"Bad record mac" looks like a TLS Alert.

Typical explanations for this alert is "Possibly a bad SSL implementation,
or payload has been tampered with"

I had some buggy versions of openssl that had this bug, but once I upgraded
to 1.0.1e it went away.

--
Joakim Erdfelt <[email protected]>
webtide.com <http://www.webtide.com/>
Developer advice, services and support
from the Jetty & CometD experts
eclipse.org/jetty - cometd.org


On Fri, Mar 1, 2013 at 10:29 AM, Mark Wyszomierski <[email protected]> wrote:

> Hi all,
>
> I've been trying to get an ios UIWebView to establish an https connection
> with a jetty instance (v7.6.9 on a windows machine). The jetty instance is
> loading an ssl certificate I got from godaddy. For what it's worth,
> firefox/chrome/safari work just fine with the same endpoint, they don't
> have any problems with the certificate.
>
> Mobile safari exhibits a similar problem, though. I don't have log output
> for that yet. The browser will just timeout.
>
> With debug logging on, I can see an SSLException is thrown when the
> UIWebView attempts to connect. I have the full log, can post it if it
> helps. Here's a snippet:
>
>
> ... (note: ip addresses masked) ...
> 2013-03-01 11:32:47.015:DBUG:oejh.HttpParser:filled 0/0
> 2013-03-01 11:32:47.015:DBUG:oejin.ssl:[Session-1,
> SSL_NULL_WITH_NULL_NULL] SslConnection@f44fe SSL NOT_HANDSHAKING
> i/o/u=0/0/0 ishut=false oshut=false 
> {AsyncHttpConnection@1de0733,g=HttpGenerator{s=0,h=-1,b=-1,c=-1},p=HttpParser{s=-14,l=0,c=0},r=0}
> NOT_HANDSHAKING filled=0/0 flushed=0/0
> 2013-03-01 11:32:47.030:DBUG:oejin.ssl:[Session-1,
> SSL_NULL_WITH_NULL_NULL] handle SslConnection@f44fe SSL NOT_HANDSHAKING
> i/o/u=0/0/0 ishut=false oshut=false 
> {AsyncHttpConnection@1de0733,g=HttpGenerator{s=0,h=-1,b=-1,c=-1},p=HttpParser{s=-14,l=0,c=0},r=0}
> progress=false
> 2013-03-01 11:32:47.046:DBUG:oejin.ssl:[Session-1,
> SSL_NULL_WITH_NULL_NULL] SslConnection@f44fe SSL NOT_HANDSHAKING
> i/o/u=389/0/0 ishut=false oshut=false 
> {AsyncHttpConnection@1de0733,g=HttpGenerator{s=0,h=-1,b=-1,c=-1},p=HttpParser{s=-14,l=0,c=0},r=0}
> NOT_HANDSHAKING filled=389/389 flushed=0/0
> 2013-03-01 11:32:47.046:DBUG:oejin.ssl:SCEP@12e1b7f{l(/xx
> .xxx.xxx.xxx:61378 <http://67.151.197.130:61378>
> )<->r(/xx.xx.xx.xxx:8443),d=true,open=true,ishut=false,oshut=false,rb=false,wb=false,w=true,i=1r}-{SslConnection@f44feSSL
>  NEED_WRAP i/o/u=389/0/0 ishut=false oshut=false
> {AsyncHttpConnection@1de0733
> ,g=HttpGenerator{s=0,h=-1,b=-1,c=-1},p=HttpParser{s=-14,l=0,c=0},r=0}}
> javax.net.ssl.SSLException: bad record MAC
> at sun.security.ssl.Alerts.getSSLException(Unknown Source)
> at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source)
>  at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source)
> at sun.security.ssl.SSLEngineImpl.readRecord(Unknown Source)
>  at sun.security.ssl.SSLEngineImpl.readNetRecord(Unknown Source)
> at sun.security.ssl.SSLEngineImpl.unwrap(Unknown Source)
>  at javax.net.ssl.SSLEngine.unwrap(Unknown Source)
> at org.eclipse.jetty.io.nio.SslConnection.unwrap(SslConnection.java:524)
>  at org.eclipse.jetty.io.nio.SslConnection.process(SslConnection.java:359)
> at org.eclipse.jetty.io.nio.SslConnection.access$900(SslConnection.java:48)
>  at
> org.eclipse.jetty.io.nio.SslConnection$SslEndPoint.fill(SslConnection.java:666)
> at org.eclipse.jetty.http.HttpParser.fill(HttpParser.java:1040)
>  at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:280)
> at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235)
>  at
> org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82)
> at org.eclipse.jetty.io.nio.SslConnection.handle(SslConnection.java:196)
>  at
> org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:628)
> at
> org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:52)
>  at
> org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:608)
> at
> org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:543)
>  at java.lang.Thread.run(Unknown Source)
>
> Any idea where I should continue looking?
>
> Thanks
>
> _______________________________________________
> jetty-users mailing list
> [email protected]
> https://dev.eclipse.org/mailman/listinfo/jetty-users
>
>
_______________________________________________
jetty-users mailing list
[email protected]
https://dev.eclipse.org/mailman/listinfo/jetty-users

Reply via email to