oscerd opened a new pull request, #27803: URL: https://github.com/apache/camel/pull/27803
## Description [CAMEL-25622](https://issues.apache.org/jira/browse/CAMEL-25622): with `usingSSL=true` (or the `smpps` scheme), `SmppConnectionFactory` created the `SSLSocket` from `SSLSocketFactory.getDefault()`, or behind an HTTP proxy layered an `SSLSocket` on the tunnel, without an endpoint identification algorithm. It therefore accepted any certificate trusted by the JVM, whatever host the certificate was issued for, and there was no option to turn the check on. This change sets the `HTTPS` endpoint identification algorithm on the `SSLSocket` before the handshake, on both paths. It adds a `hostnameVerification` option to turn the check off: default `true`, `security = "insecure:ssl"`, `insecureValue = "false"`. This is the same option as in camel-netty, and as in camel-mllp and camel-mina (#27770). - Direct connection: the socket is created unconnected and then connected to the configured host, so the check uses the endpoint's host. The `SSLParameters` are read, changed and written back, so SNI is kept. - Through an HTTP proxy: the `SSLSocket` is layered on the tunnel with the SMSC host, so the check uses that host, not the proxy's. - `SmppConnectionFactory` gets a package-private constructor that takes the `SSLSocketFactory`, for the tests. `getInstance` still uses the JVM default, created lazily as before. Docs: the URI format section now says that the certificate must match the host. Upgrade guide (4.24): a connection to a host name or an IP address that the certificate does not list now fails the handshake. Setting `hostnameVerification=false` keeps the previous behaviour. ## Tests - New `SmppConnectionFactoryHostnameVerificationTest`, run against local TLS servers. The existing `SmppConnectionFactoryTest` cases are disabled because they need a real SMSC. - The same three cases run both for the direct path and through a fake HTTP proxy: - `localhost` connects. - `127.0.0.1` fails with `SSLHandshakeException` "No subject alternative names matching IP address 127.0.0.1 found". - `127.0.0.1` with `hostnameVerification=false` connects. - With the check disabled in the code, both mismatch tests fail because nothing is thrown. - `SmppConfigurationTest` now covers the new option in its default, set, clone and `toString` checks. | Module | Tests | |---|---| | camel-smpp | 153 (4 skipped); ITs: 22 (18 manual, skipped) | Full reactor `mvn clean install -DskipTests -DskipITs`: green; the regenerated files are included. ## Backports To be backported to camel-4.22.x and camel-4.18.x after the merge. - camel-4.22.x: the source and test changes apply cleanly, so it is a straight cherry-pick. - camel-4.18.x: the changes apply, but that branch's `@UriParam` has no `security` or `insecureValue` attributes. The marker has to be removed there, so it is not a straight cherry-pick. This PR and #27770 both add owners to the `hostnameverification` entry of `SecurityUtils`. The two changes merge cleanly with each other, and with main. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
