ZOOKEEPER-4958: Fix client hostname verification ignored in server if ssl.authProvider configured

zookeeper-server/src/main/java/org/apache/zookeeper/server/ZooKeeperServerMain.java

@@ -242,15 +242,13 @@ ServerCnxnFactory getSecureCnxnFactory() {
         return secureCnxnFactory;
     }
 
-    // VisibleForTesting
     public int getClientPort() {
         if (cnxnFactory != null) {
             return cnxnFactory.getLocalPort();
         }
         return 0;
     }
 
-    // VisibleForTesting
     public int getSecureClientPort() {
         if (secureCnxnFactory != null) {
             return secureCnxnFactory.getLocalPort();

zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/KeyAuthenticationProvider.java

@@ -37,7 +37,7 @@
  * See the "Pluggable ZooKeeper authentication" section of the
  * "Zookeeper Programmer's Guide" for general details of implementing an
  * authentication plugin. e.g.
- * http://zookeeper.apache.org/doc/trunk/zookeeperProgrammers.html#sc_ZooKeeperPluggableAuthentication
+ * http://zookeeper.apache.org/doc/current/zookeeperProgrammers.html#sc_ZooKeeperPluggableAuthentication
  *
  * This class looks for a numeric "key" under the /key node.
  * Authorization is granted if the user passes in as authorization a number

zookeeper-server/src/main/java/org/apache/zookeeper/server/auth/X509AuthenticationProvider.java

@@ -89,6 +89,7 @@ public X509AuthenticationProvider() throws X509Exception {
             boolean crlEnabled = config.getBoolean(x509Util.getSslCrlEnabledProperty(), Boolean.getBoolean("com.sun.net.ssl.checkRevocation"));
             boolean ocspEnabled = config.getBoolean(x509Util.getSslOcspEnabledProperty(), Boolean.parseBoolean(Security.getProperty("ocsp.enable")));
             boolean hostnameVerificationEnabled = Boolean.parseBoolean(config.getProperty(x509Util.getSslHostnameVerificationEnabledProperty()));
+            boolean clientHostnameVerificationEnabled = x509Util.isClientHostnameVerificationEnabled(config);
 
             X509KeyManager km = null;
             X509TrustManager tm = null;
@@ -120,7 +121,7 @@ public X509AuthenticationProvider() throws X509Exception {
                         crlEnabled,
                         ocspEnabled,
                         hostnameVerificationEnabled,
-                        false,
+                        clientHostnameVerificationEnabled,
                         fipsMode);
                 } catch (TrustManagerException e) {
                     LOG.error("Failed to create trust manager", e);

zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbedded.java

@@ -116,6 +116,16 @@ static ZookKeeperServerEmbeddedBuilder builder() {
      */
     void start(long startupTimeout) throws Exception;
 
+    /**
+     * Get client port for no secure connection.
+     */
+    int getClientPort();
+
+    /**
+     * Get client port for secure connection.
+     */
+    int getSecureClientPort();
+
     /**
      * Get a connection string useful for the client.
      * @return the connection string

zookeeper-server/src/main/java/org/apache/zookeeper/server/embedded/ZooKeeperServerEmbeddedImpl.java

@@ -107,8 +107,8 @@ protected QuorumPeer getQuorumPeer() throws SaslException {
                         @Override
                         public void start() {
                             super.start();
-                            boundClientPort = getClientPort();
-                            boundSecureClientPort = getSecureClientPort();
+                            boundClientPort = super.getClientPort();
+                            boundSecureClientPort = super.getSecureClientPort();
                             LOG.info("ZK Server {} started", this);
                             started.complete(null);
                         }
@@ -148,8 +148,8 @@ public void run() {
                 @Override
                 public void serverStarted() {
                     LOG.info("ZK Server started");
-                    boundClientPort = getClientPort();
-                    boundSecureClientPort = getSecureClientPort();
+                    boundClientPort = super.getClientPort();
+                    boundSecureClientPort = super.getSecureClientPort();
                     started.complete(null);
                 }
             };
@@ -190,6 +190,16 @@ public void run() {
         }
     }
 
+    @Override
+    public int getClientPort() {
+        return boundClientPort;
+    }
+
+    @Override
+    public int getSecureClientPort() {
+        return boundSecureClientPort;
+    }
+
     @Override
     public String getConnectionString() {
         return prettifyConnectionString(config.getClientPortAddress(), boundClientPort);