oscerd commented on code in PR #29092:
URL: https://github.com/apache/camel/pull/29092#discussion_r4548611543
##########
core/camel-api/src/main/java/org/apache/camel/support/jsse/SSLContextParameters.java:
##########
@@ -353,44 +377,76 @@ public SSLContext createSSLContext(CamelContext
camelContext) throws GeneralSecu
* Auto-configures post-quantum named groups when the JVM supports them
and the user hasn't explicitly configured
* named groups or named groups filters.
* <p/>
- * When {@code X25519MLKEM768} is available (typically JDK 25+), this
method sets the preferred named group ordering
+ * When a hybrid ML-KEM group is available (typically JDK 25+), this
method sets the preferred named group ordering
* to prioritize post-quantum key exchange, protecting against
harvest-now-decrypt-later attacks.
*
* @param context the initialized SSLContext to probe for available named
groups
* @return {@code true} if PQC named groups were auto-configured,
{@code false} otherwise
*/
private boolean applyPqcNamedGroupDefaults(SSLContext context) {
SSLEngine probeEngine = context.createSSLEngine();
- String[] availableGroups =
getNamedGroupsFromParams(probeEngine.getSSLParameters());
+ List<String> ordered =
resolvePqcNamedGroups(getNamedGroupsFromParams(probeEngine.getSSLParameters()));
- if (availableGroups == null) {
+ if (ordered == null) {
+ logPqcNamedGroupsUnavailable();
return false;
}
- List<String> available = Arrays.asList(availableGroups);
- if (!available.contains(PQC_NAMED_GROUP)) {
- return false;
+ NamedGroupsParameters ngp = new NamedGroupsParameters();
+ ngp.setNamedGroup(ordered);
+ this.setNamedGroups(ngp);
+
+ LOG.info("Auto-configured PQC named groups: {}", ordered);
+ return true;
+ }
+
+ /**
+ * Orders the named groups available on this JVM so that the post-quantum
hybrids come first, followed by the
+ * classical fallbacks and then everything else, preserving the spelling
the JVM uses.
+ *
+ * @param availableGroups the named groups the JVM offers
+ * @return the preferred ordering, or {@code null} when
the JVM offers no post-quantum group - in
+ * which case the ordering is left alone rather
than rewritten
+ */
+ static @Nullable List<String> resolvePqcNamedGroups(String @Nullable []
availableGroups) {
+ if (availableGroups == null || availableGroups.length == 0) {
+ return null;
}
- // Build preferred ordering: PQC preferred groups first (if
available), then remaining
+ // Match case-insensitively, since the spelling of a group is up to
the provider, but keep the name the
+ // provider gave: that is the one it accepts back on SSLParameters.
List<String> ordered = new ArrayList<>();
+ boolean postQuantum = false;
for (String preferred : PQC_PREFERRED_NAMED_GROUPS) {
- if (available.contains(preferred)) {
- ordered.add(preferred);
+ for (String available : availableGroups) {
+ if (preferred.equalsIgnoreCase(available)) {
+ ordered.add(available);
+ postQuantum |= PQC_NAMED_GROUPS.contains(preferred);
Review Comment:
Applied in d40e0e4a941e: `PQC_PREFERRED_NAMED_GROUPS` is derived from
`PQC_NAMED_GROUPS` followed by the classical fallbacks
(`CLASSICAL_FALLBACK_NAMED_GROUPS`), so a hybrid added to the detection list
takes part in the ordering as well; the Javadoc of the constants says so.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
