CAMEL-24437/24439/24441/24443/24454: secure-default fixes, backport to camel-4.22.x

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/mllp.json

@@ -47,7 +47,7 @@
     "tcpNoDelay": { "index": 20, "kind": "property", "displayName": "Tcp No Delay", "group": "producer", "label": "advanced,producer", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "configurationClass": "org.apache.camel.component.mllp.MllpConfiguration", "configurationField": "configuration", "description": "Enable\/disable the TCP_NODELAY socket option." },
     "autowiredEnabled": { "index": 21, "kind": "property", "displayName": "Autowired Enabled", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc." },
     "defaultCharset": { "index": 22, "kind": "property", "displayName": "Default Charset", "group": "advanced", "label": "advanced", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "defaultValue": "ISO-8859-1", "description": "Set the default character set to use for byte to\/from String conversions." },
-    "logPhi": { "index": 23, "kind": "property", "displayName": "Log Phi", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether to log PHI" },
+    "logPhi": { "index": 23, "kind": "property", "displayName": "Log Phi", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether to log PHI" },
     "logPhiMaxBytes": { "index": 24, "kind": "property", "displayName": "Log Phi Max Bytes", "group": "advanced", "label": "advanced", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "defaultValue": 5120, "description": "Set the maximum number of bytes of PHI that will be logged in a log entry." },
     "maxBufferSize": { "index": 25, "kind": "property", "displayName": "Max Buffer Size", "group": "advanced", "label": "advanced", "required": false, "type": "integer", "javaType": "int", "deprecated": false, "autowired": false, "secret": false, "defaultValue": 1073741824, "configurationClass": "org.apache.camel.component.mllp.MllpConfiguration", "configurationField": "configuration", "description": "Maximum buffer size used when receiving or sending data over the wire." },
     "minBufferSize": { "index": 26, "kind": "property", "displayName": "Min Buffer Size", "group": "advanced", "label": "advanced", "required": false, "type": "integer", "javaType": "int", "deprecated": false, "autowired": false, "secret": false, "defaultValue": 2048, "configurationClass": "org.apache.camel.component.mllp.MllpConfiguration", "configurationField": "configuration", "description": "Minimum buffer size used when receiving or sending data over the wire." },

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/dataformats/pgp.json

@@ -30,6 +30,7 @@
     "algorithm": { "index": 11, "kind": "attribute", "displayName": "Algorithm", "group": "common", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "description": "Symmetric key encryption algorithm; possible values are defined in org.bouncycastle.bcpg.SymmetricKeyAlgorithmTags. Only relevant for encrypting." },
     "compressionAlgorithm": { "index": 12, "kind": "attribute", "displayName": "Compression Algorithm", "group": "common", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "description": "Compression algorithm; possible values are defined in org.bouncycastle.bcpg.CompressionAlgorithmTags. Only relevant for encrypting." },
     "hashAlgorithm": { "index": 13, "kind": "attribute", "displayName": "Hash Algorithm", "group": "common", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "description": "Signature hash algorithm; possible values are defined in org.bouncycastle.bcpg.HashAlgorithmTags. Only relevant for signing." },
-    "signatureVerificationOption": { "index": 14, "kind": "attribute", "displayName": "Signature Verification Option", "group": "common", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Controls the behavior for verifying the signature during unmarshaling. Possible values: optional, required, ignore, no_signature_allowed." }
+    "signatureVerificationOption": { "index": 14, "kind": "attribute", "displayName": "Signature Verification Option", "group": "common", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Controls the behavior for verifying the signature during unmarshaling. Possible values: optional, required, ignore, no_signature_allowed." },
+    "requireIntegrityProtection": { "index": 15, "kind": "attribute", "displayName": "Require Integrity Protection", "group": "common", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether a message must be integrity protected in order to be decrypted. The legacy symmetrically encrypted data packet carries no modification detection code, and the packet type is chosen by whoever produced the message, so accepting it lets the sender decide whether the integrity check applies. Set to false only to interoperate with a sender that still emits the legacy packet." }
   }
 }

