Channel closed when running simple example with TLS

[stefano...@digitalasset.com]

(question originally posted on StackOverflow)

I'm trying to run the official "Hello, World" example with TLS, provided by the gRPC team (code on GitHub).

I've cloned the official repo and checked out tag v1.15.0.

I've run the installation script as follows (as shown in the documentation):

./gradlew installDist

I've edited the launch scripts for hello-world-server and hello-world-client to run the classes io.grpc.examples.helloworldtls.HelloWorldServerTls and io.grpc.examples.helloworldtls.HelloWorldClientTls respectively.

I've created the certificates needed for the TLS authentication to happen using the script provided as part of the documentation and stored them in a directory I named cert.

Finally, I've run the server as follows:

./build/install/examples/bin/hello-world-server localhost 50440 cert/server.crt cert/server.pem

The server starts correctly and outputs the following:

Oct 08, 2018 9:15:10 AM io.grpc.examples.helloworldtls.HelloWorldServerTls start
INFO: Server started, listening on 50440

Finally, I try to start the client on another shell with the following command:

./build/install/examples/bin/hello-world-client localhost 50440 cert/ca.crt

Unfortunately, the client fails with the following output:

Oct 08, 2018 9:25:22 AM io.grpc.examples.helloworldtls.HelloWorldClientTls greet
INFO: Will try to greet localhost ...
Oct 08, 2018 9:25:22 AM io.grpc.examples.helloworldtls.HelloWorldClientTls greet
WARNING: RPC failed: Status{code=UNKNOWN, description=channel closed, cause=java.nio.channels.ClosedChannelException
    at io.grpc.netty.Utils.statusFromThrowable(Utils.java:169)
    at io.grpc.netty.NettyClientTransport$5.operationComplete(NettyClientTransport.java:260)
    at io.grpc.netty.NettyClientTransport$5.operationComplete(NettyClientTransport.java:254)
    at io.netty.util.concurrent.DefaultPromise.notifyListener0(DefaultPromise.java:511)
    at io.netty.util.concurrent.DefaultPromise.notifyListenersNow(DefaultPromise.java:485)
    at io.netty.util.concurrent.DefaultPromise.notifyListeners(DefaultPromise.java:424)
    at io.netty.util.concurrent.DefaultPromise.setFailure(DefaultPromise.java:112)
    at io.netty.channel.DefaultChannelPromise.setFailure(DefaultChannelPromise.java:89)
    at io.grpc.netty.ProtocolNegotiators$AbstractBufferingHandler.fail(ProtocolNegotiators.java:564)
    at io.grpc.netty.ProtocolNegotiators$BufferUntilTlsNegotiatedHandler.userEventTriggered(ProtocolNegotiators.java:661)
    at io.netty.channel.AbstractChannelHandlerContext.invokeUserEventTriggered(AbstractChannelHandlerContext.java:329)
    at io.netty.channel.AbstractChannelHandlerContext.invokeUserEventTriggered(AbstractChannelHandlerContext.java:315)
    at io.netty.channel.AbstractChannelHandlerContext.fireUserEventTriggered(AbstractChannelHandlerContext.java:307)
    at io.netty.handler.ssl.SslUtils.handleHandshakeFailure(SslUtils.java:318)
    at io.netty.handler.ssl.SslHandler.setHandshakeFailure(SslHandler.java:1551)
    at io.netty.handler.ssl.SslHandler.channelInactive(SslHandler.java:1023)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:245)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:231)
    at io.netty.channel.AbstractChannelHandlerContext.fireChannelInactive(AbstractChannelHandlerContext.java:224)
    at io.netty.channel.DefaultChannelPipeline$HeadContext.channelInactive(DefaultChannelPipeline.java:1429)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:245)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:231)
    at io.netty.channel.DefaultChannelPipeline.fireChannelInactive(DefaultChannelPipeline.java:947)
    at io.netty.channel.AbstractChannel$AbstractUnsafe$8.run(AbstractChannel.java:822)
    at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:163)
    at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:404)
    at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:464)
    at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:884)
    at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
    at java.base/java.lang.Thread.run(Thread.java:844)
Caused by: java.nio.channels.ClosedChannelException
    at io.netty.handler.ssl.SslHandler.channelInactive(...)(Unknown Source)
}

The error occurs with mutual authentication as well.

