[jira] [Resolved] (CAMEL-25622) camel-smpp - Add hostname verification for SSL connections

["Claus Ibsen (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-25622?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Claus Ibsen resolved CAMEL-25622.
---------------------------------
    Resolution: Fixed

> camel-smpp - Add hostname verification for SSL connections
> ----------------------------------------------------------
>
>                 Key: CAMEL-25622
>                 URL: https://issues.apache.org/jira/browse/CAMEL-25622
>             Project: Camel
>          Issue Type: Improvement
>          Components: camel-smpp
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.24.0
>
>
> With {{usingSSL=true}} (or the {{smpps}} scheme), {{SmppConnectionFactory.createConnection}} creates the socket from {{SSLSocketFactory.getDefault()}}, or, behind an HTTP proxy, layers an {{SSLSocket}} on the proxy tunnel, and never sets an endpoint identification algorithm on it, and there is no option to set one. camel-netty, camel-mllp (CAMEL-25604) and camel-mina (CAMEL-25605) have a {{hostnameVerification}} option for this.
> Proposed change:
> * In {{SmppConnectionFactory.createConnection}}, set the {{HTTPS}} endpoint identification algorithm on the {{SSLSocket}} before the handshake, on the direct path and on the proxy path.
> * Add a {{hostnameVerification}} option, enabled by default, to turn the check off (label {{security}}, {{security = "insecure:ssl"}}, {{insecureValue = "false"}}).
> * Document it, and add upgrade guide notes: a connection to a host name or an IP address that the certificate of the SMSC does not list now fails the handshake.
> * Tests for both paths, against local TLS servers (the existing {{SmppConnectionFactoryTest}} cases are disabled because they need a real SMSC).
> To be backported to 4.22.x and 4.18.x once merged on main.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)