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/models/pgp.json

@@ -27,6 +27,7 @@
     "algorithm": { "index": 11, "kind": "attribute", "displayName": "Algorithm", "group": "common", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "description": "Symmetric key encryption algorithm; possible values are defined in org.bouncycastle.bcpg.SymmetricKeyAlgorithmTags. Only relevant for encrypting." },
     "compressionAlgorithm": { "index": 12, "kind": "attribute", "displayName": "Compression Algorithm", "group": "common", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "description": "Compression algorithm; possible values are defined in org.bouncycastle.bcpg.CompressionAlgorithmTags. Only relevant for encrypting." },
     "hashAlgorithm": { "index": 13, "kind": "attribute", "displayName": "Hash Algorithm", "group": "common", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "description": "Signature hash algorithm; possible values are defined in org.bouncycastle.bcpg.HashAlgorithmTags. Only relevant for signing." },
-    "signatureVerificationOption": { "index": 14, "kind": "attribute", "displayName": "Signature Verification Option", "group": "common", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Controls the behavior for verifying the signature during unmarshaling. Possible values: optional, required, ignore, no_signature_allowed." }
+    "signatureVerificationOption": { "index": 14, "kind": "attribute", "displayName": "Signature Verification Option", "group": "common", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Controls the behavior for verifying the signature during unmarshaling. Possible values: optional, required, ignore, no_signature_allowed." },
+    "requireIntegrityProtection": { "index": 15, "kind": "attribute", "displayName": "Require Integrity Protection", "group": "common", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether a message must be integrity protected in order to be decrypted. The legacy symmetrically encrypted data packet carries no modification detection code, and the packet type is chosen by whoever produced the message, so accepting it lets the sender decide whether the integrity check applies. Set to false only to interoperate with a sender that still emits the legacy packet." }
   }
 }

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-spring.xsd

@@ -9506,6 +9506,18 @@ signing.
 <![CDATA[
 Controls the behavior for verifying the signature during unmarshaling. Possible values: optional, required, ignore,
 no_signature_allowed.
+]]>
+            </xs:documentation>
+          </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="requireIntegrityProtection" type="xs:string">
+          <xs:annotation>
+            <xs:documentation xml:lang="en">
+<![CDATA[
+Whether a message must be integrity protected in order to be decrypted. The legacy symmetrically encrypted data packet
+carries no modification detection code, and the packet type is chosen by whoever produced the message, so accepting it
+lets the sender decide whether the integrity check applies. Set to false only to interoperate with a sender that still
+emits the legacy packet. Default value: true
 ]]>
             </xs:documentation>
           </xs:annotation>

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camel-xml-io.xsd

@@ -8628,6 +8628,18 @@ signing.
 <![CDATA[
 Controls the behavior for verifying the signature during unmarshaling. Possible values: optional, required, ignore,
 no_signature_allowed.
+]]>
+            </xs:documentation>
+          </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="requireIntegrityProtection" type="xs:string">
+          <xs:annotation>
+            <xs:documentation xml:lang="en">
+<![CDATA[
+Whether a message must be integrity protected in order to be decrypted. The legacy symmetrically encrypted data packet
+carries no modification detection code, and the packet type is chosen by whoever produced the message, so accepting it
+lets the sender decide whether the integrity check applies. Set to false only to interoperate with a sender that still
+emits the legacy packet. Default value: true
 ]]>
             </xs:documentation>
           </xs:annotation>

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/schemas/camelYamlDsl-model.json

@@ -12653,6 +12653,12 @@
         "type" : "string",
         "description" : "Java Cryptography Extension (JCE) provider, default is Bouncy Castle (BC). Alternatively you can use, for example, the IAIK JCE provider.",
         "title" : "Provider"
+      }, {
+        "name" : "requireIntegrityProtection",
+        "type" : "boolean",
+        "description" : "Whether a message must be integrity protected in order to be decrypted. The legacy symmetrically encrypted data packet carries no modification detection code, and the packet type is chosen by whoever produced the message, so accepting it lets the sender decide whether the integrity check applies. Set to false only to interoperate with a sender that still emits the legacy packet.",
+        "title" : "Require Integrity Protection",
+        "default" : "true"
       }, {
         "name" : "signatureKeyFileName",
         "type" : "string",

components/camel-crypto-pgp/src/generated/java/org/apache/camel/converter/crypto/PGPDataFormatConfigurer.java

