oscerd opened a new pull request, #26164:
URL: https://github.com/apache/camel/pull/26164
Implements TLS delivery of asynchronous MDNs for `camel-as2` — the follow-up
to CAMEL-24417, which refused
`https` outright because `AS2AsynchronousMDNManager` delivered over a plain
`Socket` with no TLS.
## Change
- `AS2AsynchronousMDNManager` now accepts an `SSLContext` (a new
**additive** constructor overload). When the
sender's `Receipt-Delivery-Option` address uses `https`, the MDN is
delivered over an `SSLSocket` built from
that context — port defaulting to 443 — with hostname verification
(`setEndpointIdentificationAlgorithm("HTTPS")`)
and an explicit `startHandshake()` **before** the MDN and any credentials
are written.
- The endpoint's existing `sslContextParameters` (already resolved into the
`SSLContext` passed to
`AS2ServerConnection` for the inbound listener) is now also threaded to
the manager for the outbound delivery,
the same way `asyncMdnAllowedHosts` is.
- `https` stays **fail-closed** when no `sslContextParameters` is configured
— preserving the CAMEL-24417
behaviour for a deployment that has not opted in. Any scheme other than
`http`/`https` is rejected.
- The 4.23 upgrade-guide note is updated (https is now supported with
`sslContextParameters`).
## Tests
`AS2AsynchronousMDNManagerDeliveryAddressTest` now covers: a non-http/https
scheme is refused; `https` is refused
without an `SSLContext` (fail-closed); `https` is accepted with an
`SSLContext` (it gets past the scheme checks
and fails on the connection instead).
## Backport
Main-only (4.23.0): this adds a new capability rather than a bug/security
fix, so it is not backported —
maintenance branches keep the fail-closed `https`-refusal introduced by
CAMEL-24417.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01FfZZdsmEJLJoPFy588YZ2g
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
