[
https://issues.apache.org/jira/browse/CAMEL-25890?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen resolved CAMEL-25890.
---------------------------------
Resolution: Fixed
Fixed by https://github.com/apache/camel/pull/28186 on main (4.24.0). The
4.18.x and 4.22.x lines get a documentation note on how to enable the check
with ftpClient.endpointCheckingEnabled=true:
https://github.com/apache/camel/pull/28189 (4.18.6) and
https://github.com/apache/camel/pull/28188 (4.22.3).
_Claude Code on behalf of Claus Ibsen_
> camel-ftp - FTPS: verify the host name of the server over TLS
> -------------------------------------------------------------
>
> Key: CAMEL-25890
> URL: https://issues.apache.org/jira/browse/CAMEL-25890
> Project: Camel
> Issue Type: Improvement
> Components: camel-ftp
> Reporter: Federico Mariani
> Assignee: Federico Mariani
> Priority: Major
> Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> The FTPS endpoint builds an Apache Commons Net FTPSClient in
> FtpsEndpoint.createFtpClient(). Neither the branch that uses
> sslContextParameters nor the default branch (optional ftpClient.trustStore.*
> / ftpClient.keyStore.* settings) enables the client's server host name check,
> so a TLS handshake succeeds as long as the certificate is accepted by the
> trust manager, whatever host names it lists. There is no endpoint option for
> it; today it can only be enabled with ftpClient.endpointCheckingEnabled=true.
> *Current behaviour*
> - The FTPSClient created by the endpoint has endpoint checking disabled, so
> the server certificate is not matched against the host the endpoint connects
> to.
> *Behaviour after the change (main / 4.24.0)*
> - New endpoint option hostnameVerification (label "security", default true),
> with the same name and semantics as in camel-mina and camel-mllp.
> - When true, the FTPSClient created by the endpoint calls
> setEndpointCheckingEnabled(true), on both the sslContextParameters branch and
> the default branch. The TLS handshake of the control connection fails, before
> login, if the server certificate does not match the configured host.
> - hostnameVerification=false restores the previous behaviour.
> - A custom ftpClient supplied by the user is left untouched;
> ftpClient.endpointCheckingEnabled still applies on top through the existing
> property binding.
> *Code changes*
> - FtpsConfiguration: add the hostnameVerification @UriParam with javadoc.
> - FtpsEndpoint.createFtpClient(): call
> client.setEndpointCheckingEnabled(getFtpsConfiguration().isHostnameVerification())
> before returning the client.
> - ftp-component.adoc: document the option next to the FTPS default trust
> store section.
> - Regenerate the configurer, URI factory, component JSON, catalog and
> endpoint DSL.
> - Test certificates: the server.jks keystores in camel-ftp and
> camel-test-infra-ftp (CN=FtpServer) have no subject alternative names;
> regenerate them with SAN dns:localhost,ip:127.0.0.1 so the existing FTPS
> tests keep connecting to localhost.
> *Tests*
> - Unit test on createFtpClient(): host name check enabled by default, enabled
> with sslContextParameters, disabled with hostnameVerification=false, custom
> ftpClient not changed.
> - Integration test against the embedded FTPS test server: a host name the
> certificate does not list fails the handshake, localhost succeeds.
> *Upgrade guide (main)*
> - 4.24: behaviour change. FTPS connections fail when the server certificate
> does not match the configured host (for example when connecting by IP address
> to a certificate without an IP subject alternative name). Set
> hostnameVerification=false to keep the old behaviour.
> *camel-4.22.x and camel-4.18.x (documentation only)*
> - These lines keep the current behaviour; no code change.
> - Add a short section to ftp-component.adoc on each branch, next to the FTPS
> default trust store section, explaining that the host name of the FTPS server
> is not checked by default and how to enable the check with
> ftpClient.endpointCheckingEnabled=true (together with trust material via
> sslContextParameters or ftpClient.trustStore.*).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
