Possibly misleading error "ALPN is not configured properly" when Java security manager is enabled

[jmesterh]

I just spent a day on a wild goose chase trying to figure out what was causing this error:

ALPN is not configured properly. See https://github.com/grpc/grpc-java/blob/master/SECURITY.md#troubleshooting for more information.

Reading that page, and looking at my Maven dependency tree, I thought I had some kind of version conflict. I spent a day uselessly swapping out different library versions to try and fix this. In frustration I created a completely new project, with the same dependencies, and it worked. I turns out my app is using the Java Security Manager, and it was silently blocking tcnative from being loaded by netty-tcnative-boringssl-static.

Adding these three permissions fixed it:

permissions.add(new NetPermission("getProxySelector", "read"));
permissions.add(new FilePermission(System.getProperty("java.io.tmpdir")+"/-", "read,write"));
permissions.add(new RuntimePermission("loadLibrary.*"));

I couldn't figure out how to whitelist only the tcnative library, as the Netty Native Library Loader appends a random number to the library name every time (ironically, probably for security reasons).

[carl-mastrangelo]

Can you describe how it was silently being blocked? Was there an exception that got swallowed somewhere?

[jmesterh]

I couldn't find an exception being thrown, presumably there was one, somewhere. There is no mention of security manager in the stacktrace:

Caused by: java.lang.IllegalArgumentException: ALPN is not configured properly. See https://github.com/grpc/grpc-java/blob/master/SECURITY.md#troubleshooting for more information.
	at io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts.selectApplicationProtocolConfig(GrpcSslContexts.java:163)
	at io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts.configure(GrpcSslContexts.java:136)
	at io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts.configure(GrpcSslContexts.java:124)
	at io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts.forClient(GrpcSslContexts.java:94)
	at io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder$NettyTransportFactory$DefaultNettyTransportCreationParamsFilterFactory.<init>(NettyChannelBuilder.java:546)
	at io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder$NettyTransportFactory$DefaultNettyTransportCreationParamsFilterFactory.<init>(NettyChannelBuilder.java:539)
	at io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder$NettyTransportFactory.<init>(NettyChannelBuilder.java:477)
	at io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder.buildTransportFactory(NettyChannelBuilder.java:325)
	at io.grpc.internal.AbstractManagedChannelImplBuilder.build(AbstractManagedChannelImplBuilder.java:342)
	at com.google.api.gax.grpc.InstantiatingGrpcChannelProvider.createSingleChannel(InstantiatingGrpcChannelProvider.java:185)
	at com.google.api.gax.grpc.InstantiatingGrpcChannelProvider.createChannel(InstantiatingGrpcChannelProvider.java:142)
	at com.google.api.gax.grpc.InstantiatingGrpcChannelProvider.getTransportChannel(InstantiatingGrpcChannelProvider.java:134)
	at com.google.cloud.pubsub.v1.Subscriber.doStart(Subscriber.java:280)
	at com.google.api.core.AbstractApiService$InnerService.doStart(AbstractApiService.java:148)
	at com.google.common.util.concurrent.AbstractService.startAsync(AbstractService.java:225)
	at com.google.api.core.AbstractApiService.startAsync(AbstractApiService.java:120)
	at com.google.cloud.pubsub.v1.Subscriber.startAsync(Subscriber.java:270)
	... 3 more
Caused by: java.lang.ClassNotFoundException: org/eclipse/jetty/alpn/ALPN
	at java.lang.Class.forName0(Native Method)
	at java.lang.Class.forName(Class.java:348)
	at io.grpc.netty.shaded.io.grpc.netty.JettyTlsUtil.isJettyAlpnConfigured(JettyTlsUtil.java:34)
	at io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts.selectApplicationProtocolConfig(GrpcSslContexts.java:153)
	... 19 more
Exiting with error code 1

[saturnism]

We should add this to the troubleshooting section.

[ejona86]

This is a code problem. We don't expose the tcnative error naturally (although a user could find it if they wanted). I try to address this at https://github.com/grpc/grpc-java/pull/3401/files#diff-5f981c27dfe25e42ae666269a48b0488R229 .

[ejona86]

Fixed by #3401