[REM3-259] Authentication via remoting fail for larger requests e.g. …

…long password [REM3-259] Additional fix for remoting 4.0.22
jboss-remoting · May 24, 2017 · 76d85d1 · 76d85d1
1 parent 43da4c8
commit 76d85d1
Show file tree

Hide file tree

Showing 7 changed files with 522 additions and 11 deletions.
diff --git a/src/main/java/org/jboss/remoting3/RemotingOptions.java b/src/main/java/org/jboss/remoting3/RemotingOptions.java
@@ -52,6 +52,8 @@ private RemotingOptions() {
      */
     public static final int DEFAULT_RECEIVE_BUFFER_SIZE = 8192;
 
+    public static final int MAX_RECEIVE_BUFFER_SIZE = 15000;
+
     /**
      * The size of allocated buffer regions.
      */

diff --git a/src/main/java/org/jboss/remoting3/remote/ClientConnectionOpenListener.java b/src/main/java/org/jboss/remoting3/remote/ClientConnectionOpenListener.java
@@ -53,6 +53,7 @@
 import org.jboss.remoting3.spi.ConnectionHandlerContext;
 import org.jboss.remoting3.spi.ConnectionHandlerFactory;
 import org.jboss.remoting3.spi.ConnectionProviderContext;
+import org.xnio.BufferAllocator;
 import org.xnio.Buffers;
 import org.xnio.ChannelListener;
 import org.xnio.OptionMap;
@@ -247,8 +248,21 @@ final class Capabilities implements ChannelListener<ConnectedMessageChannel> {
         }
 
         public void handleEvent(final ConnectedMessageChannel channel) {
-            final Pooled<ByteBuffer> pooledReceiveBuffer = connection.allocate();
+            Pooled<ByteBuffer> pooledReceiveBuffer = connection.allocate();
             try {
+                if (channel instanceof RemotingMessageChannel) {
+                    try {
+                        int messageLength = ((RemotingMessageChannel) channel).readMessageLength();
+                        if (messageLength > pooledReceiveBuffer.getResource().capacity() && messageLength < RemotingOptions.MAX_RECEIVE_BUFFER_SIZE) {
+                            pooledReceiveBuffer = Buffers.allocatedBufferPool(BufferAllocator.BYTE_BUFFER_ALLOCATOR, messageLength).allocate();
+                            ((RemotingMessageChannel) channel).adjustToMessageLength(messageLength);
+                        }
+                    } catch (IOException e) {
+                        connection.handleException(e);
+                        return;
+                    }
+                }
+
                 final ByteBuffer receiveBuffer = pooledReceiveBuffer.getResource();
                 int res;
                 try {
@@ -480,7 +494,13 @@ public byte[] run() throws Exception {
                                     return;
                                 }
                                 // Prepare the request message body
-                                final Pooled<ByteBuffer> pooledSendBuffer = connection.allocate();
+                                Pooled<ByteBuffer> pooledSendBuffer = connection.allocate();
+
+                                if (response != null && response.length > pooledSendBuffer.getResource().capacity()) {
+                                    pooledSendBuffer = Buffers.allocatedBufferPool(BufferAllocator.BYTE_BUFFER_ALLOCATOR, response.length + 100).allocate();
+                                    connection.adjustToMessageLength(response.length + 100);
+                                }
+
                                 boolean ok = false;
                                 try {
                                     final ByteBuffer sendBuffer = pooledSendBuffer.getResource();

diff --git a/src/main/java/org/jboss/remoting3/remote/HttpUpgradeConnectionProvider.java b/src/main/java/org/jboss/remoting3/remote/HttpUpgradeConnectionProvider.java
@@ -90,6 +90,8 @@ final class HttpUpgradeConnectionProvider extends RemoteConnectionProvider {
     public static final String SEC_JBOSS_REMOTING_ACCEPT= "sec-jbossremoting-accept";
     public static final String UPGRADE = "Upgrade";
 
+    private static final int BUFFER_SIZE = 8192;
+
     private final ProviderInterface providerInterface = new ProviderInterface();
 
     HttpUpgradeConnectionProvider(final OptionMap optionMap, final ConnectionProviderContext connectionProviderContext) throws IOException {
@@ -225,10 +227,10 @@ public void adapt(final ConnectedStreamChannel channel) {
                 // ignore
             }
 
-            Pool<ByteBuffer> messageBufferPool = RemoteConnectionProvider.USE_POOLING ? GLOBAL_POOL : Buffers.allocatedBufferPool(BufferAllocator.BYTE_BUFFER_ALLOCATOR, 8192);
+            Pool<ByteBuffer> messageBufferPool = RemoteConnectionProvider.USE_POOLING ? GLOBAL_POOL : Buffers.allocatedBufferPool(BufferAllocator.BYTE_BUFFER_ALLOCATOR, BUFFER_SIZE);
             if (RemoteConnectionProvider.LEAK_DEBUGGING) messageBufferPool = new DebuggingBufferPool(messageBufferPool);
 
-            final FramedMessageChannel messageChannel = new FramedMessageChannel(channel, ByteBuffer.allocate(8192 + 4), ByteBuffer.allocate(8192 + 4));
+            final RemotingMessageChannel messageChannel = new RemotingMessageChannel(channel, ByteBuffer.allocate(BUFFER_SIZE + 4), ByteBuffer.allocate(BUFFER_SIZE + 4));
             final RemoteConnection connection = new RemoteConnection(messageBufferPool, channel, messageChannel, optionMap, HttpUpgradeConnectionProvider.this);
             final ServerConnectionOpenListener openListener = new ServerConnectionOpenListener(connection, getConnectionProviderContext(), authenticationProvider, optionMap, accessControlContext);
             messageChannel.getWriteSetter().set(connection.getWriteListener());

diff --git a/src/main/java/org/jboss/remoting3/remote/RemoteConnection.java b/src/main/java/org/jboss/remoting3/remote/RemoteConnection.java
@@ -119,6 +119,22 @@ void handleException(IOException e, boolean log) {
         }
     }
 
