Open source GCP proxy

Dagger updated to 2.13, along with all its dependencies.

Also allows us to have multiple config files for different environment (prod, sandbox, alpha, local, etc) and specify which one to use on the command line with a --env flag. Therefore the same binary can be used in all environments.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=176551289

java/google/registry/proxy/handler/BackendMetricsHandler.java

@@ -0,0 +1,129 @@
+// Copyright 2017 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.proxy.handler;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Preconditions.checkNotNull;
+import static com.google.common.base.Preconditions.checkState;
+import static google.registry.proxy.Protocol.PROTOCOL_KEY;
+import static google.registry.proxy.handler.EppServiceHandler.CLIENT_CERTIFICATE_HASH_KEY;
+import static google.registry.proxy.handler.RelayHandler.RELAY_CHANNEL_KEY;
+
+import google.registry.proxy.handler.RelayHandler.FullHttpResponseRelayHandler;
+import google.registry.proxy.metric.BackendMetrics;
+import google.registry.util.Clock;
+import io.netty.channel.Channel;
+import io.netty.channel.ChannelDuplexHandler;
+import io.netty.channel.ChannelFuture;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.channel.ChannelPromise;
+import io.netty.handler.codec.http.FullHttpRequest;
+import io.netty.handler.codec.http.FullHttpResponse;
+import java.util.ArrayDeque;
+import java.util.Optional;
+import java.util.Queue;
+import javax.inject.Inject;
+import org.joda.time.DateTime;
+
+/**
+ * Handler that records metrics a backend channel.
+ *
+ * <p>This handler is added right before {@link FullHttpResponseRelayHandler} in the backend
+ * protocol handler provider method. {@link FullHttpRequest} outbound messages encounter this first
+ * before being handed over to HTTP related handler. {@link FullHttpResponse} inbound messages are
+ * first constructed (from plain bytes) by preceding handlers and then logged in this handler.
+ */
+public class BackendMetricsHandler extends ChannelDuplexHandler {
+
+  private final Clock clock;
+  private final BackendMetrics metrics;
+
+  private String relayedProtocolName;
+  private String clientCertHash;
+  private Channel relayedChannel;
+
+  /**
+   * A queue that saves the time at which a request is sent to the GAE app.
+   *
+   * <p>This queue is used to calculate HTTP request-response latency. HTTP 1.1 specification allows
+   * for pipelining, in which a client can sent multiple requests without waiting for each
+   * responses. Therefore a queue is needed to record all the requests that are sent but have not
+   * yet received a response.
+   *
+   * <p>A server must send its response in the same order it receives requests. This invariance
+   * guarantees that the request time at the head of the queue always corresponds to the response
+   * received in {@link #channelRead}.
+   *
+   * @see <a href="https://www.w3.org/Protocols/rfc2616/rfc2616-sec8.html">RFC 2616 8.1.2.2
+   *     Pipelining</a>
+   */
+  private final Queue<DateTime> requestSentTimeQueue = new ArrayDeque<>();
+
+  @Inject
+  BackendMetricsHandler(Clock clock, BackendMetrics metrics) {
+    this.clock = clock;
+    this.metrics = metrics;
+  }
+
+  @Override
+  public void channelActive(ChannelHandlerContext ctx) throws Exception {
+    // Backend channel is always established after a frontend channel is connected, so this
+    relayedChannel = ctx.channel().attr(RELAY_CHANNEL_KEY).get();
+    checkNotNull(relayedChannel, "No frontend channel found.");
+    relayedProtocolName = relayedChannel.attr(PROTOCOL_KEY).get().name();
+    super.channelActive(ctx);
+  }
+
+  @Override
+  public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception {
+    checkArgument(msg instanceof FullHttpResponse, "Incoming response must be FullHttpResponse.");
+    checkState(!requestSentTimeQueue.isEmpty(), "Response received before request is sent.");
+    metrics.responseReceived(
+        relayedProtocolName,
+        clientCertHash,
+        (FullHttpResponse) msg,
+        clock.nowUtc().getMillis() - requestSentTimeQueue.remove().getMillis());
+    super.channelRead(ctx, msg);
+  }
+
+  @Override
+  public void write(ChannelHandlerContext ctx, Object msg, ChannelPromise promise)
+      throws Exception {
+    checkArgument(msg instanceof FullHttpRequest, "Outgoing request must be FullHttpRequest.");
+    // For WHOIS, client certificate hash is always set to "none".
+    // For EPP, the client hash attribute is set upon handshake completion, before the first HELLO
+    // is sent to the server. Therefore the first call to write() with HELLO payload has access to
+    // the hash in its channel attribute.
+    if (clientCertHash == null) {
+      clientCertHash =
+          Optional.ofNullable(relayedChannel.attr(CLIENT_CERTIFICATE_HASH_KEY).get())
+              .orElse("none");
+    }
+    FullHttpRequest request = (FullHttpRequest) msg;
+
+    // Record sent time before write finishes allows us to take network latency into account.
+    DateTime sentTime = clock.nowUtc();
+    ChannelFuture unusedFuture =
+        ctx.write(msg, promise)
+            .addListener(
+                future -> {
+                  if (future.isSuccess()) {
+                    // Only instrument request metrics when the request is actually sent to GAE.
+                    metrics.requestSent(relayedProtocolName, clientCertHash, request);
+                    requestSentTimeQueue.add(sentTime);
+                  }
+                });
+  }
+}

