ZOOKEEPER-4790: Make client hostname verification configurable

[nightkr]

FIPS mode technically covers this, in a sort of sledgehammery way, but I think it's still worthwhile to have an explicit option for this and only this. Especially since FIPS compliance is a pretty broad thing (see ZOOKEEPER-4832) that will likely expand in the future to cover a lot of things that may or may not be desired.

[anmolnar]

Accidentally closed the PR, sorry. Wanted to ask:

Have you considered replacing the current apporach with separate config settings?

• zookeeper.ssl.(quorum.)server.hostnameVerification
• zookeeper.ssl.(quorum.)client.hostnameVerification

[nightkr]

In a green field I think that makes sense, but I don't think it's worth breaking the old config value "just" for this.

[anmolnar]

In a green field I think that makes sense, but I don't think it's worth breaking the old config value "just" for this.

You can keep backward compatibility by parsing both zookeeper.ssl.server.hostnameVerification and zookeeper.ssl.hostnameVerification as the server setting.

[anmolnar]

@nightkr Ignore my previous comment. Since client hostname verification is bound to server hostname verification setting, it makes sense to keep the original and general hostnameVerification setting. It enables/disabled the entire feature. Your patch is good as it is, just elaborate a bit in the admin documentation.

[nightkr]

Sorry about the delay, got distracted by other stuff.