Repository navigation
[backport camel-4.22.x] CAMEL-25644: camel-ssh - match known_hosts entries by exact host pattern - #28215
Conversation
Backport of apache#27821 onto camel-4.22.x. When knownHostsResource is set, ResourceBasedSSHKeyVerifier parsed known_hosts with its own parser. It matched the host field with String.contains and used only the first matching line, did not tell [host]:port entries from plain ones, skipped comments, markers and CRLF lines, had no wildcard, negated or hashed patterns, and looked up an endpoint configured by address under its reverse-lookup name. The verifier now matches entries as OpenSSH does. Each pattern is compared, ignoring case, with the host the client connects to (or the HostName of the host configuration, resolved once per connection), written [host]:port for a port other than 22. Wildcard, negated and hashed |1| patterns are supported. Every entry for the host is considered, and keys are compared with Apache MINA SSHD. A key in a matching @Revoked entry, or a key not listed for a host that has entries, is rejected whatever failOnUnknownHost says, and a resource or line that cannot be read fails every connection. The upgrade guide note for this branch is on main, in the 4.22.3 section of the 4.22 guide. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
oscerd
added
bug
gnodet-bot
left a comment
gnodet-bot
left a comment
There was a problem hiding this comment.
LGTM. The new implementation is correct, fail-closed by design, and comprehensively tested. One low-severity nit on the @since tag.
This review was generated by an AI agent, Hermès on behalf of @gnodet.
| * context of the session: the entries are matched against its {@code HostName} as it is written. Without it, the | ||
| * address the client connected to is used, which writes an IPv6 address such as {@code ::1} in its full form. | ||
| * | ||
| * @since 4.24 |
There was a problem hiding this comment.
💡 Nit: The @since tag was carried over from the main branch PR (4.24) but this backport lands on camel-4.22.x — the first release to include this API is 4.22.3.
| * @since 4.24 | |
| * @since 4.22.3 |
There was a problem hiding this comment.
Thanks. I'd keep @since 4.24 here, on purpose:
- Backports to the maintenance branches keep the
@sinceof the change onmain.KnativeTransportConfigurationhas@since 4.23on bothcamel-4.22.xandcamel-4.18.x, andEmptyConsumerCachehas@since 4.21oncamel-4.18.x. Neither branch has a patch-level@sincesuch as4.22.3. - It keeps this PR a straight cherry-pick of CAMEL-25644: camel-ssh - match known_hosts entries by exact host pattern #27821, with its 16 files identical to
main. Writing4.22.3here would also mean4.18.6in [backport camel-4.18.x] CAMEL-25644: camel-ssh - match known_hosts entries by exact host pattern #28218, so each line would document a different version for the same constant.
If the project wants @since to name the first release of each line, that convention belongs on main first, for example @since 4.18.6, 4.22.3, 4.24. I'd do it there in a follow-up rather than in the backports.
Claude Code on behalf of Andrea Cosentino
davsclaus
left a comment
davsclaus
left a comment
There was a problem hiding this comment.
Thanks Andrea.
Straight cherry-pick of #27821. I diffed the two PR diffs: the 16 files of this PR are identical to #27821, hunks and context included, so it applies to camel-4.22.x without any adaptation. The only difference is that the three upgrade-guide files of #27821 are left out, as they live on main only. The note for this line is already on main, in the "Upgrading from 4.22.2 to 4.22.3" section of camel-4x-upgrade-guide-4_22.adoc (4.22.2 is tagged), so the backport policy is met.
LGTM once CI is green.
Claude Code on behalf of davsclaus. This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.
|
🌟 Thank you for your contribution to the Apache Camel project! 🌟 🐫 Apache Camel Committers, please review the following items:
|
|
🧪 CI tested the following changed modules:
🔬 Scalpel shadow comparison — Scalpel: 16 tested, 26 compile-only — current: 13 all testedMaveniverse Scalpel detected 42 affected modules (current approach: 13).
|
Backport of #27821 onto
camel-4.22.x.Original PR: #27821 - CAMEL-25644: camel-ssh - match known_hosts entries by exact host pattern
Target branch:
camel-4.22.xCAMEL-25644
What it does
As on main, when
knownHostsResourceis set,ResourceBasedSSHKeyVerifiermatches the entries of theknown_hostsresource as OpenSSH does:HostNamethat~/.ssh/configgives for it, never resolved through DNS. It is writtenhostfor port 22 and[host]:portfor another port. The producer and the consumer resolve the host configuration once per connection and hand it to the verifier.*and?are wildcards,!excludes the hosts a pattern matches, and hashed|1|entries are supported.@revokedentry is rejected, and so is a key that none of the entries of a listed host has, whatever the value offailOnUnknownHost.@cert-authorityentries are ignored.ssh-component.adochas the new "Server host key verification" section.Straight cherry-pick
The diff is the diff of #27821 without its three upgrade guide files, which live on main only. The note for this branch is already on main, in the "Upgrading from 4.22.2 to 4.22.3" section of the 4.22 guide (4.22.2 has been tagged). The other 16 files are line for line the same as in #27821, including the regenerated catalog JSON and doc mirror and the component and endpoint DSL builders. As a straight backport of a reviewed PR, it has no reviewers.
Tests
mvn clean install -DskipTests -DskipITs, BUILD SUCCESS, 684 modules, nothing regenerated.Claude Code on behalf of Andrea Cosentino
🤖 Generated with Claude Code