We Keep Coding

Perform client authentication to server with gRPC in Java with only a CA

Problem
I am trying to make a client in Java using gRPC. I have been given access to a kubernetes namespace to test out the client. However, all I have is the certificate authority for the cluster and a bearer token.
apiVersion: v1
clusters:
- cluster:
certificate-authority: /etc/ssl/certs/devwat-dal13-cruiser15-ca-bundle.pem
server: https://<host-ip>:<port>
name: devwat-dal13-cruiser15
contexts:
- context:
cluster: devwat-dal13-cruiser15
namespace: interns
user: devwat-dal13-cruiser15-sa-interns-editor
name: devwat-dal13-cruiser15-interns
current-context: devwat-dal13-cruiser15-interns
kind: Config
preferences: {}
users:
- name: devwat-dal13-cruiser15-sa-interns-editor
user:
token: <token>
Code
I don't know much about SSL and certificates but I tried to follow the documentation online on using SSL/TLS with gRPC with Java and came up with the following:
public class TrainerClient {
private ManagedChannel channel;
private TrainerGrpc.TrainerBlockingStub stub;
//private final String OVERRIDE_AUTHORITY = "24164dfe5c7842c98de431e53b6111d9-kubernetes-ca";
private final String CERT_FILE_PATH = Paths.get("/etc", "ssl", "certs", "devwat-dal13-cruiser15-ca-bundle.pem").toString();
private static final Logger logger = Logger.getLogger(TrainerClient.class.getName());
public TrainerClient(URL serviceUrl) {
File certFile = new File(CERT_FILE_PATH);
try {
logger.info("Initializing channel using SSL...");
this.channel = NettyChannelBuilder.forAddress(serviceUrl.getHost(), serviceUrl.getPort())
//.overrideAuthority(OVERRIDE_AUTHORITY)
.sslContext(getSslContext(certFile))
.build();
logger.info("Initializing new blocking stub...");
this.stub = TrainerGrpc.newBlockingStub(channel);
} catch (Exception ex) {
logger.log(Level.SEVERE, "Channel build failed: {0}", ex.toString());
System.exit(1);
}
}
public static void main(String[] args) {
TrainerClient client = null;
URL url = null;
String fullUrl = "http://localhost:8443";
try {
logger.info("Forming URL...");
url = new URL(fullUrl);
logger.info("Initializing client...");
client = new TrainerClient(url);
// Client Function Calls
TrainerOuterClass.GetAllRequest request = TrainerOuterClass.GetAllRequest.newBuilder().setUserId("").build();
TrainerOuterClass.GetAllResponse response = client.getAllTrainingsJobs(request);
} catch (Exception ex) {
if (ex instanceof MalformedURLException) {
logger.log(Level.SEVERE, "URL is malformed.");
} else {
logger.log(Level.SEVERE, "Exception has occurred: {0}", ex.getStackTrace());
ex.printStackTrace();
}
} finally {
if (client != null) {
try {
logger.info("Shutting down client...");
client.shutdown();
} catch (InterruptedException ex) {
logger.log(Level.WARNING, "Channel shutdown was interrupted.");
}
}
}
}
public SslContext getSslContext(File certFile) throws SSLException {
return GrpcSslContexts.forClient()
.trustManager(certFile)
.build();
}
private void shutdown() throws InterruptedException {
channel.shutdown().awaitTermination(5, TimeUnit.SECONDS);
}
}
The pod type is ClusterIP and is being port-forwarded to localhost with port 8443.
Error
When I run this, I get the following stack trace:
SEVERE: Exception has occurred:
io.grpc.stub.ClientCalls.toStatusRuntimeException(ClientCalls.java:210)
io.grpc.StatusRuntimeException: UNAVAILABLE
at io.grpc.stub.ClientCalls.toStatusRuntimeException(ClientCalls.java:210)
at io.grpc.stub.ClientCalls.getUnchecked(ClientCalls.java:191)
at io.grpc.stub.ClientCalls.blockingUnaryCall(ClientCalls.java:124)
at grpc.trainer.v2.TrainerGrpc$TrainerBlockingStub.getAllTrainingsJobs(TrainerGrpc.java:695)
at me.mikeygulati.grpc.TrainerClient.getAllTrainingsJobs(TrainerClient.java:70)
at me.mikeygulati.grpc.TrainerClient.main(TrainerClient.java:138)
Caused by: javax.net.ssl.SSLHandshakeException: General OpenSslEngine problem
at io.netty.handler.ssl.ReferenceCountedOpenSslContext$AbstractCertificateVerifier.verify(ReferenceCountedOpenSslContext.java:648)
at io.netty.internal.tcnative.SSL.readFromSSL(Native Method)
at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.readPlaintextData(ReferenceCountedOpenSslEngine.java:482)
at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1020)
at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1127)
at io.netty.handler.ssl.SslHandler$SslEngineType$1.unwrap(SslHandler.java:210)
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1215)
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1127)
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1162)
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489)
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428)
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1359)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:935)
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134)
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:645)
at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:580)
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:497)
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:459)
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858)
at io.netty.util.concurrent.DefaultThreadFactory$DefaultRunnableDecorator.run(DefaultThreadFactory.java:138)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.security.cert.CertificateException: No name matching localhost found
at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:231)
at sun.security.util.HostnameChecker.match(HostnameChecker.java:96)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:436)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:252)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136)
at io.netty.handler.ssl.ReferenceCountedOpenSslClientContext$ExtendedTrustManagerVerifyCallback.verify(ReferenceCountedOpenSslClientContext.java:221)
at io.netty.handler.ssl.ReferenceCountedOpenSslContext$AbstractCertificateVerifier.verify(ReferenceCountedOpenSslContext.java:644)
... 26 more
Jul 24, 2018 10:52:05 AM me.mikeygulati.grpc.TrainerClient main
From what I have read online, this happens because the Common Name on the CA does not match the hostname, in my case, localhost. I have tried using an Override Authority so that it would match the Common Name in the CA but I got the same error.
So, I am fairly sure this is not the correct way to do it. I feel like I should have been supplied a client certificate and a client key with the kubernetes cluster but I didn't so, I want to ask if maybe there's something wrong with what I am doing.

