Revert "Re-enabled TLS netty"
This reverts commit 1a37866929ca05acba71cdadad87dd563b6064dd.
Change-Id: I04cdfe02f70b608b1951c4dee38cb4e345f198d5
diff --git a/protocols/grpc/BUILD b/protocols/grpc/BUILD
index a3f3f46..26e178c 100644
--- a/protocols/grpc/BUILD
+++ b/protocols/grpc/BUILD
@@ -18,6 +18,18 @@
"@io_opencensus_opencensus_api//jar",
"@io_opencensus_opencensus_contrib_grpc_metrics//jar",
"@com_google_code_gson_gson//jar",
+ # Lazily adding all netty-related packages.
+ # Some of them might not be necessary.
+ "@io_netty_netty//jar",
+ "@io_netty_netty_buffer//jar",
+ "@io_netty_netty_codec//jar",
+ "@io_netty_netty_codec_http//jar",
+ "@io_netty_netty_codec_http2//jar",
+ "@io_netty_netty_common//jar",
+ "@io_netty_netty_handler//jar",
+ "@io_netty_netty_transport//jar",
+ "@io_netty_netty_transport_native_epoll//jar",
+ "@io_netty_netty_resolver//jar",
]
onos_app(
diff --git a/protocols/grpc/ctl/BUILD b/protocols/grpc/ctl/BUILD
index 475a90e..ac0703d 100644
--- a/protocols/grpc/ctl/BUILD
+++ b/protocols/grpc/ctl/BUILD
@@ -3,7 +3,6 @@
"//protocols/grpc/proto:onos-protocols-grpc-proto",
"@io_grpc_grpc_java//core",
"@io_grpc_grpc_java//netty",
- "@io_netty_netty_handler//jar",
]
osgi_jar(
diff --git a/protocols/grpc/ctl/src/main/java/org/onosproject/grpc/ctl/AbstractGrpcClientController.java b/protocols/grpc/ctl/src/main/java/org/onosproject/grpc/ctl/AbstractGrpcClientController.java
index 4f0403a..e5f4884 100644
--- a/protocols/grpc/ctl/src/main/java/org/onosproject/grpc/ctl/AbstractGrpcClientController.java
+++ b/protocols/grpc/ctl/src/main/java/org/onosproject/grpc/ctl/AbstractGrpcClientController.java
@@ -19,12 +19,8 @@
import com.google.common.collect.Maps;
import com.google.common.util.concurrent.Striped;
import io.grpc.ManagedChannel;
-import io.grpc.StatusRuntimeException;
-import io.grpc.netty.GrpcSslContexts;
+import io.grpc.ManagedChannelBuilder;
import io.grpc.netty.NettyChannelBuilder;
-import io.netty.handler.ssl.NotSslRecordException;
-import io.netty.handler.ssl.SslContext;
-import io.netty.handler.ssl.util.InsecureTrustManagerFactory;
import org.onosproject.event.AbstractListenerManager;
import org.onosproject.event.Event;
import org.onosproject.event.EventListener;
@@ -40,7 +36,6 @@
import org.osgi.service.component.annotations.ReferenceCardinality;
import org.slf4j.Logger;
-import javax.net.ssl.SSLException;
import java.util.Map;
import java.util.concurrent.locks.Lock;
import java.util.function.Supplier;
@@ -96,18 +91,14 @@
@Override
public boolean createClient(K clientKey) {
checkNotNull(clientKey);
- /*
- FIXME we might want to move "useTls" and "fallback" to properties of the netcfg and clientKey
- For now, we will first try to connect with TLS (accepting any cert), then fall back to
- plaintext for every device
- */
- return withDeviceLock(() -> doCreateClient(clientKey, true, true), clientKey.deviceId());
+ return withDeviceLock(() -> doCreateClient(clientKey), clientKey.deviceId());
}
- private boolean doCreateClient(K clientKey, boolean useTls, boolean fallbackToPlainText) {
- final DeviceId deviceId = clientKey.deviceId();
- final String serverAddr = clientKey.serverAddr();
- final int serverPort = clientKey.serverPort();
+
+ private boolean doCreateClient(K clientKey) {
+ DeviceId deviceId = clientKey.deviceId();
+ String serverAddr = clientKey.serverAddr();
+ int serverPort = clientKey.serverPort();
if (clientKeys.containsKey(deviceId)) {
final GrpcClientKey existingKey = clientKeys.get(deviceId);
@@ -122,69 +113,18 @@
}
}
- log.info("Creating new {}... (key={}, useTls={}, fallbackToPlainText={})",
- clientName(clientKey), clientKey, useTls,
- fallbackToPlainText);
-
- final GrpcChannelId channelId = GrpcChannelId.of(
- clientKey.deviceId(), clientKey.toString());
- final NettyChannelBuilder channelBuilder = NettyChannelBuilder
+ log.info("Creating client for {} (server={}:{})...",
+ deviceId, serverAddr, serverPort);
+ GrpcChannelId channelId = GrpcChannelId.of(clientKey.deviceId(), clientKey.toString());
+ ManagedChannelBuilder channelBuilder = NettyChannelBuilder
.forAddress(serverAddr, serverPort)
- .maxInboundMessageSize(DEFAULT_MAX_INBOUND_MSG_SIZE * MEGABYTES);
-
- if (useTls) {
- // FIXME: logic to create/manage SSL properties of a channel builder
- // should belong to the GrpcChannelController.
- log.debug("Using SSL for {}", clientName(clientKey), deviceId);
- final SslContext sslContext;
- try {
- // Accept any server certificate; this is insecure and should
- // not be used in production
- sslContext = GrpcSslContexts.forClient()
- .trustManager(InsecureTrustManagerFactory.INSTANCE)
- .build();
- } catch (SSLException e) {
- log.error("Failed to build SSL context for {}", clientName(clientKey), e);
- return false;
- }
- channelBuilder
- .sslContext(sslContext)
- .useTransportSecurity();
- } else {
- log.debug("Using plaintext TCP for {}", clientName(clientKey));
- channelBuilder.usePlaintext();
- }
+ .maxInboundMessageSize(DEFAULT_MAX_INBOUND_MSG_SIZE * MEGABYTES)
+ .usePlaintext();
final ManagedChannel channel;
- try {
- channel = grpcChannelController.connectChannel(channelId, channelBuilder);
- } catch (Throwable e) {
- for (Throwable cause = e; cause != null; cause = cause.getCause()) {
- if (useTls && cause instanceof NotSslRecordException) {
- // Likely root cause is that server is using plaintext
- log.warn("Failed to connect {} using TLS", clientName(clientKey));
- log.debug("TLS connection exception", e);
- if (fallbackToPlainText) {
- log.info("Falling back to plaintext TCP for {}", clientName(clientKey));
- return doCreateClient(clientKey, false, false);
- }
- }
- if (!useTls && "Connection reset by peer".equals(cause.getMessage())) {
- // Not a great signal, but could indicate the server is expected a TLS connection
- log.warn("Failed to connect {} using plaintext TCP; " +
- "is the server using TLS?",
- clientName(clientKey));
- break;
- }
- }
- if (e instanceof StatusRuntimeException) {
- log.warn("Unable to connect {}: {}", clientName(clientKey), e.getMessage());
- log.debug("Connection exception", e);
- } else {
- log.error("Exception while connecting {}", clientName(clientKey), e);
- }
- return false;
- }
+
+ channel = grpcChannelController.connectChannel(channelId, channelBuilder);
+
final C client;
try {