如何解决SSL"坏记录MAC"异常

Question

我正在使用Apache CXF客户端,在Windows Java 1.6.0_29-b11 VM中运行以连接到IBM大型机(我相信它是zSeries),并调用在那里运行的SOAP Web服务.连接是通过SSL/TLS完成的,大部分时间都可以正常工作.

但是,我不时会收到带有bad record MAC消息的SSL异常.以下是与javax.net.debug属性一起使用的程序的输出.

2011-11-16 12:32:37,731 INFO  LoggingOutInterceptor: Outbound Message
---------------------------
ID: 29
Address: https://1.2.3.4/access/servlet/blabla.atk123
Encoding: UTF-8
Content-Type: text/xml
Headers: {Accept=[*/*], SOAPAction=["Blablaaction/ATK123.Execute"]}
Payload: <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><ATK123.Execute xmlns="Blabla"><Usrid>WA</Usrid><Usrpwd>54321</Usrpwd><Ultautid>9999</Ultautid></ATK123.Execute></soap:Body></soap:Envelope>
--------------------------------------
pool-1-thread-1, setSoTimeout(30000) called
pool-1-thread-1, WRITE: TLSv1 Application Data, length = 321
pool-1-thread-1, WRITE: TLSv1 Application Data, length = 262
pool-1-thread-1, READ: TLSv1 Application Data, length = 483
pool-1-thread-1, READ: TLSv1 Application Data, length = 16148
pool-1-thread-1, READ: TLSv1 Application Data, length = 282
%% Invalidated:  [Session-1, SSL_RSA_WITH_RC4_128_SHA]
pool-1-thread-1, SEND TLSv1 ALERT:  fatal, description = bad_record_mac
pool-1-thread-1, WRITE: TLSv1 Alert, length = 22
pool-1-thread-1, called closeSocket()
pool-1-thread-1, handling exception: javax.net.ssl.SSLException: bad record MAC
2011-11-16 12:32:38,511 WARN  PhaseInterceptorChain: Interceptor for {Blabla}ATK123#{Blabla}Execute has thrown exception, unwinding now
org.apache.cxf.interceptor.Fault: bad record MAC
    at org.apache.cxf.interceptor.LoggingInInterceptor.logging(LoggingInInterceptor.java:144)
    at org.apache.cxf.interceptor.LoggingInInterceptor.handleMessage(LoggingInInterceptor.java:73)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:263)
    at org.apache.cxf.endpoint.ClientImpl.onMessage(ClientImpl.java:797)
.... (more stuff)

不幸的是,我没有可能在服务器上修改或调试端点.

可能是什么导致了这个？

如何隔离并修复此行为？

Answer 1

如果由于网络中的某些故障而导致大量坏包,则可能会发生错误的数据包随机存在于32位TCP校验和中.TCP中会漏掉大约十亿分之一的坏包.一旦将此数据包传送到SSL,它肯定会生成错误的记录MAC,因为SSL Mac的大小为96位.

如果这是原因,唯一的解决方案是改善网络.

请注意,通常情况下,这是一个不太可能导致错误记录MAC的原因.即使是具有生成错误数据包的错误硬件的网络也不太可能使用正确的IP和TCP元数据生成它们,使得数据包实际上传递到与TLS连接相对应的套接字.

Answer 2

这与Java无关,它是SSL/TLS失败:

20  Bad record MAC  fatal   Possibly a bad SSL implementation, or payload
                            has been tampered with e.g. FTP firewall rule
                            on FTPS server.

它可能与SSL实现有关,而且发送的数据量太大,我怀疑它是随机的.