java/google/registry/proxy/handler/EppServiceHandler.java

@@ -0,0 +1,154 @@
+// Copyright 2017 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.proxy.handler;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static com.google.common.base.Preconditions.checkNotNull;
+import static google.registry.proxy.handler.ProxyProtocolHandler.REMOTE_ADDRESS_KEY;
+import static google.registry.proxy.handler.SslServerInitializer.CLIENT_CERTIFICATE_PROMISE_KEY;
+import static google.registry.util.X509Utils.getCertificateHash;
+
+import com.google.common.base.Supplier;
+import google.registry.proxy.metric.FrontendMetrics;
+import google.registry.util.FormattingLogger;
+import io.netty.buffer.ByteBuf;
+import io.netty.buffer.Unpooled;
+import io.netty.channel.ChannelFuture;
+import io.netty.channel.ChannelFutureListener;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.channel.ChannelPromise;
+import io.netty.handler.codec.http.FullHttpRequest;
+import io.netty.handler.codec.http.HttpHeaderNames;
+import io.netty.handler.codec.http.HttpResponse;
+import io.netty.handler.ssl.SslHandshakeCompletionEvent;
+import io.netty.util.AttributeKey;
+import io.netty.util.concurrent.Promise;
+import java.security.cert.X509Certificate;
+
+/** Handler that processes EPP protocol logic. */
+public class EppServiceHandler extends HttpsRelayServiceHandler {
+
+  private static final FormattingLogger logger = FormattingLogger.getLoggerForCallerClass();
+
+  /**
+   * Attribute key to the client certificate hash whose value is set when the certificate promise is
+   * fulfilled.
+   */
+  public static final AttributeKey<String> CLIENT_CERTIFICATE_HASH_KEY =
+      AttributeKey.valueOf("CLIENT_CERTIFICATE_HASH_KEY");
+
+  /** Name of the HTTP header that stores the client certificate hash. */
+  public static final String SSL_CLIENT_CERTIFICATE_HASH_FIELD = "X-SSL-Certificate";
+
+  /** Name of the HTTP header that stores the epp server name requested by the client using SNI. */
+  // TODO(b/64510444): remove this header entirely when borg proxy is retired.
+  public static final String REQUESTED_SERVERNAME_VIA_SNI_FIELD = "X-Requested-Servername-SNI";
+
+  /** Name of the HTTP header that stores the client IP address. */
+  public static final String FORWARDED_FOR_FIELD = "X-Forwarded-For";
+
+  /** Name of the HTTP header that indicates if the EPP session should be closed. */
+  public static final String EPP_SESSION_FIELD = "Epp-Session";
+
+  public static final String EPP_CONTENT_TYPE = "application/epp+xml";
+
+  private final String serverHostname;
+  private final byte[] helloBytes;
+
+  private String sslClientCertificateHash;
+  private String clientAddress;
+
+  public EppServiceHandler(
+      String relayHost,
+      String relayPath,
+      Supplier<String> accessTokenSupplier,
+      String serverHostname,
+      byte[] helloBytes,
+      FrontendMetrics metrics) {
+    super(relayHost, relayPath, accessTokenSupplier, metrics);
+    this.serverHostname = serverHostname;
+    this.helloBytes = helloBytes;
+  }
+
+  /**
+   * Write <hello> to the server after SSL handshake completion to request <greeting>
+   *
+   * <p>When handling EPP over TCP, the server should issue a <greeting> to the client when a
+   * connection is established. Nomulus app however does not automatically sends the <greeting> upon
+   * connection. The proxy therefore first sends a <hello> to registry to request a <greeting>
+   * response.
+   *
+   * <p>The <hello> request is only sent after SSL handshake is completed between the client and the
+   * proxy so that the client certificate hash is available, which is needed to communicate with the
+   * server. Because {@link SslHandshakeCompletionEvent} is triggered before any calls to {@link
+   * #channelRead} are scheduled by the event loop executor, the <hello> request is guaranteed to be
+   * the first message sent to the server.
+   *
+   * @see <a href="https://tools.ietf.org/html/rfc5734">RFC 5732 EPP Transport over TCP</a>
+   * @see <a href="https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt">The Proxy
+   *     Protocol</a>
+   */
+  @Override
+  public void channelActive(ChannelHandlerContext ctx) throws Exception {
+    Promise<X509Certificate> unusedPromise =
+        ctx.channel()
+            .attr(CLIENT_CERTIFICATE_PROMISE_KEY)
+            .get()
+            .addListener(
+                (Promise<X509Certificate> promise) -> {
+                  if (promise.isSuccess()) {
+                    sslClientCertificateHash = getCertificateHash(promise.get());
+                    // Set the client cert hash key attribute for both this channel,
+                    // used for collecting metrics on specific clients.
+                    ctx.channel().attr(CLIENT_CERTIFICATE_HASH_KEY).set(sslClientCertificateHash);
+                    clientAddress = ctx.channel().attr(REMOTE_ADDRESS_KEY).get();
+                    metrics.registerActiveConnection(
+                        "epp", sslClientCertificateHash, ctx.channel());
+                    channelRead(ctx, Unpooled.wrappedBuffer(helloBytes));
+                  } else {
+                    logger.severefmt(promise.cause(), "Cannot finish handshake.");
+                    ChannelFuture unusedFuture = ctx.close();
+                  }
+                });
+    super.channelActive(ctx);
+  }
+
+  @Override
+  protected FullHttpRequest decodeFullHttpRequest(ByteBuf byteBuf) {
+    checkNotNull(clientAddress, "Cannot obtain client address.");
+    checkNotNull(sslClientCertificateHash, "Cannot obtain client certificate hash.");
+    FullHttpRequest request = super.decodeFullHttpRequest(byteBuf);
+    request
+        .headers()
+        .set(SSL_CLIENT_CERTIFICATE_HASH_FIELD, sslClientCertificateHash)
+        .set(REQUESTED_SERVERNAME_VIA_SNI_FIELD, serverHostname)
+        .set(FORWARDED_FOR_FIELD, clientAddress)
+        .set(HttpHeaderNames.CONTENT_TYPE, EPP_CONTENT_TYPE)
+        .set(HttpHeaderNames.ACCEPT, EPP_CONTENT_TYPE);
+    return request;
+  }
+
+  @Override
+  public void write(ChannelHandlerContext ctx, Object msg, ChannelPromise promise)
+      throws Exception {
+    checkArgument(msg instanceof HttpResponse);
+    HttpResponse response = (HttpResponse) msg;
+    String sessionAliveValue = response.headers().get(EPP_SESSION_FIELD);
+    if (sessionAliveValue != null && sessionAliveValue.equals("close")) {
+      promise.addListener(ChannelFutureListener.CLOSE);
+    }
+    super.write(ctx, msg, promise);
+  }
+}

