Croway opened a new pull request, #28186: URL: https://github.com/apache/camel/pull/28186
## Description [CAMEL-25890](https://issues.apache.org/jira/browse/CAMEL-25890) The `ftps` endpoint builds an Apache Commons Net `FTPSClient` in `FtpsEndpoint.createFtpClient()`. Neither the `sslContextParameters` branch nor the default branch (optional `ftpClient.trustStore.*` / `ftpClient.keyStore.*`) turned on the client's server host name check, so the TLS handshake succeeded with any certificate accepted by the trust manager, whatever host names it lists. There was no endpoint option for it. This adds a `hostnameVerification` endpoint option (label `security`, default `true`), with the same name and meaning as in camel-mina, camel-mllp and camel-smpp: - `FtpsConfiguration`: new `hostnameVerification` option. - `FtpsEndpoint.createFtpClient()`: calls `setEndpointCheckingEnabled(...)` on the client it creates, on both branches. A custom `ftpClient` set on the endpoint is not changed, and `ftpClient.endpointCheckingEnabled` still applies on top through the existing property binding. - `ftp-component.adoc`: documents the check and the option. - Upgrade guide 4.24: behaviour change note; set `hostnameVerification=false` to keep the previous behaviour. - Regenerated configurer, URI factory, component JSON, catalog and endpoint DSL. - Test keystores: the `ftpserver` key in `server.jks` (camel-ftp and camel-test-infra-ftp) had no subject alternative name. It is regenerated (RSA 2048, SAN `dns:localhost`) so the FTPS tests keep connecting to `localhost`; `client.jks` trusts the new certificate. ## Tests - `FtpsEndpointHostnameVerificationTest` (unit, no network): the created client has the check enabled by default, with and without `sslContextParameters`; `hostnameVerification=false` turns it off; a custom `ftpClient` is left as is. - `FileToFtpsHostnameVerificationIT` (embedded FTPS server): an upload to `localhost` succeeds; an upload to `127.0.0.1`, which the certificate does not list, fails the TLS handshake; with `hostnameVerification=false` it succeeds. - The existing camel-ftp tests and FTPS integration tests pass with the regenerated keystores. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
