NAPALM/napalm-device-types
1
0 Fork 0
Code Issues 12 Pull Requests 1 Actions Packages Projects Releases 2 Wiki Activity

feat: ssh_host_keys.HostKeyCheck, trust on first use (NetOrk/netork#1167) #49

Merged
christianmanivong merged 1 commits from fix/ssh-host-key-tofu-1167 into main 2026-10-18 19:23:26 +00:00
Conversation 0 Commits 1 Files Changed 5
+611 -1
christianmanivong commented 2026-10-18 19:23:26 +00:00
Owner
Copy link
Copy source

Generic SSH host-key verification for every SSH driver: known key by port in, observation out, refused before authentication. Version 4.19.0. Part of NetOrk/netork#1167.

Generic SSH host-key verification for every SSH driver: known key by port in, observation out, refused before authentication. Version 4.19.0. Part of NetOrk/netork#1167.
christianmanivong added 1 commit 2026-10-18 19:23:26 +00:00
feat: ssh_host_keys.HostKeyCheck, trust on first use (NetOrk/netork#1167)
CI / test (3.10) (push) Successful in 35s
Details
CI / test (3.11) (push) Successful in 41s
Details
CI / test (3.12) (push) Successful in 38s
Details
CI / test (3.13) (push) Successful in 33s
Details
CI / test (3.10) (pull_request) Successful in 29s
Details
CI / test (3.11) (pull_request) Successful in 28s
Details
CI / test (3.12) (pull_request) Successful in 33s
Details
CI / test (3.13) (pull_request) Successful in 40s
Details
94bf399d34 
Drivers get the host keys to expect in optional_args["ssh_host_keys"] (by port)
and report what they saw through optional_args["ssh_host_key_observer"].
With a known key, any other key is refused before authentication
(SshHostKeyMismatch); without one, the first key is accepted. One
implementation for paramiko (HostKeyCheck.connect) and netmiko
(HostKeyCheck.netmiko + observe). A caller or driver that ignores both keys
keeps working as before.

Version 4.19.0.
christianmanivong merged commit 888a11ca6a into main 2026-10-18 19:23:26 +00:00
christianmanivong deleted branch fix/ssh-host-key-tofu-1167 2026-10-18 19:23:26 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is broken
 enhancement
New feature or request
 tech-debt
Refactoring / cleanup / deferred debt
prio
P0
Road blocker: blocks other work, drop everything
prio
P1
Critical
prio
P2
Important and urgent
prio
P3
Important, not urgent
prio
P4
Neither important nor urgent
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
christianmanivong
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: NAPALM/napalm-device-types#49