[PR] ZOOKEEPER-4990: accept ssl.* in client config [zookeeper]

["seekskyworld (via GitHub)" <gi...@apache.org>]

seekskyworld opened a new pull request, #2343:
URL: https://github.com/apache/zookeeper/pull/2343

   Summary:
   - Allow ZKClientConfig to fall back to server-style ssl.* keys when zookeeper.ssl.* is absent.
   - Add test coverage for the fallback and precedence behavior.
   - Document zkCli TLS client.properties usage.
   
   Motivation:
   Client config files copied from zoo.cfg (ssl.* keys) don’t populate zookeeper.ssl.* today, which can lead to TLS handshake failures. This makes zkCli client configuration compatible with server-style keys while keeping zookeeper.ssl.* as the preferred form.
   
   Validation:
   - mvn -pl zookeeper-server -Dtest=ZKClientConfigTest test (Passed)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] ZOOKEEPER-4990: accept ssl.* in client config [zookeeper]

["anmolnar (via GitHub)" <gi...@apache.org>]

anmolnar commented on code in PR #2343:
URL: https://github.com/apache/zookeeper/pull/2343#discussion_r3101600794


##########
zookeeper-server/src/test/java/org/apache/zookeeper/client/ZKClientConfigTest.java:
##########
@@ -125,6 +126,34 @@ public void testReadConfigurationFile(@TempDir File testDataDir) throws IOExcept
         assertEquals(conf.getProperty("dummyProperty"), "dummyValue");
     }
 
+    @Test
+    @Timeout(value = 10)
+    public void testServerSslPropertyFallback(@TempDir File testDataDir) throws IOException, ConfigException {
+        File file = File.createTempFile("clientConfigSsl", ".conf", testDataDir);
+        Properties clientConfProp = new Properties();
+        clientConfProp.setProperty("ssl.trustStore.location", "/tmp/server-truststore.jks");
+        clientConfProp.setProperty("ssl.trustStore.password", "server-pass");
+        clientConfProp.setProperty("ssl.keyStore.location", "/tmp/server-keystore.jks");
+        clientConfProp.setProperty("ssl.keyStore.password", "server-pass");
+        clientConfProp.setProperty("zookeeper.ssl.trustStore.location", "/tmp/client-truststore.jks");

Review Comment:
   Should be just `ssl.trustStore.location`, right?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] ZOOKEEPER-4990: accept ssl.* in client config [zookeeper]

["anmolnar (via GitHub)" <gi...@apache.org>]

anmolnar commented on PR #2343:
URL: https://github.com/apache/zookeeper/pull/2343#issuecomment-4269508922

   Oh, I see know. These properties already work fine in the client config if the `zookeeper.` prefix is present. You actually want to use your `zoo.cfg` server config file for client configuration without modification. 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] ZOOKEEPER-4990: accept ssl.* in client config [zookeeper]

["anusha975 (via GitHub)" <gi...@apache.org>]

anusha975 commented on PR #2343:
URL: https://github.com/apache/zookeeper/pull/2343#issuecomment-3939072855

   All checks are passing and test coverage has been added.
   
   When convenient, could a committer please review and merge if everything looks good?
   
   Thank you for your time.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org