oscerd opened a new pull request, #28527:
URL: https://github.com/apache/camel/pull/28527
When camel-as2 requests an asynchronous MDN (Message Disposition
Notification),
`AS2AsynchronousMDNManager.send()` resolves the delivery address from the
sender-supplied
`Receipt-Delivery-Option` URI and opens a connection to it. The
`asyncMdnAllowedHosts` option on
`AS2Configuration` governs whether the MDN is delivered to the resolved
address and whether the
configured MDN credentials (`mdnUserName` / `mdnPassword` /
`mdnAccessToken`) are attached.
`send()` resolves both the host and the port of the delivery address (the
port via
`uri.getPort()`, defaulted to 80 or 443 by scheme), but the allow-list match
compared only the
host. The resolved port was used to open the socket but was never matched
against the list, so
every port on a listed host was treated the same — both for delivery and for
attaching the
credentials.
## Change
- `AS2AsynchronousMDNManager` now matches the full authority — host **and**
port — of the resolved
delivery address. The single allow decision that gates the connection and
the attachment of the
credentials now accounts for the port.
- Each `asyncMdnAllowedHosts` entry may carry an optional port in
`host:port` form. A bare-host
entry (for example `partner.example`) matches only the default port for
the scheme (80 for
`http`, 443 for `https`); a non-default port is listed explicitly (for
example
`partner.example:8443`). IPv6 literals are supported (`[::1]` or
`[::1]:8443`).
- The `asyncMdnAllowedHosts` description on `AS2Configuration` is updated to
document the
`host[:port]` form and the default-port rule, and the catalog / component
/ endpoint-dsl metadata
is regenerated.
- A new opt-in option `asyncMdnRequireHttps` (default `false`) is added.
When set, an asynchronous
MDN whose delivery address does not use `https` is refused before the
connection is opened and
before the credentials are attached, so the configured MDN credentials are
never sent in cleartext
to a sender-chosen address. The option applies per consumer endpoint, like
`asyncMdnAllowedHosts`.
## Tests
New and updated JUnit methods in
`AS2AsynchronousMDNManagerDeliveryAddressTest`:
- a delivery address whose host and port both match an entry is accepted;
- a different port on a listed (bare-host) entry is refused, and the
credentials are not attached;
- a bare-host entry matches the default port for its scheme;
- an IPv6 literal matches its allow-list entry on host and port.
- with `asyncMdnRequireHttps` set, a plain-http delivery address is refused
and an https address is
accepted; by default (option off) http is still accepted.
The existing `camel-as2-component` tests that deliver an asynchronous MDN to
a random local port
(`AS2ServerBasicAuthHeaderTest`, `AS2ServerBearerAuthHeaderTest`,
`AS2AsyncMdnBasicAuthHeaderTest`,
`AS2AsyncMdnTokenAuthHeaderTest`, `AS2AsyncMdnContextReuseTest` and
`AS2ServerTwoConsumerAsyncMdnSettingsTest`) now list `host:port` in
`asyncMdnAllowedHosts` instead of a bare
host, as a bare-host entry matches only the default port.
## Documentation
An upgrade-guide note for the default-port behaviour change is added on
`main` in
`docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc`.
_Claude Code on behalf of oscerd_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
