Andrea Cosentino created CAMEL-26546:
----------------------------------------
Summary: the transports that map SSLContextParameters onto their
own TLS stack silently drop namedGroups and signatureSchemes
Key: CAMEL-26546
URL: https://issues.apache.org/jira/browse/CAMEL-26546
Project: Camel
Issue Type: Bug
Components: camel-platform-http, camel-kafka, camel-vertx
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Since CAMEL-23154 (4.19) {{SSLContextParameters}} auto-prefers the hybrid
post-quantum group {{X25519MLKEM768}}, and the security guide states this
applies to *all* {{SSLContextParameters}}. It does not.
A component only gets the preference when it uses the decorated {{SSLContext}}
returned by {{createSSLContext()}}. The components that instead read the key
and trust material out of {{SSLContextParameters}} and hand it to a native TLS
stack keep the protocol and the cipher suites and drop {{namedGroups}} and
{{signatureSchemes}}, with no warning:
* {{camel-kafka}}:
{{KafkaClientConfiguration.applySslConfigurationFromContext()}} maps protocol,
provider, cipher suites, enabled protocols and the two key stores. Named groups
and signature schemes never reach the Kafka client.
* {{camel-vertx-common}}: {{VertxHelper.setupSSLOptions()}} forwards cipher
suites and protocols only. This covers {{camel-platform-http-vertx}} - the
embedded HTTP server used by camel-main and Camel JBang - plus
{{camel-vertx-http}} and {{camel-vertx-websocket}}.
* {{camel-thrift}}: {{ThriftProducer}} and {{ThriftConsumer}} build
{{TSSLTransportParameters}} from the key store path and password and drop
everything else.
{{camel-elasticsearch}}, {{camel-elasticsearch-rest-client}} and {{camel-solr}}
are *not* affected: they pass the decorated {{SSLContext}} through.
{{camel-netty}} works around the problem with its own copy of the ordering
logic, {{SSLEngineFactory.applyPqcNamedGroups()}}, so the same algorithm now
lives in two places and in neither of them reusable.
Expected:
* one shared helper in camel-api/camel-support, used by camel-netty and by
every transport that can apply it;
* a transport that cannot express named groups must say so (warn once) instead
of dropping a configured value silently;
* correct the "all SSLContextParameters" claim in {{security.adoc}} and state
per transport what is honoured.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
