VNA Plugin fails with UnsatisfiedLinkError: libbc-probe.so failed to map segment from shared object

Products

• Network Observability

Issue/Introduction

When you attempt to add or configure a plugin (such as the Viptela Plugin) in DX Virtual Network Assurance (VNA), the configuration fails. The server.log file contains the following error:

ERROR [org.jboss.resteasy.core.providerfactory.DefaultExceptionMapper] (default task-2) RESTEASY002375: Error processing request POST /vna/rest/v1/admin/plugins/Viptela Plugin - com.ca.em.sdn.gateway.broker.core.resources.PluginResource.configurePlugin: java.lang.NoClassDefFoundError: Could not initialize class org.bouncycastle.crypto.CryptoServicesRegistrar

Further down in the stack trace, the following root cause is present:

Caused by: java.lang.UnsatisfiedLinkError: /tmp/bc-fips-jni_####/libbc-probe.so: /tmp/bc-fips-jni_####/libbc-probe.so: failed to map segment from shared object [in thread "default task-2"]

Environment

DX Virtual Network Assurance (VNA)

Cause

The Bouncy Castle FIPS security library used by VNA plugins extracts a native JNI shared object (libbc-probe.so) to the system temporary directory (defaulting to /tmp) and attempts to execute it. If your Linux environment is hardened and the /tmp partition is mounted with the noexec flag, the operating system blocks the execution of this file. This prevents the plugin from initializing its security providers.

Resolution

To resolve this issue, you must redirect the Java temporary directory to a location that allows execution.

1. Create a new temporary directory within the VNA installation path:
   bash

    

   mkdir -p /opt/CA/VNA/tmp
   
   chmod 775 /opt/CA/VNA/tmp

2. Modify the Wildfly configuration to enforce the new temporary directory:
   • Open /opt/CA/VNA/wildfly/bin/standalone.conf in a text editor.
   • Locate the VNA_CUSTOM_JAVA_OPTS line.
   • Append the -Djava.io.tmpdir=/opt/CA/VNA/tmp parameter to the existing options.
   • Example: VNA_CUSTOM_JAVA_OPTS="-Djava.net.preferIPv4Stack=true -Djava.io.tmpdir=/opt/CA/VNA/tmp"
3. Restart the VNA service to apply the changes:
   bash

    

   sudo systemctl stop wildfly
   
   sudo systemctl start wildfly

4. Verify the configuration: Run sudo systemctl status wildfly and ensure the -Djava.io.tmpdir parameter is visible in the running process arguments.

Additional Information

For information regarding similar restrictions affecting the DX NetOps Data Collector or Portal utilities, please refer to KB 442090.