit configured...") clearly intends a *fallback*, not an override of the other two sources. Note {{knownHostsFile}}, when set, is applied twice (l.314 and l.342) - harmless, but confirms the block was never reconciled with the earlier ones.
> h3. Suggested fix
> Skip the user-known-hosts fallback when any of {{knownHostsFile}}/{{knownHostsUri}}/{{knownHosts}} is configured.
> h3. Reproducer
> Attached failing JUnit test (place in {{components/camel-ftp/src/test/java/org/apache/camel/component/file/remote/}}). Points {{user.home}} at a temp dir containing a {{.ssh/known_hosts}} for a different host, configures {{knownHostsUri}} with the target host's key, calls {{createSession}} and asserts the configured host key survived - on current main it was wiped by the fallback load.
> ----
> _This issue was researched and filed by Claude Code on behalf of [~croway] (GitHub: Croway), as part of a deep code review of camel-file and camel-ftp. A failing JUnit reproducer is attached; it fails deterministically on current main (4.22.0-SNAPSHOT)._



--
This message was sent by Atlassian Jira
(v8.20.10#820010)