davsclaus commented on code in PR #27820:
URL: https://github.com/apache/camel/pull/27820#discussion_r4269545509
##########
components/camel-netty/src/main/docs/netty-component.adoc:
##########
@@ -674,6 +674,21 @@ YAML::
----
====
+=== Verifying the host name of the server
+
+A producer, and a consumer with `clientMode=true`, connects as a TLS client
when `ssl=true`. By default it accepts any
+certificate the JVM trusts, whatever host that certificate was issued for. Set
`hostnameVerification=true` to also
+check that the certificate matches the host the endpoint connects to, with the
same rules as an HTTPS client: a
+connection to an IP address needs a certificate that lists that address as a
subject alternative name of its own.
+
+A certificate that does not match makes the producer or consumer fail with an
+`SSLHandshakeException: No subject alternative names matching IP address ...
found` (or
+`No subject alternative DNS name matching ... found` for a host name).
Enabling the option also makes the JDK send the
+host as an SNI server name.
+
+The option applies to the client side. On a consumer that acts as a server it
does not verify the host of a client
Review Comment:
Today this is not what happens. On a server consumer,
`configureServerSSLOnDemand()` still sets
`endpointIdentificationAlgorithm=HTTPS` when the option is on. The JDK then
checks the client certificate against `getPeerHost()`, which is `null` on a
server engine, so every handshake where the client presents a certificate fails
with `Hostname or IP address is undefined`.
If you set the algorithm only when `isClientMode()` (my preference, see the
review body), this sentence is right as it is. If not, it should say that the
option must not be enabled on a consumer that acts as a server and asks for
client certificates.
##########
components/camel-netty/src/main/java/org/apache/camel/component/netty/DefaultServerInitializerFactory.java:
##########
@@ -130,6 +130,26 @@ private SSLContext createSSLContext(CamelContext
camelContext, NettyServerBootst
return answer;
}
+ /**
+ * Creates the engine, carrying the host and port when this consumer
connects as a client with host name
+ * verification enabled.
+ * <p/>
+ * The JDK reads the name to match from {@code SSLSession.getPeerHost()},
which the no-arg factory method leaves
+ * {@code null} - and then {@code HostnameChecker.match} throws
+ * {@code CertificateException: Hostname or IP address is undefined}
rather than checking anything. See
+ * {@code DefaultClientInitializerFactory} for the producer side.
+ * <p/>
+ * In server mode the peer is deliberately not attached: there the
algorithm would ask the JDK to match the client's
+ * certificate against a host name the server does not have, which is not
what the option means.
+ */
+ private SSLEngine createServerSSLEngine() {
+ NettyConfiguration configuration = consumer.getConfiguration();
+ if (configuration.isClientMode() &&
configuration.isHostnameVerification()) {
Review Comment:
This leaves the peer off in server mode, which is right. The
`setEndpointIdentificationAlgorithm("HTTPS")` block a few lines below still
runs in server mode, though. I would guard it with `isClientMode()` as well, so
server mode never sets the algorithm. In server mode it can only fail a
handshake with a client certificate. It never verifies anything.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
