Andrea Cosentino created CAMEL-25605:
----------------------------------------
Summary: camel-mina - Add hostname verification for TLS producer
connections
Key: CAMEL-25605
URL: https://issues.apache.org/jira/browse/CAMEL-25605
Project: Camel
Issue Type: Improvement
Components: camel-mina
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.24.0
camel-netty has a {{hostnameVerification}} option that sets the {{HTTPS}}
endpoint identification algorithm on its client {{SSLEngine}}. camel-mina has
no equivalent: {{MinaProducer}} adds an {{SslFilter}} built from the
{{SSLContext}} of {{sslContextParameters}} and never sets an endpoint
identification algorithm on it (MINA 2.2 offers
{{SslFilter.setEndpointIdentificationAlgorithm}}), and there is no option to
set one.
Proposed change:
* In {{MinaProducer}}, call {{setEndpointIdentificationAlgorithm("HTTPS")}} on
the client {{SslFilter}} unless the check is turned off.
* Add a {{hostnameVerification}} option, enabled by default, to turn the check
off (label {{security}}, {{security = "insecure:ssl"}}, {{insecureValue =
"false"}}, as in camel-netty). It applies to the producer only.
* Document it in {{mina-component.adoc}}, and add upgrade guide notes: a
producer that connects by IP address, or to a server whose certificate does not
list the configured host name, needs a matching certificate or
{{hostnameVerification=false}}.
* Tests: the handshake fails by default when the server certificate does not
match the configured host, and succeeds with the option off or with a matching
certificate.
Same change as CAMEL-25604 for camel-mllp. To be backported to 4.22.x and
4.18.x once merged on main.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
