Repository navigation
[backport camel-4.18.x] CAMEL-25644: camel-ssh - match known_hosts entries by exact host pattern - #28218
Merged
oscerd merged 1 commit intoOct 21, 2026
Conversation
Backport of apache#27821 onto camel-4.18.x. When knownHostsResource is set, ResourceBasedSSHKeyVerifier parsed known_hosts with its own parser. It matched the host field with String.contains and used only the first matching line, did not tell [host]:port entries from plain ones, skipped comments, markers and CRLF lines, had no wildcard, negated or hashed patterns, and looked up an endpoint configured by address under its reverse-lookup name. The verifier now matches entries as OpenSSH does. Each pattern is compared, ignoring case, with the host the client connects to (or the HostName of the host configuration, resolved once per connection), written [host]:port for a port other than 22. Wildcard, negated and hashed |1| patterns are supported. Every entry for the host is considered, and keys are compared with Apache MINA SSHD. A key in a matching @Revoked entry, or a key not listed for a host that has entries, is rejected whatever failOnUnknownHost says, and a resource or line that cannot be read fails every connection. On this branch the options knownHostsResource and failOnUnknownHost take their description from the setter javadoc, so the new wording is there. The upgrade guide note for this branch is on main, in the 4.18.6 section of the 4.18 guide. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
oscerd
added
bug
gnodet-bot
reviewed
Oct 21, 2026
gnodet-bot
left a comment
gnodet-bot
left a comment
Contributor
There was a problem hiding this comment.
Backport versioning oversight: @since tag must reflect the first version on this branch, not the main branch.
This review was generated by an AI agent, Hermès on behalf of @gnodet.
davsclaus
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #27821 onto
camel-4.18.x.Original PR: #27821 - CAMEL-25644: camel-ssh - match known_hosts entries by exact host pattern
Target branch:
camel-4.18.xCAMEL-25644
What it does
As on main, when
knownHostsResourceis set,ResourceBasedSSHKeyVerifiermatches the entries of theknown_hostsresource as OpenSSH does:HostNamethat~/.ssh/configgives for it, never resolved through DNS. It is writtenhostfor port 22 and[host]:portfor another port. The producer and the consumer resolve the host configuration once per connection and hand it to the verifier.*and?are wildcards,!excludes the hosts a pattern matches, and hashed|1|entries are supported.@revokedentry is rejected, and so is a key that none of the entries of a listed host has, whatever the value offailOnUnknownHost.@cert-authorityentries are ignored.ssh-component.adochas the new "Server host key verification" section.Adaptations for camel-4.18.x
The verifier,
SshHelper, the component doc and the tests are the same as in #27821.SshConfigurationdiffers on this branch, so this needs a review:knownHostsResourceandfailOnUnknownHosthave a bare@UriParamon this branch (nolabel,securityordescription), so their descriptions come from the setter javadoc. TheknownHostsResourcesetter javadoc now carries the description that main has in the annotation. ThefailOnUnknownHostsetter javadoc is updated as on main.Tests
SshComponentKnownHostTest, 8SshComponentKnownHostIPv6Testand 1SshComponentKnownHostEdDSATest.mvn clean install -DskipTests -DskipITs, BUILD SUCCESS, 657 modules. It regenerated only the three generated files above.Claude Code on behalf of Andrea Cosentino
🤖 Generated with Claude Code