BUG: streaming speech sample uses an old version of BoringSSL

[lesv]

If you copy from it to your app, and you develop on Windows -> deploy on Linux, it will crash.

@puneith @jerjou @tswast FYI

[manjunaras]

Yes... I can deploy in windows and running fine. When same code if i push to Ubunta (IBM Bluemix) it crashes and below error generated,

Jetty ALPN/NPN has not been properly configured

Any update on this?

[lesv]

Hi Manjunaras,

You might wish to look at https://github.com/grpc/grpc-java/blob/master/SECURITY.md on the issue. If @puneith or @gguuss don't get a chance I'll try to look at it later this week.

[manjunaras]

Thanks for your quick update @lesv.

I followed the link shared and used OpenSSL: Dynamically Linked. Problem here is we developed Google speech streaming in windows os and deployed in tomcat and it really worked well and we can able to see transcript what ever we speak through microphone.

Later, took the same war file created in windows os and deployed to IBM Bluemix (Linux platform) it deployed success. When we speak through microphone,We got intial managedchannel instance working fine and later it throws error, find below error trace from IBM Bluemix logs

[gguuss]

I have a build working with an explicit version of Netty / BoringSSL, I'll check later today when I'm home to see if it fixes the build on Windows deploy on Linux issue.

[gguuss]

Building on Windows and then deploying to OSX didn't repro the issue for me. I was also unable to get the bug to appear on a Linux machine. I'm building with Maven and Java 1.8 on Windows and running the jar on Linux OSX without issue. Looks like it I'll need to perform multiple transcriptions to see the error.

[manjunaras]

Can you please review my working pom in windows that we build using maven in windows and push to IBM Bluemix (Linux),

You can see below tests in windows and linux where openssl fails in linux based on native libraries,
System.out.println("OpenSSL available? " + OpenSsl.isAvailable());
System.out.println("ALPN available? " + OpenSsl.isAlpnSupported());

In windows/tomcat server,
OpenSSL available? = true
ALPN available? = true

In Linux/IBM Bluemix ,
OpenSSL available? = false // Need to set this flag true, so all native libraries get loaded.
ALPN available? = false

Stack log in Linux/IBM Bluemix:

OpenSsl.unavailabilityCause().printStackTrace(System.out);

Failed to load any of the given libraries: [netty-tcnative-linux-x86_64, netty-tcnative-linux-x86_64-fedora, netty-tcnative]

pom.xml

<modelVersion>4.0.0</modelVersion>
<name>Liberty Profile Sample - Servlet</name>
<url>http://maven.apache.org</url>

<groupId>net.wasdev.wlp.sample</groupId>
<artifactId>JavaHelloWorldApp</artifactId>
<version>1.0</version>
<packaging>war</packaging>

<parent>
	<groupId>net.wasdev.maven.parent</groupId>
	<artifactId>java7-parent</artifactId>
	<version>1.4</version>
	<relativePath></relativePath>
</parent>


<licenses>
	<license>
		<name>The Apache Software License, Version 2.0</name>
		<url>https://raw.github.com/WASdev/sample.servlet/master/LICENSE</url>
		<distribution>repo</distribution>
	</license>

	<license>
		<name>The Apache Software License, Version 2.0</name>
		<url>https://raw.github.com/WASdev/sample.javaee7.websocket/master/LICENSE</url>
		<distribution>repo</distribution>
	</license>
	<license>
		<name>Apache 2</name>
		<url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
		<distribution>repo</distribution>
	</license>
</licenses>

<!-- My projects are run by some sort of organization describe below -->
<organization>
	<name>Google</name>
	<url>http://www.google.com</url>
</organization>

<!-- <scm> <connection>scm:git:git@github.com:WASdev/sample.javaee7.websocket.git</connection> 
	<developerConnection>scm:git:git@github.com:WASdev/sample.javaee7.websocket.git</developerConnection> 
	<url>git@github.com:WASdev/sample.javaee7.websocket.git</url> </scm> -->

