introduce opportunistic option for TLS

api/src/main/java/io/grpc/TlsServerCredentials.java

@@ -67,6 +67,7 @@ public static ServerCredentials create(
   private final ClientAuth clientAuth;
   private final byte[] rootCertificates;
   private final List<TrustManager> trustManagers;
+  private final boolean isOpportunistic;
 
   TlsServerCredentials(Builder builder) {
     fakeFeature = builder.fakeFeature;
@@ -77,6 +78,7 @@ public static ServerCredentials create(
     clientAuth = builder.clientAuth;
     rootCertificates = builder.rootCertificates;
     trustManagers = builder.trustManagers;
+    isOpportunistic = builder.opportunistic;
   }
 
   /**
@@ -145,6 +147,10 @@ public List<TrustManager> getTrustManagers() {
     return trustManagers;
   }
 
+  /** Non-{@code null} setting indicating whether the server accept both plaintext and TLS traffic
+   * depending on the first message */
+  public boolean isOpportunistic() { return isOpportunistic; }
+
   /**
    * Returns an empty set if this credential can be adequately understood via
    * the features listed, otherwise returns a hint of features that are lacking
@@ -248,6 +254,8 @@ public static final class Builder {
     private byte[] rootCertificates;
     private List<TrustManager> trustManagers;
 
+    private boolean opportunistic = false;
+
     private Builder() {}
 
     /**
@@ -384,6 +392,11 @@ public Builder trustManager(TrustManager... trustManagers) {
       return this;
     }
 
+    public Builder opportunistic(boolean isEnabled) {
+      this.opportunistic = isEnabled;
+      return this;
+    }
+
     private void clearTrustManagers() {
       this.rootCertificates = null;
       this.trustManagers = null;

