Java JSF“错误 Mac 未验证！”

JSF "Error Mac did not verify!"

提问by Shifty

I have been trying to implement some basic push functionality with primefaces in jsf. I have used there counter example http://www.primefaces.org/showcase-labs/push/counter.jsf. Essentially its a button that increments a shared counter. When running this example I always get this error:

我一直在尝试用 jsf 中的 primefaces 实现一些基本的推送功能。我在那里使用了反例http://www.primefaces.org/showcase-labs/push/counter.jsf。本质上它是一个增加共享计数器的按钮。运行此示例时，我总是收到此错误：

ERROR: MAC did not verify!

My understanding is that a mac is generated every session and then checked upon each incoming message to verify that the source hasn't changed (I think). I have not been able to find the cause of this and have looked at other threads such as:

我的理解是每个会话都会生成一个 mac，然后检查每个传入的消息以验证源没有改变（我认为）。我一直无法找到导致此问题的原因，并查看了其他线程，例如：

ERROR: MAC did not verify! PrimeFaces

错误：MAC 未验证！PrimeFaces

JSF: Mojarra 2.1 to 2.2 migration causing ViewExpiredException

JSF：Mojarra 2.1 到 2.2 迁移导致 ViewExpiredException

Unfortunately these haven't solved my problem. Both seem to be caused by a ViewExpiredException which I am not getting. The only thing that I have found to stop it is to change the state saving method from client to server in web.xml:

不幸的是，这些都没有解决我的问题。两者似乎都是由我没有得到的 ViewExpiredException 引起的。我发现阻止它的唯一方法是在 web.xml 中将状态保存方法从客户端更改为服务器：

<param-name>javax.faces.STATE_SAVING_METHOD</param-name>
<param-value>client</param-value>

However when doing this the counter is no longer shared but appears to be per user, which is not what I want. My ultimate goal is to implement a chatroom, which for the most part is there but right now it using short polling which is not very scalable. Having looked at primefaces push I thought it would be ideal but have been struggling to use it.

但是，当这样做时，计数器不再共享，而是每个用户，这不是我想要的。我的最终目标是实现一个聊天室，它大部分都在那里，但现在它使用短轮询，这不是很可扩展。看过 primefaces push 我认为它是理想的，但一直在努力使用它。

I have tried on multiple web servers (Tomcat, Jetty and Glassfish) and have tried using different versions of JSF (Mojarra) and versions of primefaces (3.4 and 4.0). I have tested it across multiple browsers and on multiple computers. Sometimes I can increment the counter a few times before I get the error, sometimes it happens straight away. I get no exceptions or servere errors and everything compiles. I'd also like to mention that I have had this error before on other projects, but it has gone away after restarting the server. When using primefaces push it always occurs. Any help will be appreciated.

我尝试过多个 Web 服务器（Tomcat、Jetty 和 Glassfish），并尝试使用不同版本的 JSF（Mojarra）和 primefaces（3.4 和 4.0）版本。我已经在多个浏览器和多台计算机上对其进行了测试。有时我可以在出现错误之前增加计数器几次，有时它会立即发生。我没有遇到任何异常或服务器错误，并且一切都可以编译。我还想提一下，我之前在其他项目上也遇到过这个错误，但是在重新启动服务器后它就消失了。使用primefaces push 时，它总是发生。任何帮助将不胜感激。

EDIT

编辑

When leaving state saving to server in web.xml to avoid MAC Error, I have noticed that the shared counter works in a per browser basis from the same machine. Meaning if I have multiple tabs or windows, updating the counter in one updates in all of them. But it doesn't work across browsers, a change in the counter in firefox is not reflected in chrome or IE, or the other ways round. It is also not reflected if on two separate computers. I don't know if this helps, but thought I would mention it.

当在 web.xml 中将状态保存到服务器以避免 MAC 错误时，我注意到共享计数器在同一台机器上的每个浏览器的基础上工作。这意味着如果我有多个选项卡或窗口，则在所有选项卡或窗口中一次更新计数器。但它不能跨浏览器工作，Firefox 中计数器的变化不会反映在 chrome 或 IE 中，或者其他方式。如果在两台单独的计算机上，也不会反映出来。我不知道这是否有帮助，但我想我会提到它。

EDIT

编辑

After noticing that the bean in the example is session scoped I changed it to application scoped. Of course session scoped means every browser has their own copy. Now the changes are reflected across browser and machines. Back to my original problem, I would still like to know why changing the saving state to server fixes the MAC error, and what the implications of this are ? I assume that the server now has to maintain view states for each session rather than the client, less scalable/more client-server traffic ? From what I've read if you set the saving state to server you can't check for view expired exceptions or stop users from creating views if they already have too many, is this correct ?

