Use JDK default security provider when Conscrypt isn't available

[lhotari]

Fixes #12907

Motivation

• fixes issue with ARM64 platform where Conscrypt isn't available.

Modifications

Call org.conscrypt.Conscrypt.checkAvailability() method using reflection to verify that Conscrypt can be loaded successfully. In a failure case, log the error and fallback to JDK default security provider.

[github-actions]

@lhotari:Thanks for your contribution. For this PR, do we need to update docs?
(The PR template contains info about doc, which helps others know more about the changes. Can you provide doc-related info in this and future PR descriptions? Thanks)

[github-actions]

@lhotari:Thanks for providing doc info!

[ladhadeepak]

@lhotari Hi, is it expected to log stack trace for the warning message when Conscrypt class is not found? Thanks.

[lhotari]

@lhotari Hi, is it expected to log stack trace for the warning message when Conscrypt class is not found? Thanks.

@ladhadeepak yes

[ladhadeepak]

@lhotari Hi, is it expected to log stack trace for the warning message when Conscrypt class is not found? Thanks.

@ladhadeepak yes

@lhotari Can you please explain why a warning should accompany a stack trace? Logging such an exception misleads into believing that something is wrong in the deployment but then it is not the case else it would not have been just WARNING. Isn't it ?

[lhotari]

@lhotari Can you please explain why a warning should accompany a stack trace? Logging such an exception misleads into believing that something is wrong in the deployment but then it is not the case else it would not have been just WARNING. Isn't it ?

@ladhadeepak The log message is pretty clear about the warning: "Conscrypt isn't available. Using JDK default security provider." Please explain the scenario where you think that it's misleading to log the stack trace. Who is being mislead? :) What is the impact?

[lhotari]

@ladhadeepak Are you running on ARM64 platform?

[ladhadeepak]

@lhotari Can you please explain why a warning should accompany a stack trace? Logging such an exception misleads into believing that something is wrong in the deployment but then it is not the case else it would not have been just WARNING. Isn't it ?

@ladhadeepak The log message is pretty clear about the warning: "Conscrypt isn't available. Using JDK default security provider." Please explain the scenario where you think that it's misleading to log the stack trace. Who is being mislead? :) What is the impact?

@lhotari My QA engineer is misled into believing that there is an error in the system and hence he has raised a ticket/defect :(
It doesn't help either that even Java docs associate stack traces with the error (error streams to be specific) and hence the QA engineer sees this stack trace as an error in the system.
It's a different matter though that we do not support Conscrypt as a security provider.

[ladhadeepak]

@ladhadeepak Are you running on ARM64 platform?

It is x86_64

[lhotari]

It's a different matter though that we do not support Conscrypt as a security provider.

Why do you want to disable Conscrypt?

[ladhadeepak]

It's a different matter though that we do not support Conscrypt as a security provider.

Why do you want to disable Conscrypt?

Oh well, we are in enterprise application development space and not in the mobile app or android space.

[lhotari]

Why do you want to disable Conscrypt?

Oh well, we are in enterprise application development space and not in the mobile app or android space.

Unfortunately Conscrypt isn't related to mobile apps or android space in Pulsar. Conscrypt is used in Pulsar to improve the performance of Jetty TLS layer. #10372 explains the rationale. The official Jetty documentation recommends to use Conscrypt to achieve good performance with TLS. Embedded Jetty is used as the http server for the Pulsar broker and Pulsar proxy.

[ladhadeepak]

Why do you want to disable Conscrypt?

Oh well, we are in enterprise application development space and not in the mobile app or android space.

Unfortunately Conscrypt isn't related to mobile apps or android space in Pulsar. Conscrypt is used in Pulsar to improve the performance of Jetty TLS layer. #10372 explains the rationale. The official Jetty documentation recommends to use Conscrypt to achieve good performance with TLS. Embedded Jetty is used as the http server for the Pulsar broker and Pulsar proxy.

Sure, we can evaluate this in our context. Thanks for the detailed info.