[ddwrt] Added strict host key checking configuration option

PR openhab#20505

Assisted-by: Windsurf:Claude Opus 4.6
Signed-off-by: Lee Ballard <ballle98@gmail.com>

Author: ballle98

bundles/org.openhab.binding.ddwrt/src/main/java/org/openhab/binding/ddwrt/internal/DDWRTNetworkConfiguration.java

@@ -71,4 +71,11 @@ public class DDWRTNetworkConfiguration {
      * clients that the routers/APs cannot, or for cross-validation of presence detection.
      */
     public boolean useLocalArpCache = false;
+
+    /**
+     * When true, reject SSH connections to hosts not already in known_hosts (strict checking).
+     * When false (default), unknown host keys are automatically accepted on first connection (TOFU)
+     * and saved to known_hosts. Changed keys are always rejected regardless of this setting.
+     */
+    public boolean strictHostKeyChecking = false;
 }

bundles/org.openhab.binding.ddwrt/src/main/java/org/openhab/binding/ddwrt/internal/api/DDWRTNetwork.java

@@ -92,6 +92,7 @@ public void setConfig(DDWRTNetworkConfiguration netCfg) {
         if (!Objects.equals(this.config, netCfg)) {
             logger.debug("Config changed.");
             this.config = netCfg;
+            SshClientManager.getInstance().setStrictHostKeyChecking(netCfg.strictHostKeyChecking);
             reloadHostnameMappings();
 
             // Clear failure tracking for retry logic

bundles/org.openhab.binding.ddwrt/src/main/java/org/openhab/binding/ddwrt/internal/api/SshClientManager.java

@@ -57,6 +57,16 @@ public static SshClientManager getInstance() {
         return INSTANCE;
     }
 
+    /**
+     * Enable or disable strict host key checking. When enabled, unknown host keys
+     * are rejected. When disabled (default), unknown keys are accepted on first
+     * connection (TOFU) and saved to known_hosts. Changed keys are always rejected.
+     */
+    public void setStrictHostKeyChecking(boolean strict) {
+        this.strictHostKeyChecking = strict;
+        logger.debug("Strict host key checking {}", strict ? "enabled" : "disabled");
+    }
+
     /**
      * Stop the SSH client and release resources. Called from the handler factory
      * deactivate to ensure clean shutdown during OSGi bundle restarts.
@@ -72,6 +82,7 @@ public void shutdown() {
 
     private final SshClient client;
     private final String ohPrivateKeyDirString = OpenHAB.getUserDataFolder() + "/ddwrt/keys";
+    private volatile boolean strictHostKeyChecking = false;
 
     private SshClientManager() {
         File ohPrivateKeyDir = new File(ohPrivateKeyDirString);
@@ -99,6 +110,10 @@ private SshClientManager() {
         Path knownHostsPath = getHomeSshDir() != null ? Objects.requireNonNull(getHomeSshDir()).resolve("known_hosts")
                 : Paths.get(ohPrivateKeyDirString, "known_hosts");
         ServerKeyVerifier verifier = new KnownHostsServerKeyVerifier((s, a, k) -> {
+            if (strictHostKeyChecking) {
+                logger.warn("Rejecting unknown host key for {} (strict host key checking is enabled)", a);
+                return false;
+            }
             logger.debug("TOFU: auto-accepting host key for {}", a);
             return true;
         }, knownHostsPath) {

bundles/org.openhab.binding.ddwrt/src/main/resources/OH-INF/i18n/ddwrt.properties

@@ -60,6 +60,8 @@ thing-type.config.ddwrt.network.user.label = User
 thing-type.config.ddwrt.network.user.description = Default SSH username. Precedence: user@ in hostnames > this parameter > ~/.ssh/config > system username.
 thing-type.config.ddwrt.network.useSystemUser.label = Use System User
 thing-type.config.ddwrt.network.useSystemUser.description = Ignore the User field and resolve the username from ~/.ssh/config or the system username.
+thing-type.config.ddwrt.network.strictHostKeyChecking.label = Strict Host Key Checking
+thing-type.config.ddwrt.network.strictHostKeyChecking.description = When enabled, reject SSH connections to hosts not already in known_hosts. When disabled (default), unknown host keys are automatically accepted on first connection (TOFU) and saved to known_hosts. Changed keys are always rejected regardless of this setting.
 thing-type.config.ddwrt.radio.interfaceId.label = Interface ID
 thing-type.config.ddwrt.radio.interfaceId.description = Wireless interface identifier. Discovery sets this to deviceMAC:iface (e.g. aa:bb:cc:dd:ee:ff:wl0). For manual configuration, use just the interface name (e.g. wl0) together with parentDeviceMac.
 thing-type.config.ddwrt.radio.parentDeviceMac.label = Parent Device MAC

bundles/org.openhab.binding.ddwrt/src/main/resources/OH-INF/thing/thing-types.xml

@@ -72,6 +72,15 @@
 				<default>false</default>
 				<advanced>true</advanced>
 			</parameter>
+			<parameter name="strictHostKeyChecking" type="boolean">
+				<label>Strict Host Key Checking</label>
+				<description>When enabled, reject SSH connections to hosts not already in known_hosts. When disabled (default),
+					unknown host keys are automatically accepted on first connection (TOFU) and saved to known_hosts. Changed keys
+					are
+					always rejected regardless of this setting.</description>
+				<default>false</default>
+				<advanced>true</advanced>
+			</parameter>
 		</config-description>
 
 	</bridge-type>