This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new a24a1b5f3db1 CAMEL-25604, CAMEL-25605, CAMEL-25622: upgrade guide
notes for the 4.22.2 and 4.18.6 backports (#27939)
a24a1b5f3db1 is described below
commit a24a1b5f3db11d00b0a44e59acfdf03f3e7979e2
Author: Andrea Cosentino <[email protected]>
AuthorDate: Fri Oct 16 10:29:57 2026 +0200
CAMEL-25604, CAMEL-25605, CAMEL-25622: upgrade guide notes for the 4.22.2
and 4.18.6 backports (#27939)
The camel-mina, camel-mllp and camel-smpp host name verification changes are
backported to camel-4.22.x and camel-4.18.x; add their notes to the 4.22.1
to
4.22.2 and 4.18.5 to 4.18.6 sections, with the same text as in the 4.24
guide.
Signed-off-by: Andrea Cosentino <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
---
.../ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 47 ++++++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 47 ++++++++++++++++++++++
2 files changed, 94 insertions(+)
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index 22210e2210f0..a134fe1e6525 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -111,6 +111,53 @@ A `BasicMessageFilter` created in application code applies
a `SpringWebserviceHe
created with another strategy. A route that relies on the previous behaviour
can supply a custom
`headerFilterStrategy` on the `spring-ws` endpoint.
+=== camel-mina - the host name of the server is verified over SSL
+
+When `sslContextParameters` is set (on the endpoint, or with
`useGlobalSslContextParameters` on the component), the
+producer, and the consumer with `clientMode=true`, now check that the
certificate of the server matches the `host` of
+the endpoint, with the same rules as an HTTPS client. Before, any certificate
trusted by the trust store was accepted,
+whatever host the certificate was issued for.
+
+A connection to a host name or an IP address that the certificate does not
list now fails the SSL handshake; an IP
+address must be listed as a subject alternative name of the certificate. Use a
certificate that matches the host of the
+endpoint, or set the new `hostnameVerification` option to `false` to keep the
previous behaviour.
+
+MINA does not pass a failed handshake on as an error: the producer fails with
a timeout (after `writeTimeout`, or
+`timeout` while waiting for a reply), and the handshake error is logged at
`ERROR` level by
+`org.apache.mina.filter.ssl.SslHandler`. A producer that starts timing out
after the upgrade should be checked for a
+certificate that does not list the host.
+
+=== camel-mllp - the producer verifies the host name of the server over TLS
+
+When `sslContextParameters` is set (on the endpoint, or with
`useGlobalSslContextParameters` on the component), the
+MLLP producer now checks that the certificate of the server matches the host
it connects to, with the same rules as an
+HTTPS client. Before, it accepted any certificate trusted by the trust store,
whatever host the certificate was issued
+for.
+
+A producer that connects with a host name or an IP address that the
certificate does not list now fails the TLS
+handshake; an IP address must be listed as a subject alternative name of the
certificate, and a producer URI without a
+host name (such as `mllp://8888`) cannot pass the check. Use a certificate
that matches the host of the endpoint, or set
+the new `hostnameVerification` option to `false` to keep the previous
behaviour.
+
+=== camel-smpp - the host name of the SMSC is verified over SSL
+
+With `smpps` (or `usingSSL=true`), directly or through an HTTP proxy, the
connection now checks that the certificate of
+the SMSC matches the host it connects to, with the same rules as an HTTPS
client. Before, any certificate trusted by the
+JVM was accepted, whatever host it was issued for.
+
+A connection to a host name or an IP address that the certificate does not
list now fails the SSL handshake; an IP
+address must be listed as a subject alternative name of the certificate. Use a
certificate that matches the host of the
+endpoint, or set the new `hostnameVerification` option to `false` to keep the
previous behaviour.
+
+A mismatch shows as the producer or consumer failing to start, with an
`IOException` whose cause names the host that
+was checked:
+
+[source]
+----
+java.io.IOException: No subject alternative names matching IP address
127.0.0.1 found
+ Caused by: javax.net.ssl.SSLHandshakeException: No subject alternative
names matching IP address 127.0.0.1 found
+----
+
=== camel-pqc - a configured KeyGenerator is used by one exchange at a time
When Camel creates the instance itself, the KEM operations of the `pqc`
component and the PQC data format now use a
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index eaeb9b040803..b452a2932177 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -182,6 +182,53 @@ Custom implicit converters that intentionally select the
document element as the
may observe different template selection. To retain element-context semantics,
provide an explicit
`DOMSource(element)` as the body or through the endpoint's `source` expression.
+=== camel-mina - the host name of the server is verified over SSL
+
+When `sslContextParameters` is set (on the endpoint, or with
`useGlobalSslContextParameters` on the component), the
+producer, and the consumer with `clientMode=true`, now check that the
certificate of the server matches the `host` of
+the endpoint, with the same rules as an HTTPS client. Before, any certificate
trusted by the trust store was accepted,
+whatever host the certificate was issued for.
+
+A connection to a host name or an IP address that the certificate does not
list now fails the SSL handshake; an IP
+address must be listed as a subject alternative name of the certificate. Use a
certificate that matches the host of the
+endpoint, or set the new `hostnameVerification` option to `false` to keep the
previous behaviour.
+
+MINA does not pass a failed handshake on as an error: the producer fails with
a timeout (after `writeTimeout`, or
+`timeout` while waiting for a reply), and the handshake error is logged at
`ERROR` level by
+`org.apache.mina.filter.ssl.SslHandler`. A producer that starts timing out
after the upgrade should be checked for a
+certificate that does not list the host.
+
+=== camel-mllp - the producer verifies the host name of the server over TLS
+
+When `sslContextParameters` is set (on the endpoint, or with
`useGlobalSslContextParameters` on the component), the
+MLLP producer now checks that the certificate of the server matches the host
it connects to, with the same rules as an
+HTTPS client. Before, it accepted any certificate trusted by the trust store,
whatever host the certificate was issued
+for.
+
+A producer that connects with a host name or an IP address that the
certificate does not list now fails the TLS
+handshake; an IP address must be listed as a subject alternative name of the
certificate, and a producer URI without a
+host name (such as `mllp://8888`) cannot pass the check. Use a certificate
that matches the host of the endpoint, or set
+the new `hostnameVerification` option to `false` to keep the previous
behaviour.
+
+=== camel-smpp - the host name of the SMSC is verified over SSL
+
+With `smpps` (or `usingSSL=true`), directly or through an HTTP proxy, the
connection now checks that the certificate of
+the SMSC matches the host it connects to, with the same rules as an HTTPS
client. Before, any certificate trusted by the
+JVM was accepted, whatever host it was issued for.
+
+A connection to a host name or an IP address that the certificate does not
list now fails the SSL handshake; an IP
+address must be listed as a subject alternative name of the certificate. Use a
certificate that matches the host of the
+endpoint, or set the new `hostnameVerification` option to `false` to keep the
previous behaviour.
+
+A mismatch shows as the producer or consumer failing to start, with an
`IOException` whose cause names the host that
+was checked:
+
+[source]
+----
+java.io.IOException: No subject alternative names matching IP address
127.0.0.1 found
+ Caused by: javax.net.ssl.SSLHandshakeException: No subject alternative
names matching IP address 127.0.0.1 found
+----
+
=== camel-zipfile, camel-tarfile - a maxDecompressedSize of 2 GiB or more is
now enforced
The `maxDecompressedSize` option of the Zip File and Tar File data formats
(and of `ZipSplitter`) was not
