gnodet commented on code in PR #26164:
URL: https://github.com/apache/camel/pull/26164#discussion_r3949945103
##########
components/camel-as2/camel-as2-api/src/main/java/org/apache/camel/component/as2/api/AS2AsynchronousMDNManager.java:
##########
@@ -223,6 +248,20 @@ public HttpCoreContext send(
}
}
+ private Socket createSocket(boolean https, String host, int port) throws
IOException {
+ if (!https) {
+ return new Socket(host, port);
+ }
+ SSLSocket sslSocket = (SSLSocket)
sslContext.getSocketFactory().createSocket(host, port);
+ // verify the delivery host against the certificate the peer presents
during the handshake
+ SSLParameters sslParameters = sslSocket.getSSLParameters();
+ sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
+ sslSocket.setSSLParameters(sslParameters);
+ // handshake now so a certificate or hostname mismatch fails before
the MDN and any credentials are written
+ sslSocket.startHandshake();
+ return sslSocket;
+ }
Review Comment:
⚠️ **Resource leak on handshake failure.** If `startHandshake()` throws
(certificate mismatch, unreachable host, expired cert), the `SSLSocket` is
already connected at TCP level but never closed — the reference is stuck inside
this method and the caller's try-with-resources for `httpConnection` never
begins. In production with misconfigured partners, this leaks a TCP connection
+ SSL session per failed MDN delivery attempt.
```suggestion
private Socket createSocket(boolean https, String host, int port) throws
IOException {
if (!https) {
return new Socket(host, port);
}
SSLSocket sslSocket = (SSLSocket)
sslContext.getSocketFactory().createSocket(host, port);
try {
// verify the delivery host against the certificate the peer
presents during the handshake
SSLParameters sslParameters = sslSocket.getSSLParameters();
sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
sslSocket.setSSLParameters(sslParameters);
// handshake now so a certificate or hostname mismatch fails
before the MDN and any credentials are written
sslSocket.startHandshake();
} catch (IOException e) {
sslSocket.close();
throw e;
}
return sslSocket;
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