<properties>
	<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
	<codehaus-versions-maven-plugin-version>2.3</codehaus-versions-maven-plugin-version>
	<grpc-protobuf-version>1.1.2</grpc-protobuf-version>
	<grpc-version>1.2.0</grpc-version> <!-- 1.1.2 doesn't work - DO NOT UPGRADE -->
	<maven-compiler-plugin-version>3.6.0</maven-compiler-plugin-version>
	<xolstice-protobuf-maven-plugin-version>0.5.0</xolstice-protobuf-maven-plugin-version>

	<maven.compiler.target>1.8</maven.compiler.target>
	<maven.compiler.source>1.8</maven.compiler.source>
</properties>

<prerequisites>
	<maven>3.3.9</maven>
</prerequisites>

<!-- [START] - profiles -->
<profiles>
	<profile>
		<id>staged</id>
		<repositories>
			<repository>
				<id>snapshots-repo</id>
				<url>https://oss.sonatype.org/content/repositories/snapshots</url>
				<releases>
					<enabled>false</enabled>
				</releases>
				<snapshots>
					<enabled>true</enabled>
				</snapshots>
			</repository>
		</repositories>
	</profile>
	<profile>
		<id>jdk7</id>
		<activation>
			<jdk>1.7</jdk>
		</activation>
		<properties>
			<jdk.version>1.7</jdk.version>
		</properties>
	</profile>
	<profile>
		<id>jdk8</id>
		<activation>
			<jdk>1.8</jdk>
		</activation>
		<properties>
			<jdk.version>1.8</jdk.version>
		</properties>
	</profile>
	<profile>
		<id>fedora</id>
		<activation>
			<property>
				<name>os.detected.classifier</name>
				<value>os.detected.release.fedora</value>
			</property>
		</activation>
		<properties>
			<tcnative.classifier>${os.detected.classifier}-fedora</tcnative.classifier>
		</properties>
	</profile>
	<profile>
		<id>non-fedora</id>
		<activation>
			<property>
				<name>os.detected.classifier</name>
				<value>!os.detected.release.fedora</value>
			</property>
		</activation>
		<properties>
			<tcnative.classifier>${os.detected.classifier}</tcnative.classifier>
		</properties>
	</profile>
</profiles>

<!-- [END] - profiles -->

<dependencyManagement>
	<dependencies>
		<dependency>
			<groupId>org.apache.geronimo.specs</groupId>
			<artifactId>geronimo-servlet_3.0_spec</artifactId>
			<version>1.0</version>
		</dependency>
	</dependencies>
</dependencyManagement>

<dependencies>
	<dependency>
		<groupId>jstl</groupId>
		<artifactId>jstl</artifactId>
		<version>1.2</version>
	</dependency>

	<dependency>
		<groupId>org.apache.geronimo.specs</groupId>
		<artifactId>geronimo-servlet_3.0_spec</artifactId>
		<scope>provided</scope>
	</dependency>

	<dependency>
		<groupId>javax.websocket</groupId>
		<artifactId>javax.websocket-api</artifactId>
		<scope>provided</scope>
		<version>1.0</version>
	</dependency>

	<!-- https://mvnrepository.com/artifact/javax.json/javax.json-api -->
	<!-- <dependency> <groupId>javax.json</groupId> <artifactId>javax.json-api</artifactId> 
		<version>1.0</version> </dependency> -->

	<dependency>
		<groupId>junit</groupId>
		<artifactId>junit</artifactId>
		<version>4.12</version>
		<scope>test</scope>
	</dependency>

	<!-- https://mvnrepository.com/artifact/com.google.code.gson/gson -->
	<dependency>
		<groupId>com.google.code.gson</groupId>
		<artifactId>gson</artifactId>
		<version>2.8.0</version>
	</dependency>

	<!-- Google Speech dependency -->
	<!-- // [START speech API dependency] -->
	<dependency>
		<groupId>com.google.cloud</groupId>
		<artifactId>google-cloud-speech</artifactId>
		<version>0.8.3-alpha</version>
	</dependency>