I'm not sure what's going wrong or how to find the root cause of this, do you have any pointers?

[stefano...@digitalasset.com]

I originally followed the instructions on this document to set up my project and used netty-tcnative-boringssl-static version 2.0.7.Final.

Using version 2.0.17.Final made the problem go away.

Any idea of why that may be the case?

[stefano...@digitalasset.com]

This document: https://github.com/grpc/grpc-java/blob/master/SECURITY.md#getting-netty-tcnative-boringssl-static-from-maven

[stefano...@digitalasset.com]

After checking multiple versions, it seems that 2.0.11.Final is the one that fixes the problem. Will have a look at the change logs.

On Monday, October 8, 2018 at 10:29:36 AM UTC+2, stefano...@digitalasset.com wrote:

[stefano...@digitalasset.com]

I looked on the project page and the code repo but it looks like there are no available changelogs. Is there any way to understand what caused the problem and why it went away?

https://opensource.google.com/projects/boringssl

On Monday, October 8, 2018 at 3:50:27 PM UTC+2, stefano...@digitalasset.com wrote:

After checking multiple versions, it seems that 2.0.11.Final is the one that fixes the problem. Will have a look at the change logs.

On Monday, October 8, 2018 at 10:29:36 AM UTC+2, stefano...@digitalasset.com wrote:

(question originally posted on StackOverflow)

I'm trying to run the official "Hello, World" example with TLS, provided by the gRPC team (code on GitHub).

I've cloned the official repo and checked out tag v1.15.0.

I've run the installation script as follows (as shown in the documentation):

./gradlew installDist

I've edited the launch scripts for hello-world-server and hello-world-client to run the classes io.grpc.examples.helloworldtls.HelloWorldServerTls and io.grpc.examples.helloworldtls.HelloWorldClientTls respectively.

I've created the certificates needed for the TLS authentication to happen using the script provided as part of the documentation and stored them in a directory I named cert.

Finally, I've run the server as follows:

./build/install/examples/bin/hello-world-server localhost 50440 cert/server.crt cert/server.pem

The server starts correctly and outputs the following:

Oct 08, 2018 9:15:10 AM io.grpc.examples.helloworldtls.HelloWorldServerTls start
INFO: Server started, listening on 50440

Finally, I try to start the client on another shell with the following command:

./build/install/examples/bin/hello-world-client localhost 50440 cert/ca.crt

Unfortunately, the client fails with the following output:

Oct 08, 2018 9:25:22 AM io.grpc.examples.helloworldtls.HelloWorldClientTls greet
INFO: Will try to greet localhost ...
Oct 08, 2018 9:25:22 AM io.grpc.examples.helloworldtls.HelloWorldClientTls

 greet
WARNING: RPC failed: Status{code=UNKNOWN, description=channel closed, cause=java.<span style="font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;line-height:inherit;font-family:inherit;v

[Stefano Baghino]

Ok, as reported in the document I linked in this same thread, I was using incompatible versions.

This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.digitalasset.com/emaildisclaimer.html. If you are not the intended recipient, please delete this message.

--
You received this message because you are subscribed to a topic in the Google Groups "grpc.io" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/grpc-io/zg9tBeRpg88/unsubscribe.
To unsubscribe from this group and all its topics, send an email to grpc-io+u...@googlegroups.com.
To post to this group, send email to grp...@googlegroups.com.
Visit this group at https://groups.google.com/group/grpc-io.
To view this discussion on the web visit https://groups.google.com/d/msgid/grpc-io/d0c5ffdc-7e40-4eb3-b4d3-7bd58acbd407%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Stefano Baghino
Software Engineer
e: stefano...@digitalasset.com

Digital Asset (Switzerland) GmbH
Luggwegstrasse 9
8048 Zurich, Switzerland
digitalasset.com

This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.digitalasset.com/emaildisclaimer.html. If you are not the intended recipient, please delete this message.