netty/src/main/java/io/grpc/netty/CustomOptionalSslHandler.java

@@ -0,0 +1,148 @@
+/*
+ * Copyright 2015 The gRPC Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package io.grpc.netty;
+
+import io.grpc.Channel;
+import io.grpc.netty.ProtocolNegotiators.PlaintextProtocolNegotiator;
+import io.netty.buffer.ByteBuf;
+import io.netty.buffer.ByteBufAllocator;
+import io.netty.channel.ChannelHandler;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.handler.codec.ByteToMessageDecoder;
+import io.netty.handler.ssl.SslContext;
+import io.netty.handler.ssl.SslHandler;
+import io.netty.util.ReferenceCountUtil;
+import io.netty.util.concurrent.ImmediateExecutor;
+import io.netty.util.internal.ObjectUtil;
+
+import java.util.concurrent.Executor;
+import javax.annotation.Nullable;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLParameters;
+import java.util.List;
+
+/**
+ * {@link CustomOptionalSslHandler} is a utility decoder to support both SSL and non-SSL handlers
+ * based on the first message received.
+ *
+ * <p> This is equivalent to Netty's {@link io.netty.handler.ssl.OptionalSslHandler} with a few
+ * added features:
+ * <li> The {@link CustomOptionalSslHandler} constructor takes an {@link Executor} so it can be used
+ * to create a new SslHandler if dealing with Ssl traffic. This is more in line with how the
+ * SslHandler is created when created from
+ * {@link io.grpc.netty.ProtocolNegotiators.ServerTlsHandler#handlerAdded(ChannelHandlerContext)}
+ * <li> When dealing with plaintext traffic, it's not enough to remove only the
+ * {@link CustomOptionalSslHandler}. We need to also remove the
+ * {@link io.grpc.netty.ProtocolNegotiators.ServerOpportunisticTlsHandler} so that the channel pipeline
+ * behaves the same as the traditional plaintext pipeline, and we need to call
+ * {@link ChannelHandlerContext#fireUserEventTriggered(Object)} to continue along the pipeline
+ */
+public class CustomOptionalSslHandler extends ByteToMessageDecoder {
+
+  private final SslContext sslContext;
+  private final Executor executor;
+  private final ChannelHandler next;
+
+  public CustomOptionalSslHandler(SslContext sslContext, ChannelHandler next, @Nullable Executor executor) {
+    this.sslContext = ObjectUtil.checkNotNull(sslContext, "sslContext");
+    this.next = ObjectUtil.checkNotNull(next, "next");
+    if (executor != null) {
+      this.executor = executor;
+    } else {
+      this.executor = ImmediateExecutor.INSTANCE;
+    }
+  }
+
+  @Override
+  protected void decode(ChannelHandlerContext context, ByteBuf in, List<Object> out) throws Exception {
+    // SslUtils.SSL_RECORD_HEADER_LENGTH = 5
+    if (in.readableBytes() < 5) {
+      return;
+    }
+    if (SslHandler.isEncrypted(in)) {
+      handleSsl(context);
+    } else {
+      handleNonSsl(context);
+    }
+  }
+
+  private void handleSsl(ChannelHandlerContext context) {
+    SslHandler sslHandler = null;
+    try {
+      sslHandler = newSslHandler(context, sslContext);
+      context.pipeline().replace(this, newSslHandlerName(), sslHandler);
+      sslHandler = null;
+    } finally {
+      // Since the SslHandler was not inserted into the pipeline the ownership of the SSLEngine was not
+      // transferred to the SslHandler.
+      if (sslHandler != null) {
+        ReferenceCountUtil.safeRelease(sslHandler.engine());
+      }
+    }
+  }
+
+  private void handleNonSsl(ChannelHandlerContext context) {
+    ChannelHandler handler = newNonSslHandler(context);
+    if (handler != null) {
+      context.pipeline().replace(this, newNonSslHandlerName(), handler);
+    } else {
+      context.pipeline().remove(this);
+      context.pipeline().replace(ProtocolNegotiators.ServerOpportunisticTlsHandler.class, null, next);
+      context.fireUserEventTriggered(ProtocolNegotiationEvent.DEFAULT);
+    }
+  }
+
+  /**
+   * Optionally specify the SSL handler name, this method may return {@code null}.
+   * @return the name of the SSL handler.
+   */
+  protected String newSslHandlerName() {
+    return null;
+  }
+
+  /**
+   * Override to configure the SslHandler eg. {@link SSLParameters#setEndpointIdentificationAlgorithm(String)}.
+   * The hostname and port is not known by this method so servers may want to override this method and use the
+   * {@link SslContext#newHandler(ByteBufAllocator, String, int)} variant.
+   *
+   * @param context the {@link ChannelHandlerContext} to use.
+   * @param sslContext the {@link SSLContext} to use.
+   * @return the {@link SslHandler} which will replace the {@link CustomOptionalSslHandler} in the pipeline if the
+   * traffic is SSL.
+   */
+  protected SslHandler newSslHandler(ChannelHandlerContext context, SslContext sslContext) {
+    return sslContext.newHandler(context.alloc(), executor);
+  }
+
+  /**
+   * Optionally specify the non-SSL handler name, this method may return {@code null}.
+   * @return the name of the non-SSL handler.
+   */
+  protected String newNonSslHandlerName() {
+    return null;
+  }
+
+  /**
+   * Override to configure the ChannelHandler.
+   * @param context the {@link ChannelHandlerContext} to use.
+   * @return the {@link ChannelHandler} which will replace the {@link CustomOptionalSslHandler} in the pipeline
+   * or {@code null} to simply remove the {@link CustomOptionalSslHandler} if the traffic is non-SSL.
+   */
+  protected ChannelHandler newNonSslHandler(ChannelHandlerContext context) {
+    return null;
+  }
+}

netty/src/main/java/io/grpc/netty/NettyServerBuilder.java

@@ -353,20 +353,28 @@ void setForceHeapBuffer(boolean value) {
    * have been configured with {@link GrpcSslContexts}, but options could have been overridden.
    */
   @CanIgnoreReturnValue
-  public NettyServerBuilder sslContext(SslContext sslContext) {
+  public NettyServerBuilder sslContext(SslContext sslContext, boolean oppTLS) {
     checkState(!freezeProtocolNegotiatorFactory,
                "Cannot change security when using ServerCredentials");
     if (sslContext != null) {
       checkArgument(sslContext.isServer(),
           "Client SSL context can not be used for server");
       GrpcSslContexts.ensureAlpnAndH2Enabled(sslContext.applicationProtocolNegotiator());
-      protocolNegotiatorFactory = ProtocolNegotiators.serverTlsFactory(sslContext);
+      if (oppTLS) {
+        protocolNegotiatorFactory = ProtocolNegotiators.serverOpportunisticTlsFactory(sslContext);
+      } else {
+        protocolNegotiatorFactory = ProtocolNegotiators.serverTlsFactory(sslContext);
+      }
     } else {
       protocolNegotiatorFactory = ProtocolNegotiators.serverPlaintextFactory();
     }
     return this;
   }
 
+  public NettyServerBuilder sslContext(SslContext sslContext) {
+    return sslContext(sslContext, false);
+  }
+
   /**
    * Sets the {@link ProtocolNegotiator} to be used. Overrides the value specified in {@link
    * #sslContext(SslContext)}.