BigIP F5 : changing IP leads to cache invalidated and redownload of applet jars

Question

Hello all,
In short, I'm trying to figure out how to have the java 7 plugin not considering the server IP to decide whether to use cached version of our applet's signed jars.
As suggested in the title, we use BigIP's F5 boxes to dispatch requests among actual servers, which are located in 2 different sites (disaster recovery purposes).
Each site has an F5 box ; and our DNS resolve the application's host name by alternating between 2 different IPs : one for site 1, the other for site 2.
Each time a user visits http://theapp.mycompany.com, the host is resolved as 9.9.9.1 or 9.9.9.2, more or less randomly.
This works very nicely as long as the applet is not concerned, or bandwith and latency is good enough to absorb 1.5Mb in a snap.
For remote subsidiaries (10.000km away from servers), downloading 1.5Mb takes 35s -- too much for the normal user to wait.
And the problem is : the plugin insists on looking up the server IP each time it starts up, and ignores cache entries that have been downloaded from a different IP.
Here is the use case :
- user connects to http://theapp.mycompany.com ; the browser get an IP, doesn't matter which ; user logs on, navigates in the app's html pages -- no problem
- user gets to the applet :
- the html page says
<applet id="myApplet">
    <param name="archive" value="a.jar,b.jar,c.jar,d.jar,e.jar"/>
    <param name="codebase_lookup" value="false"/>
    <param name="archive_1" value="a.jar, preload, version=7.5.7" />
    <param name="archive_2" value="b.jar, preload, version=7.5.7" />
    <param name="archive_3" value="c.jar, preload, version=7.5.7" />
    <param name="archive_4" value="d.jar, preload, version=7.5.7" />
    <param name="archive_5" value="e.jar, preload, version=7.5.7" />
    <param name="baseUrl" value="/"/>
    <param name="code" value="a/package/for/Applet.class"/>     
    <param name="mayscript" value="mayscript"/>
    <param name="codebase" value="/applet/"/>
    <param name="name" value="MyApplet" />"
    <param name="locale" value="fr"/>
</applet>
     The archive_n parameters are here in an attempt to tell the plugin to not even ask for jars if its cache contains entries with same host/same name/same version.
     The version is assigned at build time at an application level ; it has nothing to do with the Implementation-Version attribute found in MANIFEST.MF files.
- Java and the plugin sarts up : let's assume this is the first time : cache is empty : all jars are downloaded ; as they are signed and the CA certificate chain was set in the browser config, and the java.policy is also configured to allow smooth exec, the applet runs smoothly -- after a long startup delay
- user leaves the applet, do some stuff in other applet-less pages for some minutes (the java/plugin processes are shut down after a minute or so)
- user reenters the page that contains the applet
- Java and the plugin start up again :
     - the cache has entries for each jar : host, name, version are all ok.
     - But : the jars are not seen as "prevalidated" ; heres' the applet log ( in French, translation provided after "//") :
network: Vérification de version pour a.jar. La version spécifiée est 7.5.7     //Checking version for a.jar. Specified version is 7.5.7
security: La vérification de révocation de la liste noire est activée     // Check of blacklist revocation is activated
security: blacklist: created: NEED_LOAD, lastModified: 1378474147992
security: blacklist: hasBeenModifiedSince 1380806409906 (we have 1378474147992)
security: La vérification de liste de bibliothèques sécurisées est activée     // Check of trusted libraries is activated
..... same for the other jars ....
network: Created version ID: 7.5.7
network: Created version ID: 7.5.7
network: Entrée de cache trouvée [URL : http://theapp.mycompany.com/applet/a.jar, version : 7.5.7] prevalidated=false/0  //Cache entry found
cache: Adding MemoryCache entry: http://sandbox-mosaic.jcdecaux.com/applet/plannerApplet_7.5.7.jar
network: Created version ID: 7.5.7
     - The plugin then tries to lookup the host IP to check whether it matches that seen when creating the entry
     - 2 possibilities here :
               - the IP returned is the same : the plugin is happy, uses the cached jar, no question/download to/from the server, and the applet starts up quick and runs ok
               - the IP returned is not the same ; the plugin says :
network: Vérification de version pour a.jar. La version spécifiée est 7.5.7     //Checking version for a.jar. Specified version is 7.5.
security: blacklist: created: NEED_LOAD, lastModified: 1378474147992
security: blacklist: hasBeenModifiedSince 1380806409906 (we have 1378474147992)
security: La vérification de liste de bibliothèques sécurisées est activée     // Check of trusted libraries is activated
cache: CacheEntry IP mismatch: 9.9.9.1 != 9.9.9.2
          and then it downloads again the jar.
