[jira] [Resolved] (CAMEL-25890) camel-ftp - FTPS: verify the host name of the server over TLS

["Claus Ibsen (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-25890?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Claus Ibsen resolved CAMEL-25890.
---------------------------------
    Resolution: Fixed

Fixed by https://github.com/apache/camel/pull/28186 on main (4.24.0). The 4.18.x and 4.22.x lines get a documentation note on how to enable the check with ftpClient.endpointCheckingEnabled=true: https://github.com/apache/camel/pull/28189 (4.18.6) and https://github.com/apache/camel/pull/28188 (4.22.3).

_Claude Code on behalf of Claus Ibsen_

> camel-ftp - FTPS: verify the host name of the server over TLS
> -------------------------------------------------------------
>
>                 Key: CAMEL-25890
>                 URL: https://issues.apache.org/jira/browse/CAMEL-25890
>             Project: Camel
>          Issue Type: Improvement
>          Components: camel-ftp
>            Reporter: Federico Mariani
>            Assignee: Federico Mariani
>            Priority: Major
>             Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> The FTPS endpoint builds an Apache Commons Net FTPSClient in FtpsEndpoint.createFtpClient(). Neither the branch that uses sslContextParameters nor the default branch (optional ftpClient.trustStore.* / ftpClient.keyStore.* settings) enables the client's server host name check, so a TLS handshake succeeds as long as the certificate is accepted by the trust manager, whatever host names it lists. There is no endpoint option for it; today it can only be enabled with ftpClient.endpointCheckingEnabled=true.
> *Current behaviour*
> - The FTPSClient created by the endpoint has endpoint checking disabled, so the server certificate is not matched against the host the endpoint connects to.
> *Behaviour after the change (main / 4.24.0)*
> - New endpoint option hostnameVerification (label "security", default true), with the same name and semantics as in camel-mina and camel-mllp.
> - When true, the FTPSClient created by the endpoint calls setEndpointCheckingEnabled(true), on both the sslContextParameters branch and the default branch. The TLS handshake of the control connection fails, before login, if the server certificate does not match the configured host.
> - hostnameVerification=false restores the previous behaviour.
> - A custom ftpClient supplied by the user is left untouched; ftpClient.endpointCheckingEnabled still applies on top through the existing property binding.
> *Code changes*
> - FtpsConfiguration: add the hostnameVerification @UriParam with javadoc.
> - FtpsEndpoint.createFtpClient(): call client.setEndpointCheckingEnabled(getFtpsConfiguration().isHostnameVerification()) before returning the client.
> - ftp-component.adoc: document the option next to the FTPS default trust store section.
> - Regenerate the configurer, URI factory, component JSON, catalog and endpoint DSL.
> - Test certificates: the server.jks keystores in camel-ftp and camel-test-infra-ftp (CN=FtpServer) have no subject alternative names; regenerate them with SAN dns:localhost,ip:127.0.0.1 so the existing FTPS tests keep connecting to localhost.
> *Tests*
> - Unit test on createFtpClient(): host name check enabled by default, enabled with sslContextParameters, disabled with hostnameVerification=false, custom ftpClient not changed.
> - Integration test against the embedded FTPS test server: a host name the certificate does not list fails the handshake, localhost succeeds.
> *Upgrade guide (main)*
> - 4.24: behaviour change. FTPS connections fail when the server certificate does not match the configured host (for example when connecting by IP address to a certificate without an IP subject alternative name). Set hostnameVerification=false to keep the old behaviour.
> *camel-4.22.x and camel-4.18.x (documentation only)*
> - These lines keep the current behaviour; no code change.
> - Add a short section to ftp-component.adoc on each branch, next to the FTPS default trust store section, explaining that the host name of the FTPS server is not checked by default and how to enable the check with ftpClient.endpointCheckingEnabled=true (together with trust material via sslContextParameters or ftpClient.trustStore.*).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)