@normanmaurer and @trustin - Thoughts?
 PR https://github.com/netty/netty/pull/3073 demonstrates using the `wantsDirectBuffer` variable to prevent requiring a direct byte buffer on every wrap.  This could be a big savings if non-direct byte buffers are used and direct byte buffers are not required (i.e. JDK ssl provider?).
 @Scottmitch sounds legit to me... let us wait what @trustin things about it
 @normanmaurer - Ok sounds good.
 Cherry-picked changes into 4.0, 4.1 and master
 @normanmaurer Thanks!

This sounds legit... @trustin agree ? 

SslHandler wrap unconditionally copying to direct buffer
In light of a recent bug fix (https://github.com/netty/netty/pull/3058) it became evident that the SslHander wrap method was (and is still) unconditionally requiring a direct ByteBuffer for the input buffer to the SSLEngine.wrap() operation [here](https://github.com/netty/netty/blob/4.0/handler/src/main/java/io/netty/handler/ssl/SslHandler.java#L584).  Is it necessary (or even beneficial) to always do the the extra allocation and copy?  Should this conversion be conditional based upon the [wantsDirectBuffer](https://github.com/netty/netty/blob/4.0/handler/src/main/java/io/netty/handler/ssl/SslHandler.java#L187) boolean member variable, or some other condition?

handler/src/main/java/io/netty/handler/ssl/SslHandler.java
handler/src/main/java/io/netty/handler/ssl/SslHandler.java
diff --git a/handler/src/main/java/io/netty/handler/ssl/SslHandler.java b/handler/src/main/java/io/netty/handler/ssl/SslHandler.java
index 9ea071d5292..3b683ff1e0c 100644
--- a/handler/src/main/java/io/netty/handler/ssl/SslHandler.java
+++ b/handler/src/main/java/io/netty/handler/ssl/SslHandler.java
@@ -182,7 +182,7 @@ public class SslHandler extends ByteToMessageDecoder implements ChannelOutboundH
     // BEGIN Platform-dependent flags
 
     /**
-     * {@code trus} if and only if {@link SSLEngine} expects a direct buffer.
+     * {@code true} if and only if {@link SSLEngine} expects a direct buffer.
      */
     private final boolean wantsDirectBuffer;
     /**
@@ -581,7 +581,7 @@ private SSLEngineResult wrap(ByteBufAllocator alloc, SSLEngine engine, ByteBuf i
         ByteBuf newDirectIn = null;
         try {
             final ByteBuffer in0;
-            if (in.isDirect()) {
+            if (in.isDirect() || !wantsDirectBuffer) {
                 in0 = in.nioBuffer();
             } else {
                 int readableBytes = in.readableBytes();
