Update to netty-tcnative 2.0.69.Final

[normanmaurer]

Motivation:

A new tcnative release is out

Modifications:

Update to 2.0.69.Final

Result:

Depend on latest release

[normanmaurer]

We will need a new tcnative release...

2024-10-29T13:56:29.9481349Z 	Suppressed: java.lang.UnsatisfiedLinkError: /tmp/libnetty_tcnative_linux_x86_6414354760954349521464.so: /tmp/libnetty_tcnative_linux_x86_6414354760954349521464.so: undefined symbol: _ZTVN10__cxxabiv117__class_type_infoE

working on a fix

[chrisvest]

I see a lot of log messages like

2024-10-29T14:27:53.4367239Z 14:27:53.421 [nioEventLoopGroup-12156-1] DEBUG i.n.h.s.ReferenceCountedOpenSslContext - verification of certificate failed
2024-10-29T14:27:53.4370287Z sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: basic constraints check failed: this is not a CA certificate
2024-10-29T14:27:53.4377349Z 	at java.base/sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:369)
2024-10-29T14:27:53.4383768Z 	at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:263)
2024-10-29T14:27:53.4385687Z 	at java.base/sun.security.validator.Validator.validate(Validator.java:264)
2024-10-29T14:27:53.4389673Z 	at java.base/sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:313)
2024-10-29T14:27:53.4394552Z 	at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:276)
2024-10-29T14:27:53.4397408Z 	at java.base/sun.security.ssl.X509TrustManagerImpl.checkClientTrusted(X509TrustManagerImpl.java:135)
2024-10-29T14:27:53.4400355Z 	at io.netty.handler.ssl.EnhancingX509ExtendedTrustManager.checkClientTrusted(EnhancingX509ExtendedTrustManager.java:62)
2024-10-29T14:27:53.4404441Z 	at io.netty.handler.ssl.ReferenceCountedOpenSslServerContext$ExtendedTrustManagerVerifyCallback.verify(ReferenceCountedOpenSslServerContext.java:280)
2024-10-29T14:27:53.4408717Z 	at io.netty.handler.ssl.ReferenceCountedOpenSslContext$AbstractCertificateVerifier.verify(ReferenceCountedOpenSslContext.java:817)
2024-10-29T14:27:53.4410658Z 	at io.netty.internal.tcnative.SSL.readFromSSL(Native Method)
2024-10-29T14:27:53.4412088Z 	at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.readPlaintextData(ReferenceCountedOpenSslEngine.java:660)
2024-10-29T14:27:53.4413497Z 	at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1292)
2024-10-29T14:27:53.4414477Z 	at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1443)
2024-10-29T14:27:53.4415311Z 	at io.netty.handler.ssl.SslHandler$SslEngineType$1.unwrap(SslHandler.java:218)
2024-10-29T14:27:53.4415933Z 	at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1473)
2024-10-29T14:27:53.4416592Z 	at io.netty.handler.ssl.SslHandler.decodeNonJdkCompatible(SslHandler.java:1377)
2024-10-29T14:27:53.4417245Z 	at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1417)
2024-10-29T14:27:53.4418149Z 	at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530)
2024-10-29T14:27:53.4419272Z 	at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469)
2024-10-29T14:27:53.4420120Z 	at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290)
2024-10-29T14:27:53.4421052Z 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
2024-10-29T14:27:53.4422072Z 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
2024-10-29T14:27:53.4423082Z 	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
2024-10-29T14:27:53.4424047Z 	at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1357)
2024-10-29T14:27:53.4425013Z 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)
2024-10-29T14:27:53.4426030Z 	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
2024-10-29T14:27:53.4426949Z 	at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:868)
2024-10-29T14:27:53.4427962Z 	at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
2024-10-29T14:27:53.4428767Z 	at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788)
2024-10-29T14:27:53.4430205Z 	at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:724)
2024-10-29T14:27:53.4431026Z 	at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:650)
2024-10-29T14:27:53.4431677Z 	at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562)
2024-10-29T14:27:53.4432392Z 	at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997)
2024-10-29T14:27:53.4433161Z 	at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
2024-10-29T14:27:53.4433903Z 	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
2024-10-29T14:27:53.4434512Z 	at java.base/java.lang.Thread.run(Thread.java:829)
2024-10-29T14:27:53.4435253Z Caused by: java.security.cert.CertPathValidatorException: basic constraints check failed: this is not a CA certificate
2024-10-29T14:27:53.4436360Z 	at java.base/sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:135)
2024-10-29T14:27:53.4437435Z 	at java.base/sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:224)
2024-10-29T14:27:53.4438445Z 	at java.base/sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:144)
2024-10-29T14:27:53.4439608Z 	at java.base/sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:83)
2024-10-29T14:27:53.4440544Z 	at java.base/java.security.cert.CertPathValidator.validate(CertPathValidator.java:309)
2024-10-29T14:27:53.4441321Z 	at java.base/sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:364)
2024-10-29T14:27:53.4441862Z 	... 35 common frames omitted
2024-10-29T14:27:53.4442510Z Caused by: java.security.cert.CertPathValidatorException: basic constraints check failed: this is not a CA certificate
2024-10-29T14:27:53.4443566Z 	at java.base/sun.security.provider.certpath.ConstraintsChecker.checkBasicConstraints(ConstraintsChecker.java:259)
2024-10-29T14:27:53.4444558Z 	at java.base/sun.security.provider.certpath.ConstraintsChecker.check(ConstraintsChecker.java:122)
2024-10-29T14:27:53.4445573Z 	at java.base/sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:125)
2024-10-29T14:27:53.4446293Z 	... 40 common frames omitted

Which I suppose could come from stricter validation in the new BoringSSL? If so, then I can look into preparing a PR that makes SelfSignedCertificate add these basic constraints.

[normanmaurer]

This can be reverted once we pulled in netty/netty-tcnative#902 and released a new version