-
Notifications
You must be signed in to change notification settings - Fork 181
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add support for Optional TLS negotiation for http/1 and http/2 (#2871)
Motivation ---------- In certain deployment scenarios it can be useful to accept incoming traffic on the same port for both TLS and non-TLS connections. ServiceTalk does not support this at this point, so this changeset aims to add the feature. Modifications ------------- User-facing, a new overload option for the sslConfig is introduced which allows the user to specify that insecure connections should also be accepted. When set to true, both http/1 and http/2 protocols are supported, although ServiceTalk does not support h2c cleartext upgrades so this combination is still not supported. This also works with ALPN and SNI, since the negotiation happens before the TLS connection is fully established. Internally, the OptionalSslNegotiator will determine if the incoming first bytes of the connection signify a TLS connection or not and will hand it to the right channel initializer afterwards.
- Loading branch information
Showing
24 changed files
with
801 additions
and
172 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
42 changes: 42 additions & 0 deletions
42
servicetalk-http-netty/src/main/java/io/servicetalk/http/netty/NoopChannelInitializer.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| /* | ||
| * Copyright © 2024 Apple Inc. and the ServiceTalk project authors | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package io.servicetalk.http.netty; | ||
|
|
||
| import io.servicetalk.transport.netty.internal.ChannelInitializer; | ||
|
|
||
| import io.netty.channel.Channel; | ||
|
|
||
| /** | ||
| * {@link ChannelInitializer} that does not do anything. | ||
| */ | ||
| final class NoopChannelInitializer implements ChannelInitializer { | ||
|
|
||
| static final ChannelInitializer INSTANCE = new NoopChannelInitializer(); | ||
|
|
||
| private NoopChannelInitializer() { | ||
| // Singleton | ||
| } | ||
|
|
||
| @Override | ||
| public void init(final Channel channel) { | ||
| // NOOP | ||
| } | ||
|
|
||
| @Override | ||
| public ChannelInitializer andThen(final ChannelInitializer after) { | ||
| return after; | ||
| } | ||
| } |
94 changes: 94 additions & 0 deletions
94
servicetalk-http-netty/src/main/java/io/servicetalk/http/netty/OptionalSslChannelSingle.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| /* | ||
| * Copyright © 2024 Apple Inc. and the ServiceTalk project authors | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package io.servicetalk.http.netty; | ||
|
|
||
| import io.servicetalk.concurrent.SingleSource; | ||
|
|
||
| import io.netty.buffer.ByteBuf; | ||
| import io.netty.channel.Channel; | ||
| import io.netty.channel.ChannelHandler; | ||
| import io.netty.channel.ChannelHandlerContext; | ||
| import io.netty.handler.codec.ByteToMessageDecoder; | ||
| import io.netty.handler.ssl.SslHandler; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| import java.util.List; | ||
| import javax.annotation.Nullable; | ||
|
|
||
| /** | ||
| * Part of a {@link io.netty.channel.ChannelInitializer} which negotiates SSL/non-SSL connections when SSL is enabled. | ||
| */ | ||
| final class OptionalSslChannelSingle extends ChannelInitSingle<Boolean> { | ||
|
|
||
| OptionalSslChannelSingle(final Channel channel) { | ||
| super(channel, NoopChannelInitializer.INSTANCE); | ||
| } | ||
|
|
||
| @Override | ||
| protected ChannelHandler newChannelHandler(final Subscriber<? super Boolean> subscriber) { | ||
| return new OptionalSslHandler(subscriber); | ||
| } | ||
|
|
||
| private static final class OptionalSslHandler extends ByteToMessageDecoder { | ||
|
|
||
| private static final Logger LOGGER = LoggerFactory.getLogger(OptionalSslHandler.class); | ||
|
|
||
| /** | ||
| * the length of the ssl record header (in bytes) | ||
| */ | ||
| private static final int SSL_RECORD_HEADER_LENGTH = 5; | ||
|
|
||
| @Nullable | ||
| SingleSource.Subscriber<? super Boolean> subscriber; | ||
|
|
||
| OptionalSslHandler(final SingleSource.Subscriber<? super Boolean> subscriber) { | ||
| this.subscriber = subscriber; | ||
| } | ||
|
|
||
| @Override | ||
| public void handlerAdded(final ChannelHandlerContext ctx) throws Exception { | ||
| if (ctx.channel().isActive()) { | ||
| ctx.read(); // we need to force a read to detect SSL yes/no | ||
| } | ||
| super.handlerAdded(ctx); | ||
| } | ||
|
|
||
| @Override | ||
| public void channelActive(final ChannelHandlerContext ctx) throws Exception { | ||
| ctx.read(); // we need to force a read to detect SSL yes/no | ||
| ctx.fireChannelActive(); | ||
| } | ||
|
|
||
| @Override | ||
| protected void decode(final ChannelHandlerContext ctx, final ByteBuf in, final List<Object> out) { | ||
| if (in.readableBytes() < SSL_RECORD_HEADER_LENGTH || subscriber == null) { | ||
| return; | ||
| } | ||
| boolean isEncrypted = SslHandler.isEncrypted(in); | ||
| LOGGER.debug("{} Detected TLS for this connection: {}", ctx.channel(), isEncrypted); | ||
| final SingleSource.Subscriber<? super Boolean> subscriberCopy = subscriber; | ||
| subscriber = null; | ||
| subscriberCopy.onSuccess(isEncrypted); | ||
|
|
||
| // Need to make sure that when this handler is removed, there is another handler in the pipeline | ||
| // to pick up the read bytes from ByteToMessageDecoder when this handler is removed. | ||
| assert ctx.executor().inEventLoop(); | ||
| assert ctx.pipeline().last() != this; | ||
| ctx.pipeline().remove(this); | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.