java/google/registry/proxy/handler/HealthCheckHandler.java

@@ -0,0 +1,42 @@
+// Copyright 2017 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.proxy.handler;
+
+import io.netty.buffer.ByteBuf;
+import io.netty.buffer.Unpooled;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.channel.ChannelInboundHandlerAdapter;
+import java.nio.charset.StandardCharsets;
+
+/** A handler that responds to GCP load balancer health check message */
+public class HealthCheckHandler extends ChannelInboundHandlerAdapter {
+
+  private final ByteBuf checkRequest;
+  private final ByteBuf checkResponse;
+
+  public HealthCheckHandler(String checkRequest, String checkResponse) {
+    this.checkRequest = Unpooled.wrappedBuffer(checkRequest.getBytes(StandardCharsets.US_ASCII));
+    this.checkResponse = Unpooled.wrappedBuffer(checkResponse.getBytes(StandardCharsets.US_ASCII));
+  }
+
+  @Override
+  public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception {
+    ByteBuf buf = (ByteBuf) msg;
+    if (buf.equals(checkRequest)) {
+      ctx.writeAndFlush(checkResponse);
+    }
+    buf.release();
+  }
+}

java/google/registry/proxy/handler/HttpsRelayServiceHandler.java

@@ -0,0 +1,185 @@
+// Copyright 2017 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.proxy.handler;
+
+import static com.google.common.base.Preconditions.checkArgument;
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+import com.google.common.base.Supplier;
+import google.registry.proxy.metric.FrontendMetrics;
+import google.registry.util.FormattingLogger;
+import io.netty.buffer.ByteBuf;
+import io.netty.channel.ChannelFuture;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.channel.ChannelPromise;
+import io.netty.handler.codec.ByteToMessageCodec;
+import io.netty.handler.codec.http.DefaultFullHttpRequest;
+import io.netty.handler.codec.http.FullHttpRequest;
+import io.netty.handler.codec.http.FullHttpResponse;
+import io.netty.handler.codec.http.HttpHeaderNames;
+import io.netty.handler.codec.http.HttpMethod;
+import io.netty.handler.codec.http.HttpResponseStatus;
+import io.netty.handler.codec.http.HttpVersion;
+import io.netty.handler.codec.http.cookie.ClientCookieDecoder;
+import io.netty.handler.codec.http.cookie.ClientCookieEncoder;
+import io.netty.handler.codec.http.cookie.Cookie;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Handler that relays a single (framed) ByteBuf message to an HTTPS server.
+ *
+ * <p>This handler reads in a {@link ByteBuf}, converts it to an {@link FullHttpRequest}, and passes
+ * it to the {@code channelRead} method of the next inbound handler the channel pipeline, which is
+ * usually a {@link RelayHandler<FullHttpRequest>}. The relay handler writes the request to the
+ * relay channel, which is connected to an HTTPS endpoint. After the relay channel receives a {@link
+ * FullHttpResponse} back, its own relay handler writes the response back to this channel, which is
+ * the relay channel of the relay channel. This handler then handles write request by encoding the
+ * {@link FullHttpResponse} to a plain {@link ByteBuf}, and pass it down to the {@code write} method
+ * of the next outbound handler in the channel pipeline, which eventually writes the response bytes
+ * to the remote peer of this channel.
+ *
+ * <p>This handler is session aware and will store all the session cookies that the are contained in
+ * the HTTP response headers, which are added back to headers of subsequent HTTP requests.
+ */
+abstract class HttpsRelayServiceHandler extends ByteToMessageCodec<FullHttpResponse> {
+
+  private static final FormattingLogger logger = FormattingLogger.getLoggerForCallerClass();
+
+  private final Map<String, Cookie> cookieStore = new LinkedHashMap<>();
+  private final String relayHost;
+  private final String relayPath;
+  private final Supplier<String> accessTokenSupplier;
+
+  protected final FrontendMetrics metrics;
+
+  HttpsRelayServiceHandler(
+      String relayHost,
+      String relayPath,
+      Supplier<String> accessTokenSupplier,
