/*
 * Copyright 2018 Netflix, Inc.
 *
 *      Licensed under the Apache License, Version 2.0 (the "License");
 *      you may not use this file except in compliance with the License.
 *      You may obtain a copy of the License at
 *
 *          http://www.apache.org/licenses/LICENSE-2.0
 *
 *      Unless required by applicable law or agreed to in writing, software
 *      distributed under the License is distributed on an "AS IS" BASIS,
 *      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *      See the License for the specific language governing permissions and
 *      limitations under the License.
 */

package com.netflix.zuul.netty.server.http2;

import com.netflix.config.DynamicBooleanProperty;
import com.netflix.zuul.netty.ssl.SslContextFactory;
import io.netty.handler.ssl.ApplicationProtocolConfig;
import io.netty.handler.ssl.ApplicationProtocolNames;
import io.netty.handler.ssl.SslContext;
import io.netty.handler.ssl.SslContextBuilder;

import javax.net.ssl.SSLException;

public class Http2Configuration {

    private static final DynamicBooleanProperty HTTP2_DISABLED =
            new DynamicBooleanProperty("zuul.server.http2.disabled", false);


    /**
     * Use {@link #configureSSL(SslContextFactory, String)} instead.
     */
    @Deprecated
    public static SslContext configureSSL(SslContextFactory sslContextFactory, int port) {
        return configureSSL(sslContextFactory, String.valueOf(port));
    }

    public static SslContext configureSSL(SslContextFactory sslContextFactory, String metricId) {
        SslContextBuilder builder = sslContextFactory.createBuilderForServer();

        String[] supportedProtocol;
        if (HTTP2_DISABLED.get()) {
            supportedProtocol = new String[]{ApplicationProtocolNames.HTTP_1_1};
        }
        else {
            supportedProtocol = new String[]{ApplicationProtocolNames.HTTP_2,
                    ApplicationProtocolNames.HTTP_1_1};
        }

        ApplicationProtocolConfig apn = new ApplicationProtocolConfig(
                ApplicationProtocolConfig.Protocol.ALPN,
                // NO_ADVERTISE is currently the only mode supported by both OpenSsl and JDK providers.
                ApplicationProtocolConfig.SelectorFailureBehavior.NO_ADVERTISE,
                // ACCEPT is currently the only mode supported by both OpenSsl and JDK providers.
                ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT,
                supportedProtocol);

        final SslContext sslContext;
        try {
            sslContext = builder
                    .applicationProtocolConfig(apn)
                    .build();
        }
        catch (SSLException e) {
            throw new RuntimeException("Error configuring SslContext with ALPN!", e);
        }

        // Enable TLS Session Tickets support.
        sslContextFactory.enableSessionTickets(sslContext);

        // Setup metrics tracking the OpenSSL stats.
        sslContextFactory.configureOpenSslStatsMetrics(sslContext, metricId);

        return sslContext;
    }
}

@@ -3075,11 +3075,1234 @@
 t;%0A    %7D
+%0A%0A    /**%0A     * This is meant to be use in cases where the server wishes not to advertise h2 as part of ALPN.%0A     */%0A    private SslContext configureSSLWithH2Disabled(SslContextFactory sslContextFactory, String host) %7B%0A%0A        ApplicationProtocolConfig apn = new ApplicationProtocolConfig(%0A                ApplicationProtocolConfig.Protocol.ALPN,%0A                // NO_ADVERTISE is currently the only mode supported by both OpenSsl and JDK providers.%0A                ApplicationProtocolConfig.SelectorFailureBehavior.NO_ADVERTISE,%0A                // ACCEPT is currently the only mode supported by both OpenSsl and JDK providers.%0A                ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT,%0A                ApplicationProtocolNames.HTTP_1_1);%0A        final SslContext sslContext;%0A        try %7B%0A            sslContext = sslContextFactory.createBuilderForServer().applicationProtocolConfig(apn).build();%0A        %7D catch (SSLException e) %7B%0A            throw new RuntimeException(%22Error configuring SslContext with ALPN!%22, e);%0A        %7D%0A%0A        sslContextFactory.enableSessionTickets(sslContext);%0A        sslContextFactory.configureOpenSslStatsMetrics(sslContext, host);%0A        return sslContext;%0A    %7D
 %0A%7D%0A

add SslContext builder with h2 disabled