ZOOKEEPER-5070: Support Single EKU certificates

zookeeper-server/src/main/java/org/apache/zookeeper/common/ClientX509Util.java

@@ -74,7 +74,7 @@ public SslContext createNettySslContextForClient(ZKConfig config)
 
         SslContextBuilder sslContextBuilder = SslContextBuilder.forClient();
 
-        KeyManager km = buildKeyManager(config);
+        KeyManager km = buildClientKeyManager(config);
         if (km != null) {
             sslContextBuilder.keyManager(km);
         }
@@ -116,7 +116,7 @@ public SslContext createNettySslContextForServer(ZKConfig config)
             throw new X509Exception.SSLContextException(
                 "Keystore is required for SSL server: " + getSslKeystoreLocationProperty());
         }
-        return createNettySslContextForServer(config, km, buildTrustManager(config));
+        return createNettySslContextForServer(config, km, buildServerTrustManager(config));
     }
 
     public SslContext createNettySslContextForServer(ZKConfig config, KeyManager keyManager, TrustManager trustManager) throws SSLException {

zookeeper-server/src/main/java/org/apache/zookeeper/common/SSLContextAndOptions.java

@@ -31,7 +31,7 @@
 import org.slf4j.LoggerFactory;
 
 /**
- * Wrapper class for an SSLContext + some config options that can't be set on the context when it is created but
+ * Wrapper class for SSLContexts and config options that can't be set on the context when it is created but
  * must be set on a secure socket created by the context after the socket creation. By wrapping the options in this
  * class we avoid reading from global system properties during socket configuration. This makes testing easier
  * since we can create different X509Util instances with different configurations in a single test process, and
@@ -45,52 +45,68 @@ public class SSLContextAndOptions {
     private final String[] enabledProtocols;
     private final String[] cipherSuites;
     private final X509Util.ClientAuth clientAuth;
-    private final SSLContext sslContext;
+    private final SSLContext clientSSLContext;
+    private final SSLContext serverSSLContext;
     private final int handshakeDetectionTimeoutMillis;
 
-
     /**
+     * Creates an SSLContextAndOptions with separate client and server contexts.
      * Note: constructor is intentionally package-private, only the X509Util class should be creating instances of this
      * class.
      * @param x509Util the X509Util that created this object.
      * @param config a ZKConfig that holds config properties.
-     * @param sslContext the SSLContext.
+     * @param clientSSLContext the SSLContext for connecting as a client.
+     * @param serverSSLContext the SSLContext for accepting connections as a server.
      */
-    SSLContextAndOptions(final X509Util x509Util, final ZKConfig config, final SSLContext sslContext) {
+    SSLContextAndOptions(final X509Util x509Util, final ZKConfig config,
+                         final SSLContext clientSSLContext, final SSLContext serverSSLContext) {
         this.x509Util = requireNonNull(x509Util);
-        this.sslContext = requireNonNull(sslContext);
-        this.enabledProtocols = getEnabledProtocols(requireNonNull(config), sslContext);
+        this.clientSSLContext = requireNonNull(clientSSLContext);
+        this.serverSSLContext = requireNonNull(serverSSLContext);
+        this.enabledProtocols = getEnabledProtocols(requireNonNull(config), clientSSLContext);
         this.cipherSuites = getCipherSuites(config);
         this.clientAuth = getClientAuth(config);
         this.handshakeDetectionTimeoutMillis = getHandshakeDetectionTimeoutMillis(config);
     }
 
-    public SSLContext getSSLContext() {
-        return sslContext;
+    /**
+     * Creates an SSLContextAndOptions with a single context used for both roles.
+     * Note: constructor is intentionally package-private, only the X509Util class should be creating instances of this
+     * class.
+     * @param x509Util the X509Util that created this object.
+     * @param config a ZKConfig that holds config properties.
+     * @param sslContext the SSLContext.
+     */
+    SSLContextAndOptions(final X509Util x509Util, final ZKConfig config, final SSLContext sslContext) {
+        this(x509Util, config, sslContext, sslContext);
+    }
+
+    public SSLContext getClientSSLContext() {
+        return clientSSLContext;
     }
 
     public SSLSocket createSSLSocket() throws IOException {
-        return configureSSLSocket((SSLSocket) sslContext.getSocketFactory().createSocket(), true);
+        return configureSSLSocket((SSLSocket) clientSSLContext.getSocketFactory().createSocket(), true);
     }
 
     public SSLSocket createSSLSocket(Socket socket, byte[] pushbackBytes) throws IOException {
         SSLSocket sslSocket;
         if (pushbackBytes != null && pushbackBytes.length > 0) {
-            sslSocket = (SSLSocket) sslContext.getSocketFactory()
+            sslSocket = (SSLSocket) serverSSLContext.getSocketFactory()
                                               .createSocket(socket, new ByteArrayInputStream(pushbackBytes), true);
         } else {
-            sslSocket = (SSLSocket) sslContext.getSocketFactory().createSocket(socket, null, socket.getPort(), true);
+            sslSocket = (SSLSocket) serverSSLContext.getSocketFactory().createSocket(socket, null, socket.getPort(), true);
         }
         return configureSSLSocket(sslSocket, false);
     }
 
     public SSLServerSocket createSSLServerSocket() throws IOException {
-        SSLServerSocket sslServerSocket = (SSLServerSocket) sslContext.getServerSocketFactory().createServerSocket();
+        SSLServerSocket sslServerSocket = (SSLServerSocket) serverSSLContext.getServerSocketFactory().createServerSocket();
         return configureSSLServerSocket(sslServerSocket);
     }
 
     public SSLServerSocket createSSLServerSocket(int port) throws IOException {
-        SSLServerSocket sslServerSocket = (SSLServerSocket) sslContext.getServerSocketFactory().createServerSocket(port);
+        SSLServerSocket sslServerSocket = (SSLServerSocket) serverSSLContext.getServerSocketFactory().createServerSocket(port);
         return configureSSLServerSocket(sslServerSocket);
     }