+      FrontendMetrics metrics) {
+    this.relayHost = relayHost;
+    this.relayPath = relayPath;
+    this.accessTokenSupplier = accessTokenSupplier;
+    this.metrics = metrics;
+  }
+
+  /**
+   * Construct the {@link FullHttpRequest}.
+   *
+   * <p>This default method creates a bare-bone {@link FullHttpRequest} that may need to be
+   * modified, e. g. adding headers specific for each protocol.
+   *
+   * @param byteBuf inbound message.
+   */
+  protected FullHttpRequest decodeFullHttpRequest(ByteBuf byteBuf) {
+    FullHttpRequest request =
+        new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.POST, relayPath);
+    request
+        .headers()
+        .set(HttpHeaderNames.USER_AGENT, "Proxy")
+        .set(HttpHeaderNames.HOST, relayHost)
+        .set(HttpHeaderNames.AUTHORIZATION, "Bearer " + accessTokenSupplier.get())
+        .set(HttpHeaderNames.CONTENT_LENGTH, byteBuf.readableBytes());
+    request.content().writeBytes(byteBuf);
+    return request;
+  }
+
+  /**
+   * Load session cookies in the cookie store and write them in to the HTTP request.
+   *
+   * <p>Multiple cookies are folded into one {@code Cookie} header per RFC 6265.
+   *
+   * @see <a href="https://tools.ietf.org/html/rfc6265#section-5.4">RFC 6265 5.4.The Cookie
+   *     Header</a>
+   */
+  private void loadCookies(FullHttpRequest request) {
+    if (!cookieStore.isEmpty()) {
+      request
+          .headers()
+          .set(HttpHeaderNames.COOKIE, ClientCookieEncoder.STRICT.encode(cookieStore.values()));
+    }
+  }
+
+  @Override
+  protected void decode(ChannelHandlerContext ctx, ByteBuf byteBuf, List<Object> out)
+      throws Exception {
+    FullHttpRequest request = decodeFullHttpRequest(byteBuf);
+    loadCookies(request);
+    out.add(request);
+  }
+
+  /**
+   * Construct the {@link ByteBuf}
+   *
+   * <p>This default method puts all the response payload into the {@link ByteBuf}.
+   *
+   * @param fullHttpResponse outbound http response.
+   */
+  ByteBuf encodeFullHttpResponse(FullHttpResponse fullHttpResponse) {
+    return fullHttpResponse.content();
+  }
+
+  /**
+   * Save session cookies from the HTTP response header to the cookie store.
+   *
+   * <p>Multiple cookies are </b>not</b> folded in to one {@code Set-Cookie} header per RFC 6265.
+   *
+   * @see <a href="https://tools.ietf.org/html/rfc6265#section-3">RFC 6265 3.Overview</a>
+   */
+  private void saveCookies(FullHttpResponse response) {
+    for (String cookieString : response.headers().getAll(HttpHeaderNames.SET_COOKIE)) {
+      Cookie cookie = ClientCookieDecoder.STRICT.decode(cookieString);
+      cookieStore.put(cookie.name(), cookie);
+    }
+  }
+
+  @Override
+  protected void encode(ChannelHandlerContext ctx, FullHttpResponse response, ByteBuf byteBuf)
+      throws Exception {
+    checkArgument(
+        response.status().equals(HttpResponseStatus.OK),
+        "Cannot relay HTTP response status \"%s\"\n%s",
+        response.status(),
+        response.content().toString(UTF_8));
+    saveCookies(response);
+    byteBuf.writeBytes(encodeFullHttpResponse(response));
+  }
+
+  /** Terminates connection upon inbound exception. */
+  @Override
+  public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) throws Exception {
+    logger.severefmt(cause, "Inbound exception caught for channel %s", ctx.channel());
+    ChannelFuture unusedFuture = ctx.close();
+  }
+
+  /** Terminates connection upon outbound exception. */
+  @Override
+  public void write(ChannelHandlerContext ctx, Object msg, ChannelPromise promise)
+      throws Exception {
+    promise.addListener(
+        (ChannelFuture channelFuture) -> {
+          if (!channelFuture.isSuccess()) {
+            logger.severefmt(
+                channelFuture.cause(),
+                "Outbound exception caught for channel %s",
+                channelFuture.channel());
+            ChannelFuture unusedFuture = channelFuture.channel().close();
+          }
+        });
+    super.write(ctx, msg, promise);
+  }
+}

