davsclaus commented on code in PR #28154:
URL: https://github.com/apache/camel/pull/28154#discussion_r4324151680
##########
components/camel-thrift/src/main/java/org/apache/camel/component/thrift/ThriftConsumer.java:
##########
@@ -148,39 +162,30 @@ protected void initializeServer() throws
TTransportException, IOException {
+
configuration.getNegotiationType());
}
- ObjectHelper.notNull(sslParameters.getSecureSocketProtocol(),
"Security protocol");
-
ObjectHelper.notNull(sslParameters.getKeyManagers().getKeyStore().getResource(),
"Keystore path");
-
ObjectHelper.notNull(sslParameters.getKeyManagers().getKeyStore().getPassword(),
"Keystore password");
-
- TSSLTransportFactory.TSSLTransportParameters sslParams;
- sslParams = new TSSLTransportFactory.TSSLTransportParameters(
- sslParameters.getSecureSocketProtocol(),
- sslParameters.getCipherSuites() == null
- ? null
- :
sslParameters.getCipherSuites().getCipherSuite().stream().toArray(String[]::new));
-
- if
(ObjectHelper.isNotEmpty(sslParameters.getKeyManagers().getKeyStore().getProvider())
- &&
ObjectHelper.isNotEmpty(sslParameters.getKeyManagers().getKeyStore().getType()))
{
- sslParams.setKeyStore(
-
ResourceHelper.resolveResourceAsInputStream(endpoint.getCamelContext(),
-
sslParameters.getKeyManagers().getKeyStore().getResource()),
-
sslParameters.getKeyManagers().getKeyStore().getPassword(),
-
sslParameters.getKeyManagers().getKeyStore().getProvider(),
-
sslParameters.getKeyManagers().getKeyStore().getType());
- } else {
- sslParams.setKeyStore(
-
ResourceHelper.resolveResourceAsInputStream(endpoint.getCamelContext(),
-
sslParameters.getKeyManagers().getKeyStore().getResource()),
-
sslParameters.getKeyManagers().getKeyStore().getPassword());
- }
+ ObjectHelper.notNull(sslParameters.getKeyManagers(), "Key
managers");
+ // the server socket factory of the SSL context applies all the
sslParameters: the key and trust managers,
+ // the protocols and cipher suites, and the server parameters such
as the client authentication
+ SSLServerSocket serverSocket;
try {
- syncServerTransport =
TSSLTransportFactory.getServerSocket(configuration.getPort(),
- configuration.getClientTimeout(),
InetAddress.getByName(configuration.getHost()),
- sslParams);
+ SSLContext sslContext =
sslParameters.createSSLContext(endpoint.getCamelContext());
+ serverSocket = (SSLServerSocket)
sslContext.getServerSocketFactory().createServerSocket(
+ configuration.getPort(), SERVER_SOCKET_BACKLOG,
InetAddress.getByName(configuration.getHost()));
} catch (UnknownHostException e) {
throw new IllegalArgumentException("Unknown host defined: " +
configuration.getHost());
+ } catch (GeneralSecurityException e) {
Review Comment:
Before, the key was read with the key store password. Now
`KeyManagersParameters` passes a `null` password to `kmf.init` when
`keyPassword` is unset, so an existing SSL consumer with a protected key fails
to start after a patch upgrade on 4.18.x/4.22.x. That is fine on main with the
upgrade note. For the backports, consider falling back to the key store
password when `keyPassword` is null, to keep patch upgrades drop-in.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
