3

这个问题已经让我摸不着头脑好几天了。对于某个网络上的站点（恰好是 DDOS 迁移提供商），与其他站点相比，安全管理 checkConnect 调用似乎需要非常非常长的时间。

该网络上的站点是否可以通过任何方式破坏安全管理器的访问检查？是否有我不知道的配置？我会（更多）疯狂吗？

这是一个测试用例，演示...

package com.test;

import java.net.Socket;
import java.util.ArrayList;
import java.util.List;

public class SSCCE
{

static class StatCounter
{
    boolean security;
    String host;
    long avg;
    long total;
    int iterations;

    StatCounter(String host)
    {
        this.host = host;
    }

    @Override
    public String toString()
    {
        return host + "\t\titerations (" + iterations + ")\t\tavg (" + avg + ")\t\tsecurity (" + security + ")";
    }

    void inc(long time)
    {
        ++iterations;
        total += time;
    }

    void avg()
    {
        avg = total / (long)iterations;
    }

    void reset()
    {
        total = 0;
        iterations = 0;
    }
}

static String[] hosts = new String[]
{
    "google.com",
    "youtube.com",
    "oracle.com",
    "random.org",
    "phpbb.com",
    "staminus.net", 

    // MUCH Higher Latency with site below (only with security manager enabled?)
    "blacklotus.net"
};

public static void main(String[] argv) throws Throwable
{
    int iterations = Integer.parseInt(argv[0]);
    List<StatCounter> counters = new ArrayList<StatCounter>(hosts.length);
    for(String host : hosts)
    {
        counters.add(new StatCounter(host));
    }
    System.out.println("Running Without Security");
    for(int i = 0; i < iterations; ++i)
    {
        for(StatCounter counter : counters)
        {
            long then = System.currentTimeMillis();
            new Socket(counter.host, 80).close();
            counter.inc(System.currentTimeMillis() - then);
        }
    }
    for(StatCounter counter : counters)
    {
        counter.avg();
        System.out.println(counter);
        counter.reset();
        counter.security = true;
    }
    System.setProperty("java.security.policy", "sscce.policy");
    System.setSecurityManager(new SecurityManager());

    System.out.println("\n\nRunning With Security");

    for(int i = 0; i < iterations; ++i)
    {
        for(StatCounter counter : counters)
        {
            long then = System.currentTimeMillis();
            new Socket(counter.host, 80).close();
            counter.inc(System.currentTimeMillis() - then);
        }
    }

    for(StatCounter counter : counters)
    {
        counter.avg();
        System.out.println(counter);
    }

}
}

政策文件

grant
{
 permission java.net.SocketPermission "google.com:80", "connect";
 permission java.net.SocketPermission "youtube.com:80", "connect";
 permission java.net.SocketPermission "oracle.com:80", "connect";
 permission java.net.SocketPermission "random.org:80", "connect";
 permission java.net.SocketPermission "phpbb.com:80", "connect";
 permission java.net.SocketPermission "staminus.net:80", "connect";
 permission java.net.SocketPermission "blacklotus.net:80", "connect";
};

使用 java com.test.SSCCE 运行

示例输出

Running Without Security
google.com      iterations (4)      avg (65)        security (false)
youtube.com     iterations (4)      avg (61)        security (false)
oracle.com      iterations (4)      avg (104)       security (false)
random.org      iterations (4)      avg (101)       security (false)
phpbb.com       iterations (4)      avg (143)       security (false)
staminus.net        iterations (4)      avg (137)       security (false)
blacklotus.net      iterations (4)      avg (137)       security (false)


Running With Security
google.com      iterations (4)      avg (261)       security (true)
youtube.com     iterations (4)      avg (64)        security (true)
oracle.com      iterations (4)      avg (103)       security (true)
random.org      iterations (4)      avg (100)       security (true)
phpbb.com       iterations (4)      avg (882)       security (true)
staminus.net        iterations (4)      avg (303)       security (true)
blacklotus.net      iterations (4)      avg (4669)      security (true)

我真的很感激任何意见，谢谢。

据我所知，一切看起来都不错（除了看似网络延迟！）

4

1 回答 1

4

我终于通过使用额外的调试信息对 JRE 系统库进行逆向工程，找到了这种现象的根本原因。我能够将延迟的原因追溯到本机方法

java.net.Inet4AddressImpl.getHostByAddr([B)Ljava.lang.String

事实证明，由于未知原因，从其 IP 地址解析有问题的主机失败，并且在超时后，调用方法会尝试另一条路由以返回有效的主机名。我用几个基于 Web 的反向查找工具对此进行了检查，似乎 blacklotus.net 很可能存在问题（或者可能是防止反向查找的功能？）

我希望这可以帮助遇到像这样奇怪的情况的其他人。T-减 36 小时，案件结案。

于 2013-09-24T07:00:25.807 回答