ZKTrustManager extends X509ExtendedTrustManager { @Override public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket) throws CertificateException { x509ExtendedTrustManager.checkServerTrusted(chain, authType, socket); if (serverHostnameVerificationEnabled) { performHostVerification(socket.getInetAddress(), chain[0]); } } ZKTrustManager(X509ExtendedTrustManager x509ExtendedTrustManager, boolean serverHostnameVerificationEnabled,
                   boolean clientHostnameVerificationEnabled); @Override X509Certificate[] getAcceptedIssuers(); @Override void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket); @Override void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket); @Override void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine); @Override void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine); @Override void checkClientTrusted(X509Certificate[] chain, String authType); @Override void checkServerTrusted(X509Certificate[] chain, String authType);  }
@Test public void testServerHostnameVerificationWithHostnameVerificationDisabled() throws Exception { ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, false); X509Certificate[] certificateChain = createSelfSignedCertifcateChain(IP_ADDRESS, HOSTNAME); zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket); verify(mockInetAddress, times(0)).getHostAddress(); verify(mockInetAddress, times(0)).getHostName(); verify(mockX509ExtendedTrustManager, times(1)).checkServerTrusted(certificateChain, null, mockSocket); }
@Test public void testServerHostnameVerificationWithHostnameVerificationDisabledAndClientHostnameVerificationEnabled() throws Exception { ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, false, true); X509Certificate[] certificateChain = createSelfSignedCertifcateChain(IP_ADDRESS, HOSTNAME); zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket); verify(mockInetAddress, times(0)).getHostAddress(); verify(mockInetAddress, times(0)).getHostName(); verify(mockX509ExtendedTrustManager, times(1)).checkServerTrusted(certificateChain, null, mockSocket); }
@Test public void testServerHostnameVerificationWithIPAddress() throws Exception { ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false); X509Certificate[] certificateChain = createSelfSignedCertifcateChain(IP_ADDRESS, null); zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket); verify(mockInetAddress, times(1)).getHostAddress(); verify(mockInetAddress, times(0)).getHostName(); verify(mockX509ExtendedTrustManager, times(1)).checkServerTrusted(certificateChain, null, mockSocket); }
@Test public void testServerHostnameVerificationWithHostname() throws Exception { ZKTrustManager zkTrustManager = new ZKTrustManager(mockX509ExtendedTrustManager, true, false); X509Certificate[] certificateChain = createSelfSignedCertifcateChain(null, HOSTNAME); zkTrustManager.checkServerTrusted(certificateChain, null, mockSocket); verify(mockInetAddress, times(1)).getHostAddress(); verify(mockInetAddress, times(1)).getHostName(); verify(mockX509ExtendedTrustManager, times(1)).checkServerTrusted(certificateChain, null, mockSocket); }