java/google/registry/proxy/handler/ProxyProtocolHandler.java

@@ -0,0 +1,167 @@
+// Copyright 2017 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.proxy.handler;
+
+import static com.google.common.base.Preconditions.checkState;
+import static java.nio.charset.StandardCharsets.US_ASCII;
+
+import google.registry.util.FormattingLogger;
+import io.netty.buffer.ByteBuf;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.handler.codec.ByteToMessageDecoder;
+import io.netty.util.AttributeKey;
+import java.net.InetSocketAddress;
+import java.net.SocketAddress;
+import java.util.List;
+import javax.inject.Inject;
+
+/**
+ * Handler that processes possible existence of a PROXY protocol v1 header.
+ *
+ * <p>When an EPP client connects to the registry (through the proxy), the registry performs two
+ * validations to ensure that only known registrars are allowed. First it checks the sha265 hash of
+ * the client SSL certificate and match it to the hash stored in datastore for the registrar. It
+ * then checks if the connection is from an whitelisted IP address that belongs to that registrar.
+ *
+ * <p>The proxy receives client connects via the GCP load balancer, which results in the loss of
+ * original client IP from the channel. Luckily, the load balancer supports the PROXY protocol v1,
+ * which adds a header with source IP information, among other things, to the TCP request at the
+ * start of the connection.
+ *
+ * <p>This handler determines if a connection is proxied (PROXY protocol v1 header present) and
+ * correctly sets the source IP address to the channel's attribute regardless of whether it is
+ * proxied. After that it removes itself from the channel pipeline because the proxy header is only
+ * present at the beginning of the connection.
+ *
+ * <p>This handler must be the very first handler in a protocol, even before SSL handlers, because
+ * PROXY protocol header comes as the very first thing, even before SSL handshake request.
+ *
+ * @see <a href="https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt">The PROXY protocol</a>
+ */
+public class ProxyProtocolHandler extends ByteToMessageDecoder {
+
+  /** Key used to retrieve origin IP address from a channel's attribute. */
+  public static final AttributeKey<String> REMOTE_ADDRESS_KEY =
+      AttributeKey.valueOf("REMOTE_ADDRESS_KEY");
+
+  private static final FormattingLogger logger = FormattingLogger.getLoggerForCallerClass();
+
+  // The proxy header must start with this prefix.
+  // Sample header: "PROXY TCP4 255.255.255.255 255.255.255.255 65535 65535\r\n".
+  private static final byte[] HEADER_PREFIX = "PROXY".getBytes(US_ASCII);
+
+  private boolean finished = false;
+  private String proxyHeader = null;
+
+  @Inject
+  ProxyProtocolHandler() {}
+
+  @Override
+  public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception {
+    super.channelRead(ctx, msg);
+    if (finished) {
+      if (proxyHeader != null) {
+        logger.finefmt("PROXIED CONNECTION: %s", ctx.channel());
+        logger.finefmt("PROXY HEADER: %s", proxyHeader);
+        ctx.channel().attr(REMOTE_ADDRESS_KEY).set(proxyHeader.split(" ")[2]);
+      } else {
+        SocketAddress remoteAddress = ctx.channel().remoteAddress();
+        if (remoteAddress instanceof InetSocketAddress) {
+          ctx.channel()
+              .attr(REMOTE_ADDRESS_KEY)
+              .set(((InetSocketAddress) remoteAddress).getAddress().getHostAddress());
+          logger.finefmt("REMOTE IP ADDRESS: %s", ctx.channel().attr(REMOTE_ADDRESS_KEY).get());
+        }
+      }
+      ctx.pipeline().remove(this);
+    }
+  }
+
+  /**
+   * Attempts to decode an internally accumulated buffer and find the proxy protocol header.
+   *
+   * <p>When the connection is not proxied (i. e. the initial bytes are not "PROXY"), simply set
+   * {@link #finished} to true and allow the handler to be removed. Otherwise the handler waits
+   * until there's enough bytes to parse the header, save the parsed header to {@link #proxyHeader},
+   * and then mark {@link #finished}.
+   *
+   * @param in internally accumulated buffer, newly arrived bytes are appended to it.
+   * @param out objects passed to the next handler, in this case nothing is ever passed because the
+   *     header itself is processed and written to the attribute of the proxy, and the handler is
+   *     then removed from the pipeline.
+   */
+  @Override
+  protected void decode(ChannelHandlerContext ctx, ByteBuf in, List<Object> out) throws Exception {
+    // Wait until there are more bytes available than the header's length before processing.
+    if (in.readableBytes() >= HEADER_PREFIX.length) {
+      if (containsHeader(in)) {
+        // The inbound message contains the header, it must be a proxied connection. Note that
+        // currently proxied connection is only used for EPP protocol, which requires the connection
+        // to be SSL enabled. So the beginning of the inbound message upon connection can only be
+        // either the proxy header (when proxied), or SSL handshake request (when not proxied),
+        // which does not start with "PROXY". Therefore it is safe to assume that if the beginning
+        // of the message contains "PROXY", it must be proxied, and must contain \r\n.
+        int eol = findEndOfLine(in);
+        // If eol is not found, that is because that we do not yet have enough inbound message, do
+        // nothing and wait for more bytes to be readable. eol will  eventually be positive because
+        // of the reasoning above: The connection starts with "PROXY", so it must be a proxied
+        // connection and contain \r\n.
+        if (eol >= 0) {
+          // ByteBuf.readBytes is called so that the header is processed and not passed to handlers
+          // further in the pipeline.
+          proxyHeader = in.readBytes(eol).toString(US_ASCII);
+          // Skip \r\n.
+          in.skipBytes(2);
+          // Proxy header processed, mark finished so that this handler is removed.
+          finished = true;
+        }
+      } else {
+        // The inbound message does not contain a proxy header, mark finished so that this handler
+        // is removed. Note that no inbound bytes are actually processed by this handler because we
+        // did not call ByteBuf.readBytes(), but ByteBuf.getByte(), which does not change reader
+        // index of the ByteBuf. So any inbound byte is then passed to the next handler to process.
+        finished = true;
+      }
+    }
+  }
+
+  /**
+   * Returns the index in the buffer of the end of line found. Returns -1 if no end of line was
+   * found in the buffer.
+   */
+  private static int findEndOfLine(final ByteBuf buffer) {
+    final int n = buffer.writerIndex();
+    for (int i = buffer.readerIndex(); i < n; i++) {
+      final byte b = buffer.getByte(i);
+      if (b == '\r' && i < n - 1 && buffer.getByte(i + 1) == '\n') {
+        return i; // \r\n
+      }
+    }
+    return -1; // Not found.
+  }
+
+  /** Checks if the given buffer contains the proxy header prefix. */
+  private boolean containsHeader(ByteBuf buffer) {
+    // The readable bytes is always more or equal to the size of the header prefix because this
+    // method is only called when this condition is true.
+    checkState(buffer.readableBytes() >= HEADER_PREFIX.length);
+    for (int i = 0; i < HEADER_PREFIX.length; ++i) {
+      if (buffer.getByte(buffer.readerIndex() + i) != HEADER_PREFIX[i]) {
+        return false;
+      }
+    }
+    return true;
+  }
+}

