This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 981480002093 CAMEL-24056: Mark kafka sslEndpointAlgorithm as
insecure:ssl
981480002093 is described below
commit 981480002093b4386b8fc39149bdcc193d1c470f
Author: Omar Atie <[email protected]>
AuthorDate: Sun Jul 19 00:16:27 2026 -0700
CAMEL-24056: Mark kafka sslEndpointAlgorithm as insecure:ssl
Annotate sslEndpointAlgorithm in camel-kafka with security=insecure:ssl
and insecureValue=none so Camel's security policy can flag disabled TLS
hostname verification. Update SecurityUtils to treat none, false, and
empty values as insecure for this option. Also add insecureValue=none to
camel-openai for consistency.
---
.../org/apache/camel/catalog/components/kafka.json | 4 ++--
.../org/apache/camel/catalog/components/openai.json | 2 +-
.../org/apache/camel/component/openai/openai.json | 2 +-
.../camel/component/openai/OpenAIConfiguration.java | 2 +-
.../META-INF/org/apache/camel/component/kafka/kafka.json | 4 ++--
.../apache/camel/component/kafka/KafkaConfiguration.java | 2 +-
.../camel/component/kafka/KafkaConfigurationTest.java | 10 ++++++++++
.../main/java/org/apache/camel/util/SecurityUtils.java | 16 ++++++++++++++--
.../java/org/apache/camel/util/SecurityUtilsTest.java | 6 ++++++
9 files changed, 38 insertions(+), 10 deletions(-)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/kafka.json
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/kafka.json
index acfd1e2bbf26..20079d364ed0 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/kafka.json
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/kafka.json
@@ -140,7 +140,7 @@
"sslCipherSuites": { "index": 113, "kind": "property", "displayName": "Ssl
Cipher Suites", "group": "security", "label": "common,security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "A list of cipher suites. This is a named
combination of authentication, encryption, MAC a [...]
"sslContextParameters": { "index": 114, "kind": "property", "displayName":
"Ssl Context Parameters", "group": "security", "label": "common,security",
"required": false, "type": "object", "javaType":
"org.apache.camel.support.jsse.SSLContextParameters", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "SSL configuration using a Camel SSLContextPar
[...]
"sslEnabledProtocols": { "index": 115, "kind": "property", "displayName":
"Ssl Enabled Protocols", "group": "security", "label": "common,security",
"required": false, "type": "string", "javaType": "java.lang.String",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The list of protocols enabled for SSL
connections. The default is TLSv1.2,TLSv1.3 [...]
- "sslEndpointAlgorithm": { "index": 116, "kind": "property", "displayName":
"Ssl Endpoint Algorithm", "group": "security", "label": "common,security",
"required": false, "type": "string", "javaType": "java.lang.String",
"deprecated": false, "autowired": false, "secret": false, "defaultValue":
"https", "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The endpoint identification algorithm to
validate serv [...]
+ "sslEndpointAlgorithm": { "index": 116, "kind": "property", "displayName":
"Ssl Endpoint Algorithm", "group": "security", "label": "common,security",
"required": false, "type": "string", "javaType": "java.lang.String",
"deprecated": false, "autowired": false, "secret": false, "security":
"insecure:ssl", "insecureValue": "none", "defaultValue": "https",
"configurationClass": "org.apache.camel.component.kafka.KafkaConfiguration",
"configurationField": "configuration", "description": "T [...]
"sslKeymanagerAlgorithm": { "index": 117, "kind": "property",
"displayName": "Ssl Keymanager Algorithm", "group": "security", "label":
"common,security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": "SunX509", "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The algorithm used by key manager factory for
SS [...]
"sslKeyPassword": { "index": 118, "kind": "property", "displayName": "Ssl
Key Password", "group": "security", "label": "common,security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The password of the private key in the key
store file or the PEM key s [...]
"sslKeystoreLocation": { "index": 119, "kind": "property", "displayName":
"Ssl Keystore Location", "group": "security", "label": "common,security",
"required": false, "type": "string", "javaType": "java.lang.String",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The location of the key store file. This is
optional for the client and can be us [...]
@@ -279,7 +279,7 @@
"sslCipherSuites": { "index": 106, "kind": "parameter", "displayName":
"Ssl Cipher Suites", "group": "security", "label": "common,security",
"required": false, "type": "string", "javaType": "java.lang.String",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "A list of cipher suites. This is a named
combination of authentication, encryption, MAC [...]