在注意到示例中的 bean 是会话范围后，我将其更改为应用程序范围。当然会话范围意味着每个浏览器都有自己的副本。现在更改会反映在浏览器和机器上。回到我原来的问题，我仍然想知道为什么将保存状态更改为服务器会修复 MAC 错误，这意味着什么？我假设服务器现在必须为每个会话而不是客户端维护视图状态，更少的可扩展性/更多的客户端 - 服务器流量？从我读过的内容来看，如果您将保存状态设置为服务器，您将无法检查视图过期异常或阻止用户创建视图（如果他们已经拥有太多视图），这是正确的吗？

回答by Armen Arzumanyan

Seems your application have dependency problem ViewExpiredException can be handled easily, it is a no problem handle ViewExpiredException

看来你的应用程序有依赖问题 ViewExpiredException 可以轻松处理，处理 ViewExpiredException 是没有问题的

full configured JSF project example JSF2.2 frontend

完整配置的 JSF 项目示例JSF2.2 前端

回答by Pascual Prados

ByteArrayGuard class randomly outputs "ERROR: MAC did not verify!" messages to the error console. This only occurs when client side viewstate encryption is enabled and that multiple clients are running against the server.

ByteArrayGuard 类随机输出“ERROR：MAC 未验证！” 消息到错误控制台。这仅在启用客户端视图状态加密并且多个客户端针对服务器运行时发生。

So you must change that class in your Java Server Faces references with...

因此，您必须在 Java Server Faces 引用中更改该类...

/*
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
 *
 * Copyright (c) 1997-2011 Oracle and/or its affiliates. All rights reserved.
 *
 * The contents of this file are subject to the terms of either the GNU
 * General Public License Version 2 only ("GPL") or the Common Development
 * and Distribution License("CDDL") (collectively, the "License").  You
 * may not use this file except in compliance with the License.  You can
 * obtain a copy of the License at
 * https://glassfish.dev.java.net/public/CDDL+GPL_1_1.html
 * or packager/legal/LICENSE.txt.  See the License for the specific
 * language governing permissions and limitations under the License.
 *
 * When distributing the software, include this License Header Notice in each
 * file and include the License file at packager/legal/LICENSE.txt.
 *
 * GPL Classpath Exception:
 * Oracle designates this particular file as subject to the "Classpath"
 * exception as provided by Oracle in the GPL Version 2 section of the License
 * file that accompanied this code.
 *
 * Modifications:
 * If applicable, add the following below the License Header, with the fields
 * enclosed by brackets [] replaced by your own identifying information:
 * "Portions Copyright [year] [name of copyright owner]"
 *
 * Contributor(s):
 * If you wish your version of this file to be governed by only the CDDL or
 * only the GPL Version 2, indicate your decision by adding "[Contributor]
 * elects to include this software in this distribution under the [CDDL or GPL
 * Version 2] license."  If you don't indicate a single choice of license, a
 * recipient has the option to distribute your version of this file under
 * either the CDDL, the GPL Version 2 or to extend the choice of license to
 * its licensees as provided above.  However, if you add GPL Version 2 code
 * and therefore, elected the GPL Version 2 license, then the option applies
 * only if the new code is made subject to such option by the copyright
 * holder.
 */

package com.sun.faces.renderkit;

import com.sun.faces.util.FacesLogger;
import java.security.SecureRandom;
import java.util.Arrays;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.Mac;
import javax.crypto.SecretKey;
import javax.crypto.spec.IvParameterSpec;
import javax.faces.FacesException;

/**
 * <p>This utility class is to provide both encryption and
 * decryption <code>Ciphers</code> to <code>ResponseStateManager</code>
 * implementations wishing to provide encryption support.</p>
 * 
 * <p>The algorithm used to encrypt byte array is AES with CBC.</p>
 *  
 * <p>Original author Inderjeet Singh, J2EE Blue Prints Team. Modified to suit JSF
 * needs.</p> 
 */
public final class ByteArrayGuard {


     // Log instance for this class
    private static final Logger LOGGER = FacesLogger.RENDERKIT.getLogger();

    private static final int MAC_LENGTH = 32;
    private static final int KEY_LENGTH = 128;
    private static final int IV_LENGTH = 16;

    private static final String KEY_ALGORITHM = "AES";
    private static final String CIPHER_CODE = "AES/CBC/PKCS5Padding";
    private static final String MAC_CODE = "HmacSHA256";
    private SecretKey sk;

    // ------------------------------------------------------------ Constructors

    public ByteArrayGuard() {

        try {
            setupKeyAndMac();
        } catch (Exception e) {
            if (LOGGER.isLoggable(Level.SEVERE)) { 
                LOGGER.log(Level.SEVERE,
                           "Unexpected exception initializing encryption."
                           + "  No encryption will be performed.",
                           e);
            }
            System.err.println("ERROR: Initializing Ciphers");
        }
    }