java/google/registry/proxy/handler/RelayHandler.java

@@ -0,0 +1,99 @@
+// Copyright 2017 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.proxy.handler;
+
+import static com.google.common.base.Preconditions.checkNotNull;
+
+import google.registry.util.FormattingLogger;
+import io.netty.channel.Channel;
+import io.netty.channel.ChannelFuture;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.channel.SimpleChannelInboundHandler;
+import io.netty.handler.codec.http.FullHttpRequest;
+import io.netty.handler.codec.http.FullHttpResponse;
+import io.netty.util.Attribute;
+import io.netty.util.AttributeKey;
+import javax.inject.Inject;
+
+/**
+ * Receives inbound massage of type {@code I}, and writes it to the {@code relayChannel} stored in
+ * the inbound channel's attribute.
+ */
+public class RelayHandler<I> extends SimpleChannelInboundHandler<I> {
+
+  private static final FormattingLogger logger = FormattingLogger.getLoggerForCallerClass();
+
+  /** Key used to retrieve the relay channel from a {@link Channel}'s {@link Attribute}. */
+  public static final AttributeKey<Channel> RELAY_CHANNEL_KEY =
+      AttributeKey.valueOf("RELAY_CHANNEL");
+
+  public RelayHandler(Class<? extends I> clazz) {
+    super(clazz, false);
+  }
+
+  /** Terminate connection when an exception is caught during inbound IO. */
+  @Override
+  public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) throws Exception {
+    logger.severefmt(cause, "Inbound exception caught for channel %s", ctx.channel());
+    ctx.close();
+  }
+
+  /** Close relay channel if this channel is closed. */
+  @Override
+  public void channelInactive(ChannelHandlerContext ctx) throws Exception {
+    Channel relayChannel = ctx.channel().attr(RELAY_CHANNEL_KEY).get();
+    if (relayChannel != null) {
+      relayChannel.close();
+    }
+    ctx.fireChannelInactive();
+  }
+
+  /** Read message of type {@code I}, write it as-is into the relay channel. */
+  @Override
+  protected void channelRead0(ChannelHandlerContext ctx, I msg) throws Exception {
+    Channel relayChannel = ctx.channel().attr(RELAY_CHANNEL_KEY).get();
+    checkNotNull(relayChannel, "Relay channel not specified for channel: %s", ctx.channel());
+    if (relayChannel.isActive()) {
+      // Relay channel is open, write to it.
+      ChannelFuture channelFuture = relayChannel.writeAndFlush(msg);
+      channelFuture.addListener(
+          future -> {
+            // Cannot write into relay channel, close this channel.
+            if (!future.isSuccess()) {
+              ctx.close();
+            }
+          });
+    } else {
+      // close this channel if the relay channel is closed.
+      ctx.close();
+    }
+  }
+
+  /** Specialized {@link RelayHandler} that takes a {@link FullHttpRequest} as inbound payload. */
+  public static class FullHttpRequestRelayHandler extends RelayHandler<FullHttpRequest> {
+    @Inject
+    public FullHttpRequestRelayHandler() {
+      super(FullHttpRequest.class);
+    }
+  }
+
+  /** Specialized {@link RelayHandler} that takes a {@link FullHttpResponse} as inbound payload. */
+  public static class FullHttpResponseRelayHandler extends RelayHandler<FullHttpResponse> {
+    @Inject
+    public FullHttpResponseRelayHandler() {
+      super(FullHttpResponse.class);
+    }
+  }
+}