@@ -31,6 +31,7 @@ public class PGPDataFormatConfigurer extends org.apache.camel.support.component.
         map.put("KeyUserid", java.lang.String.class);
         map.put("Password", java.lang.String.class);
         map.put("Provider", java.lang.String.class);
+        map.put("RequireIntegrityProtection", boolean.class);
         map.put("SignatureKeyFileName", java.lang.String.class);
         map.put("SignatureKeyRing", byte[].class);
         map.put("SignatureKeyUserid", java.lang.String.class);
@@ -56,6 +57,8 @@ public boolean configure(CamelContext camelContext, Object obj, String name, Obj
         case "keyUserid": target.setKeyUserid(property(camelContext, java.lang.String.class, value)); return true;
         case "password": target.setPassword(property(camelContext, java.lang.String.class, value)); return true;
         case "provider": target.setProvider(property(camelContext, java.lang.String.class, value)); return true;
+        case "requireintegrityprotection":
+        case "requireIntegrityProtection": target.setRequireIntegrityProtection(property(camelContext, boolean.class, value)); return true;
         case "signaturekeyfilename":
         case "signatureKeyFileName": target.setSignatureKeyFileName(property(camelContext, java.lang.String.class, value)); return true;
         case "signaturekeyring":
@@ -91,6 +94,8 @@ public Class<?> getOptionType(String name, boolean ignoreCase) {
         case "keyUserid": return java.lang.String.class;
         case "password": return java.lang.String.class;
         case "provider": return java.lang.String.class;
+        case "requireintegrityprotection":
+        case "requireIntegrityProtection": return boolean.class;
         case "signaturekeyfilename":
         case "signatureKeyFileName": return java.lang.String.class;
         case "signaturekeyring":
@@ -122,6 +127,8 @@ public Object getOptionValue(Object obj, String name, boolean ignoreCase) {
         case "keyUserid": return target.getKeyUserid();
         case "password": return target.getPassword();
         case "provider": return target.getProvider();
+        case "requireintegrityprotection":
+        case "requireIntegrityProtection": return target.isRequireIntegrityProtection();
         case "signaturekeyfilename":
         case "signatureKeyFileName": return target.getSignatureKeyFileName();
         case "signaturekeyring":

components/camel-crypto-pgp/src/generated/resources/META-INF/org/apache/camel/converter/crypto/pgp.json

@@ -30,6 +30,7 @@
     "algorithm": { "index": 11, "kind": "attribute", "displayName": "Algorithm", "group": "common", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "description": "Symmetric key encryption algorithm; possible values are defined in org.bouncycastle.bcpg.SymmetricKeyAlgorithmTags. Only relevant for encrypting." },
     "compressionAlgorithm": { "index": 12, "kind": "attribute", "displayName": "Compression Algorithm", "group": "common", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "description": "Compression algorithm; possible values are defined in org.bouncycastle.bcpg.CompressionAlgorithmTags. Only relevant for encrypting." },
     "hashAlgorithm": { "index": 13, "kind": "attribute", "displayName": "Hash Algorithm", "group": "common", "required": false, "type": "integer", "javaType": "java.lang.Integer", "deprecated": false, "autowired": false, "secret": false, "description": "Signature hash algorithm; possible values are defined in org.bouncycastle.bcpg.HashAlgorithmTags. Only relevant for signing." },
-    "signatureVerificationOption": { "index": 14, "kind": "attribute", "displayName": "Signature Verification Option", "group": "common", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Controls the behavior for verifying the signature during unmarshaling. Possible values: optional, required, ignore, no_signature_allowed." }
+    "signatureVerificationOption": { "index": 14, "kind": "attribute", "displayName": "Signature Verification Option", "group": "common", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Controls the behavior for verifying the signature during unmarshaling. Possible values: optional, required, ignore, no_signature_allowed." },
+    "requireIntegrityProtection": { "index": 15, "kind": "attribute", "displayName": "Require Integrity Protection", "group": "common", "required": false, "type": "boolean", "javaType": "java.lang.Boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether a message must be integrity protected in order to be decrypted. The legacy symmetrically encrypted data packet carries no modification detection code, and the packet type is chosen by whoever produced the message, so accepting it lets the sender decide whether the integrity check applies. Set to false only to interoperate with a sender that still emits the legacy packet." }
   }
 }

