davsclaus commented on code in PR #27803:
URL: https://github.com/apache/camel/pull/27803#discussion_r4268655374
##########
components/camel-smpp/src/main/docs/smpp-component.adoc:
##########
@@ -166,8 +166,18 @@ If no *username* is provided, then Camel will provide the
default value
`smppclient`. +
If no *port* number is provided, then Camel will provide the default
value `2775`. +
-If the protocol name is "smpps", camel-smpp with try to
-use SSLSocket to init a connection to the server.
+If the protocol name is "smpps", camel-smpp will try to
+use SSLSocket to init a connection to the server. The certificate of the
+server must be trusted by the JVM, and it must match the host Camel connects
+to, with the same rules as an HTTPS client: a connection to an IP address
+needs a certificate that lists that address as a subject alternative name.
+Set `hostnameVerification=false` to turn the host check off.
+
+The handshake runs while the connection is being created, so a certificate
that does not match makes the producer or
+consumer fail to start with an `IOException` caused by an
+`SSLHandshakeException: No subject alternative names matching IP address ...
found` (or
+`No name matching ... found` for a host name). An IP address has to be listed
as a subject alternative name of the
Review Comment:
`No name matching ... found` is only reported when the certificate has no
DNS subject alternative names (the JDK then falls back to the CN). With DNS
subject alternative names, which most certificates have,
`HostnameChecker.matchDNS` says `No subject alternative DNS name matching
<host> found.` Maybe:
`SSLHandshakeException: No subject alternative names matching IP address ...
found` (or `No subject alternative DNS name matching ... found.` for a host
name)
##########
components/camel-smpp/src/main/java/org/apache/camel/component/smpp/SmppConnectionFactory.java:
##########
@@ -102,13 +112,14 @@ public Connection createConnection(String host, int port)
throws IOException {
socket.connect(new InetSocketAddress(host, port),
config.getEnquireLinkTimer());
}
- if (config.isUsingSSL() && config.getHttpProxyHost() != null) {
- // Init the SSL socket which is based on the proxy socket
- SSLSocketFactory sslSocketFactory = (SSLSocketFactory)
SSLSocketFactory.getDefault();
- // NOTE: the socket must be closed by the factory method
client.
- SSLSocket sslSocket = (SSLSocket)
sslSocketFactory.createSocket(socket, host, port, true); // NOSONAR
- sslSocket.startHandshake();
- socket = sslSocket;
+ if (config.isUsingSSL()) {
+ if (config.getHttpProxyHost() != null) {
+ // Init the SSL socket which is based on the proxy socket
+ // NOTE: the socket must be closed by the factory method
client.
+ socket = getSslSocketFactory().createSocket(socket, host,
port, true); // NOSONAR
+ configureHostnameVerification(socket);
+ }
+ startHandshake((SSLSocket) socket);
Review Comment:
If the handshake times out, the `SocketTimeoutException` goes to the catch
block below and the socket stays open. The JDK does not close an `SSLSocket` on
a timeout during `startHandshake`, and jSMPP never gets a `Connection` it could
close. Declaring the socket before the `try` and closing it in the catch covers
this, and the older connect and CONNECT-request failures too:
```java
Socket socket = null;
try {
...
} catch (Exception e) {
IOHelper.close(socket);
throw new IOException(e.getMessage(), e);
}
```
On the proxy path `socket` is the layered `SSLSocket` by then, created with
`autoClose=true`, so closing it also closes the tunnel socket.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
