Croway commented on code in PR #28186:
URL: https://github.com/apache/camel/pull/28186#discussion_r4334588434
##########
docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc:
##########
@@ -1405,6 +1405,17 @@ MINA does not pass a failed handshake on as an error:
the producer fails with a
`org.apache.mina.filter.ssl.SslHandler`. A producer that starts timing out
after the upgrade should be checked for a
certificate that does not list the host.
+=== camel-ftp - the host name of the FTPS server is verified
+
+The `ftps` endpoint now checks that the certificate of the server matches the
host of the endpoint, with the same
+rules as an HTTPS client, with `sslContextParameters` as well as with the
`ftpClient.trustStore.*` options. Before, any certificate accepted by the trust
manager was accepted, whatever host the
Review Comment:
Rewrapped in 37b2134.
##########
components/camel-ftp/src/main/docs/ftp-component.adoc:
##########
@@ -80,6 +80,13 @@ include::partial$component-endpoint-headers.adoc[]
== Usage
+=== FTPS host name verification
+
+The FTPS client that Camel creates checks that the certificate of the server
matches the host of the endpoint, with
Review Comment:
Done in 37b2134: the component doc and the upgrade guide now say the host
name is checked on the control connection, before login, and that data
connections (`PROT P`) are not checked by host name.
##########
components/camel-ftp/src/main/java/org/apache/camel/component/file/remote/FtpsEndpoint.java:
##########
@@ -164,6 +164,8 @@ protected FTPClient createFtpClient() throws Exception {
}
}
+
client.setEndpointCheckingEnabled(getFtpsConfiguration().isHostnameVerification());
Review Comment:
Added a paragraph to the component doc in 37b2134: use
`hostnameVerification` to control the check;
`ftpClient.endpointCheckingEnabled` takes precedence over it and is not seen by
the security policy.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