"sslContextParameters": { "index": 107, "kind": "parameter",
"displayName": "Ssl Context Parameters", "group": "security", "label":
"common,security", "required": false, "type": "object", "javaType":
"org.apache.camel.support.jsse.SSLContextParameters", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "SSL configuration using a Camel SSLContextPa
[...]
"sslEnabledProtocols": { "index": 108, "kind": "parameter", "displayName":
"Ssl Enabled Protocols", "group": "security", "label": "common,security",
"required": false, "type": "string", "javaType": "java.lang.String",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The list of protocols enabled for SSL
connections. The default is TLSv1.2,TLSv1. [...]
- "sslEndpointAlgorithm": { "index": 109, "kind": "parameter",
"displayName": "Ssl Endpoint Algorithm", "group": "security", "label":
"common,security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": "https", "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The endpoint identification algorithm to
validate ser [...]
+ "sslEndpointAlgorithm": { "index": 109, "kind": "parameter",
"displayName": "Ssl Endpoint Algorithm", "group": "security", "label":
"common,security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"security": "insecure:ssl", "insecureValue": "none", "defaultValue": "https",
"configurationClass": "org.apache.camel.component.kafka.KafkaConfiguration",
"configurationField": "configuration", "description": " [...]
"sslKeymanagerAlgorithm": { "index": 110, "kind": "parameter",
"displayName": "Ssl Keymanager Algorithm", "group": "security", "label":
"common,security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": "SunX509", "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The algorithm used by key manager factory for
S [...]
"sslKeyPassword": { "index": 111, "kind": "parameter", "displayName": "Ssl
Key Password", "group": "security", "label": "common,security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The password of the private key in the key
store file or the PEM key [...]
"sslKeystoreLocation": { "index": 112, "kind": "parameter", "displayName":
"Ssl Keystore Location", "group": "security", "label": "common,security",
"required": false, "type": "string", "javaType": "java.lang.String",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The location of the key store file. This is
optional for the client and can be u [...]
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/openai.json
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/openai.json
index ae4a63a23c81..6c38a7b582f4 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/openai.json
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/openai.json
@@ -113,7 +113,7 @@
"lazyStartProducer": { "index": 34, "kind": "parameter", "displayName":
"Lazy Start Producer", "group": "producer (advanced)", "label":
"producer,advanced", "required": false, "type": "boolean", "javaType":
"boolean", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": false, "description": "Whether the producer should be started
lazy (on the first message). By starting lazy you can use this to allow
CamelContext and routes to startup in situations where a produ [...]
"oauthProfile": { "index": 35, "kind": "parameter", "displayName": "Oauth
Profile", "group": "security", "label": "security", "required": false, "type":
"string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.openai.OpenAIConfiguration",
"configurationField": "configuration", "description": "OAuth profile name for
obtaining an access token via the OAuth 2.0 Client Cred [...]
"sslContextParameters": { "index": 36, "kind": "parameter", "displayName":
"Ssl Context Parameters", "group": "security", "label": "security", "required":
false, "type": "object", "javaType":
"org.apache.camel.support.jsse.SSLContextParameters", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.openai.OpenAIConfiguration",
"configurationField": "configuration", "description": "SSLContextParameters to
use [...]
- "sslEndpointAlgorithm": { "index": 37, "kind": "parameter", "displayName":
"Ssl Endpoint Algorithm", "group": "security", "label": "security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false, "security":
"insecure:ssl", "defaultValue": "https", "configurationClass":
"org.apache.camel.component.openai.OpenAIConfiguration", "configurationField":
"configuration", "description": "The endp [...]
+ "sslEndpointAlgorithm": { "index": 37, "kind": "parameter", "displayName":
"Ssl Endpoint Algorithm", "group": "security", "label": "security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false, "security":
"insecure:ssl", "insecureValue": "none", "defaultValue": "https",
"configurationClass": "org.apache.camel.component.openai.OpenAIConfiguration",
"configurationField": "configuration", [...]
"sslKeymanagerAlgorithm": { "index": 38, "kind": "parameter",
"displayName": "Ssl Keymanager Algorithm", "group": "security", "label":
"security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "defaultValue": "SunX509", "configurationClass":
"org.apache.camel.component.openai.OpenAIConfiguration", "configurationField":
"configuration", "description": "The algorithm used by the key [...]
