This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new cef7fab36fee CAMEL-24731: camel-spiffe - register acceptAnySpiffeId
with the security policy framework
cef7fab36fee is described below
commit cef7fab36fee2d852add3e6c4f0fde2406507be6
Author: Andrea Cosentino <[email protected]>
AuthorDate: Tue Sep 15 06:51:59 2026 +0200
CAMEL-24731: camel-spiffe - register acceptAnySpiffeId with the security
policy framework
SpiffeSSLContextParameters.acceptAnySpiffeId disables peer identity pinning
in
mutual TLS (any SVID chaining to the trust bundle is accepted instead of the
acceptedSpiffeIds allow-list). It is the SPIFFE analogue of disabling
hostname
verification, but it carried no security marker and was absent from
SecurityUtils,
so camel.main.profile=prod could not flag it.
Because the class is a standalone bean rather than a component option, its
@Metadata never reaches a component JSON, so the option is added to the
EXTRA_SECURITY_OPTIONS list in UpdateSensitizeHelper (with the field also
annotated
security = "insecure:ssl" for documentation). SecurityUtils is regenerated
and
SecurityUtilsTest guards that the entry stays registered.
Closes #26421
Co-Authored-By: Claude Opus 5 <[email protected]>
---
.../apache/camel/component/spiffe/SpiffeSSLContextParameters.java | 7 ++++---
.../src/main/java/org/apache/camel/util/SecurityUtils.java | 1 +
.../src/test/java/org/apache/camel/util/SecurityUtilsTest.java | 7 +++++++
.../org/apache/camel/maven/packaging/UpdateSensitizeHelper.java | 3 +++
4 files changed, 15 insertions(+), 3 deletions(-)
diff --git
a/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeSSLContextParameters.java
b/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeSSLContextParameters.java
index d574a2ffb118..42e20ebb5425 100644
---
a/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeSSLContextParameters.java
+++
b/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeSSLContextParameters.java
@@ -69,10 +69,11 @@ public class SpiffeSSLContextParameters extends
SSLContextParameters {
description = "Comma-separated allow-list of peer SPIFFE IDs to
accept during the TLS handshake"
+ " (for example spiffe://example.org/client).
Mutually exclusive with acceptAnySpiffeId.")
private String acceptedSpiffeIds;
- @Metadata(label = "security", defaultValue = "false",
+ @Metadata(label = "security", defaultValue = "false", security =
"insecure:ssl",
description = "Accept any peer SPIFFE ID that validates against
the trust bundle, instead of an"
- + " explicit acceptedSpiffeIds allow-list. Use
with care; mutually exclusive with"
- + " acceptedSpiffeIds.")
+ + " explicit acceptedSpiffeIds allow-list. This
authenticates the trust domain but not"
+ + " the peer, so it is the SPIFFE analogue of
disabling hostname verification."
+ + " Use with care; mutually exclusive with
acceptedSpiffeIds.")
private boolean acceptAnySpiffeId;
@Metadata(label = "security", defaultValue = "30000",
description = "Timeout in milliseconds to wait for the first
SVID from the Workload API when creating"
diff --git
a/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
b/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
index d6dd43f6d57d..ea18612da6ec 100644
--- a/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
+++ b/core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java
@@ -57,6 +57,7 @@ public final class SecurityUtils {
Map<String, SecurityOption> map = new HashMap<>();
// Generated by camel build tools - do NOT edit this map!
// SECURITY-OPTIONS: START
+ map.put("acceptanyspiffeid", new SecurityOption(INSECURE_SSL, "true"));
map.put("allowcontrolheaders", new SecurityOption(INSECURE_DEV,
"true"));
map.put("allowexternalentities", new SecurityOption(INSECURE_DEV,
"true"));
map.put("allowfilepathsource", new SecurityOption(INSECURE_DEV,
"true"));
diff --git
a/core/camel-util/src/test/java/org/apache/camel/util/SecurityUtilsTest.java
b/core/camel-util/src/test/java/org/apache/camel/util/SecurityUtilsTest.java
index d0eec7b32005..1f98d8618556 100644
--- a/core/camel-util/src/test/java/org/apache/camel/util/SecurityUtilsTest.java
+++ b/core/camel-util/src/test/java/org/apache/camel/util/SecurityUtilsTest.java
@@ -39,6 +39,13 @@ class SecurityUtilsTest {
// verify known entries
assertNotNull(options.get("trustallcertificates"));
assertEquals("insecure:ssl",
options.get("trustallcertificates").category());
+
+ // acceptAnySpiffeId lives on a bean (SpiffeSSLContextParameters)
rather than on a component option, so it
+ // only reaches this map through EXTRA_SECURITY_OPTIONS in
UpdateSensitizeHelper; guard that it is not lost
+ assertNotNull(options.get("acceptanyspiffeid"),
+ "acceptAnySpiffeId must stay registered so
camel.main.profile=prod can flag it");
+ assertEquals("insecure:ssl",
options.get("acceptanyspiffeid").category());
+ assertEquals("true", options.get("acceptanyspiffeid").insecureValue());
}
@Test
diff --git
a/tooling/maven/camel-package-maven-plugin/src/main/java/org/apache/camel/maven/packaging/UpdateSensitizeHelper.java
b/tooling/maven/camel-package-maven-plugin/src/main/java/org/apache/camel/maven/packaging/UpdateSensitizeHelper.java
index 20be84f0518f..5efc85fb5c19 100644
---
a/tooling/maven/camel-package-maven-plugin/src/main/java/org/apache/camel/maven/packaging/UpdateSensitizeHelper.java
+++
b/tooling/maven/camel-package-maven-plugin/src/main/java/org/apache/camel/maven/packaging/UpdateSensitizeHelper.java
@@ -93,6 +93,9 @@ public class UpdateSensitizeHelper extends
AbstractGeneratorMojo {
{ "uploadenabled", INSECURE_DEV, "true" },
{ "downloadenabled", INSECURE_DEV, "true" },
{ "sendenabled", INSECURE_DEV, "true" },
+ // SpiffeSSLContextParameters is a bean referenced through
sslContextParameters=#bean, not a component
+ // option, so its @Metadata never reaches a component JSON and the
scan above cannot see it
+ { "acceptanyspiffeid", INSECURE_SSL, "true" },
};
@Parameter(defaultValue =
"${project.basedir}/src/generated/resources/org/apache/camel/catalog/")