          Of course, all the jars are treated the same way.
          Note that the applet eventually runs normally ; the only problem is that the cache essentially doesn't work, causing terribly annoying 35s delays at applet startup.
Interestingly enough, examining the jdk 6 code shows that the "prevalidated=false" fragment (in bold/pink above) means that the method CacheEntry.isKnownToBeSigned() returns false.
I tried with a self-signed certificate which I added first in IE as "Trusted publisher" ; I also tried with a certificate signed by a CA that is known by IE -- no help.
So I really wonder : what does it take to have the plugin consider that each jar "isKnownToBeSigned" ?
Any thoughts ?
Note : we of course are considering packing jars, cleaning dead code, etc. to decrease applet size. But it doesn't help with the fact that the plugin considers the IP, which it shouldn't do in our case. And even with pack200 we're left with +350Kb of unnecessary downloads, not counting with future code to be developped ...
Thanks for any feedback
David
Browser is IE7.
Complete dump of system properties :
__applet_launched = 280874909499
__jvm_launched = 280874910680
acl.read = +
acl.read.default =
acl.write = +
acl.write.default =
awt.toolkit = sun.awt.windows.WToolkit
browser = sun.plugin
browser.vendor = Oracle
browser.version = 1.1
file.encoding = Cp1252
file.encoding.pkg = sun.io
file.separator = \
file.separator.applet = true
http.agent = Mozilla/4.0 (Windows Vista 6.0)
http.auth.serializeRequests = true
https.protocols = TLSv1,SSLv3
java.awt.graphicsenv = sun.awt.Win32GraphicsEnvironment
java.awt.printerjob = sun.awt.windows.WPrinterJob
java.class.path = C:\tools\Java\jre7\classes
java.class.version = 51.0
java.class.version.applet = true
java.endorsed.dirs = C:\tools\Java\jre7\lib\endorsed
java.ext.dirs = C:\tools\Java\jre7\lib\ext;C:\Windows\Sun\Java\lib\ext
java.home = C:\tools\Java\jre7
java.io.tmpdir = C:\Users\taille\AppData\Local\Temp\
java.library.path = C:\tools\Java\jre7\bin;C:\Windows\Sun\Java\bin;C:\Windows\system32;C:\Windows;C:\Program Files\Internet Explorer;;C:\oracle\ORA102\bin;C:\Perl\site\bin;C:\Perl\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;c:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\JavaSoft\JRE\1.3.1_06\bin;C:\ORACLE\Ora92\jre\1.3.1\bin;C:\ORACLE\Ora92\jre\1.1.8\bin;C:\tools\Groovy-1.7.5\bin;C:\tools\Graphviz2.28\bin;C:\tools\Git\cmd;C:\tools\tortoiseSVN\bin;C:\Program Files\Windows Imaging\;C:\oracle\ORA102\bin;C:\Perl\site\bin;C:\Perl\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;c:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\JavaSoft\JRE\1.3.1_06\bin;C:\ORACLE\Ora92\jre\1.3.1\bin;C:\ORACLE\Ora92\jre\1.1.8\bin;C:\tools\Groovy-1.7.5\bin;C:\tools\Graphviz2.28\bin;C:\tools\Git\cmd;C:\tools\tortoiseSVN\bin;C:\Program Files\Windows Imaging\;.
