Skip to content

Possibly misleading error "ALPN is not configured properly" when Java security manager is enabled #4163

@jmesterh

Description

@jmesterh

I just spent a day on a wild goose chase trying to figure out what was causing this error:

ALPN is not configured properly. See https://github.com/grpc/grpc-java/blob/master/SECURITY.md#troubleshooting for more information.

Reading that page, and looking at my Maven dependency tree, I thought I had some kind of version conflict. I spent a day uselessly swapping out different library versions to try and fix this. In frustration I created a completely new project, with the same dependencies, and it worked. I turns out my app is using the Java Security Manager, and it was silently blocking tcnative from being loaded by netty-tcnative-boringssl-static.

Adding these three permissions fixed it:

permissions.add(new NetPermission("getProxySelector", "read"));
permissions.add(new FilePermission(System.getProperty("java.io.tmpdir")+"/-", "read,write"));
permissions.add(new RuntimePermission("loadLibrary.*"));

I couldn't figure out how to whitelist only the tcnative library, as the Netty Native Library Loader appends a random number to the library name every time (ironically, probably for security reasons).

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions