java - Glassfish 4 + SSL 客户端 = 连接失败 : socketType: SSL; hostname: 127. 0.0.1

Question

我有一个 glassfish 服务器，我想通过 SSL 从独立的 swing 客户端连接到 EJB。没有 SSL 一切正常。

当我尝试使用此环境在客户端中创建 InitialContext 时:

hashtable.put("java.naming.factory.initial", "com.sun.enterprise.naming.impl.SerialInitContextFactory");
hashtable.put("java.naming.factory.url.pkgs", "com.sun.enterprise.naming");
hashtable.put("java.naming.factory.state", "com.sun.corba.ee.impl.presentation.rmi.JNDIStateFactoryImpl");
hashtable.put("org.omg.CORBA.ORBInitialHost", serverIp);
hashtable.put("org.omg.CORBA.ORBInitialPort", 3820);

此外，我还使用了以下 JVM 参数:

-Djavax.net.ssl.trustStorePassword=changeit \
-Djavax.net.ssl.trustStore=./myTrustStore\
-Dcom.sun.CSIV2.ssl.standalone.client.required=true\
-Dorg.omg.CORBA.ORBInitialPort=3820 \

我在古代得到以下信息:

javax.naming.CommunicationException: Communication exception for SerialContext[myEnv={org.omg.CORBA.ORBInitialPort=3700, java.naming.factory.initial=com.sun.enterprise.naming.impl.SerialInitContextFactory, org.omg.CORBA.ORBInitialHost=10.0.17.2, java.naming.factory.state=com.sun.corba.ee.impl.presentation.rmi.JNDIStateFactoryImpl, java.naming.factory.url.pkgs=com.sun.enterprise.naming} [Root exception is java.rmi.MarshalException: CORBA COMM_FAILURE 1330446337 No; nested exception is: 
    org.omg.CORBA.COMM_FAILURE: FINE: 00410001: Connection failure: socketType: SSL; hostname: 127.0.0.1; port: 3820  vmcid: OMG  minor code: 1  completed: No]
....
Caused by: java.rmi.MarshalException: CORBA COMM_FAILURE 1330446337 No; nested exception is: 
    org.omg.CORBA.COMM_FAILURE: FINE: 00410001: Connection failure: socketType: SSL; hostname: 127.0.0.1; port: 3820  vmcid: OMG  minor code: 1  completed: No
...
Caused by: org.omg.CORBA.COMM_FAILURE: FINE: 00410001: Connection failure: socketType: SSL; hostname: 127.0.0.1; port: 3820  vmcid: OMG  minor code: 1  completed: No
    at com.sun.proxy.$Proxy17.connectFailure(Unknown Source)
...
Caused by: java.lang.RuntimeException: java.io.IOException: Error opening SSL socket to host=home.home port=3820
...
Caused by: java.io.IOException: Error opening SSL socket to host=home.home port=3820
...
Caused by: java.net.ConnectException: Connection refused

home.home 是我的工作站。完整日志为 here .

请解释为什么它尝试打开到 localhost 而不是 serverIp 的连接。

编辑:这是我的 sun-ejb-jar.xml(服务器端)

<sun-ejb-jar>
    <enterprise-beans>
        <ejb>
            <ejb-name>OrganizationDirBean</ejb-name>
            <ior-security-config>
                <transport-config>
                    <integrity>required</integrity>
                    <confidentiality>required</confidentiality>
                    <establish-trust-in-target>supported</establish-trust-in-target>
                    <establish-trust-in-client>supported</establish-trust-in-client>
                </transport-config>
                <sas-context>
                    <caller-propagation>supported</caller-propagation>
                </sas-context>
            </ior-security-config>
        </ejb>
    </enterprise-beans>
</sun-ejb-jar>

编辑 2
我使用以下代码创建初始上下文(环境在上面)。我在客户端使用 OSGI(在服务器端 EJB 应用程序包，EAB)，这就是为什么我需要在这里使用类加载器:

   ClassLoader thatLoader = Thread.currentThread().getContextClassLoader();
    Thread.currentThread().setContextClassLoader(getClass().getClassLoader());
    try {
        InitialContext ctx = new InitialContext(hashtable);
        Directory directory = (Directory) ctx.lookup("ejb/OrganizationDirBean");
        action=directory.read(action);
    } catch (Exception e) {
        e.printStackTrace();
    }finally {
        Thread.currentThread().setContextClassLoader(thatLoader);
    }

编辑 3
我自己从源代码构建了 glassfish (GF 4.0.1)。我现在所拥有的。当客户端和服务器在同一台主机上时，一切似乎都正常。客户端获取 EJB，EJB 将信息写入日志。是的。我又检查了一次。所有数据包都通过接口(interface) lo。在服务器端端口 3820 上。一切正常。

但是现在当他们在不同的主机上时，我也不异常(exception)。 Tcpdump 显示我们每分钟都在感激地跟随，并且这种情况无休止地继续(我仍然离开过夜):

    10.0.18.5.55618 > 10.0.17.2.3820: Flags [.], cksum 0xa8e4 (correct), seq 76855, ack 136375, win 499, options [nop,nop,TS val 669632607 ecr 224087792], length 0
08:44:46.148416 IP (tos 0x0, ttl 64, id 38301, offset 0, flags [DF], proto TCP (6), length 52)
    10.0.18.5.55618 > 10.0.17.2.3820: Flags [.], cksum 0xa7c1 (correct), seq 76855, ack 136668, win 497, options [nop,nop,TS val 669632607 ecr 224087792], length 0
08:45:48.965565 IP (tos 0x0, ttl 64, id 38302, offset 0, flags [DF], proto TCP (6), length 238)
    10.0.18.5.55618 > 10.0.17.2.3820: Flags [P.], cksum 0xdf9c (correct), seq 76855:77041, ack 136668, win 499, options [nop,nop,TS val 669695423 ecr 224087792], length 186
08:45:48.966448 IP (tos 0x0, ttl 64, id 3268, offset 0, flags [DF], proto TCP (6), length 89)
    10.0.17.2.3820 > 10.0.18.5.55618: Flags [P.], cksum 0x3752 (incorrect -> 0xe28f), seq 136668:136705, ack 77041, win 501, options [nop,nop,TS val 224150610 ecr 669695423], length 37
08:45:48.966520 IP (tos 0x0, ttl 64, id 3269, offset 0, flags [DF], proto TCP (6), length 345)
    10.0.17.2.3820 > 10.0.18.5.55618: Flags [P.], cksum 0x3852 (incorrect -> 0xbd0f), seq 136705:136998, ack 77041, win 501, options [nop,nop,TS val 224150610 ecr 669695423], length 293
08:45:48.966702 IP (tos 0x0, ttl 64, id 38303, offset 0, flags [DF], proto TCP (6), length 52)
    10.0.18.5.55618 > 10.0.17.2.3820: Flags [.], cksum 0xbc1b (correct), seq 77041, ack 136705, win 499, options [nop,nop,TS val 669695424 ecr 224150610], length 0
08:45:48.966962 IP (tos 0x0, ttl 64, id 38304, offset 0, flags [DF], proto TCP (6), length 52)
    10.0.18.5.55618 > 10.0.17.2.3820: Flags [.], cksum 0xbaf8 (correct), seq 77041, ack 136998, win 497, options [nop,nop,TS val 669695424 ecr 224150610], length 0

10.0.17.2 我的GF服务器在哪里。这是服务器日志的结尾:

[2014-06-04T09:17:18.369+0400] [glassfish 4.0] [INFO] [] [] [tid: _ThreadID=143 _ThreadName=Thread-8] [timeMillis: 1401859038369] [levelValue: 800] [[
  p: thread-pool-1; w: 2, WRITE: TLSv1 Application Data, length = 32]]
[2014-06-04T09:17:18.369+0400] [glassfish 4.0] [INFO] [] [] [tid: _ThreadID=143 _ThreadName=Thread-8] [timeMillis: 1401859038369] [levelValue: 800] [[
  p: thread-pool-1; w: 2, WRITE: TLSv1 Application Data, length = 288]]
[2014-06-04T09:18:21.220+0400] [glassfish 4.0] [INFO] [] [] [tid: _ThreadID=142 _ThreadName=Thread-8] [timeMillis: 1401859101220] [levelValue: 800] [[
  p: thread-pool-1; w: 1, READ: TLSv1 Application Data, length = 32]]
[2014-06-04T09:18:21.220+0400] [glassfish 4.0] [INFO] [] [] [tid: _ThreadID=142 _ThreadName=Thread-8] [timeMillis: 1401859101220] [levelValue: 800] [[
  p: thread-pool-1; w: 1, READ: TLSv1 Application Data, length = 144]]
[2014-06-04T09:18:21.222+0400] [glassfish 4.0] [INFO] [] [] [tid: _ThreadID=142 _ThreadName=Thread-8] [timeMillis: 1401859101222] [levelValue: 800] [[
  p: thread-pool-1; w: 1, WRITE: TLSv1 Application Data, length = 32]]
[2014-06-04T09:18:21.222+0400] [glassfish 4.0] [INFO] [] [] [tid: _ThreadID=142 _ThreadName=Thread-8] [timeMillis: 1401859101222] [levelValue: 800] [[
  p: thread-pool-1; w: 1, WRITE: TLSv1 Application Data, length = 288]]

我的意思是写，读，写，读等等。据我了解，如果它在同一主机上工作，则意味着客户端在某个时候连接到 127.0.0.1 3820。因此，有必要在设置中将其更改为真实服务器 ip。

Answer 1

我自己解决了这个问题。在 linux 机器上，有必要在/etc/hosts 文件中设置服务器 IP。因为glassfish使用函数

InetAddress.getLocalHost()

获取服务器IP。我没有在此文件中设置服务器 IP。这就是为什么在建立新连接时的 ssl 协商过程中，glassfish 试图打开到 127.0.0.1 而不是真实服务器 IP 的连接。