java.protocol.handler.pkgs = sun.plugin.net.protocol|com.sun.deploy.net.protocol
java.rmi.server.RMIClassLoaderSpi = sun.plugin2.applet.JNLP2RMIClassLoaderSpi
java.runtime.name = Java(TM) SE Runtime Environment
java.runtime.version = 1.7.0_21-b11
java.specification.name = Java Platform API Specification
java.specification.vendor = Oracle Corporation
java.specification.version = 1.7
java.vendor = Oracle Corporation
java.vendor.applet = true
java.vendor.url = http://java.oracle.com/
java.vendor.url.applet = true
java.vendor.url.bug = http://bugreport.sun.com/bugreport/
java.version = 1.7.0_21
java.version.applet = true
java.vm.info = mixed mode, sharing
java.vm.name = Java HotSpot(TM) Client VM
java.vm.specification.name = Java Virtual Machine Specification
java.vm.specification.vendor = Oracle Corporation
java.vm.specification.version = 1.7
java.vm.vendor = Oracle Corporation
java.vm.version = 23.21-b01
javaplugin.nodotversion = 10212
javaplugin.version = 10.21.2.11
javaplugin.vm.options = -Ddeployment.trace.level=all -Duser.language=en
javawebstart.version = javaws-10.21.2.11
line.separator = \r\n
line.separator.applet = true
mrj.version.applet = true
os.arch = x86
os.arch.applet = true
os.name = Windows Vista
os.name.applet = true
os.version = 6.0
os.version.applet = true
package.restrict.access.com.sun.deploy = true
package.restrict.access.netscape = false
package.restrict.access.org.mozilla.jss = true
package.restrict.access.sun = true
package.restrict.definition.com.sun.deploy = true
package.restrict.definition.java = true
package.restrict.definition.netscape = true
package.restrict.definition.org.mozilla.jss = true
package.restrict.definition.sun = true
path.separator = ;
path.separator.applet = true
sun.arch.data.model = 32
sun.awt.enableExtraMouseButtons = true
sun.awt.warmup = true
sun.boot.class.path = C:\tools\Java\jre7\lib\resources.jar;C:\tools\Java\jre7\lib\rt.jar;C:\tools\Java\jre7\lib\sunrsasign.jar;C:\tools\Java\jre7\lib\jsse.jar;C:\tools\Java\jre7\lib\jce.jar;C:\tools\Java\jre7\lib\charsets.jar;C:\tools\Java\jre7\lib\jfr.jar;C:\tools\Java\jre7\classes;C:\tools\Java\jre7\lib\deploy.jar;C:\tools\Java\jre7\lib\javaws.jar;C:\tools\Java\jre7\lib\plugin.jar
sun.boot.library.path = C:\tools\Java\jre7\bin
sun.cpu.endian = little
sun.cpu.isalist = pentium_pro+mmx pentium_pro pentium+mmx pentium i486 i386 i86
sun.desktop = windows
sun.io.unicode.encoding = UnicodeLittle
sun.java.command = sun.plugin2.main.client.PluginMain write_pipe_name=jpi2_pid7004_pipe37,read_pipe_name=jpi2_pid7004_pipe36
sun.java.launcher = SUN_STANDARD
sun.jnu.encoding = Cp1252
sun.management.compiler = HotSpot Client Compiler
sun.net.client.defaultConnectTimeout = 120000
sun.net.http.errorstream.enableBuffering = true
sun.os.patch.level = Service Pack 2
trustProxy = true
user.country = FR
user.dir = C:\dtaille\TMA\perfs_br\newcert
user.home = C:\Users\taille
user.language = fr
user.name = taille
user.script =
user.timezone = Europe/Paris
user.variant =
Vider les propriétés de déploiement...
active.deployment.proxy.bypass.local = false
active.deployment.proxy.same = false
active.deployment.proxy.type = 3
deployment.baseline.url = https://javadl-esd-secure.oracle.com/update/baseline.version
deployment.blacklist.url = https://javadl-esd-secure.oracle.com/update/blacklist
deployment.blacklisted.certs.url = https://javadl-esd-secure.oracle.com/update/blacklisted.certs
deployment.browser.path = C:\Program Files\Mozilla Firefox\firefox.exe
deployment.browser.vm.iexplorer = true
deployment.browser.vm.mozilla = true
deployment.cache.enabled = true
deployment.cache.jarcompression = 0
deployment.cache.max.size = 726
deployment.capture.mime.types = false
deployment.console.startup.mode = SHOW
deployment.control.panel.log = false
deployment.expiration.decision.10.21.2 = later
deployment.expiration.decision.suppression.10.21.2 = true
deployment.expiration.decision.timestamp.10.21.2 = 9/6/2013 15:29:3
deployment.insecure.jres = PROMPT
deployment.javafx.mode.enabled = true
deployment.javapi.cache.update = false
deployment.javapi.lifecycle.exception = false
deployment.javapi.log.filename =
deployment.javapi.runtime.type = 0
deployment.javapi.stop.timeout = 200
deployment.javapi.trace.filename =
deployment.javaws.appicon.index = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\appIcon\appIcon.xml
deployment.javaws.associations = ASK_USER
deployment.javaws.cache.update = false
deployment.javaws.concurrentDownloads = 4
deployment.javaws.install = IF_HINT
deployment.javaws.installURL = http://java.sun.com/products/autodl/j2se
deployment.javaws.logFileName =
deployment.javaws.muffin.max = 256
deployment.javaws.shortcut = ASK_IF_HINTED
deployment.javaws.splash.index = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\splash\splash.xml
deployment.javaws.traceFileName =
deployment.javaws.uninstall.shortcut = false
deployment.javaws.update.timeout = 1500
deployment.javaws.viewer.bounds = 1723,197,881,546
deployment.jpi.mode.new = true
deployment.log = false
deployment.macosx.check.update = true
deployment.max.output.file.size = 10
deployment.max.output.files = 5
deployment.mime.types.use.default = true
