Karavan SSL verification

[mostafammagdy]

Describe the bug

I am using Karavan VS code and I am trying to create a bean called CertCheck to add my truststore (which is located in another location other than my karavan project) and set Ssl Context Parameters in the HTTPS component but each time I try to do jbang run I face the below error :

Error pre-parsing resource: file:Reefy.camel.yaml
        at org.apache.camel.dsl.yaml.YamlRoutesBuilderLoader.preParseRoute(YamlRoutesBuilderLoader.java:975)
        at org.apache.camel.main.RoutesConfigurer.doConfigureModeline(RoutesConfigurer.java:374)
        at org.apache.camel.main.RoutesConfigurer.configureModeline(RoutesConfigurer.java:300)
        at org.apache.camel.main.BaseMainSupport.modelineRoutes(BaseMainSupport.java:607)
        at org.apache.camel.main.BaseMainSupport.autoconfigure(BaseMainSupport.java:474)
        at org.apache.camel.main.MainSupport.autoconfigure(MainSupport.java:73)       
        at org.apache.camel.main.KameletMain.autoconfigure(KameletMain.java:685)      
        at org.apache.camel.main.BaseMainSupport.postProcessCamelContext(BaseMainSupport.java:685)
        at org.apache.camel.main.MainSupport.initCamelContext(MainSupport.java:339)   
        at org.apache.camel.main.KameletMain.doInit(KameletMain.java:355)
        at org.apache.camel.support.service.BaseService.init(BaseService.java:78)     
        at org.apache.camel.support.service.BaseService.start(BaseService.java:105)   
        at org.apache.camel.dsl.jbang.core.commands.Run.runKameletMain(Run.java:1299) 
        at org.apache.camel.dsl.jbang.core.commands.Run.run(Run.java:844)
        at org.apache.camel.dsl.jbang.core.commands.Run.doCall(Run.java:315)
        at org.apache.camel.dsl.jbang.core.commands.CamelCommand.call(CamelCommand.java:71)
        at org.apache.camel.dsl.jbang.core.commands.CamelCommand.call(CamelCommand.java:37)
        at picocli.CommandLine.executeUserObject(CommandLine.java:2041)
        at picocli.CommandLine.access$1500(CommandLine.java:148)
        at picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2461)
        at picocli.CommandLine$RunLast.handle(CommandLine.java:2453)
        at picocli.CommandLine$RunLast.handle(CommandLine.java:2415)
        at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:2273)
        at picocli.CommandLine$RunLast.execute(CommandLine.java:2417)
        at picocli.CommandLine.execute(CommandLine.java:2170)
        at org.apache.camel.dsl.jbang.core.commands.CamelJBangMain.run(CamelJBangMain.java:165)
        at org.apache.camel.dsl.jbang.core.commands.CamelJBangMain.run(CamelJBangMain.java:61)
        at main.CamelJBang.main(CamelJBang.java:36)
Caused by: java.lang.RuntimeException: Error creating bean: CertCheck of type: #class:HttpClientConfigurerTrustAllCACerts
        at org.apache.camel.dsl.yaml.deserializers.BeansDeserializer.registerBean(BeansDeserializer.java:118)
        at org.apache.camel.dsl.yaml.deserializers.BeansDeserializer$BeansCustomizer.configure(BeansDeserializer.java:141)
        at org.apache.camel.dsl.yaml.YamlRoutesBuilderLoader.preParseNode(YamlRoutesBuilderLoader.java:995)
        at org.apache.camel.dsl.yaml.YamlRoutesBuilderLoader.lambda$preParseRoute$6(YamlRoutesBuilderLoader.java:973)
        at java.base/java.util.Optional.map(Optional.java:260)
        at org.apache.camel.dsl.yaml.YamlRoutesBuilderLoader.preParseRoute(YamlRoutesBuilderLoader.java:973)
        ... 27 more
Caused by: java.lang.ClassNotFoundException: HttpClientConfigurerTrustAllCACerts      
Caused by: java.lang.ClassNotFoundException: HttpClientConfigurerTrustAllCACerts
Caused by: java.lang.ClassNotFoundException: HttpClientConfigurerTrustAllCACerts
        at org.apache.camel.impl.engine.DefaultClassResolver.resolveMandatoryClass(DefaultClassResolver.java:125)
        at org.apache.camel.support.PropertyBindingSupport.resolveBean(PropertyBindingSupport.java:1566)
assResolver.java:125)
        at org.apache.camel.support.PropertyBindingSupport.resolveBean(PropertyBindingSupporassResolver.java:125)
assResolver.java:125)
assResolver.java:125)
        at org.apache.camel.support.PropertyBindingSupport.resolveBean(PropertyBindingSupport.java:1566)
        at org.apache.camel.model.BeanModelHelper.newInstance(BeanModelHelper.java:132)     
        at org.apache.camel.dsl.yaml.deserializers.BeansDeserializer.registerBean(BeansDeserassResolver.java:125)
        at org.apache.camel.support.PropertyBindingSupport.resolveBean(PropertyBindingSupport.java:1566)
        at org.apache.camel.model.BeanModelHelper.newInstance(BeanModelHelper.java:132)     
assResolver.java:125)
        at org.apache.camel.support.PropertyBindingSupport.resolveBean(PropertyBindingSupport.java:1566)
assResolver.java:125)
        at org.apache.camel.support.PropertyBindingSupport.resolveBean(PropertyBindingSupporassResolver.java:125)
        at org.apache.camel.support.PropertyBindingSupport.resolveBean(PropertyBindingSupport.java:1566)
        at org.apache.camel.model.BeanModelHelper.newInstance(BeanModelHelper.java:132)     
        at org.apache.camel.dsl.yaml.deserializers.BeansDeserializer.registerBean(BeansDeserializer.java:110)
        ... 32 more

