扩展server_name（SNI 扩展）不是随 jdk1.8.0 一起发送，而是使用 jdk1.7.0 发送

ssl java web-services sni cxf

2022-09-01 23:08:04

我已经使用ApacheCXF（v3.0.4）实现了JAX-WS客户端，一切都很成功，但是当我想将安全连接（SSL / TLS）与java 8（jdk1.8.0_25）一起使用时，问题就来了。

我在日志中看到以下异常（-Djavax.net.debug=all）：

main, handling exception: java.net.SocketException: Connection reset
main, SEND TLSv1.2 ALERT:  fatal, description =    unexpected_message
main, WRITE: TLSv1.2 Alert, length = 2
main, Exception sending alert: java.net.SocketException: Connection reset by peer: socket write error

经过depeer分析，我观察到问题是由Java 8发送server_name（SNI）引起的，但是对于Java 7，它被发送并且Web服务调用成功。

Java 8 log （-Djavax.net.debug=all）：缺少“扩展server_name”

[...]
Compression Methods:  { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA224withECDSA, SHA224withRSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA, MD5withRSA
***
[...]

Java 7 log （-Djavax.net.debug=all）（works）：设置“扩展server_name”

[...]
Compression Methods:  { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA224withECDSA, SHA224withRSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA, MD5withRSA
Extension server_name, server_name: [host_name: testeo.hostname.es]
***
[...]

据观察，在 Java 7 中，设置了扩展server_name server_name：[host_name：testeo.hostname.es]，然后 Web 服务调用成功工作。

为什么Java 8没有像Java 7那样设置server_name？是 Java 配置问题吗？

答案 1

如前所述，原因与JDK错误有关，其中使用setHostnameVerifier（）会破坏SNI（扩展server_name）。https://bugs.openjdk.java.net/browse/JDK-8144566

我们的解决方法：经过测试，我们发现将连接的SSSocketFactory设置为默认值的任何内容似乎可以解决此问题。

这不起作用：HttpsURLConnection.setSSLSocketFactory((SSLSocketFactory) SSLSocketFactory.getDefault());

这确实有效：HttpsURLConnection.setSSLSocketFactory(new SSLSocketFactoryFacade());

因此，要针对 JAX-WS 客户机修复它，您可以执行如下操作：bindingProvider.getRequestContext().put("com.sun.xml.internal.ws.transport.https.client.SSLSocketFactory", new SSLSocketFactoryFacade());

我们的SSLSocketFactory外观：（请注意，它实际上不做任何事情）

public class SSLSocketFactoryFacade extends SSLSocketFactory {

    SSLSocketFactory sslsf;

    public SSLSocketFactoryFacade() {
        sslsf = (SSLSocketFactory) SSLSocketFactory.getDefault();;
    }

    @Override
    public String[] getDefaultCipherSuites() {
        return sslsf.getDefaultCipherSuites();
    }

    @Override
    public String[] getSupportedCipherSuites() {
        return sslsf.getSupportedCipherSuites();
    }

    @Override
    public Socket createSocket(Socket socket, String s, int i, boolean b) throws IOException {
        return sslsf.createSocket(socket, s, i, b);
    }

    @Override
    public Socket createSocket(String s, int i) throws IOException, UnknownHostException {
        return sslsf.createSocket(s, i);
    }

    @Override
    public Socket createSocket(String s, int i, InetAddress inetAddress, int i1) throws IOException, UnknownHostException {
        return sslsf.createSocket(s, i, inetAddress, i1);
    }

    @Override
    public Socket createSocket(InetAddress inetAddress, int i) throws IOException {
        return createSocket(inetAddress, i);
    }

    @Override
    public Socket createSocket(InetAddress inetAddress, int i, InetAddress inetAddress1, int i1) throws IOException {
        return createSocket(inetAddress, i, inetAddress1, i1);
    }
}

答案 2

请使用 JDK 版本 8u141 及更高版本，其中已修复此问题。请查看 JDK 8u141 错误修复页面了解更多详情