[SOLR-16679] Fix solr.jetty.ssl.verifyClientHostName logging

• Type: Task
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: main (10.0), 9.2
• Assignee: Kevin Risden
• Reporter: Kevin Risden
• Created: 22/Feb/23 14:41
• Updated: 27/Mar/23 18:04
• Resolved: 27/Feb/23 17:02

Description

In SOLR-16669, houston found in https://github.com/apache/solr/pull/1367

Main with #1366 included:

2023-02-22 09:28:49.232 WARN  (main) [] o.e.j.u.s.S.config Trusting all certificates configured for Client@1d901f20[provider=null,keyStore=null,trustStore=null]
2023-02-22 09:28:49.233 WARN  (main) [] o.e.j.u.s.S.config No Client EndPointIdentificationAlgorithm configured for Client@1d901f20[provider=null,keyStore=null,trustStore=null]
2023-02-22 09:28:49.339 WARN  (main) [] o.e.j.u.s.S.config Trusting all certificates configured for Client@760487aa[provider=null,keyStore=null,trustStore=null]
2023-02-22 09:28:49.339 WARN  (main) [] o.e.j.u.s.S.config No Client EndPointIdentificationAlgorithm configured for Client@760487aa[provider=null,keyStore=null,trustStore=null]

Then with this change:

2023-02-22 09:31:12.602 WARN  (main) [] o.e.j.u.s.S.config No Client EndPointIdentificationAlgorithm configured for Client@2c9a6717[provider=null,keyStore=null,trustStore=null]
2023-02-22 09:31:12.690 WARN  (main) [] o.e.j.u.s.S.config No Client EndPointIdentificationAlgorithm configured for Client@760487aa[provider=null,keyStore=null,trustStore=null]

That is due to this line:

sslContextFactory.setEndpointIdentificationAlgorithm(
        System.getProperty("solr.jetty.ssl.verifyClientHostName"));

It seems like this stems from https://issues.apache.org/jira/browse/SOLR-14163, so we have the perfect people to discuss this @janhoy & @risdenk ! I'll leave it to y'all if we want to use "HTTPS" as the default. That will make the last 2 warnings go away. We can also deal with this in a different PR/issue if y'all want to, it's pretty unrelated. (I will say the SolrJ tests work with HTTPS as the default for this sysProp, so it will work for users using HTTP)

We should default to HTTPS if TLS is not enabled. It looks like we disable client hostname verification by default and the setting solr.jetty.ssl.verifyClientHostName only applies if TLS is enabled.

Issue Links

• relates to: SOLR-14163 SOLR_SSL_CLIENT_HOSTNAME_VERIFICATION needs to work with Jetty server/client SSL contexts
• relates to: SOLR-16669 Http2SolrClient defaults checkPeerName incorrectly
• links to: GitHub Pull Request #1376