oscerd opened a new pull request, #27770: URL: https://github.com/apache/camel/pull/27770
## Description The TLS clients of camel-mllp and camel-mina validated the certificate chain of the server, but never checked that the certificate was issued for the host they connect to, and had no option to turn that check on. This adds host name verification to both, enabled by default, with a `hostnameVerification` option to turn it off. The option has the same name and the same security marker as the existing one in camel-netty. - [CAMEL-25604](https://issues.apache.org/jira/browse/CAMEL-25604) - camel-mllp: `MllpTcpClientProducer` sets the `HTTPS` endpoint identification algorithm on the client `SSLSocket` before it is used. - [CAMEL-25605](https://issues.apache.org/jira/browse/CAMEL-25605) - camel-mina: the producer, and the consumer with `clientMode=true`, use a new `MinaClientSslFilter` that sets the endpoint identification algorithm on MINA's `SslFilter`. Both changes are in one PR because they add the same option and regenerate the same line of the security option registry (`SecurityUtils`, `owners.put("hostnameverification", ...)`). Two PRs would conflict on that line. ### camel-mllp - The socket's `SSLParameters` are read, the algorithm is set, and they are written back. This keeps the protocols, cipher suites and SNI names configured through `SSLContextParameters`. The server names stay unset, so SNI is still sent for the configured host. - `hostnameVerification` is a producer option: `label = "producer,security"`, default `true`, `security = "insecure:ssl"`, `insecureValue = "false"`. It is copied from the component configuration and exposed on `MllpEndpoint` like the other options. - The component page had no TLS section; this adds one. ### camel-mina - `SslFilter` is only added for TCP, so the vm and udp protocols are unchanged. - MINA's `SslFilter.createEngine` takes the peer host from `InetSocketAddress.getHostName()`, which looks up a host name for an IP address. `MinaClientSslFilter` passes the host as written instead. A connection to an IP address is then checked against the IP addresses in the certificate, as the JDK does for a plain `SSLSocket`, and not against whatever name a reverse lookup returns. - `hostnameVerification` is labelled `security`, because it applies to the producer and to the consumer in client mode. ### Upgrade guide (4.24) There is one note per component. Connecting by an IP address, or with a name the certificate does not list, now fails the handshake. Set `hostnameVerification=false` to keep the previous behaviour. ## Tests - camel-mllp: `keystore.jks` is regenerated with the same alias, password and subject DN, plus a `DNS:localhost` subject alternative name; the old certificate had none. All the existing TLS tests now run with host name verification enabled. - camel-mllp: new `MllpTcpClientProducerHostnameVerificationTest`. `localhost` connects. `127.0.0.1` fails because the certificate is rejected. `127.0.0.1` with `hostnameVerification=false` connects. The mismatch test fails on the current code, because nothing is thrown. - camel-mina: new `MinaSslContextParametersHostnameVerificationTest` with the same three cases; its mismatch test fails on the current code. - camel-mina: new `MinaClientSslFilterTest`. It checks that the algorithm is set and that the peer host is the IP address as written. That test fails without the override, because MINA's lookup returns `localhost`. - MINA 2.2 keeps a handshake error in its `SslHandler` instead of passing it to the session, so the producer only fails when the write times out. The mismatch test therefore uses short `writeTimeout` and `timeout` values. | Module | Tests | |---|---| | camel-mllp | 360 (3 skipped) | | camel-mina | 112 (4 skipped) | Full reactor `mvn clean install -DskipTests -DskipITs`: green; the regenerated files are included. ## Backports These changes will be backported to camel-4.22.x and camel-4.18.x after the merge. - camel-4.22.x: the source and test changes apply cleanly, so it is a straight cherry-pick. - camel-4.18.x: not a straight cherry-pick. That branch's `@UriParam` has no `security` or `insecureValue` attributes, its tests use the junit5 `CamelTestSupport`, and `mllp-component.adoc` differs, so the backport needs adapting and a review. ## Not in this PR `MinaHelper.writeBody` fails only on a write timeout, not on a write future that completed with an error. With `sync=false`, a failed write can therefore look successful. This is a separate issue. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