here is the bean code :

import java.security.KeyManagementException;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.SSLContext;
import org.apache.hc.client5.http.ssl.NoopHostnameVerifier;
import org.apache.hc.client5.http.classic.HttpClient;
import org.apache.hc.client5.http.impl.classic.HttpClientBuilder;
import org.apache.camel.component.http.HttpClientConfigurer;
import org.apache.hc.core5.http.config.Registry;
import org.apache.hc.core5.http.config.RegistryBuilder;
import org.apache.hc.client5.http.socket.ConnectionSocketFactory;
import org.apache.hc.client5.http.socket.PlainConnectionSocketFactory;
import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory;
import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactoryBuilder;
import org.apache.hc.core5.ssl.SSLContextBuilder;
import org.apache.hc.core5.ssl.TrustStrategy;
import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager;
// import org.apache.http.impl.conn.BasicHttpClientConnectionManager;
import org.apache.camel.BindToRegistry;
import org.apache.camel.Configuration;

@Configuration
@BindToRegistry("HttpClientConfigurerTrustAllCACerts")


public class HttpClientConfigurerTrustAllCACerts implements HttpClientConfigurer {

    // HttpClientBuilder clientBuilder;

	@Override
	public void configureHttpClient(HttpClientBuilder clientBuilder) {
		// setup a Trust Strategy that allows all certificates.
	    //
	    SSLContext sslContext = null;
		try {
			sslContext = new SSLContextBuilder().loadTrustMaterial(null, new TrustStrategy() {
			    public boolean isTrusted(X509Certificate[] arg0, String arg1) throws CertificateException {
			        return true;
			    }
			}).build();
		} catch (KeyManagementException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		} catch (NoSuchAlgorithmException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		} catch (KeyStoreException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		}
	    // clientBuilder.setSslcontext( sslContext);
	 
	    // don't check Hostnames, either.
	    //      -- use SSLConnectionSocketFactory.getDefaultHostnameVerifier(), if you don't want to weaken
		// NoopHostnameVerifier noopHostnameVerifier ;
	    // HostnameVerifier hostnameVerifier =  noopHostnameVerifier ;
	 
	    // here's the special part:
	    //      -- need to create an SSL Socket Factory, to use our weakened "trust strategy";
	    //      -- and create a Registry, to register it.
	    //
	    SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);
	    Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create()
	            .register("http", PlainConnectionSocketFactory.getSocketFactory())
	            .register("https", sslSocketFactory)
	            .build();
	 
	    // now, we create connection-manager using our Registry.
	    //      -- allows multi-threaded use
	 PoolingHttpClientConnectionManager connectionManager = new PoolingHttpClientConnectionManager( socketFactoryRegistry);

	//  final BasicHttpClientConnectionManager connectionManager = new BasicHttpClientConnectionManager(socketFactoryRegistry);

	 clientBuilder.setConnectionManager(connectionManager);
	}

}
 

Is there any better way to add the truststore or disable SSL verification to my project?

Steps to reproduce the behavior

Same as described above

Variant

Vs Code Extension

Container Management (if applicable)

None

Operating System (if applicable)

Windows

Version

4.6.0

Relevant log output

No response

[davsclaus]

Try with latest version of karavan first

[mostafammagdy]

@davsclaus updated to the latest version and still getting the same error

[davsclaus]

You use @BindToRegistry("HttpClientConfigurerTrustAllCACerts") which is the bean id, you can call it "allCaCerts" to keep it more easier. And then in the yaml route, then refer to this bean via #bean:allCaCerts instead of the #class syntax

[samar-elsayed]

Hi @davsclaus
Actually me and @mostafammagdy have already tried that before but it is still not working

[davsclaus]

try outside karavan with local camel-jbang and save the files to a folder, and use camel run *

[samar-elsayed]

@davsclaus I have tried that now but faced the same error, the bean file exists in the same path where I ran camel run *

[samar-elsayed]

@davsclaus if you have a working example that serves the same purpose we have mentioned here (configure SSL params through a bean ) please share it with us

[davsclaus]

You can configure global SSL via camel.ssl.xxx options in application.properties - Use file:xxx to refer to file location of trust/key store files etc. More options being added in Camel 4.8.
https://camel.apache.org/components/4.4.x/others/main.html#_camel_ssl_configurations

For custom java code then you can put your code somewhere where others can download and try them. And as said try in pure jbang to have more power and ensure that the java code you have can compile.

[samar-elsayed]

Thank you for your usual support, I was able to make the bean be included and the CLASS NOT FOUND was solved successfully.
also the truststore was loaded successfully without the need to actually use these properties :

camel.ssl.trustStore= file\:cacerts
camel.ssl.trustStorePassword= null
# camel.ssl.enabled= false

(I think since JAVA_HOME is set then the default cacerts path is already detected by camel automatically)

@davsclaus I just have one last question before closing the discussion, I noticed that using these properties didn't actually do anything like for example using: camel.ssl.enabled= false didn't actually let apache camel pypass the SSL Certificate check / verification

So just in case we had a scenario where we need to disable / skip the SSL certificate check, what property should we use ?

[davsclaus]

You can add some custom trust all certificate "thingy" (i cant recall the name on top of my head)

[davsclaus]

https://issues.apache.org/jira/browse/CAMEL-21128