Repository navigation
[camel-4.18.x] CAMEL-25890: camel-ftp - document how to enable FTPS host name verification - #28189
Conversation
…ost name verification The FTPS client created by the endpoint does not check the host name of the server on this line. Document how to enable the check with ftpClient.endpointCheckingEnabled=true, together with trust material. From 4.24 the check is enabled by default with the hostnameVerification option.
davsclaus
left a comment
davsclaus
left a comment
There was a problem hiding this comment.
Thanks @Croway. Docs-only change for camel-4.18.x. I checked it against the camel-4.18.x code: FtpsEndpoint is the same as on main, ftpClient.endpointCheckingEnabled=true is bound onto the FTPSClient in createRemoteFileOperations() (also for a custom ftpClient), and commons-net 3.12.0 has setEndpointCheckingEnabled. The text is accurate. The advice to also configure trust material is right. 4.18.x has no catalog doc copy, so changing only the component doc is right.
1. The check covers the control connection only (nit). commons-net enables endpoint identification in sslNegotiation(); the data connection with PROT P uses the same trust manager without a host name check. One sentence could say so.
Open questions, not blocking:
- The mina, mllp and smpp host name checks were backported with the default on (#27937, #27938). Is docs-only a deliberate choice for FTPS on this line? Fine with me, since it keeps the LTS behaviour unchanged and needs no upgrade-guide entry.
- The last sentence refers to the
hostnameVerificationoption from #28186, so this should be merged after #28186.
Claude Code on behalf of davsclaus. This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.
gnodet-bot
left a comment
gnodet-bot
left a comment
There was a problem hiding this comment.
LGTM. No issues found — the technical claims are accurate: ftpClient.endpointCheckingEnabled=true is correctly wired to FTPSClient.setEndpointCheckingEnabled() via the ftpClient. parameter prefix, the HTTPS-rule statement matches what commons-net's SSLSocketUtils.enableEndpointNameVerification does, and the security guidance (configure trust material alongside the check) is sound. The forward reference to hostnameVerification (Camel 4.24) is scoped correctly; as davsclaus noted, merge after PR #28186.
This review was generated by an AI agent, Hermès on behalf of @gnodet.
…he control connection Say that the host name check covers the control connection only, and that hostnameVerification is only available from Camel 4.24.
|
Thanks. Addressed the review comments; this should be merged after #28186, since the last sentence refers to its |
3 participants
Description
CAMEL-25890
Documentation only, no code change on
camel-4.18.x.On this line the FTPS client created by the
ftpsendpoint does not check that the server certificate matches the host of the endpoint. This adds a short "FTPS host name verification" section toftp-component.adocthat explains how to enable the check with the existingftpClient.endpointCheckingEnabled=trueparameter, together with trust material (sslContextParametersorftpClient.trustStore.*), and notes that from Camel 4.24 the check is enabled by default with thehostnameVerificationoption (#28186).