Skip to content

Share one SslContext between the channels of a factory #776

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alex268 merged 2 commits into from
Oct 16, 2026
Merged

Share one SslContext between the channels of a factory #776

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
379bc4d
Share one SslContext between the channels of a factory
Oct 10, 2026
a240928
Style and test fixes
alex268 Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 11 additions & 9 deletions core/src/main/java/tech/ydb/core/impl/pool/NettyChannelFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,21 +33,19 @@ public class NettyChannelFactory implements ManagedChannelFactory {

private final ClientInterceptor metadata;

private final boolean useTLS;
private final byte[] cert;
private final boolean retryEnabled;
private final boolean useDefaultGrpcResolver;
private final Long grpcKeepAliveTimeMillis;
private final List<Consumer<? super ManagedChannelBuilder<?>>> initializers;
private final SslContext sslCtx;

private NettyChannelFactory(GrpcTransportBuilder builder) {
this.metadata = YdbHeaders.createMetadataInterceptor(builder);
this.useTLS = builder.getUseTls();
this.cert = builder.getCert();
this.retryEnabled = builder.isEnableRetry();
this.useDefaultGrpcResolver = builder.useDefaultGrpcResolver();
this.grpcKeepAliveTimeMillis = builder.getGrpcKeepAliveTimeMillis();
this.initializers = builder.getChannelInitializers();
this.sslCtx = createSslContext(builder.getUseTls(), builder.getCert());
}

@SuppressWarnings("deprecation")
Expand All @@ -56,10 +54,10 @@ public ManagedChannel newManagedChannel(String host, int port, String sslHostOve
NettyChannelBuilder channelBuilder = NettyChannelBuilder
.forAddress(host, port);

if (useTLS) {
if (sslCtx != null) {
channelBuilder
.negotiationType(NegotiationType.TLS)
.sslContext(createSslContext());
.sslContext(sslCtx);
if (sslHostOverride != null) {
channelBuilder.overrideAuthority(sslHostOverride);
}
Expand Down Expand Up @@ -104,11 +102,15 @@ protected void configure(NettyChannelBuilder channelBuilder) {

}

private SslContext createSslContext() {
private static SslContext createSslContext(boolean useTLS, byte[] customCert) {
if (!useTLS) {
return null;
}

try {
SslContextBuilder sslContextBuilder = GrpcSslContexts.forClient();
if (cert != null) {
sslContextBuilder.trustManager(new ByteArrayInputStream(cert));
if (customCert != null) {
sslContextBuilder.trustManager(new ByteArrayInputStream(customCert));
} else {
sslContextBuilder.trustManager(new YandexTrustManagerFactory(""));
}
Expand Down
20 changes: 11 additions & 9 deletions core/src/main/java/tech/ydb/core/impl/pool/ShadedNettyChannelFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,21 +33,19 @@ public class ShadedNettyChannelFactory implements ManagedChannelFactory {

private final ClientInterceptor metadata;

private final boolean useTLS;
private final byte[] cert;
private final boolean retryEnabled;
private final boolean useDefaultGrpcResolver;
private final Long grpcKeepAliveTimeMillis;
private final List<Consumer<? super ManagedChannelBuilder<?>>> initializers;
private final SslContext sslCtx;

private ShadedNettyChannelFactory(GrpcTransportBuilder builder) {
this.metadata = YdbHeaders.createMetadataInterceptor(builder);
this.useTLS = builder.getUseTls();
this.cert = builder.getCert();
this.retryEnabled = builder.isEnableRetry();
this.useDefaultGrpcResolver = builder.useDefaultGrpcResolver();
this.grpcKeepAliveTimeMillis = builder.getGrpcKeepAliveTimeMillis();
this.initializers = builder.getChannelInitializers();
this.sslCtx = createSslContext(builder.getUseTls(), builder.getCert());
}

@SuppressWarnings("deprecation")
Expand All @@ -56,10 +54,10 @@ public ManagedChannel newManagedChannel(String host, int port, String sslHostOve
NettyChannelBuilder channelBuilder = NettyChannelBuilder
.forAddress(host, port);

if (useTLS) {
if (sslCtx != null) {
channelBuilder
.negotiationType(NegotiationType.TLS)
.sslContext(createSslContext());
.sslContext(sslCtx);
if (sslHostOverride != null) {
channelBuilder.overrideAuthority(sslHostOverride);
}
Expand Down Expand Up @@ -104,11 +102,15 @@ protected void configure(NettyChannelBuilder channelBuilder) {

}

private SslContext createSslContext() {
private static SslContext createSslContext(boolean useTLS, byte[] customCert) {
if (!useTLS) {
return null;
}

try {
SslContextBuilder sslContextBuilder = GrpcSslContexts.forClient();
if (cert != null) {
sslContextBuilder.trustManager(new ByteArrayInputStream(cert));
if (customCert != null) {
sslContextBuilder.trustManager(new ByteArrayInputStream(customCert));
} else {
sslContextBuilder.trustManager(new YandexTrustManagerFactory(""));
}
Expand Down
4 changes: 1 addition & 3 deletions core/src/test/java/tech/ydb/core/impl/pool/DefaultChannelFactoryTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,10 +244,8 @@ public void invalidSslCert() {
GrpcTransportBuilder builder = GrpcTransport.forHost(MOCKED_HOST, MOCKED_PORT, "/Root")
.withSecureConnection(cert);

ManagedChannelFactory factory = ChannelFactoryLoader.load().buildFactory(builder);

RuntimeException ex = Assert.assertThrows(RuntimeException.class,
() -> factory.newManagedChannel(MOCKED_HOST, MOCKED_PORT, null));
() -> ChannelFactoryLoader.load().buildFactory(builder));

Assert.assertEquals("cannot create ssl context", ex.getMessage());
Assert.assertNotNull(ex.getCause());
Expand Down
4 changes: 1 addition & 3 deletions core/src/test/java/tech/ydb/core/impl/pool/NettyChannelFactoryTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -243,10 +243,8 @@ public void invalidSslCert() {
GrpcTransportBuilder builder = GrpcTransport.forHost(MOCKED_HOST, MOCKED_PORT, "/Root")
.withSecureConnection(cert);

ManagedChannelFactory factory = ChannelFactoryLoader.load().buildFactory(builder);

RuntimeException ex = Assert.assertThrows(RuntimeException.class,
() -> factory.newManagedChannel(MOCKED_HOST, MOCKED_PORT, null));
() -> ChannelFactoryLoader.load().buildFactory(builder));

Assert.assertEquals("cannot create ssl context", ex.getMessage());
Assert.assertNotNull(ex.getCause());
Expand Down
Loading