"sslKeyPassword": { "index": 39, "kind": "parameter", "displayName": "Ssl
Key Password", "group": "security", "label": "security", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": true, "security":
"secret", "configurationClass":
"org.apache.camel.component.openai.OpenAIConfiguration", "configurationField":
"configuration", "description": "The password of the private key in the key
store file" },
"sslKeystoreLocation": { "index": 40, "kind": "parameter", "displayName":
"Ssl Keystore Location", "group": "security", "label": "security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.openai.OpenAIConfiguration",
"configurationField": "configuration", "description": "The location of the key
store file. This is optional and can be [...]
diff --git
a/components/camel-ai/camel-openai/src/generated/resources/META-INF/org/apache/camel/component/openai/openai.json
b/components/camel-ai/camel-openai/src/generated/resources/META-INF/org/apache/camel/component/openai/openai.json
index ae4a63a23c81..6c38a7b582f4 100644
---
a/components/camel-ai/camel-openai/src/generated/resources/META-INF/org/apache/camel/component/openai/openai.json
+++
b/components/camel-ai/camel-openai/src/generated/resources/META-INF/org/apache/camel/component/openai/openai.json
@@ -113,7 +113,7 @@
"lazyStartProducer": { "index": 34, "kind": "parameter", "displayName":
"Lazy Start Producer", "group": "producer (advanced)", "label":
"producer,advanced", "required": false, "type": "boolean", "javaType":
"boolean", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": false, "description": "Whether the producer should be started
lazy (on the first message). By starting lazy you can use this to allow
CamelContext and routes to startup in situations where a produ [...]
"oauthProfile": { "index": 35, "kind": "parameter", "displayName": "Oauth
Profile", "group": "security", "label": "security", "required": false, "type":
"string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.openai.OpenAIConfiguration",
"configurationField": "configuration", "description": "OAuth profile name for
obtaining an access token via the OAuth 2.0 Client Cred [...]
"sslContextParameters": { "index": 36, "kind": "parameter", "displayName":
"Ssl Context Parameters", "group": "security", "label": "security", "required":
false, "type": "object", "javaType":
"org.apache.camel.support.jsse.SSLContextParameters", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.openai.OpenAIConfiguration",
"configurationField": "configuration", "description": "SSLContextParameters to
use [...]
- "sslEndpointAlgorithm": { "index": 37, "kind": "parameter", "displayName":
"Ssl Endpoint Algorithm", "group": "security", "label": "security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false, "security":
"insecure:ssl", "defaultValue": "https", "configurationClass":
"org.apache.camel.component.openai.OpenAIConfiguration", "configurationField":
"configuration", "description": "The endp [...]
+ "sslEndpointAlgorithm": { "index": 37, "kind": "parameter", "displayName":
"Ssl Endpoint Algorithm", "group": "security", "label": "security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false, "security":
"insecure:ssl", "insecureValue": "none", "defaultValue": "https",
"configurationClass": "org.apache.camel.component.openai.OpenAIConfiguration",
"configurationField": "configuration", [...]
"sslKeymanagerAlgorithm": { "index": 38, "kind": "parameter",
"displayName": "Ssl Keymanager Algorithm", "group": "security", "label":
"security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "defaultValue": "SunX509", "configurationClass":
"org.apache.camel.component.openai.OpenAIConfiguration", "configurationField":
"configuration", "description": "The algorithm used by the key [...]
"sslKeyPassword": { "index": 39, "kind": "parameter", "displayName": "Ssl
Key Password", "group": "security", "label": "security", "required": false,
"type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": true, "security":
"secret", "configurationClass":
"org.apache.camel.component.openai.OpenAIConfiguration", "configurationField":
"configuration", "description": "The password of the private key in the key
store file" },
"sslKeystoreLocation": { "index": 40, "kind": "parameter", "displayName":
"Ssl Keystore Location", "group": "security", "label": "security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"deprecationNote": "", "autowired": false, "secret": false,
"configurationClass": "org.apache.camel.component.openai.OpenAIConfiguration",
"configurationField": "configuration", "description": "The location of the key
store file. This is optional and can be [...]
