ServeHTTP doesn't work without TLS

[tamird]

This is somewhat obvious, knowing that Go's http2 doesn't work without TLS.

Still, it can be surprising given that grpc exposes grpc.WithInsecure(). The errors returned in this case are also really not helpful.

This is a pain point for us in CockroachDB, where we want to allow folks to operate the database without provisioning certificates.

[iamqizhao]

Non-TLS case needs some cmux type of connection dispatching solution we designed but not implemented.

But in general, if your system allows insecure connections, I do not see the reason you need to stick to a single port shared by http2 and grpc. You can have a grpc server and http server listening on 2 different ports in this case.

[tamird]

At the very least, this is a documentation issue.
On Feb 16, 2016 03:55, "Qi Zhao" notifications@github.com wrote:

Non-TLS case needs some cmux type of connection dispatching solution we
designed but not implemented.

But in general, if your system allows insecure connections, I do not see
the reason you need to stick to a single port shared by http2 and grpc. You
can have a grpc server and http server listening on 2 different ports in
this case.

—
Reply to this email directly or view it on GitHub
#555 (comment).

[tamird]

@iamqizhao can you reopen this please? It is actually possible to make this work with some hacks cockroachdb/cockroach@c036c15#diff-4bf1ae5b9eb22814a15582886403053f, however Go 1.6 contains a change that rejects insecure gRPC connections before they even get to the handler golang/go@6e11f45, which breaks this again.

cc @bradfitz

[iamqizhao]

Please provide your use case to justify why your system cannot use 2 ports in the insecure case if you think we should pursue this further. It is not that hard to implement cmux in grpc but we want to focus on the real demands given the limited resource from our side. I think insecure port sharing is a really rare case and not needed by >99% grpc users right now.

[tamird]

OK, but is closing the issue really appropriate? You don't have to fix it
right now, but it's not fair to say that the use case is illegitimate.

On Wed, Feb 17, 2016 at 8:37 PM, Qi Zhao notifications@github.com wrote:

Please provide your use case to justify why your system cannot use 2 ports
in the insecure case if you think we should pursue this further. It is not
that hard to implement cmux in grpc but we want to focus on the real
demands given the limited resource from our side. I think insecure port
sharing is a really rare case and not needed by >99% grpc users right now.

—
Reply to this email directly or view it on GitHub
#555 (comment).

[bradfitz]

We could use the Github Milestone feature to track prioritization. And/or Labels.

[iamqizhao]

To be clear, I was not saying the use case is illegitimate (I was actually saying we even have a designdoc for that). :)

I am trying to clean up and organize (milestones and labels, etc.) all the issues in the repo for GA. I'll see what the best way is to deal with this kind of issues. Reopen this for now.

[vgough]

I just came by to say that don't believe insecure port sharing to be rare. It is very convenient to setup grpc (& other http services) on insecure ports during development, and it is also convenient to reduce the number of ports in order to simplify firewalls and avoid port conflicts. I had been in the process of trying to consolidate ports for a project when I came across this issue.

[glerchundi]

I do not see the reason you need to stick to a single port shared by http2 and grpc. You can have a grpc server and http server listening on 2 different ports in this case.

What about grpc-gateway and grpc server working on the same endpoint? For example like @philips did in his philips/grpc-gateway-example repo.

[AlekSi]

I also do want to have gRPC and REST APIs on the same port. It is possible with TLS (see link in the previous comment), but not without it. And local developing with self-signed certificates is still cumbersome.

[AlekSi]

Cross-reference to implement a workaround with cmux:
https://open.dgraph.io/post/cmux/
https://github.com/soheilhy/cmux