NativeHelper triggers JDK warning

[cowwoc]

Jetty version(s)
12.0.9

Jetty Environment
core

Java version/vendor (use: java -version)
openjdk 22.0.1 2024-04-16
OpenJDK Runtime Environment (build 22.0.1+8-16)
OpenJDK 64-Bit Server VM (build 22.0.1+8-16, mixed mode, sharing)

OS type/version
Microsoft Windows [Version 10.0.19045.4412]

Description
When starting a server, I get the following warning:

WARNING: A restricted method in java.lang.foreign.AddressLayout has been called
WARNING: java.lang.foreign.AddressLayout::withTargetLayout has been called by org.eclipse.jetty.quic.quiche.foreign.NativeHelper in an unnamed module
WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
WARNING: Restricted methods will be blocked in a future release unless native access is enabled

How to reproduce?
Launch a new Server with HTTP/3 support

Expected behavior: Find a way to suppress this warning from within Jetty, or add a section to the programmer/operation guides explaining what to do.

In particular, I am wondering why we need to enable-native-access to ALL-UNNAMED. Shouldn't we be able to limit access to a specific Java Module?

[lorban]

Adding --enable-native-access=org.eclipse.jetty.quic.quiche.foreign should be enough. I'm not aware of any way to suppress that warning with code, but indeed, we could add a section to the documentation.

[cowwoc]

I just tried this and got WARNING: Unknown module: org.eclipse.jetty.quic.quiche.foreign specified to --enable-native-access which is weird given that this is the right module name. Maybe I need to pass this to the Maven compiler plugin instead of the top-level Maven process itself...

[cowwoc]

Hmm, nope. Passing this to the compiler does not work (error: invalid flag: --enable-native-access) which makes sense now that I think about it...

So it's not clear why this is failing. Per https://docs.oracle.com/en/java/javase/22/core/restricted-methods.html it should work the way you mentioned.

[cowwoc]

Nevermind, -DMAVEN_OPTS=--enable-native-access=org.eclipse.jetty.quic.quiche.foreign seems to work.

[lorban]

@sbordet where should that be reflected in the docs in your opinion?

[cowwoc]

My vote would be somewhere close to https://eclipse.dev/jetty/documentation/jetty-12/programming-guide/index.html#pg-server-http3-setup

[github-actions]

This issue has been automatically marked as stale because it has been a
full year without activity. It will be closed if no further activity occurs.
Thank you for your contributions.

[cowwoc]

@sbordet ping

[sbordet]

I'm not sure that this needs to be documented, as it is part of the JVM and not of Jetty.

Furthermore, with Java 22 there are no warnings, but with Java 24 there are warnings, so the documentation would now depend on the Java version.

When running with Java 24 and no JPMS, we should not add by default --enable-native-access=ALL-UNNAMED because that would allow any library in the class-path to access native libraries, but it is necessary; we would like to grant access only to org.eclipse.jetty.quic.quiche.foreign, but it is not possible without JPMS.

Rather than opening by default, the warning forces users to take a decision: either ignore it, or grant native access to ALL-DEFAULT, but at least the user decided.

Also, the warning depends on whether one runs with JPMS or not.

Alternatively, we remove the specification of --enable-native-access in quiche-foreign.mod, and we document how it can be added to $JETTY_BASE/start.d/quiche-foreign.ini.
In this way, by default the warning is present, but it can be diabled by modifying $JETTY_BASE/start.d/quiche-foreign.ini, so it is always an explicit decision from the user.

[cowwoc]

@sbordet What about users who don't use Jetty as a standalone server but rather embed it within their own application? I assume they wouldn't want to or need to create a quiche-foreign.ini file...

Also, to clarify, we're not asking users or Jetty to add -enable-native-access=ALL-UNNAMED but rather --enable-native-access=org.eclipse.jetty.quic.quiche.foreign.

[sbordet]

Just --enable-native-access=org.eclipse.jetty.quic.quiche.foreign does not produce a warning in Java 22, but it does in Java 24 and 25 😞

But you're right we should add some documentation.