deployment.modified.timestamp = 1380804178316
deployment.proxy.bypass.local = false
deployment.proxy.override.hosts =
deployment.proxy.same = false
deployment.proxy.type = 3
deployment.security.SSLv2Hello = false
deployment.security.SSLv3 = true
deployment.security.TLSv1 = true
deployment.security.TLSv1.1 = false
deployment.security.TLSv1.2 = false
deployment.security.askgrantdialog.notinca = true
deployment.security.askgrantdialog.show = true
deployment.security.authenticator = true
deployment.security.blacklist.check = true
deployment.security.browser.keystore.use = true
deployment.security.clientauth.keystore.auto = true
deployment.security.disable = false
deployment.security.https.warning.show = false
deployment.security.jsse.hostmismatch.warning = true
deployment.security.level = HIGH
deployment.security.local.applets = PROMPT
deployment.security.mixcode = DISABLE
deployment.security.notinca.warning = true
deployment.security.password.cache = true
deployment.security.run.untrusted = PROMPT
deployment.security.sandbox.awtwarningwindow = true
deployment.security.sandbox.casigned = PROMPT
deployment.security.sandbox.jnlp.enhanced = true
deployment.security.sandbox.selfsigned = PROMPT
deployment.security.trusted.policy =
deployment.security.validation.crl = false
deployment.security.validation.ocsp = false
deployment.security.validation.ocsp.publisher = false
deployment.system.cachedir = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\SystemCache
deployment.system.security.blacklist = C:\tools\Java\jre7\lib\security\blacklist
deployment.system.security.cacerts = C:\tools\Java\jre7\lib\security\cacerts
deployment.system.security.jssecacerts = C:\tools\Java\jre7\lib\security\jssecacerts
deployment.system.security.oldcacerts = C:\tools\Java\jre7\lib\security\cacerts
deployment.system.security.oldjssecacerts = C:\tools\Java\jre7\lib\security\jssecacerts
deployment.system.security.trusted.certs = C:\tools\Java\jre7\lib\security\trusted.certs
deployment.system.security.trusted.clientauthcerts = C:\tools\Java\jre7\lib\security\trusted.clientcerts
deployment.system.security.trusted.jssecerts = C:\tools\Java\jre7\lib\security\trusted.jssecerts
deployment.system.security.trusted.libraries = C:\tools\Java\jre7\lib\security\trusted.libraries
deployment.system.tray.icon = true
deployment.trace = true
deployment.update.mime.types = true
deployment.user.cachedir = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\cache
deployment.user.extdir = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\ext
deployment.user.logdir = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\log
deployment.user.security.blacklist = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\security\blacklist
deployment.user.security.blacklist.dynamic = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\security\blacklist.dynamic
deployment.user.security.blacklisted.certs = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\security\blacklisted.certs
deployment.user.security.policy = file:/C:/Users/taille/AppData/LocalLow/Sun/Java/Deployment/security/java.policy
deployment.user.security.sandbox.certs = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\security\sandbox.certs
deployment.user.security.saved.credentials = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\security\auth.dat
deployment.user.security.trusted.cacerts = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\security\trusted.cacerts
deployment.user.security.trusted.certs = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\security\trusted.certs
deployment.user.security.trusted.clientauthcerts = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\security\trusted.clientcerts
deployment.user.security.trusted.jssecacerts = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\security\trusted.jssecacerts
deployment.user.security.trusted.jssecerts = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\security\trusted.jssecerts
deployment.user.security.trusted.libraries = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\security\trusted.libraries
deployment.user.tmp = C:\Users\taille\AppData\LocalLow\Sun\Java\Deployment\tmp
deployment.version = 7.21
deployment.webjava.enabled = true
java.quick.starter = false

Answer 1

This behavior was introduced by a security "fix" intended to prevent a DNS re-binding attack which permits unsigned applets to escape the applet sandbox.  The "fix" was, imo, very poorly thought out.  You think you have a problem with 1.5 megabits of applet jars, but I have 8 megabytes, hundreds of thousands of users, with lousy networks. So now I'm stuck with a colocation vendor.  Imagine my chagrin when they changed *their* ISP and thus their IP addresses.  
As far as I can see, signed applets are already permitted (if the user allows) to communicate outside the sandbox, so this "fix" should not have been applied to signed jars, only to unsigned ones.  There are a couple of other techniques that Oracle might have used to prevent this attack, but they chose the simplest one, effectively preventing anyone from using the most common, inexpensive strategies for improving the availability of their web-based Java applications.