[jira] [Updated] (CAMEL-25644) camel-ssh - match known_hosts entries by exact host pattern

["Andrea Cosentino (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-25644?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Andrea Cosentino updated CAMEL-25644:
-------------------------------------
    Fix Version/s: 4.22.3
                   4.18.6

> camel-ssh - match known_hosts entries by exact host pattern
> -----------------------------------------------------------
>
>                 Key: CAMEL-25644
>                 URL: https://issues.apache.org/jira/browse/CAMEL-25644
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-ssh
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> When {{knownHostsResource}} is set, {{ResourceBasedSSHKeyVerifier}} parses the known_hosts resource with its own parser, which does not follow the OpenSSH known_hosts format:
> * the host field is compared with {{String.contains}} instead of matching each comma-separated host pattern;
> * only the first matching line is used, so a host listed with several keys (one line per key type, as {{ssh-keyscan}} writes them) fails unless the first line holds the negotiated key type;
> * {{[host]:port}} entries are not distinguished from plain entries;
> * wildcard and negated patterns, hashed entries, {{@revoked}} / {{@cert-authority}} markers, comments, repeated whitespace, CRLF line endings and upper-case host names are not handled;
> * for an endpoint configured with an IP address, the lookup name comes from a reverse DNS lookup of that address.
> Proposed change:
> * match entries with Apache MINA SSHD's {{KnownHostEntry}} (as camel-mina-sftp does) against the configured host and port;
> * consider every matching entry;
> * keep rejecting a listed host whose keys do not match, whatever {{failOnUnknownHost}} is set to;
> * document the supported format;
> * add an upgrade-guide note for entries that only matched through the old comparison.
> _Filed by Claude Code on behalf of Andrea Cosentino (@oscerd)._



--
This message was sent by Atlassian Jira
(v8.20.10#820010)