Figured it out.
My company had a client certificate (client.crt) lying around that I was supposed to use instead of the CA. When I used that certificate instead with the proper override authority, the error went away.

Unknown host excpetion issue with proxy settings

import java.io.*;
import java.net.*;
import java.util.*;
public class testprop {
public static void main (String args[])
throws IOException, URISyntaxException {
// to check wether proxy working or not
Properties p = System.getProperties();
p.setProperty("proxySet", "true");
p.put("https.proxyHost","proxy servername");
p.put("https.proxyPort","80");
System.setProperties(p);
//if i uncomment the below line i am getting Glib GIO error org.gnome.system.proxy is not installed
//System.setProperty("java.net.useSystemProxies", "true");
try {
Proxy p1= (Proxy) ProxySelector.getDefault().select(new URI("http://google.com")).iterator().next();
System.out.println("ProxyString"+p1.type());
InetSocketAddress addr=(InetSocketAddress)p1.address();
if(addr==null)
System.out.println("no proxy");
else{
System.out.println("Proxy hostname" +addr.getHostName());
System.out.println("Proxy port" +addr.getPort());
}
System.out.println("done");
} catch (URISyntaxException uo){
System.out.println("done3");
}
String str="google.com";
try{
InetAddress ip=InetAddress.getByName(str);
System.out.println("the ip address of servicenow is"+ip);
}catch (UnknownHostException ue){
ue.printStackTrace();
System.out.println("website not found");
}
}
}
I am in an enterprise network,so to access internet I have to go through proxy.The above code is not setting the proxy for the next connection.Throwing an unknown host exception.
Is there any way I can achieve this?
Setting proxy so that external URL will be passed through proxy server.
Out put of the above code:
output:
ProxyStringDIRECT
no proxy
done
java.net.UnknownHostException: google.com: No address associated with hostnamewebsite not found
at java.net.Inet6AddressImpl.lookupAllHostAddr(Native Method)
at java.net.InetAddress$1.lookupAllHostAddr(InetAddress.java:901)
at java.net.InetAddress.getAddressesFromNameService(InetAddress.java:1293)
at java.net.InetAddress.getAllByName0(InetAddress.java:1246)
at java.net.InetAddress.getAllByName(InetAddress.java:1162)
at java.net.InetAddress.getAllByName(InetAddress.java:1098)
at java.net.InetAddress.getByName(InetAddress.java:1048)
at testprop.main(testprop.java:49)

java.net.ConnectException while running webservice?

