Java takes too long to load if java.policy has many grants to http URLs

Question

I am facing a nasty issue with trying to secure the Java browser plugin using the java.policy file. Some jars cause the JVM to stall for a time that is directly proportional to the size of the java.policy file.
The entries inside our java.policy look like this:
*grant codeBase "http://some.site.local:port/-" { permission java.security.AllPermission; };*
The more entries I add to this file, the slower the performance gets (as of java loading time). Using -Djava.security.debug=all I found that the timeout is 4.5 seconds for every grant in the java.policy. The log output just before the delay looks like this:
policy: evaluate codesources:
Policy CodeSource: (http://some.site.local:port/- <no signer certificates>)
*Active CodeSource: (http://wassup/wassup.jar [*
The http://wassup/wassup.jar is a signed test jar I installed on a local web server.
This old thread suggests this is a DNS/Netbios lookup timeout. However, Wireshark does not show any such traffic. Our DNS server does reply quickly, both on failure and success. http://192.9.162.102/thread.jspa?threadID=5250986&messageID=10039588
When I use the remote http://mindprod.com/applet/wassup.html there is no delay. The only difference I can see is that the remote JAR is always loaded via http, while the local jar is cached. Remote jar:
*network: Cache entry not found [url: http://mindprod.com/applet/wassup.jar, version: null]*
network: Connecting http://mindprod.com/applet/wassup.jar with proxy=HTTP @ proxy.company.local/10.10.1.2:8080
network: Downloading resource: http://mindprod.com/applet/wassup.jar
Content-Length: 19.804
Content-Encoding: null
Local jar:
network: Connecting http://wassup/wassup.jar with proxy=DIRECT
network: Connecting http://wassup:80/ with proxy=DIRECT
network: ResponseCode for http://wassup/wassup.jar : 304
network: Encoding for http://wassup/wassup.jar : null
network: Disconnect connection to http://wassup/wassup.jar
cache: Reading Signers from 1218 http://wassup/wassup.jar | C:\Program Files\Java\JrejCache\6.0\53\bd564b5-14aba644.idx
cache:  Read manifest for http://wassup/wassup.jar: read=691 full=691
I am using 1.6.0u22 at the moment. Is there anything I can do to fix this?

Answer 1

>
Try putting the domain names in the Windows hosts files with their numeric addresses. That should bypass any DNS lookup. If you have central maintenance you can update all the hosts files when IP address change.
We have considered this option, but then we have the same problem described on c). IP maintentance. IPs change often and we cannot control it.
Malcolmmc, paul.miner, jschell,
I think the problem is Netbios resolution, rather than DNS one. The sites that figure on java.policy file, are not available in terms of Netbios (they are not LAN clients), so they are only visibles on DNS resolution. But Java still tries to resolve them with Netbios first, so I think there's a timeout on this resolution (not the DNS one) . This timeout causes the problem.
But, anyway .... Why is Java trying to resolve those names ??? In fact, Java will only have to match the site you are visiting with the site specified on java.policy (just a String comparison). Why does Java need to resolve (netbios & dns) the names on java.policy? I cannot figure out why.
Thank you all.
Marc