diff --git
a/components/camel-ai/camel-openai/src/main/java/org/apache/camel/component/openai/OpenAIConfiguration.java
b/components/camel-ai/camel-openai/src/main/java/org/apache/camel/component/openai/OpenAIConfiguration.java
index a5e51d114832..b0833d7ccf70 100644
---
a/components/camel-ai/camel-openai/src/main/java/org/apache/camel/component/openai/OpenAIConfiguration.java
+++
b/components/camel-ai/camel-openai/src/main/java/org/apache/camel/component/openai/OpenAIConfiguration.java
@@ -240,7 +240,7 @@ public class OpenAIConfiguration implements Cloneable {
@Metadata(description = "The algorithm used by the trust manager factory
for SSL connections")
private String sslTrustmanagerAlgorithm = "PKIX";
- @UriParam(label = "security", defaultValue = "https", security =
"insecure:ssl")
+ @UriParam(label = "security", defaultValue = "https", security =
"insecure:ssl", insecureValue = "none")
@Metadata(description = "The endpoint identification algorithm to validate
the server hostname using the server certificate. "
+ "Set to an empty string or 'none' to disable
hostname verification")
private String sslEndpointAlgorithm = "https";
diff --git
a/components/camel-kafka/src/generated/resources/META-INF/org/apache/camel/component/kafka/kafka.json
b/components/camel-kafka/src/generated/resources/META-INF/org/apache/camel/component/kafka/kafka.json
index acfd1e2bbf26..20079d364ed0 100644
---
a/components/camel-kafka/src/generated/resources/META-INF/org/apache/camel/component/kafka/kafka.json
+++
b/components/camel-kafka/src/generated/resources/META-INF/org/apache/camel/component/kafka/kafka.json
@@ -140,7 +140,7 @@
"sslCipherSuites": { "index": 113, "kind": "property", "displayName": "Ssl
Cipher Suites", "group": "security", "label": "common,security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "A list of cipher suites. This is a named
combination of authentication, encryption, MAC a [...]
"sslContextParameters": { "index": 114, "kind": "property", "displayName":
"Ssl Context Parameters", "group": "security", "label": "common,security",
"required": false, "type": "object", "javaType":
"org.apache.camel.support.jsse.SSLContextParameters", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "SSL configuration using a Camel SSLContextPar
[...]
"sslEnabledProtocols": { "index": 115, "kind": "property", "displayName":
"Ssl Enabled Protocols", "group": "security", "label": "common,security",
"required": false, "type": "string", "javaType": "java.lang.String",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The list of protocols enabled for SSL
connections. The default is TLSv1.2,TLSv1.3 [...]
- "sslEndpointAlgorithm": { "index": 116, "kind": "property", "displayName":
"Ssl Endpoint Algorithm", "group": "security", "label": "common,security",
"required": false, "type": "string", "javaType": "java.lang.String",
"deprecated": false, "autowired": false, "secret": false, "defaultValue":
"https", "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The endpoint identification algorithm to
validate serv [...]
+ "sslEndpointAlgorithm": { "index": 116, "kind": "property", "displayName":
"Ssl Endpoint Algorithm", "group": "security", "label": "common,security",
"required": false, "type": "string", "javaType": "java.lang.String",
"deprecated": false, "autowired": false, "secret": false, "security":
"insecure:ssl", "insecureValue": "none", "defaultValue": "https",
"configurationClass": "org.apache.camel.component.kafka.KafkaConfiguration",
"configurationField": "configuration", "description": "T [...]
"sslKeymanagerAlgorithm": { "index": 117, "kind": "property",
"displayName": "Ssl Keymanager Algorithm", "group": "security", "label":
"common,security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": "SunX509", "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The algorithm used by key manager factory for
SS [...]
"sslKeyPassword": { "index": 118, "kind": "property", "displayName": "Ssl
Key Password", "group": "security", "label": "common,security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The password of the private key in the key
store file or the PEM key s [...]
"sslKeystoreLocation": { "index": 119, "kind": "property", "displayName":
"Ssl Keystore Location", "group": "security", "label": "common,security",
"required": false, "type": "string", "javaType": "java.lang.String",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The location of the key store file. This is
optional for the client and can be us [...]