    // ---------------------------------------------------------- Public Methods    


    /**
     * This method:
     *    Encrypts bytes using a cipher.  
     *    Generates MAC for intialization vector of the cipher
     *    Generates MAC for encrypted data
     *    Returns a byte array consisting of the following concatenated together:
     *       |MAC for cnrypted Data | MAC for Init Vector | Encrypted Data |
     * @param bytes The byte array to be encrypted.
     * @return the encrypted byte array.
     */
    public byte[] encrypt(byte[] bytes) {
        byte[] securedata = null;
        try {
            // Generate IV
            SecureRandom rand = new SecureRandom();
            byte[] iv = new byte[16];
            rand.nextBytes(iv);
            IvParameterSpec ivspec = new IvParameterSpec(iv);
            Cipher encryptCipher = Cipher.getInstance(CIPHER_CODE);
            encryptCipher.init(Cipher.ENCRYPT_MODE, sk, ivspec);
            Mac encryptMac = Mac.getInstance(MAC_CODE);
            encryptMac.init(sk);
            encryptMac.update(iv);
            // encrypt the plaintext
            byte[] encdata = encryptCipher.doFinal(bytes);
            byte[] macBytes = encryptMac.doFinal(encdata);
            byte[] tmp = concatBytes(macBytes, iv);
            securedata = concatBytes(tmp, encdata);
        } catch (Exception e) {
            if (LOGGER.isLoggable(Level.SEVERE)) {
                LOGGER.log(Level.SEVERE,
                           "Unexpected exception initializing encryption."
                           + "  No encryption will be performed.",
                           e);
            }
            return null;
        }
        return securedata;
    }

    /**
     * This method decrypts the provided byte array.
     * The decryption is only performed if the regenerated MAC
     * is the same as the MAC for the received value.
     * @param bytes Encrypted byte array to be decrypted.
     * @return Decrypted byte array.
     */
    public byte[] decrypt(byte[] bytes) {
        try {
            // Extract MAC
            byte[] macBytes = new byte[MAC_LENGTH];
            System.arraycopy(bytes, 0, macBytes, 0, macBytes.length);

            // Extract IV
            byte[] iv = new byte[IV_LENGTH];
            System.arraycopy(bytes, macBytes.length, iv, 0, iv.length);

            // Extract encrypted data
            byte[] encdata = new byte[bytes.length - macBytes.length - iv.length];
            System.arraycopy(bytes, macBytes.length + iv.length, encdata, 0, encdata.length);

            IvParameterSpec ivspec = new IvParameterSpec(iv);
            Cipher decryptCipher = Cipher.getInstance(CIPHER_CODE);
            decryptCipher.init(Cipher.DECRYPT_MODE, sk, ivspec);

            // verify MAC by regenerating it and comparing it with the received value
            Mac decryptMac = Mac.getInstance(MAC_CODE);
            decryptMac.init(sk);
            decryptMac.update(iv);
            decryptMac.update(encdata);
            byte[] macBytesCalculated = decryptMac.doFinal();
            if (Arrays.equals(macBytes, macBytesCalculated)) {
                // continue only if the MAC was valid
                // System.out.println("Valid MAC found!");
                byte[] plaindata = decryptCipher.doFinal(encdata);
                return plaindata;
            } else {
                System.err.println("ERROR: MAC did not verify!");
                return null;
            }
        } catch (Exception e) {
            System.err.println("ERROR: Decrypting:"+e.getCause());
            return null; // Signal to JSF runtime
        }
    }

    // --------------------------------------------------------- Private Methods

    /**
     * Generates secret key.
     * Initializes MAC(s).
     */
    private void setupKeyAndMac() {

        try {
            KeyGenerator kg = KeyGenerator.getInstance(KEY_ALGORITHM);
            kg.init(KEY_LENGTH);   // 256 if you're using the Unlimited Policy Files
            sk = kg.generateKey(); 

        } catch (Exception e) {
            throw new FacesException(e);
        }
    }

    /**
     * This method concatenates two byte arrays
     * @return a byte array of array1||array2
     * @param array1 first byte array to be concatenated
     * @param array2 second byte array to be concatenated
     */
    private static byte[] concatBytes(byte[] array1, byte[] array2) {
        byte[] cBytes = new byte[array1.length + array2.length];
        try {
            System.arraycopy(array1, 0, cBytes, 0, array1.length);
            System.arraycopy(array2, 0, cBytes, array1.length, array2.length);
        } catch(Exception e) {
            throw new FacesException(e);
        }
        return cBytes;
    }    
}

And reload this jar. JSF_REFERENCE

并重新加载这个罐子。 JSF_REFERENCE