Andrea Cosentino created CAMEL-26545:
----------------------------------------
Summary: the post-quantum named group auto-configuration races on
a shared SSLContextParameters and only looks for X25519MLKEM768
Key: CAMEL-26545
URL: https://issues.apache.org/jira/browse/CAMEL-26545
Project: Camel
Issue Type: Bug
Components: camel-core
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Three defects in {{SSLContextParameters.applyPqcNamedGroupDefaults()}}
(core/camel-api, {{org.apache.camel.support.jsse}}):
1. *Race on shared state.* The method configures the preference by mutating the
bean itself - {{setNamedGroups(...)}} - and resets it in a {{finally}} block
once the configurers have been built. There is no synchronization, and a global
{{SSLContextParameters}} is shared by every component in the context. Two
concurrent {{createSSLContext()}} calls can interleave so that one caller skips
the auto-configuration (it observed the other thread's value) or builds its
configurers after the other thread's reset. The result is a post-quantum
preference that is applied or not depending on timing.
2. *Only one hybrid group is probed.* The detection tests for
{{X25519MLKEM768}} only. A JVM or a crypto policy that offers
{{SecP256r1MLKEM768}} or {{SecP384r1MLKEM1024}} but not the X25519 hybrid gets
no post-quantum preference at all.
3. *No signal when it does not apply.* The method logs at INFO when it
configures the groups and says nothing when no post-quantum group is available,
so on a JDK that does not offer one there is no way to tell the feature is
dormant short of {{-Djavax.net.debug}}.
Fix: compute the ordering into a local value and pass it to the configurers
without touching instance state, extend the probe to the NIST hybrids, and log
once when no post-quantum group is available.
Out of scope here, as a separate improvement: a fail-fast "require
post-quantum" option tied to {{camel.main.profile=prod}}.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
