new option to ignore incoming connection encryption if set

src/java/org/apache/cassandra/config/Config.java

@@ -240,6 +240,7 @@ public class Config
     public EncryptionOptions.ServerEncryptionOptions encryption_options;
     public Boolean listen_on_storage_port;
     public Boolean listen_on_ssl_storage_port;
+    public Boolean external_addressing_mode;
 
     public InternodeCompression internode_compression = InternodeCompression.none;
 

src/java/org/apache/cassandra/config/DatabaseDescriptor.java

@@ -2119,6 +2119,12 @@ public static boolean shouldListenOnStoragePort() {
         }
     }
 
+    public static boolean isExternalAddressingMode() {
+        if (conf.external_addressing_mode == null)
+            return false;
+        return conf.external_addressing_mode;
+    }
+
     public static boolean shouldListenOnSslStoragePort() {
         if (conf.listen_on_ssl_storage_port == null)
             return getServerEncryptionOptions().internode_encryption != EncryptionOptions.ServerEncryptionOptions.InternodeEncryption.none;

src/java/org/apache/cassandra/net/IncomingStreamingConnection.java

@@ -72,7 +72,9 @@ public void run()
             {
                 logger.warn("Peer {} attempted to establish an unencrypted streaming connection (broadcast address {})",
                             socket.getRemoteSocketAddress(), init.from);
-                throw new IOException("Peer " + init.from + " attempted an unencrypted streaming connection");
+                if (DatabaseDescriptor.isExternalAddressingMode()) {
+                    throw new IOException("Peer " + init.from + " attempted an unencrypted streaming connection");
+                }
             }
 
             //Set SO_TIMEOUT on follower side

src/java/org/apache/cassandra/net/IncomingTcpConnection.java

@@ -160,7 +160,9 @@ private void receiveMessages() throws IOException
         {
             logger.warn("Peer {} attempted to establish an unencrypted connection (broadcast address {})",
                         socket.getRemoteSocketAddress(), from);
-            throw new IOException("Peer " + from + " attempted an unencrypted connection");
+            if (DatabaseDescriptor.isExternalAddressingMode()) {
+                throw new IOException("Peer " + from + " attempted an unencrypted streaming connection");
+            }
         }
 
         // record the (true) version of the endpoint