java/google/registry/proxy/handler/SslClientInitializer.java

@@ -0,0 +1,80 @@
+// Copyright 2017 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.proxy.handler;
+
+import static com.google.common.base.Preconditions.checkNotNull;
+import static google.registry.proxy.Protocol.PROTOCOL_KEY;
+
+import google.registry.proxy.Protocol.BackendProtocol;
+import google.registry.util.FormattingLogger;
+import io.netty.channel.Channel;
+import io.netty.channel.ChannelHandler.Sharable;
+import io.netty.channel.ChannelInitializer;
+import io.netty.channel.embedded.EmbeddedChannel;
+import io.netty.handler.ssl.SslContextBuilder;
+import io.netty.handler.ssl.SslHandler;
+import io.netty.handler.ssl.SslProvider;
+import java.security.cert.X509Certificate;
+import javax.annotation.Nullable;
+import javax.inject.Inject;
+import javax.inject.Named;
+import javax.inject.Singleton;
+import javax.net.ssl.SSLEngine;
+import javax.net.ssl.SSLParameters;
+
+/**
+ * Adds a client side SSL handler to the channel pipeline.
+ *
+ * <p>This <b>must</b> be the first handler provided for any handler provider list, if it is
+ * provided. The type parameter {@code C} is needed so that unit tests can construct this handler
+ * that works with {@link EmbeddedChannel};
+ */
+@Singleton
+@Sharable
+public class SslClientInitializer<C extends Channel> extends ChannelInitializer<C> {
+
+  private static final FormattingLogger logger = FormattingLogger.getLoggerForCallerClass();
+  private final SslProvider sslProvider;
+  private final X509Certificate[] trustedCertificates;
+
+  @Inject
+  SslClientInitializer(
+      SslProvider sslProvider,
+      @Nullable @Named("relayTrustedCertificates") X509Certificate... trustCertificates) {
+    logger.finefmt("Client SSL Provider: %s", sslProvider);
+    this.sslProvider = sslProvider;
+    this.trustedCertificates = trustCertificates;
+  }
+
+  @Override
+  protected void initChannel(C channel) throws Exception {
+    BackendProtocol protocol = (BackendProtocol) channel.attr(PROTOCOL_KEY).get();
+    checkNotNull(protocol, "Protocol is not set for channel: %s", channel);
+    SslHandler sslHandler =
+        SslContextBuilder.forClient()
+            .sslProvider(sslProvider)
+            .trustManager(trustedCertificates)
+            .build()
+            .newHandler(channel.alloc(), protocol.host(), protocol.port());
+
+    // Enable hostname verification.
+    SSLEngine sslEngine = sslHandler.engine();
+    SSLParameters sslParameters = sslEngine.getSSLParameters();
+    sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
+    sslEngine.setSSLParameters(sslParameters);
+
+    channel.pipeline().addLast(sslHandler);
+  }
+}