+    /**
+     * Adjusts inner buffers to required message length. For security reason, the buffer size cannot exceed value
+     * specified in {@link RemotingOptions#MAX_RECEIVE_BUFFER_SIZE}
+     *
+     * @param   length
+     *          message length the buffers
+     *
+     * @throws  IllegalArgumentException
+     *          if requested length exceeds maximal allowed buffer size
+     */
+    void adjustToMessageLength(int length) {
+        if (channel instanceof RemotingMessageChannel) {
+            ((RemotingMessageChannel) channel).adjustToMessageLength(length);
+        }
+    }
+
     void send(final Pooled<ByteBuffer> pooled) {
         writeListener.send(pooled, false);
     }

diff --git a/src/main/java/org/jboss/remoting3/remote/RemoteConnectionProvider.java b/src/main/java/org/jboss/remoting3/remote/RemoteConnectionProvider.java
@@ -66,7 +66,6 @@
 import org.xnio.channels.AcceptingChannel;
 import org.xnio.channels.ConnectedSslStreamChannel;
 import org.xnio.channels.ConnectedStreamChannel;
-import org.xnio.channels.FramedMessageChannel;
 import org.xnio.ssl.XnioSsl;
 
 /**
@@ -88,7 +87,9 @@ class RemoteConnectionProvider extends AbstractHandleableCloseable<ConnectionPro
         LEAK_DEBUGGING = leakDebugging;
     }
 
-    static final Pool<ByteBuffer> GLOBAL_POOL = new ByteBufferSlicePool(BufferAllocator.DIRECT_BYTE_BUFFER_ALLOCATOR, 8192, 2048 * 1024);
+    private static final int BUFFER_SIZE = 8192;
+
+    static final Pool<ByteBuffer> GLOBAL_POOL = new ByteBufferSlicePool(BufferAllocator.DIRECT_BYTE_BUFFER_ALLOCATOR, BUFFER_SIZE, 2048 * 1024);
 
     private final ProviderInterface providerInterface = new ProviderInterface();
     private final Xnio xnio;
@@ -174,9 +175,9 @@ public void handleEvent(final ConnectedStreamChannel channel) {
                 } catch (IOException e) {
                     // ignore
                 }
-                Pool<ByteBuffer> messageBufferPool = USE_POOLING ? GLOBAL_POOL : Buffers.allocatedBufferPool(BufferAllocator.BYTE_BUFFER_ALLOCATOR, 8192);
+                Pool<ByteBuffer> messageBufferPool = USE_POOLING ? GLOBAL_POOL : Buffers.allocatedBufferPool(BufferAllocator.BYTE_BUFFER_ALLOCATOR, BUFFER_SIZE);
                 if (LEAK_DEBUGGING) messageBufferPool = new DebuggingBufferPool(messageBufferPool);
-                final FramedMessageChannel messageChannel = new FramedMessageChannel(channel, ByteBuffer.allocate(8192 + 4), ByteBuffer.allocate(8192 + 4));
+                final RemotingMessageChannel messageChannel = new RemotingMessageChannel(channel, ByteBuffer.allocate(BUFFER_SIZE + 4), ByteBuffer.allocate(BUFFER_SIZE + 4));
                 final RemoteConnection remoteConnection = new RemoteConnection(messageBufferPool, channel, messageChannel, connectOptions, RemoteConnectionProvider.this);
                 cancellableResult.addCancelHandler(new Cancellable() {
                     @Override
@@ -326,7 +327,7 @@ private final class AcceptListener implements ChannelListener<AcceptingChannel<?
             this.serverOptionMap = serverOptionMap;
             this.serverAuthenticationProvider = serverAuthenticationProvider;
             this.accessControlContext = accessControlContext;
-            Pool<ByteBuffer> pool = USE_POOLING ? GLOBAL_POOL : Buffers.allocatedBufferPool(BufferAllocator.BYTE_BUFFER_ALLOCATOR, 8192);
+            Pool<ByteBuffer> pool = USE_POOLING ? GLOBAL_POOL : Buffers.allocatedBufferPool(BufferAllocator.BYTE_BUFFER_ALLOCATOR, BUFFER_SIZE);
             messageBufferPool = LEAK_DEBUGGING ? new DebuggingBufferPool(pool) : pool;
         }
 
@@ -347,7 +348,7 @@ public void handleEvent(final AcceptingChannel<? extends ConnectedStreamChannel>
                 // ignore
             }
 
-            final FramedMessageChannel messageChannel = new FramedMessageChannel(accepted, ByteBuffer.allocate(8192 + 4), ByteBuffer.allocate(8192 + 4));
+            final RemotingMessageChannel messageChannel = new RemotingMessageChannel(accepted, ByteBuffer.allocate(BUFFER_SIZE + 4), ByteBuffer.allocate(BUFFER_SIZE + 4));
             final RemoteConnection connection = new RemoteConnection(messageBufferPool, accepted, messageChannel, serverOptionMap, RemoteConnectionProvider.this);
             final ServerConnectionOpenListener openListener = new ServerConnectionOpenListener(connection, connectionProviderContext, serverAuthenticationProvider, serverOptionMap, accessControlContext);
             messageChannel.getWriteSetter().set(connection.getWriteListener());