I am developing the web service where in I want to connect to the SOA server. It's giving connection exception.
Code:
public class ConnectSOA{
public static void main(String[] args){
Map<IWorkflowServiceClientConstants.CONNECTION_PROPERTY, String> connProperties = new HashMap<IWorkflowServiceClientConstants.CONNECTION_PROPERTY, String>();
connProperties.put(IWorkflowServiceClientConstants.CONNECTION_PROPERTY.CLIENT_TYPE,WorkflowServiceClientFactory.REMOTE_CLIENT);
connProperties.put(IWorkflowServiceClientConstants.CONNECTION_PROPERTY.EJB_PROVIDER_URL,"t3://10.10.78.79:8001");
connProperties.put(IWorkflowServiceClientConstants.CONNECTION_PROPERTY.EJB_INITIAL_CONTEXT_FACTORY,"weblogic.jndi.WLInitialContextFactory");
try {
workflowServiceClient = WorkflowServiceClientFactory
.getWorkflowServiceClient(connProperties, null, null);
itaskQueryService = workflowServiceClient.getTaskQueryService();
statePredicate = new Predicate(
TableConstants.WFTASK_STATE_COLUMN, Predicate.OP_EQ,
IWorkflowConstants.TASK_STATE_ASSIGNED);
iworkFlowContext = itaskQueryService.authenticate("demouser","demo1".toCharArray(), null);
} catch(Exception e ){
e.printStackTrace();
}
}
}
Exception :
java.net.ConnectException: t3://10.10.78.79:8001 Bootstrap to: hostname/'10.10.78.79:8001' over: 't3' got an error or timed out
I have check the soa server its up and running on the machine.

Can you ping your weblogic?
java weblogic.Admin -url t3://IP:8001 -username xxx -password xxx PING 10
I see that you have 10.10.78.79:8001 and in Exception IP:8001
Could be that your server is not ok. Check the config. See your config.xml and what the listen address for the server is and verify that you can ping it.

Java derby database server won't start anymore

I inherited some source code that uses a derby database but starting the server doesn't work anymore.
public void startDatabase(){
try {
Class.forName("org.apache.derby.jdbc.ClientDriver");
System.setProperty("derby.system.home", "D:\\runtime-my.product\\log");
NetworkServerControl nsc = new NetworkServerControl(InetAddress.getByName("localhost"), 1527)
nsc.start(null);
nsc.ping();
catch (Exception e){
e.printStackTrace();
}
}
When nsc.ping() is exectued, the following exception is thrown:
Exception: java.lang.Exception: DRDA_NoIO.S:Could not connect to Derby Network Server on host 127.0.0.1, port 1527: Connection refused: connect
Is there anything obvious missing or wrong with those lines of codes?

Check whether the server is started. You need to start the server explicitly. or via
setting the system property derby.drda.startNetworkServer=true.

It takes a while from the NetworkServerControl constructor returns, before the socket is ready for connections. On my machine about 50 ms. I changed your example like so:
NetworkServerControl nsc = new NetworkServerControl(InetAddress.getByName("localhost"), 1527);
nsc.start(null);
for (int i = 0; i < 10; ++i) {
try {
System.out.println("Attempting to ping...");
nsc.ping();
break;
} catch (Exception e) {
System.out.println(e.getMessage());
}
Thread.sleep(10);
}
It succeeded on the 5. attempt...

