Java C/S架构TLS通信Wireshark抓包仅显示TCP流量问题排查

开发基于TLS实现安全通信的Java客户端-服务端应用，密钥库、信任库均通过JDK内置keytool工具生成，两端核心逻辑如下：

服务端核心代码 #

private static SSLContext sslContext;
private static final String fullPathToTrustStore = ".\\lib\\truststore";
private static final String fullPathToKeyStore = ".\\lib\\keystore";
private final String serverIP = "127.0.0.1";
private static final String password = "password";
private static KeyManagerFactory kmf;
private static TrustManagerFactory tmf;

// 服务启动逻辑
boolean status;
status = CreateKeyTrustManagerFactory();
if (status) {
    CreateSSLContext();
}

try {
    SSLServerSocketFactory ssf = sslContext.getServerSocketFactory();
    SSLServerSocket serverSocket = (SSLServerSocket) ssf.createServerSocket(5000);

    while (true) {
        Socket s = null;
        try {
            // 接收客户端连接
            s = serverSocket.accept();
            System.out.println("A new client is connected : " + s);
            // 获取输入输出流
            DataInputStream dis = new DataInputStream(s.getInputStream());
            DataOutputStream dos = new DataOutputStream(s.getOutputStream());

            System.out.println("Assigning new thread for this client");
            // 启动独立线程处理客户端请求
            Thread t = new ClientHandler(s, dis, dos);
            t.start();

        } catch (Exception e) {
            s.close();
            e.printStackTrace();
        }
    }
} catch (IOException e) {
    e.printStackTrace();
}

// 初始化密钥、信任管理器工厂
private static boolean CreateKeyTrustManagerFactory() throws CertificateException, IOException, NoSuchAlgorithmException {
    boolean retval = true;
    char[] passPhrase = password.toCharArray();
    try {

        KeyStore ksKeys = KeyStore.getInstance("PKCS12");
        ksKeys.load(new FileInputStream(fullPathToKeyStore), passPhrase);
        KeyStore ksTrust = KeyStore.getInstance("PKCS12");
        ksTrust.load(new FileInputStream(fullPathToTrustStore), passPhrase);

        kmf = KeyManagerFactory.getInstance("SunX509");
        kmf.init(ksKeys, passPhrase);
        tmf = TrustManagerFactory.getInstance("SunX509");
        tmf.init(ksKeys);

    } catch (KeyStoreException | FileNotFoundException | UnrecoverableKeyException e) {
        retval = false;
    }
    System.out.println("CreateKeyTrustManagerFactory returned: " + retval);
    return retval;
}

// 初始化SSL上下文
private static boolean CreateSSLContext() {
    boolean retval = true;
    try {
        sslContext = SSLContext.getInstance("TLSv1.3");
        sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

    } catch (Exception ex) {
        retval = false;
    }
    System.out.println("CreateSSLContext returned: " + retval);
    return retval;
}

客户端核心代码 #

客户端CreateKeyTrustManagerFactory、CreateSSLContext方法实现与服务端完全一致，连接逻辑如下：

private Client() throws CertificateException, IOException, NoSuchAlgorithmException {
    this.connection=true;

    boolean status;
    status = CreateKeyTrustManagerFactory();
    if (status) {
        CreateSSLContext();
    }

    SSLSocketFactory ssf = sslContext.getSocketFactory();

    try {
        SSLSocket sslClientSocket = (SSLSocket) ssf.createSocket();
        InetSocketAddress connectAddress = new InetSocketAddress(serverIP, serverPort);
        sslClientSocket.connect(connectAddress);
        sslClientSocket.startHandshake();
        SSLSession session = sslClientSocket.getSession();
        System.out.println("Session: " + session);
        InStream = new DataInputStream(sslClientSocket.getInputStream());
        OutStream = new DataOutputStream(sslClientSocket.getOutputStream());
    } catch (IOException e) {
        this.connection=false;
    }
}

故障现象 #

• 客户端、服务端通信功能完全正常
• 使用Wireshark抓取环回接口流量时，所有流量仅被识别为普通TCP协议，无法识别出TLS协议

• 检查Wireshark抓包环境配置
  Windows平台下默认WinPcap驱动不支持环回接口流量捕获，必须安装Npcap驱动（最新版Wireshark安装包默认自带，安装时勾选对应选项即可）；抓包时需要选择名为Npcap Loopback Adapter的环回接口，不能选择物理网卡接口，否则会因为链路层协议解析错误，无法识别上层TLS流量。
• 手动配置Wireshark端口解析规则
  Wireshark默认仅将443、465等标准TLS端口的流量识别为TLS协议，你的服务端使用的是自定义端口5000，需要手动指定解析规则：选中任意一条5000端口的TCP数据包，右键选择「解码为」，在下拉列表中选择TLS协议，保存后所有5000端口的流量就会按TLS规则解析。
• 修复代码中隐藏的信任库配置bug
  虽然当前通信正常，但服务端CreateKeyTrustManagerFactory方法中存在逻辑错误：tmf.init(ksKeys);错误传入了自身密钥库ksKeys，前面加载的信任库ksTrust完全没有被使用，会导致双向认证逻辑失效，存在安全风险，正确写法应为tmf.init(ksTrust);，客户端侧也需要同步检查是否存在相同错误。
• 验证TLS协商结果
  可以在客户端握手完成后添加一行代码打印协商的协议版本，确认TLS确实正常生效：

  System.out.println("协商的TLS版本: " + sslClientSocket.getSession().getProtocol());
  

  输出TLSv1.3即证明协议协商正常，问题仅出在Wireshark识别配置上。
• 环回抓包异常兜底方案
  如果配置完Npcap还是无法正常识别环回TLS流量，可以将服务端绑定地址从127.0.0.1改成本机物理网卡的实际IP，客户端连接这个物理IP，抓取物理网卡的流量即可正常解析TLS协议。

内容的提问来源于stack exchange，提问作者Hudini