components/camel-crypto-pgp/src/main/java/org/apache/camel/converter/crypto/PGPKeyAccessDataFormat.java

@@ -163,6 +163,8 @@ public class PGPKeyAccessDataFormat extends ServiceSupport implements DataFormat
 
     private String signatureVerificationOption = "optional";
 
+    private boolean requireIntegrityProtection = true;
+
     /*
      * The default value "_CONSOLE" marks the file as For Your Eyes Only... may
      * cause problems for the receiver if they use an automated process to
@@ -418,6 +420,14 @@ public Object unmarshal(Exchange exchange, InputStream encryptedStream) throws E
                 if (!pbe.verify()) {
                     throw new PGPException("Message failed integrity check");
                 }
+            } else if (requireIntegrityProtection) {
+                // Without a modification detection code the ciphertext is malleable, and whether the check runs
+                // would otherwise be decided by the packet type the sender chose - so a sender or an intermediary
+                // could drop the protection simply by sending the legacy packet.
+                throw new PGPException(
+                        "PGP message is not integrity protected. Either send an integrity protected message, or set"
+                                       + " requireIntegrityProtection=false on the PGP decryptor to accept the legacy"
+                                       + " symmetrically encrypted data packet.");
             }
         } finally {
             IOHelper.close(osb, litData, uncompressedData, encData, in, encryptedStream);
@@ -690,6 +700,25 @@ public void setSecretKeyAccessor(PGPSecretKeyAccessor secretKeyAccessor) {
         this.secretKeyAccessor = secretKeyAccessor;
     }
 
+    public boolean isRequireIntegrityProtection() {
+        return requireIntegrityProtection;
+    }
+
+    /**
+     * Whether a message must be integrity protected in order to be decrypted.
+     * <p>
+     * An OpenPGP symmetrically encrypted integrity protected data packet carries a modification detection code, which
+     * {@code unmarshal} verifies. The older symmetrically encrypted data packet carries none, and OpenPGP's CFB mode is
+     * malleable without it, so accepting such a message means accepting ciphertext that may have been altered. Since
+     * the packet type is chosen by whoever produced the message, leaving this off lets the sender - or anyone who can
+     * rewrite the message in transit - decide whether the check applies at all.
+     * <p>
+     * Defaults to true. Set it to false only to interoperate with a sender that still emits the legacy packet.
+     */
+    public void setRequireIntegrityProtection(boolean requireIntegrityProtection) {
+        this.requireIntegrityProtection = requireIntegrityProtection;
+    }
+
     public String getSignatureVerificationOption() {
         return signatureVerificationOption;
     }

components/camel-crypto-pgp/src/test/java/org/apache/camel/converter/crypto/PGPDataFormatTest.java

@@ -98,6 +98,9 @@ public void setUpEncryptorAndDecryptor() {
         decryptor.setSignatureKeyFileName(PUB_KEY_RING_SUBKEYS_FILE_NAME);
         decryptor.setPassword("Abcd1234");
         decryptor.setSignatureKeyUserid("keyflag");
+        // the encryptor above deliberately emits the legacy packet, which carries no modification detection code,
+        // so the decryptor has to accept messages that are not integrity protected
+        decryptor.setRequireIntegrityProtection(false);
     }
 
     protected String getKeyFileName() {