[
https://issues.apache.org/jira/browse/CAMEL-25622?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126962#comment-18126962
]
Andrea Cosentino commented on CAMEL-25622:
------------------------------------------
PR opened: https://github.com/apache/camel/pull/27803
Held overnight for the 10-PR/day cap on 2026-10-13 and opened once it reset.
Re-verified before opening: branch head still a6f39c76bb28, no conflict against
current main, and the fix is still absent from main (zero occurrences of
EndpointIdentification in SmppConnectionFactory).
Backports after merge: 4.22.x applies straight; 4.18.x applies but needs the
security/insecureValue attributes dropped.
_Claude Code on behalf of oscerd_
> camel-smpp - Add hostname verification for SSL connections
> ----------------------------------------------------------
>
> Key: CAMEL-25622
> URL: https://issues.apache.org/jira/browse/CAMEL-25622
> Project: Camel
> Issue Type: Improvement
> Components: camel-smpp
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.24.0
>
>
> With {{usingSSL=true}} (or the {{smpps}} scheme),
> {{SmppConnectionFactory.createConnection}} creates the socket from
> {{SSLSocketFactory.getDefault()}}, or, behind an HTTP proxy, layers an
> {{SSLSocket}} on the proxy tunnel, and never sets an endpoint identification
> algorithm on it, and there is no option to set one. camel-netty, camel-mllp
> (CAMEL-25604) and camel-mina (CAMEL-25605) have a {{hostnameVerification}}
> option for this.
> Proposed change:
> * In {{SmppConnectionFactory.createConnection}}, set the {{HTTPS}} endpoint
> identification algorithm on the {{SSLSocket}} before the handshake, on the
> direct path and on the proxy path.
> * Add a {{hostnameVerification}} option, enabled by default, to turn the
> check off (label {{security}}, {{security = "insecure:ssl"}}, {{insecureValue
> = "false"}}).
> * Document it, and add upgrade guide notes: a connection to a host name or an
> IP address that the certificate of the SMSC does not list now fails the
> handshake.
> * Tests for both paths, against local TLS servers (the existing
> {{SmppConnectionFactoryTest}} cases are disabled because they need a real
> SMSC).
> To be backported to 4.22.x and 4.18.x once merged on main.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
