Abstract revoked key handling in KnownHostsServerKeyVerifier

New method handleRevokedKey() is invoked if a revoked host key is
encountered, before the key exchange is rejected. Subclasses can
override to customize reporting. The default just issues a log message.

CHANGES.md

@@ -50,6 +50,7 @@
 ## New Features
 
 * [GH-606](https://github.com/apache/mina-sshd/issues/606) Support ML-KEM PQC hybrid key exchanges
+* [GH-652](https://github.com/apache/mina-sshd/issues/652) New method `KnownHostsServerKeyVerifier.handleRevokedKey()`
 
 * [SSHD-988](https://issues.apache.org/jira/projects/SSHD/issues/SSHD-988) Support ed25519 keys via the Bouncy Castle library
 

sshd-core/src/main/java/org/apache/sshd/client/keyverifier/KnownHostsServerKeyVerifier.java

@@ -285,8 +285,7 @@ protected boolean acceptKnownHostEntries(
 
         if (keyMatches.stream()
                 .anyMatch(k -> "revoked".equals(k.getHostEntry().getMarker()))) {
-            log.debug("acceptKnownHostEntry({})[{}] key={}-{} marked as revoked",
-                    clientSession, remoteAddress, KeyUtils.getKeyType(serverKey), KeyUtils.getFingerPrint(serverKey));
+            handleRevokedKey(clientSession, remoteAddress, serverKey);
             return false;
         }
 
@@ -536,6 +535,18 @@ protected List<HostEntryPair> findKnownHostEntries(
         return matches;
     }
 
+    /**
+     * Invoked if any matching host entry has a 'revoked' marker
+     *
+     * @param clientSession The {@link ClientSession}
+     * @param remoteAddress The remote host address
+     * @param serverKey     The presented server {@link PublicKey}
+     */
+    protected void handleRevokedKey(ClientSession clientSession, SocketAddress remoteAddress, PublicKey serverKey) {
+        log.debug("acceptKnownHostEntry({})[{}] key={}-{} marked as revoked",
+                clientSession, remoteAddress, KeyUtils.getKeyType(serverKey), KeyUtils.getFingerPrint(serverKey));
+    }
+
     /**
      * Called if failed to reload known hosts - by default invokes
      * {@link #acceptUnknownHostKey(ClientSession, SocketAddress, PublicKey)}