oscerd commented on code in PR #27770:
URL: https://github.com/apache/camel/pull/27770#discussion_r4258432830
##########
components/camel-mllp/src/main/java/org/apache/camel/component/mllp/MllpEndpoint.java:
##########
@@ -333,6 +333,10 @@ public void setSslContextParameters(SSLContextParameters
sslContextParameters) {
public SSLContextParameters getSslContextParameters() {
return configuration.getSslContextParameters();
}
+
+ public void setHostnameVerification(boolean hostnameVerification) {
+ configuration.setHostnameVerification(hostnameVerification);
+ }
// Utility methods for producers and consumers
Review Comment:
Added in 552876ef7c08: `isHostnameVerification()` now sits next to the
setter on `MllpEndpoint`, delegating to `MllpConfiguration` like the other
options.
_Claude Code on behalf of oscerd_
##########
components/camel-mina/src/test/java/org/apache/camel/component/mina/MinaSslContextParametersHostnameVerificationTest.java:
##########
@@ -0,0 +1,84 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mina;
+
+import org.apache.camel.CamelExecutionException;
+import org.apache.camel.builder.RouteBuilder;
+import org.apache.camel.component.mock.MockEndpoint;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+/**
+ * The producer checks that the certificate of the server matches the host it
connects to.
+ * <p>
+ * The certificate in jsse/localhost.p12 lists only DNS:localhost as subject
alternative name, so it matches "localhost"
+ * but not "127.0.0.1".
+ */
+class MinaSslContextParametersHostnameVerificationTest extends BaseMinaTest {
+
+ @Test
+ void sendsWhenTheCertificateMatchesTheHost() {
+ Object reply = template.requestBody(producerUri("localhost", ""),
"Hello");
+
+ assertEquals("Bye Hello", reply);
+ }
+
+ @Test
+ void failsWhenTheCertificateDoesNotMatchTheHost() throws Exception {
+ MockEndpoint result = getMockEndpoint("mock:result");
+ result.expectedMessageCount(0);
+
+ // MINA keeps the handshake error in its SslHandler, so the producer
fails when the write does not complete:
+ // short timeouts keep the test fast
+ assertThrows(CamelExecutionException.class,
Review Comment:
Tightened in 552876ef7c08, in two parts:
- The producer test now asserts that the failure is the write that never
completed (`CamelExchangeException` "Cannot write body"), and that
`mock:result` got nothing. A refused connection fails differently, and a codec
error is reported through the response handler instead. Together with the third
case (the same `127.0.0.1` connects once `hostnameVerification=false`), the
only thing that changes is the host check.
- The `SSLHandshakeException` itself is not reachable from the producer:
MINA keeps it in its `SslHandler` and has no accessor for it. So
`MinaClientSslFilterTest` now runs an in-memory TLS handshake between an engine
created by `MinaClientSslFilter` and a server engine with the same
`localhost.p12` certificate. For `127.0.0.1` it fails with
`SSLHandshakeException` "No subject alternative names matching IP address
127.0.0.1 found". It completes for `localhost`, and for `127.0.0.1` with the
check disabled.
camel-mina: 115 tests, 4 skipped as before.
_Claude Code on behalf of oscerd_
##########
docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc:
##########
@@ -234,6 +246,17 @@ In both cases the objects are no longer kept in the
`inProgressRepository`; befo
the same key) was skipped by all later polls until the endpoint was restarted.
With the `fileName` option, a failed
get still fails the poll.
+=== camel-mina - the host name of the server is verified over SSL
+
+When `sslContextParameters` is set (on the endpoint, or with
`useGlobalSslContextParameters` on the component), the
+producer, and the consumer with `clientMode=true`, now check that the
certificate of the server matches the `host` of
+the endpoint, with the same rules as an HTTPS client. Before, any certificate
trusted by the trust store was accepted,
+whatever host the certificate was issued for.
+
+A connection to a host name or an IP address that the certificate does not
list now fails the SSL handshake; an IP
Review Comment:
Added in 552876ef7c08, to this entry and to the mina page (_Using SSL/TLS_).
A mismatch shows as a producer timeout, after `writeTimeout`, or after
`timeout` while waiting for a reply. The handshake error is logged at `ERROR`
by `org.apache.mina.filter.ssl.SslHandler` ("No subject alternative names
matching ..."), so the entry points users at that log and at the certificate's
subject alternative names.
_Claude Code on behalf of oscerd_
##########
docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc:
##########
@@ -202,6 +202,18 @@ poll returns only the tweets newer than the last one
consumed, and a page has `c
default of 15 applied before). Raise `count` and `numberOfPages` if a search
can match more tweets than that between
two polls. A consumer with `type=direct` returned nothing when keywords were
given, and now runs the search at startup.
+=== camel-mllp - the producer verifies the host name of the server over TLS
+
+When `sslContextParameters` is set (on the endpoint, or with
`useGlobalSslContextParameters` on the component), the
+MLLP producer now checks that the certificate of the server matches the host
it connects to, with the same rules as an
+HTTPS client. Before, it accepted any certificate trusted by the trust store,
whatever host the certificate was issued
+for.
+
+A producer that connects with a host name or an IP address that the
certificate does not list now fails the TLS
Review Comment:
Added in 552876ef7c08, to this entry and to the mllp page (_Using TLS_): a
producer URI without a host name (such as `mllp://8888`) cannot pass the check.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
