bvahdat opened a new pull request, #28749: URL: https://github.com/apache/camel/pull/28749
# Description Fixes CAMEL-26425. An AS2 server built on camel-as2 refused a correctly signed message with `authentication-failed` when the signed part used `Content-Transfer-Encoding: base64` or `quoted-printable` and came from another AS2 implementation (openssl cms, Lobster_data, OpenAS2). `SigningUtils.isValid` verified the signature over a re-serialisation of the parsed first body part, which re-encodes the content with camel-as2's own line length and escaping and rewrites the headers; RFC 1847 section 2.1 defines the signature over the part as transmitted. `MicUtils.createReceivedContentMic` computed the MDN's `Received-Content-MIC` over the same re-serialisation, so the receipt's MIC did not match the sender's (RFC 4130 section 7.1). camel-as2's own client was never affected because both sides re-encode identically. The fix keeps the first body part of a `multipart/signed` exactly as received while parsing (`AS2SessionInputBuffer` raw capture of the bytes `readLine` consumes; `EntityParser` strips the boundary delimiter that ends the part, RFC 2046 section 5.1.1) and exposes it as `MultipartSignedEntity.getSignedDataRaw()`. `getSignedDataContent()` returns the bytes a signature has to be verified against: the part as received, or its serialisation for an entity built locally. `SigningUtils.isValid` and `MicUtils` use it; the sending side is unchanged. Tests: `MultipartSignedEntityAsReceivedTest` plays another implementation (base64 wrapped at 64, quoted-printable with foreign escaping, binary; the signed part inside an encrypted message; a locally built entity still verifies over its serialisation) and shows that the re-serialisation differs from the signed bytes. `AS2SessionInputBufferTest` covers the raw capture. Upgrade guide entry for 4.24. Verified end to end against a Lobster_data partner: base64-encoded EDI messages that were refused are accepted, and the partner's own MIC check of the MDN passes. # Target - [x] I checked that the commit is targeting the correct branch (Camel 4 uses the `main` branch) # Tracking - [x] If this is a large change, bug fix, or code improvement, I checked there is a [JIRA issue](https://issues.apache.org/jira/browse/CAMEL) filed for the change (usually before you start working on it). # Apache Camel coding standards and style - [x] I checked that each commit in the pull request has a meaningful subject line and body. - [x] I have run `mvn clean install -DskipTests` locally from root folder and I have committed all auto-generated changes. # AI-assisted contributions - [x] If this PR includes AI-generated code, commits have proper co-authorship attribution (e.g., `Co-authored-by` trailers) and the PR description identifies the AI tool used. The analysis, fix, tests and documentation were written with Claude Code (Claude Fable 5.1) on behalf of Babak Vahdat, who reviewed, verified and tested them; the commit carries the `Co-authored-by` trailer. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
