[HADOOP-16718] Allow disabling Server Name Indication (SNI) for Jetty

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.2.1
• Fix Version/s: 3.3.0, 3.1.4, 3.2.2
• Target Version/s: 3.3.0, 3.1.4, 3.2.2
• Assignee: Aravindan Vijayan
• Reporter: Siyao Meng
• Created: 18/Nov/19 22:33
• Updated: 07/Dec/23 17:59
• Resolved: 03/Dec/19 23:55

Description

As of now, createHttpsChannelConnector() enables SNI by default with Jetty:

    private ServerConnector createHttpsChannelConnector(
        Server server, HttpConfiguration httpConfig) {
      httpConfig.setSecureScheme(HTTPS_SCHEME);
      httpConfig.addCustomizer(new SecureRequestCustomizer());
      ServerConnector conn = createHttpChannelConnector(server, httpConfig);

with the default constructor without any parameters automatically setting sniHostCheck to true:

    public SecureRequestCustomizer()
    {
        this(true);
    }

Proposal: We should make this configurable and probably default this to false.

Credit: Aravindan Vijayan

Issue Links

• is related to: HDDS-9878 Disable Server Name Indication (SNI) for Jetty