oscerd opened a new pull request, #29092: URL: https://github.com/apache/camel/pull/29092
## Motivation `SSLContextParameters` has auto-preferred the hybrid post-quantum group `X25519MLKEM768` since CAMEL-23188 (4.19). Three defects in that auto-configuration: 1. **It races on a shared instance.** The preference is applied by mutating the bean itself — `setNamedGroups(...)` — and resetting it in a `finally` once the configurers (which read it) have been built. There is no exclusion, and a single `SSLContextParameters` is shared by every component of a `CamelContext` (`camel.ssl` global config, a shared `#bean`). Two concurrent `createSSLContext()` calls can interleave so that one caller skips the auto-configuration because it observed the other thread's ordering, or builds its configurers after that thread has reset it. The post-quantum preference then applies or not depending on timing. 2. **Only one hybrid was probed.** The detection tested for `X25519MLKEM768` alone. A JVM or a crypto policy restricted to the NIST curves offers `SecP256r1MLKEM768` and `SecP384r1MLKEM1024` without the X25519 hybrid, and got no post-quantum preference at all. 3. **Silence when it does not apply.** The method logged at INFO when it configured the groups and said nothing otherwise, so on a JDK that offers no hybrid group there was no way to tell the feature was dormant short of `-Djavax.net.debug`. ## Changes - The window in which the computed ordering is published on the instance is now held under a `ReentrantLock`, so concurrent `createSSLContext()` calls each get the full ordering and the instance is left untouched afterwards. - The ordering is computed by a new pure function, `resolvePqcNamedGroups(String[])`, over the groups the JVM reports. It accepts any of `X25519MLKEM768`, `SecP256r1MLKEM768`, `SecP384r1MLKEM1024`, matches case-insensitively, and keeps the spelling the provider gave — that is the spelling `SSLParameters` accepts back. It returns `null` when no hybrid is on offer, in which case the JVM ordering is left alone rather than rewritten. - A JVM without any post-quantum group logs that once per JVM. No API change: the new method is package-private, and the lock is a private field. ## Testing Five new tests in `SSLContextParametersTest`: - `resolvePqcNamedGroups` over synthetic group lists — hybrid-first ordering, the NIST-only case (which returned no preference before this PR), provider spelling preserved, and `null` for no-hybrid / empty / null input. These are deterministic on any JDK, which is the point of extracting the function. - `testPqcAutoConfigurationIsThreadSafe` — eight threads release together against one shared `SSLContextParameters`; every resulting context must prefer the hybrid group, and the shared instance must have no ordering left on it. The four existing assertions that hard-coded `X25519MLKEM768` now ask for "the first hybrid this JVM offers", so they stay honest on a NIST-only JVM. `mvn -Dquickly install` (full reactor) and `SSLContextParametersTest` pass. Note the thread-safety test only exercises the auto-configuration branch on a JDK that offers a hybrid group — locally that was JDK 21, so it took the "no PQC" branch; CI runs JDK 25, where it exercises the real path. --- _Claude Code on behalf of @oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