java/google/registry/proxy/handler/SslServerInitializer.java

@@ -0,0 +1,105 @@
+// Copyright 2017 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.proxy.handler;
+
+import google.registry.util.FormattingLogger;
+import io.netty.channel.Channel;
+import io.netty.channel.ChannelHandler.Sharable;
+import io.netty.channel.ChannelInitializer;
+import io.netty.channel.embedded.EmbeddedChannel;
+import io.netty.handler.ssl.ClientAuth;
+import io.netty.handler.ssl.SslContextBuilder;
+import io.netty.handler.ssl.SslHandler;
+import io.netty.handler.ssl.SslProvider;
+import io.netty.handler.ssl.util.InsecureTrustManagerFactory;
+import io.netty.util.AttributeKey;
+import io.netty.util.concurrent.Future;
+import io.netty.util.concurrent.Promise;
+import java.security.PrivateKey;
+import java.security.cert.X509Certificate;
+import javax.inject.Inject;
+import javax.inject.Named;
+import javax.inject.Singleton;
+
+/**
+ * Adds a server side SSL handler to the channel pipeline.
+ *
+ * <p>This <b>should</b> be the first handler provided for any handler provider list, if it is
+ * provided. Unless you wish to first process the PROXY header with {@link ProxyProtocolHandler},
+ * which should come before this handler. The type parameter {@code C} is needed so that unit tests
+ * can construct this handler that works with {@link EmbeddedChannel};
+ *
+ * <p>The ssl handler added requires client authentication, but it uses an {@link
+ * InsecureTrustManagerFactory}, which accepts any ssl certificate presented by the client, as long
+ * as the client uses the corresponding private key to establish SSL handshake. The client
+ * certificate hash will be passed along to GAE as an HTTP header for verification (not handled by
+ * this handler).
+ */
+@Singleton
+@Sharable
+public class SslServerInitializer<C extends Channel> extends ChannelInitializer<C> {
+
+  /**
+   * Attribute key to the client certificate promise whose value is set when SSL handshake completes
+   * successfully.
+   */
+  public static final AttributeKey<Promise<X509Certificate>> CLIENT_CERTIFICATE_PROMISE_KEY =
+      AttributeKey.valueOf("CLIENT_CERTIFICATE_PROMISE_KEY");
+
+  private static final FormattingLogger logger = FormattingLogger.getLoggerForCallerClass();
+  private final SslProvider sslProvider;
+  private final PrivateKey privateKey;
+  private final X509Certificate[] certificates;
+
+  @Inject
+  SslServerInitializer(
+      SslProvider sslProvider,
+      PrivateKey privateKey,
+      @Named("eppServerCertificates") X509Certificate... certificates) {
+    logger.finefmt("Server SSL Provider: %s", sslProvider);
+    this.sslProvider = sslProvider;
+    this.privateKey = privateKey;
+    this.certificates = certificates;
+  }
+
+  @Override
+  protected void initChannel(C channel) throws Exception {
+    SslHandler sslHandler =
+        SslContextBuilder.forServer(privateKey, certificates)
+            .sslProvider(sslProvider)
+            .trustManager(InsecureTrustManagerFactory.INSTANCE)
+            .clientAuth(ClientAuth.REQUIRE)
+            .build()
+            .newHandler(channel.alloc());
+    Promise<X509Certificate> clientCertificatePromise = channel.eventLoop().newPromise();
+    Future<Channel> unusedFuture =
+        sslHandler
+            .handshakeFuture()
+            .addListener(
+                future -> {
+                  if (future.isSuccess()) {
+                    Promise<X509Certificate> unusedPromise =
+                        clientCertificatePromise.setSuccess(
+                            (X509Certificate)
+                                sslHandler.engine().getSession().getPeerCertificates()[0]);
+                  } else {
+                    Promise<X509Certificate> unusedPromise =
+                        clientCertificatePromise.setFailure(future.cause());
+                  }
+                });
+    channel.attr(CLIENT_CERTIFICATE_PROMISE_KEY).set(clientCertificatePromise);
+    channel.pipeline().addLast(sslHandler);
+  }
+}

java/google/registry/proxy/handler/WhoisServiceHandler.java

@@ -0,0 +1,54 @@
+// Copyright 2017 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.proxy.handler;
+
+import com.google.common.base.Supplier;
+import google.registry.proxy.metric.FrontendMetrics;
+import io.netty.buffer.ByteBuf;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.handler.codec.http.FullHttpRequest;
+import io.netty.handler.codec.http.HttpHeaderNames;
+import io.netty.handler.codec.http.HttpHeaderValues;
+
+/** Handler that processes WHOIS protocol logic. */
+public final class WhoisServiceHandler extends HttpsRelayServiceHandler {
+
+  public WhoisServiceHandler(
+      String relayHost,
+      String relayPath,
+      Supplier<String> accessTokenSupplier,
+      FrontendMetrics metrics) {
+    super(relayHost, relayPath, accessTokenSupplier, metrics);
+  }
+
+  @Override
+  public void channelActive(ChannelHandlerContext ctx) throws Exception {
+    metrics.registerActiveConnection("whois", "none", ctx.channel());
+    super.channelActive(ctx);
+  }
+
+  @Override
+  protected FullHttpRequest decodeFullHttpRequest(ByteBuf byteBuf) {
+    FullHttpRequest request = super.decodeFullHttpRequest(byteBuf);
+    request
+        .headers()
+        // Close connection after a response is received, per RFC-3912
+        // https://tools.ietf.org/html/rfc3912
+        .set(HttpHeaderNames.CONNECTION, HttpHeaderValues.CLOSE)
+        .set(HttpHeaderNames.CONTENT_TYPE, HttpHeaderValues.TEXT_PLAIN)
+        .set(HttpHeaderNames.ACCEPT, HttpHeaderValues.TEXT_PLAIN);
+    return request;
+  }
+}