title: Using SSL with Netty at the beginning of a connection, then disabling it
body: <p>I'm writing a server application and its client counterpart that both use Netty for the network layer. I find myself facing typical safety concerns about sending a password from a client to the server so I decided SSL was the safest way of doing this.</p>
  
  <p>I know of the <a href="http://docs.jboss.org/netty/3.2/xref/org/jboss/netty/example/securechat/package-summary.html" rel="nofollow">securechat</a> example and will use this to modify my pipelines accordingly. However, I would also like to disable SSL after password transmission and acknowledge to save a few precious CPU cycles on server side, which may be busy with many other clients. The <a href="http://docs.jboss.org/netty/3.2/api/org/jboss/netty/channel/ChannelPipeline.html" rel="nofollow">ChannelPipeline</a> documentation states that:</p>
  
  <blockquote>
    <p>"Once attached, the coupling between the channel and the pipeline is permanent; the channel cannot attach another pipeline to it nor detach the current pipeline from it."</p>
  </blockquote>
  
  <p>The idea is then to not change the pipeline on-the-fly, which is prohibited, but to somehow tell the <em>SslHandler</em> in the pipeline that it should stop encrypting messages at some point. I was thinking of creating a class inheriting from <em>SslHandler</em>, overriding its <em>handleDownstream</em> function to call <em>context.sendDownstream(evt)</em> after some point in the communication.</p>
  
  <p><em>Question 1</em>: Is this a bad idea, that is, disabling SSL at some point ?</p>
  
  <p>To allow a block in the pipeline (say a <em>Decoder</em>) telling another block (say <em>SslHandler</em>) that it should change its behaviour from now on, I thought I could create, say, an <em>AtomicBoolean</em> in my <em>ChannelPipelineFactory</em>'s <em>getPipeline()</em> and pass it to the constructor of both the <em>Decoder</em> and the <em>SslHandler</em>.</p>
  
  <p><em>Question 2</em>: Is this a bad idea, that is, sharing state between pipeline blocks ? I'm worried I might screw up the multithreading of Netty here: are the blocks of a pipeline working on a single message, one at a time ? i.e.: does the first block wait for the completion of the last block before pulling the next message ?</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>Oh my bad, this is from the <a href="http://docs.jboss.org/netty/3.2/api/org/jboss/netty/channel/ChannelPipeline.html" rel="nofollow">ChannelPipeline</a> page I had been visiting many times and quoting in this very question:</p>
  
  <blockquote>
    <p>"A ChannelHandler can be added or removed at any time because a ChannelPipeline is thread safe. For example, you can insert a SslHandler when sensitive information is about to be exchanged, and remove it after the exchange."</p>
  </blockquote>
  
  <p>So this answers question 2 about modifying the pipeline's <em>content</em> on-the-fly, and not the pipeline reference itself.</p>