	<dependency>
		<groupId>commons-cli</groupId>
		<artifactId>commons-cli</artifactId>
		<version>1.3.1</version>
	</dependency>

	<dependency>
		<groupId>com.google.auth</groupId>
		<artifactId>google-auth-library-credentials</artifactId>
		<version>0.6.0</version>
	</dependency>

	<dependency>
		<groupId>com.google.auth</groupId>
		<artifactId>google-auth-library-oauth2-http</artifactId>
		<version>0.6.0</version>
		<exclusions>
			<!-- Exclude an old version of guava that is being pulled in by a transitive 
				dependency of google-api-client -->
			<exclusion>
				<groupId>com.google.guava</groupId>
				<artifactId>guava-jdk5</artifactId>
			</exclusion>
		</exclusions>
	</dependency>

	<dependency>
		<groupId>com.google.guava</groupId>
		<artifactId>guava</artifactId>
		<version>20.0</version>
	</dependency>
	<dependency>
		<groupId>com.google.truth</groupId>
		<artifactId>truth</artifactId>
		<version>0.32</version>
		<scope>test</scope>
	</dependency>
	<dependency>
		<groupId>org.mockito</groupId>
		<artifactId>mockito-all</artifactId>
		<version>1.10.19</version>
		<scope>test</scope>
	</dependency>
	<dependency>
		<groupId>io.grpc</groupId>
		<artifactId>grpc-auth</artifactId>
		<version>${grpc-version}</version>
	</dependency>
	<dependency>
		<groupId>io.grpc</groupId>
		<artifactId>grpc-netty</artifactId>
		<version>${grpc-version}</version>
	</dependency>
	<dependency>
		<groupId>io.grpc</groupId>
		<artifactId>grpc-protobuf</artifactId>
		<version>${grpc-version}</version>
	</dependency>
	<dependency>
		<groupId>io.grpc</groupId>
		<artifactId>grpc-stub</artifactId>
		<version>${grpc-version}</version>
	</dependency>

	<dependency>
		<groupId>log4j</groupId>
		<artifactId>log4j</artifactId>
		<version>1.2.17</version>
	</dependency>
	<dependency>
		<groupId>com.fasterxml.jackson.core</groupId>
		<artifactId>jackson-core</artifactId>
		<version>2.7.4</version>
	</dependency>
	<dependency>
		<groupId>com.fasterxml.jackson.core</groupId>
		<artifactId>jackson-databind</artifactId>
		<version>2.7.4</version>
	</dependency>
	<dependency>
		<!-- - It is recommended to use OpenSSL: Statically Linked Netty - for 
			transport security. These steps do not use the TLS that - comes with JDK 
			(Jetty APLN/NPN), which is not - recommended. See - https://github.com/grpc/grpc-java/blob/master/SECURITY.md 
			- for details. - -->
		<groupId>io.netty</groupId>
		<artifactId>netty-tcnative</artifactId>
		<version>1.1.33.Fork26</version>
		<!-- <classifier>${tcnative.classifier}</classifier> -->
	</dependency>
	<dependency>
		<groupId>javax</groupId>
		<artifactId>javaee-api</artifactId>
		<version>7.0</version>
	</dependency>

