Java 安全管理器 SocketPermission 解析、连接速度非常慢

Question

这个问题已经让我挠头好几天了。对于特定网络上的站点(恰好是 DDOS 缓解提供商)，与其他站点相比，安全管理 checkConnect 调用似乎花费了非常非常长的时间。

这个网络上的站点有什么方法可以抛出安全管理器的访问检查吗？有没有我不知道的配置？我会(更)发疯吗？

这是一个演示...的测试用例

package com.test;

import java.net.Socket;
import java.util.ArrayList;
import java.util.List;

public class SSCCE
{

static class StatCounter
{
    boolean security;
    String host;
    long avg;
    long total;
    int iterations;

    StatCounter(String host)
    {
        this.host = host;
    }

    @Override
    public String toString()
    {
        return host + "\t\titerations (" + iterations + ")\t\tavg (" + avg + ")\t\tsecurity (" + security + ")";
    }

    void inc(long time)
    {
        ++iterations;
        total += time;
    }

    void avg()
    {
        avg = total / (long)iterations;
    }

    void reset()
    {
        total = 0;
        iterations = 0;
    }
}

static String[] hosts = new String[]
{
    "google.com",
    "youtube.com",
    "oracle.com",
    "random.org",
    "phpbb.com",
    "staminus.net", 

    // MUCH Higher Latency with site below (only with security manager enabled?)
    "blacklotus.net"
};

public static void main(String[] argv) throws Throwable
{
    int iterations = Integer.parseInt(argv[0]);
    List<StatCounter> counters = new ArrayList<StatCounter>(hosts.length);
    for(String host : hosts)
    {
        counters.add(new StatCounter(host));
    }
    System.out.println("Running Without Security");
    for(int i = 0; i < iterations; ++i)
    {
        for(StatCounter counter : counters)
        {
            long then = System.currentTimeMillis();
            new Socket(counter.host, 80).close();
            counter.inc(System.currentTimeMillis() - then);
        }
    }
    for(StatCounter counter : counters)
    {
        counter.avg();
        System.out.println(counter);
        counter.reset();
        counter.security = true;
    }
    System.setProperty("java.security.policy", "sscce.policy");
    System.setSecurityManager(new SecurityManager());

    System.out.println("\n\nRunning With Security");

    for(int i = 0; i < iterations; ++i)
    {
        for(StatCounter counter : counters)
        {
            long then = System.currentTimeMillis();
            new Socket(counter.host, 80).close();
            counter.inc(System.currentTimeMillis() - then);
        }
    }

    for(StatCounter counter : counters)
    {
        counter.avg();
        System.out.println(counter);
    }

}
}

策略文件

grant
{
 permission java.net.SocketPermission "google.com:80", "connect";
 permission java.net.SocketPermission "youtube.com:80", "connect";
 permission java.net.SocketPermission "oracle.com:80", "connect";
 permission java.net.SocketPermission "random.org:80", "connect";
 permission java.net.SocketPermission "phpbb.com:80", "connect";
 permission java.net.SocketPermission "staminus.net:80", "connect";
 permission java.net.SocketPermission "blacklotus.net:80", "connect";
};

运行 java com.test.SSCCE

示例输出

Running Without Security
google.com      iterations (4)      avg (65)        security (false)
youtube.com     iterations (4)      avg (61)        security (false)
oracle.com      iterations (4)      avg (104)       security (false)
random.org      iterations (4)      avg (101)       security (false)
phpbb.com       iterations (4)      avg (143)       security (false)
staminus.net        iterations (4)      avg (137)       security (false)
blacklotus.net      iterations (4)      avg (137)       security (false)


Running With Security
google.com      iterations (4)      avg (261)       security (true)
youtube.com     iterations (4)      avg (64)        security (true)
oracle.com      iterations (4)      avg (103)       security (true)
random.org      iterations (4)      avg (100)       security (true)
phpbb.com       iterations (4)      avg (882)       security (true)
staminus.net        iterations (4)      avg (303)       security (true)
blacklotus.net      iterations (4)      avg (4669)      security (true)

非常感谢任何意见，谢谢。

• 控制台输出 java.security.debug=all http://pastebin.com/wNcAhSy2

据我所知，一切看起来都很好(除了看似网络延迟的问题!)

Answer 1

通过使用附加调试信息对 JRE 系统库进行逆向工程，我终于找到了这种现象的根本原因。我能够将延迟的原因追溯到 native 方法

java.net.Inet4AddressImpl.getHostByAddr([B)Ljava.lang.String

事实证明，由于未知原因，从其 IP 地址解析有问题的主机失败，并且在超时后，调用方法尝试另一条路由以返回有效的主机名。我已经使用几个基于 Web 的反向查找工具对此进行了检查，似乎 blacklotus.net 很可能存在问题(或者可能是防止反向查找的功能？)

我希望这能帮助遇到这种奇怪情况的任何其他人。 T 减 36 小时，结案。