Andrea Cosentino created CAMEL-25622:
----------------------------------------
Summary: camel-smpp - Add hostname verification for SSL connections
Key: CAMEL-25622
URL: https://issues.apache.org/jira/browse/CAMEL-25622
Project: Camel
Issue Type: Improvement
Components: camel-smpp
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.24.0
With {{usingSSL=true}} (or the {{smpps}} scheme),
{{SmppConnectionFactory.createConnection}} creates the socket from
{{SSLSocketFactory.getDefault()}}, or, behind an HTTP proxy, layers an
{{SSLSocket}} on the proxy tunnel, and never sets an endpoint identification
algorithm on it, and there is no option to set one. camel-netty, camel-mllp
(CAMEL-25604) and camel-mina (CAMEL-25605) have a {{hostnameVerification}}
option for this.
Proposed change:
* In {{SmppConnectionFactory.createConnection}}, set the {{HTTPS}} endpoint
identification algorithm on the {{SSLSocket}} before the handshake, on the
direct path and on the proxy path.
* Add a {{hostnameVerification}} option, enabled by default, to turn the check
off (label {{security}}, {{security = "insecure:ssl"}}, {{insecureValue =
"false"}}).
* Document it, and add upgrade guide notes: a connection to a host name or an
IP address that the certificate of the SMSC does not list now fails the
handshake.
* Tests for both paths, against local TLS servers (the existing
{{SmppConnectionFactoryTest}} cases are disabled because they need a real SMSC).
To be backported to 4.22.x and 4.18.x once merged on main.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
