Federico Mariani created CAMEL-25890:
----------------------------------------
Summary: camel-ftp - FTPS: verify the host name of the server over
TLS
Key: CAMEL-25890
URL: https://issues.apache.org/jira/browse/CAMEL-25890
Project: Camel
Issue Type: Improvement
Components: camel-ftp
Reporter: Federico Mariani
Assignee: Federico Mariani
Fix For: 4.24.0
The FTPS endpoint builds an Apache Commons Net FTPSClient in
FtpsEndpoint.createFtpClient(). Neither the branch that uses
sslContextParameters nor the default branch (optional ftpClient.trustStore.* /
ftpClient.keyStore.* settings) enables the client's server host name check, so
a TLS handshake succeeds as long as the certificate is accepted by the trust
manager, whatever host names it lists. There is no endpoint option for it;
today it can only be enabled with ftpClient.endpointCheckingEnabled=true.
*Current behaviour*
- The FTPSClient created by the endpoint has endpoint checking disabled, so the
server certificate is not matched against the host the endpoint connects to.
*Behaviour after the change (main / 4.24.0)*
- New endpoint option hostnameVerification (label "security", default true),
with the same name and semantics as in camel-mina and camel-mllp.
- When true, the FTPSClient created by the endpoint calls
setEndpointCheckingEnabled(true), on both the sslContextParameters branch and
the default branch. The TLS handshake of the control connection fails, before
login, if the server certificate does not match the configured host.
- hostnameVerification=false restores the previous behaviour.
- A custom ftpClient supplied by the user is left untouched;
ftpClient.endpointCheckingEnabled still applies on top through the existing
property binding.
*Code changes*
- FtpsConfiguration: add the hostnameVerification @UriParam with javadoc.
- FtpsEndpoint.createFtpClient(): call
client.setEndpointCheckingEnabled(getFtpsConfiguration().isHostnameVerification())
before returning the client.
- ftp-component.adoc: document the option next to the FTPS default trust store
section.
- Regenerate the configurer, URI factory, component JSON, catalog and endpoint
DSL.
- Test certificates: the server.jks keystores in camel-ftp and
camel-test-infra-ftp (CN=FtpServer) have no subject alternative names;
regenerate them with SAN dns:localhost,ip:127.0.0.1 so the existing FTPS tests
keep connecting to localhost.
*Tests*
- Unit test on createFtpClient(): host name check enabled by default, enabled
with sslContextParameters, disabled with hostnameVerification=false, custom
ftpClient not changed.
- Integration test against the embedded FTPS test server: a host name the
certificate does not list fails the handshake, localhost succeeds.
*Upgrade guide (main)*
- 4.24: behaviour change. FTPS connections fail when the server certificate
does not match the configured host (for example when connecting by IP address
to a certificate without an IP subject alternative name). Set
hostnameVerification=false to keep the old behaviour.
*camel-4.22.x and camel-4.18.x (documentation only)*
- These lines keep the current behaviour; no code change.
- Add a short section to ftp-component.adoc on each branch, next to the FTPS
default trust store section, explaining that the host name of the FTPS server
is not checked by default and how to enable the check with
ftpClient.endpointCheckingEnabled=true (together with trust material via
sslContextParameters or ftpClient.trustStore.*).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