	<!-- // [END speech API dependency] -->

	<dependency>
		<groupId>org.eclipse.jetty.alpn</groupId>
		<artifactId>alpn-api</artifactId>
		<version>1.1.3.v20160715</version>
	</dependency>
</dependencies>
<build>
	<extensions>
		<extension>
			<groupId>kr.motd.maven</groupId>
			<artifactId>os-maven-plugin</artifactId>
			<version>1.4.0.Final</version>
		</extension>
	</extensions>
	<pluginManagement>
		<plugins>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-war-plugin</artifactId>
				<configuration>
					<failOnMissingWebXml>false</failOnMissingWebXml>
					<warName>JavaHelloWorldApp</warName>
				</configuration>
			</plugin>
			<plugin>
				<groupId>net.wasdev.wlp.maven.plugins</groupId>
				<artifactId>liberty-maven-plugin</artifactId>
				<version>1.2.1</version>
			</plugin>
		</plugins>
	</pluginManagement>
	<plugins>
		<plugin>
			<groupId>net.wasdev.wlp.maven.plugins</groupId>
			<artifactId>liberty-maven-plugin</artifactId>
			<configuration>
				<configFile>src/main/wlp/server.xml</configFile>
				<bootstrapProperties>
					<appLocation>../../../../../${project.build.finalName}</appLocation>
				</bootstrapProperties>
			</configuration>
		</plugin>
		<plugin>
			<groupId>org.xolstice.maven.plugins</groupId>
			<artifactId>protobuf-maven-plugin</artifactId>
			<version>${xolstice-protobuf-maven-plugin-version}</version>
			<configuration>
				<!-- The version of protoc must match protobuf-java. If you don't depend 
					on protobuf-java directly, you will be transitively depending on the protobuf-java 
					version that grpc depends on. -->
				<protocArtifact>com.google.protobuf:protoc:3.0.0:exe:${os.detected.classifier}</protocArtifact>
				<pluginId>grpc-java</pluginId>
				<protoSourceRoot>${basedir}/src/main/java/third_party</protoSourceRoot>
				<pluginArtifact>io.grpc:protoc-gen-grpc-java:${grpc-protobuf-version}:exe:${os.detected.classifier}</pluginArtifact>
			</configuration>
			<executions>
				<execution>
					<goals>
						<goal>compile</goal>
						<goal>compile-custom</goal>
					</goals>
				</execution>
			</executions>
		</plugin>
		<plugin>
			<groupId>org.codehaus.mojo</groupId>
			<artifactId>versions-maven-plugin</artifactId>
			<version>${codehaus-versions-maven-plugin-version}</version>
			<executions>
				<execution>
					<phase>compile</phase>
					<goals>
						<goal>display-dependency-updates</goal>
					</goals>
				</execution>
			</executions>
		</plugin>
		<plugin>
			<artifactId>maven-compiler-plugin</artifactId>
			<version>${maven-compiler-plugin-version}</version>
			<configuration>
				<source>${jdk.version}</source>
				<target>${jdk.version}</target>
				<showWarnings>true</showWarnings>
				<showDeprecation>false</showDeprecation>
				<compilerArgument>-Xlint:-options</compilerArgument>
			</configuration>
		</plugin>
		<plugin>
			<artifactId>maven-assembly-plugin</artifactId>
			<configuration>
				<descriptorRefs>
					<descriptorRef>jar-with-dependencies</descriptorRef>
				</descriptorRefs>
			</configuration>
			<executions>
				<execution>
					<id>simple-command</id>
					<phase>package</phase>
					<goals>
						<goal>attached</goal>
					</goals>
				</execution>
			</executions>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-antrun-plugin</artifactId>
				<executions>
					<execution>
						<phase>initialize</phase>
						<configuration>
							<exportAntProperties>true</exportAntProperties>
							<target>
								<condition property="tcnative.classifier" value="${os.detected.classifier}-fedora"
									else="${os.detected.classifier}">
									<isset property="os.detected.release.fedora" />
								</condition>
							</target>
						</configuration>
						<goals>
							<goal>run</goal>
						</goals>
					</execution>
				</executions>
			</plugin>
	</plugins>

</build>

[lesv]

Hi @manjunaras - on BlueMix, are you using Intel or Power servers?

If Power, things aren't going to work with BoringSSL, you can put a request on the Netty repo(s) asking for a version for Power, or you can go with an all Java solution, like using ALPNBoot.

[manjunaras]

Hi @lesv ,

Finally issue resolved by downgrading tomcat version in IBM Bluemix from 8.x to 7.x.

Root cause, tomcat 8 works if ALPN bootclasspath is set. Where as in tomcat 7.x by default OpenSSL is avail.

Thanks for you support @gguuss and @lesv.