Open javamail folder failed

I developed an email website using javamail and apache-james and it works well mostly. But some user got Open failed Exception and cannot receive new mail.
The code of receive email:
Session mailSession = Session.getInstance(System.getProperties(), null);
mailSession.setDebug(false);
Store store = null;
Folder folder = null; //javax.mail.Folder
try {
store = mailSession.getStore(SParam.PROTOCOL);
store.connect(Property.getPop3(), userName, password);
logger.info("trying to receive emails from james server...");
folder = store.getFolder("INBOX");
try {
if (!folder.isOpen()) {
folder.open(Folder.READ_WRITE); //the point of throwing the exception
}
} catch (Exception e) {
// TODO: handle exception
e.printStackTrace();
}
//receive email from james server.
} catch (Exception e) {
logger.error("Email Receive Error!" + StackTraceStr.st2str(e));
try {
folder.close(true);
} catch (Exception e2) {
}
} finally {
try {
store.close();
} catch (Exception cloex) {
}
}
In most cases, it works just fine. But still got the error occasionally:
javax.mail.MessagingException: Open failed;
nested exception is:
java.io.IOException: STAT command failed: null
at com.sun.mail.pop3.POP3Folder.open(POP3Folder.java:228)
at com.csc.mail.jsh.mail.core.ReceiveMail.receive(ReceiveMail.java:82)
at com.csc.mail.jsh.mail.core.ReceiveMail.run(ReceiveMail.java:222)
at java.lang.Thread.run(Thread.java:619)
Caused by: java.io.IOException: STAT command failed: null
at com.sun.mail.pop3.Protocol.stat(Protocol.java:366)
at com.sun.mail.pop3.POP3Folder.open(POP3Folder.java:203)
... 3 more
Waiting your help and thanks a lot!
I debug and debug, finally found the STAT command failed! when STAT command got an error, there's an exception of james, but that makes no sence!
21/11/12 14:39:16 ERROR pop3server: Exception during connection from 127.0.0.1
(127.0.0.1) : An exception occurred getting a database connection.
org.apache.avalon.framework.CascadingRuntimeException: An exception occurred getting a database connection.
at org.apache.james.userrepository.AbstractJdbcUsersRepository.openConnection(AbstractJdbcUsersRepository.java:617)
at org.apache.james.userrepository.AbstractJdbcUsersRepository.getUserByName(AbstractJdbcUsersRepository.java:521)
at org.apache.james.userrepository.AbstractUsersRepository.test(AbstractUsersRepository.java:270)
at org.apache.james.core.LocalUsersRepository.test(LocalUsersRepository.java:90)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.avalon.phoenix.components.application.BlockInvocationHandler.invoke(BlockInvocationHandler.java:134)
at $Proxy4.test(Unknown Source)
at org.apache.james.pop3server.POP3Handler.doPASS(POP3Handler.java:537)
at org.apache.james.pop3server.POP3Handler.parseCommand(POP3Handler.java:479)
at org.apache.james.pop3server.POP3Handler.handleConnection(POP3Handler.java:277)
at org.apache.james.util.connection.ServerConnection$ClientConnectionRunner.run(ServerConnection.java:432)
at org.apache.excalibur.thread.impl.ExecutableRunnable.execute(ExecutableRunnable.java:55)
at org.apache.excalibur.thread.impl.WorkerThread.run(WorkerThread.java:116)
Caused by: java.sql.SQLException: Listener refused the connection with the following error:
ORA-12519, TNS:no appropriate service handler found
The Connection descriptor used by the client was: 192.168.250.23:1521:csmis
at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:112)
at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:261)
at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:387)
at oracle.jdbc.driver.PhysicalConnection.<init>(PhysicalConnection.java:439)
at oracle.jdbc.driver.T4CConnection.<init>(T4CConnection.java:165)
at oracle.jdbc.driver.T4CDriverExtension.getConnection(T4CDriverExtension.java:35)
at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java:801)
at org.apache.commons.dbcp.DriverConnectionFactory.createConnection(DriverConnectionFactory.java:37)
at org.apache.commons.dbcp.PoolableConnectionFactory.makeObject(PoolableConnectionFactory.java:290)
at org.apache.commons.pool.impl.GenericObjectPool.borrowObject(GenericObjectPool.java:771)
at org.apache.commons.dbcp.PoolingDataSource.getConnection(PoolingDataSource.java:95)
at org.apache.commons.dbcp.BasicDataSource.getConnection(BasicDataSource.java:540)
at org.apache.james.util.dbcp.JdbcDataSource.getConnection(JdbcDataSource.java:220)
at org.apache.james.userrepository.AbstractJdbcUsersRepository.openConnection(AbstractJdbcUsersRepository.java:614)
... 15 more
All application runs on the same server, and there's only a few users online(when I test it, only me use it). The error just appear occasionally. Why?

It seems to be a mail server issue. STAT command is used to show number of messages. Normally STAT is the first command to run after successfully connected to the mail server.
Try to use mailSession.setDebug(true) to enter debug mode to get more error logs.

I had contact with Apache James and finally found the answer. You can find it at here: STAT command failed occasionally. At the end of the page, the thread had been listed.