@@ -279,7 +279,7 @@
"sslCipherSuites": { "index": 106, "kind": "parameter", "displayName":
"Ssl Cipher Suites", "group": "security", "label": "common,security",
"required": false, "type": "string", "javaType": "java.lang.String",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "A list of cipher suites. This is a named
combination of authentication, encryption, MAC [...]
"sslContextParameters": { "index": 107, "kind": "parameter",
"displayName": "Ssl Context Parameters", "group": "security", "label":
"common,security", "required": false, "type": "object", "javaType":
"org.apache.camel.support.jsse.SSLContextParameters", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "SSL configuration using a Camel SSLContextPa
[...]
"sslEnabledProtocols": { "index": 108, "kind": "parameter", "displayName":
"Ssl Enabled Protocols", "group": "security", "label": "common,security",
"required": false, "type": "string", "javaType": "java.lang.String",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The list of protocols enabled for SSL
connections. The default is TLSv1.2,TLSv1. [...]
- "sslEndpointAlgorithm": { "index": 109, "kind": "parameter",
"displayName": "Ssl Endpoint Algorithm", "group": "security", "label":
"common,security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": "https", "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The endpoint identification algorithm to
validate ser [...]
+ "sslEndpointAlgorithm": { "index": 109, "kind": "parameter",
"displayName": "Ssl Endpoint Algorithm", "group": "security", "label":
"common,security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"security": "insecure:ssl", "insecureValue": "none", "defaultValue": "https",
"configurationClass": "org.apache.camel.component.kafka.KafkaConfiguration",
"configurationField": "configuration", "description": " [...]
"sslKeymanagerAlgorithm": { "index": 110, "kind": "parameter",
"displayName": "Ssl Keymanager Algorithm", "group": "security", "label":
"common,security", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": "SunX509", "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The algorithm used by key manager factory for
S [...]
"sslKeyPassword": { "index": 111, "kind": "parameter", "displayName": "Ssl
Key Password", "group": "security", "label": "common,security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": true, "security": "secret", "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The password of the private key in the key
store file or the PEM key [...]
"sslKeystoreLocation": { "index": 112, "kind": "parameter", "displayName":
"Ssl Keystore Location", "group": "security", "label": "common,security",
"required": false, "type": "string", "javaType": "java.lang.String",
"deprecated": false, "autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.kafka.KafkaConfiguration", "configurationField":
"configuration", "description": "The location of the key store file. This is
optional for the client and can be u [...]
diff --git
a/components/camel-kafka/src/main/java/org/apache/camel/component/kafka/KafkaConfiguration.java
b/components/camel-kafka/src/main/java/org/apache/camel/component/kafka/KafkaConfiguration.java
index 2c0f57a671be..de386e795497 100755
---
a/components/camel-kafka/src/main/java/org/apache/camel/component/kafka/KafkaConfiguration.java
+++
b/components/camel-kafka/src/main/java/org/apache/camel/component/kafka/KafkaConfiguration.java
@@ -308,7 +308,7 @@ public class KafkaConfiguration implements Cloneable,
HeaderFilterStrategyAware
@UriParam(label = "common,security")
private String sslCipherSuites;
// ssl.endpoint.identification.algorithm
- @UriParam(label = "common,security", defaultValue = "https")
+ @UriParam(label = "common,security", defaultValue = "https", security =
"insecure:ssl", insecureValue = "none")
private String sslEndpointAlgorithm =
SslConfigs.DEFAULT_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM;
// ssl.keymanager.algorithm
@UriParam(label = "common,security", defaultValue = "SunX509")
diff --git
a/components/camel-kafka/src/test/java/org/apache/camel/component/kafka/KafkaConfigurationTest.java
