davsclaus commented on code in PR #28186:
URL: https://github.com/apache/camel/pull/28186#discussion_r4326353059
##########
components/camel-ftp/src/main/docs/ftp-component.adoc:
##########
@@ -80,6 +80,13 @@ include::partial$component-endpoint-headers.adoc[]
== Usage
+=== FTPS host name verification
+
+The FTPS client that Camel creates checks that the certificate of the server
matches the host of the endpoint, with
Review Comment:
commons-net only checks the host name on the control connection
(`sslNegotiation()`); the data connection with `PROT P` uses the same trust
manager without a host name check. Maybe: "checks, on the control connection,
that the certificate of the server matches the host of the endpoint".
##########
components/camel-ftp/src/main/java/org/apache/camel/component/file/remote/FtpsEndpoint.java:
##########
@@ -164,6 +164,8 @@ protected FTPClient createFtpClient() throws Exception {
}
}
+
client.setEndpointCheckingEnabled(getFtpsConfiguration().isHostnameVerification());
Review Comment:
`ftpClient.endpointCheckingEnabled=false` is bound later in
`createRemoteFileOperations()`, so it still overrides this. That is fine as
described, but the security policy (`camel.main.profile=prod`) only sees
`hostnameVerification`. A line in the doc would help.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
