gnodet-bot commented on code in PR #29092:
URL: https://github.com/apache/camel/pull/29092#discussion_r4455368731
##########
core/camel-api/src/main/java/org/apache/camel/support/jsse/SSLContextParameters.java:
##########
@@ -353,44 +377,76 @@ public SSLContext createSSLContext(CamelContext
camelContext) throws GeneralSecu
* Auto-configures post-quantum named groups when the JVM supports them
and the user hasn't explicitly configured
* named groups or named groups filters.
* <p/>
- * When {@code X25519MLKEM768} is available (typically JDK 25+), this
method sets the preferred named group ordering
+ * When a hybrid ML-KEM group is available (typically JDK 25+), this
method sets the preferred named group ordering
* to prioritize post-quantum key exchange, protecting against
harvest-now-decrypt-later attacks.
*
* @param context the initialized SSLContext to probe for available named
groups
* @return {@code true} if PQC named groups were auto-configured,
{@code false} otherwise
*/
private boolean applyPqcNamedGroupDefaults(SSLContext context) {
SSLEngine probeEngine = context.createSSLEngine();
- String[] availableGroups =
getNamedGroupsFromParams(probeEngine.getSSLParameters());
+ List<String> ordered =
resolvePqcNamedGroups(getNamedGroupsFromParams(probeEngine.getSSLParameters()));
- if (availableGroups == null) {
+ if (ordered == null) {
+ logPqcNamedGroupsUnavailable();
return false;
}
- List<String> available = Arrays.asList(availableGroups);
- if (!available.contains(PQC_NAMED_GROUP)) {
- return false;
+ NamedGroupsParameters ngp = new NamedGroupsParameters();
+ ngp.setNamedGroup(ordered);
+ this.setNamedGroups(ngp);
+
+ LOG.info("Auto-configured PQC named groups: {}", ordered);
+ return true;
+ }
+
+ /**
+ * Orders the named groups available on this JVM so that the post-quantum
hybrids come first, followed by the
+ * classical fallbacks and then everything else, preserving the spelling
the JVM uses.
+ *
+ * @param availableGroups the named groups the JVM offers
+ * @return the preferred ordering, or {@code null} when
the JVM offers no post-quantum group - in
+ * which case the ordering is left alone rather
than rewritten
+ */
+ static @Nullable List<String> resolvePqcNamedGroups(String @Nullable []
availableGroups) {
+ if (availableGroups == null || availableGroups.length == 0) {
+ return null;
}
- // Build preferred ordering: PQC preferred groups first (if
available), then remaining
+ // Match case-insensitively, since the spelling of a group is up to
the provider, but keep the name the
+ // provider gave: that is the one it accepts back on SSLParameters.
List<String> ordered = new ArrayList<>();
+ boolean postQuantum = false;
for (String preferred : PQC_PREFERRED_NAMED_GROUPS) {
- if (available.contains(preferred)) {
- ordered.add(preferred);
+ for (String available : availableGroups) {
+ if (preferred.equalsIgnoreCase(available)) {
+ ordered.add(available);
+ postQuantum |= PQC_NAMED_GROUPS.contains(preferred);
Review Comment:
`PQC_NAMED_GROUPS` and `PQC_PREFERRED_NAMED_GROUPS` are coupled through the
`postQuantum |= PQC_NAMED_GROUPS.contains(preferred)` check. If a future hybrid
group is added to `PQC_PREFERRED_NAMED_GROUPS` (so it participates in ordering)
but not to `PQC_NAMED_GROUPS` (so it doesn't trigger the PQC flag), the
auto-configuration silently returns `null` even when that hybrid is available.
The two lists are kept in sync today, but the dependency is implicit. Consider
a brief comment near the constants warning future editors, or deriving one list
from the other.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