b/components/camel-kafka/src/test/java/org/apache/camel/component/kafka/KafkaConfigurationTest.java
index 0f211726799b..ae391dc70b7b 100644
---
a/components/camel-kafka/src/test/java/org/apache/camel/component/kafka/KafkaConfigurationTest.java
+++
b/components/camel-kafka/src/test/java/org/apache/camel/component/kafka/KafkaConfigurationTest.java
@@ -19,11 +19,14 @@ package org.apache.camel.component.kafka;
import java.util.Properties;
import org.apache.camel.spi.StateRepository;
+import org.apache.camel.util.SecurityUtils;
import org.apache.kafka.clients.consumer.ConsumerConfig;
import org.apache.kafka.common.config.SslConfigs;
import org.junit.jupiter.api.Test;
import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.mockito.Mockito.mock;
class KafkaConfigurationTest {
@@ -50,6 +53,13 @@ class KafkaConfigurationTest {
assertEquals("",
consumerProps.get(SslConfigs.SSL_ENDPOINT_IDENTIFICATION_ALGORITHM_CONFIG));
}
+ @Test
+ void sslEndpointAlgorithmNoneIsInsecureConfiguration() {
+
assertTrue(SecurityUtils.isInsecureValue("camel.component.kafka.sslEndpointAlgorithm",
"none"));
+
assertTrue(SecurityUtils.isInsecureValue("camel.component.kafka.sslEndpointAlgorithm",
"false"));
+
assertFalse(SecurityUtils.isInsecureValue("camel.component.kafka.sslEndpointAlgorithm",
"https"));
+ }
+
@Test
@SuppressWarnings("unchecked")
void offsetRepositoryDisablesAutoCommit() {
diff --git
a/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
b/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
index 3ad3fa371edf..29493dc6991c 100644
--- a/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
+++ b/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
@@ -69,7 +69,7 @@ public final class SecurityUtils {
map.put("objectmessageenabled", new
SecurityOption(INSECURE_SERIALIZATION, "true"));
map.put("sendenabled", new SecurityOption(INSECURE_DEV, "true"));
map.put("skiptlsverify", new SecurityOption(INSECURE_SSL, "true"));
- map.put("sslendpointalgorithm", new SecurityOption(INSECURE_SSL, ""));
+ map.put("sslendpointalgorithm", new SecurityOption(INSECURE_SSL,
"none"));
map.put("stricthostkeychecking", new SecurityOption(INSECURE_SSL, ""));
map.put("tls", new SecurityOption(INSECURE_SSL, VALUE_FALSE));
map.put("transferexception", new
SecurityOption(INSECURE_SERIALIZATION, "true"));
@@ -124,7 +124,19 @@ public final class SecurityUtils {
if (option == null) {
return false;
}
- return String.valueOf(value).equalsIgnoreCase(option.insecureValue());
+ String v = String.valueOf(value);
+ if (INSECURE_SSL.equals(option.category()) &&
"sslendpointalgorithm".equals(normalizeOptionName(text))) {
+ return v.isEmpty() || "none".equalsIgnoreCase(v) ||
"false".equalsIgnoreCase(v);
+ }
+ return v.equalsIgnoreCase(option.insecureValue());
+ }
+
+ private static String normalizeOptionName(String text) {
+ int lastPeriod = text.lastIndexOf('.');
+ if (lastPeriod >= 0) {
+ text = text.substring(lastPeriod + 1);
+ }
+ return text.toLowerCase(Locale.ENGLISH).replace("-", "");
}
/**
diff --git
a/core/camel-util/src/test/java/org/apache/camel/util/SecurityUtilsTest.java
b/core/camel-util/src/test/java/org/apache/camel/util/SecurityUtilsTest.java
index ee7324a76f8b..d0eec7b32005 100644
--- a/core/camel-util/src/test/java/org/apache/camel/util/SecurityUtilsTest.java
+++ b/core/camel-util/src/test/java/org/apache/camel/util/SecurityUtilsTest.java
@@ -104,6 +104,12 @@ class SecurityUtilsTest {
assertTrue(SecurityUtils.isInsecureValue("camel.ssl.hostnameVerification",
"false"));
assertFalse(SecurityUtils.isInsecureValue("camel.ssl.hostnameVerification",
"true"));
+ // sslEndpointAlgorithm=none/false/empty disables hostname verification
+
assertTrue(SecurityUtils.isInsecureValue("camel.component.kafka.sslEndpointAlgorithm",
"none"));
+
assertTrue(SecurityUtils.isInsecureValue("camel.component.kafka.sslEndpointAlgorithm",
"false"));
+
assertTrue(SecurityUtils.isInsecureValue("camel.component.kafka.sslEndpointAlgorithm",
""));
+
assertFalse(SecurityUtils.isInsecureValue("camel.component.kafka.sslEndpointAlgorithm",
"https"));
+
// unknown option is never insecure
assertFalse(SecurityUtils.isInsecureValue("camel.component.http.port",
"8080"));
}
