[
https://issues.apache.org/jira/browse/CAMEL-24077?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen updated CAMEL-24077:
--------------------------------
Fix Version/s: 4.22.0
> camel-amqp: useSsl=true renders empty transport.* options - breaks
> JVM-default trust store and server-only TLS
> --------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24077
> URL: https://issues.apache.org/jira/browse/CAMEL-24077
> Project: Camel
> Issue Type: Bug
> Components: camel-amqp
> Affects Versions: 4.21.0
> Reporter: Federico Mariani
> Priority: Major
> Labels: code-review
> Fix For: 4.22.0
>
> Attachments: AMQPSslTransportOptionsTest.java
>
>
> h3. Problem
> When {{useSsl=true}}, {{AMQPComponent.doInit()}} (AMQPComponent.java:113-131)
> always appends all six {{transport.*}} options to the connection URI,
> substituting {{""}} for the ones that are not configured. Qpid JMS (2.10.0)
> parses {{key=}} as the empty string (not null), and its {{TransportSupport}}
> only skips key/trust store loading when the location is *null* - an empty
> string triggers {{new FileInputStream("")}} -> {{FileNotFoundException}} at
> connect time.
> h3. Failure scenarios
> # Broker certificate signed by a CA in the JVM default trust store; user sets
> only {{useSsl=true}} -> connection fails instead of using the default trust
> store (cacerts).
> # The common server-only TLS case (trust store configured, no client key
> store) -> fails trying to load a key store from {{""}}.
> The existing tests mask this: {{AMQPConfigTest.testEnabledSslComponent}}
> literally asserts the empty parameters (URI shape only), and
> {{AMQPSAuthRouteTest}} always configures both stores. Introduced by
> CAMEL-11780 (eb5b6ab9219f, Oct 2024).
> h3. Related (same code block)
> * Values are not URL-encoded: a literal {{%}}, {{&}}, {{=}} or {{#}} in a
> store password/path corrupts the connection URI.
> * Store passwords are embedded in plaintext in the connection factory's
> {{remoteURI}} (retrievable via {{getRemoteURI()}}, part of qpid's
> debug-logging surface). Consider configuring the stores through qpid's
> transport options API instead of the URI.
> h3. Suggested fix direction
> Only append a {{transport.*}} option when the corresponding value is actually
> configured, and URL-encode the values.
> h3. Reproducer
> Attached {{AMQPSslTransportOptionsTest.java}} (place in
> {{components/camel-amqp/src/test/java/org/apache/camel/component/amqp/}}).
> Both tests fail today: the rendered remote URI contains
> {{transport.keyStoreLocation=&...&transport.keyStorePassword=}} /
> {{transport.trustStoreLocation=}} empty options. No broker needed.
> ----
> _This issue was researched and filed by Claude Code on behalf of [~croway]
> (GitHub: Croway), as part of a deep code review of camel-jms and camel-amqp.
> A failing JUnit reproducer is attached; it fails deterministically on current
> main (4.22.0-SNAPSHOT)._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
