[REM3-259] Authentication via remoting fail for larger requests i.e. …

…long password
jboss-remoting · May 24, 2017 · e7a17c3 · e7a17c3
1 parent 11de9ee
commit e7a17c3
Show file tree

Hide file tree

Showing 6 changed files with 489 additions and 9 deletions.
diff --git a/src/main/java/org/jboss/remoting3/RemotingOptions.java b/src/main/java/org/jboss/remoting3/RemotingOptions.java
@@ -52,6 +52,8 @@ private RemotingOptions() {
      */
     public static final int DEFAULT_RECEIVE_BUFFER_SIZE = 8192;
 
+    public static final int MAX_RECEIVE_BUFFER_SIZE = 15000;
+
     /**
      * The size of allocated buffer regions.
      */

diff --git a/src/main/java/org/jboss/remoting3/remote/ClientConnectionOpenListener.java b/src/main/java/org/jboss/remoting3/remote/ClientConnectionOpenListener.java
@@ -53,6 +53,7 @@
 import org.jboss.remoting3.spi.ConnectionHandlerContext;
 import org.jboss.remoting3.spi.ConnectionHandlerFactory;
 import org.jboss.remoting3.spi.ConnectionProviderContext;
+import org.xnio.BufferAllocator;
 import org.xnio.Buffers;
 import org.xnio.ChannelListener;
 import org.xnio.OptionMap;
@@ -249,8 +250,21 @@ final class Capabilities implements ChannelListener<ConnectedMessageChannel> {
         }
 
         public void handleEvent(final ConnectedMessageChannel channel) {
-            final Pooled<ByteBuffer> pooledReceiveBuffer = connection.allocate();
+            Pooled<ByteBuffer> pooledReceiveBuffer = connection.allocate();
             try {
+                if (channel instanceof RemotingMessageChannel) {
+                    try {
+                        int messageLength = ((RemotingMessageChannel) channel).readMessageLength();
+                        if (messageLength > pooledReceiveBuffer.getResource().capacity() && messageLength < RemotingOptions.MAX_RECEIVE_BUFFER_SIZE) {
+                            pooledReceiveBuffer = Buffers.allocatedBufferPool(BufferAllocator.BYTE_BUFFER_ALLOCATOR, messageLength).allocate();
+                            ((RemotingMessageChannel) channel).adjustToMessageLength(messageLength);
+                        }
+                    } catch (IOException e) {
+                        connection.handleException(e);
+                        return;
+                    }
+                }
+
                 final ByteBuffer receiveBuffer = pooledReceiveBuffer.getResource();
                 synchronized (connection.getLock()) {
                     int res;
@@ -479,7 +493,13 @@ public byte[] run() throws Exception {
                                     return;
                                 }
                                 // Prepare the request message body
-                                final Pooled<ByteBuffer> pooledSendBuffer = connection.allocate();
+                                Pooled<ByteBuffer> pooledSendBuffer = connection.allocate();
+
+                                if (response != null && response.length > pooledSendBuffer.getResource().capacity()) {
+                                    pooledSendBuffer = Buffers.allocatedBufferPool(BufferAllocator.BYTE_BUFFER_ALLOCATOR, response.length + 100).allocate();
+                                    connection.adjustToMessageLength(response.length + 100);
+                                }
+
                                 boolean ok = false;
                                 try {
                                     final ByteBuffer sendBuffer = pooledSendBuffer.getResource();

diff --git a/src/main/java/org/jboss/remoting3/remote/RemoteConnection.java b/src/main/java/org/jboss/remoting3/remote/RemoteConnection.java
@@ -119,6 +119,22 @@ void handleException(IOException e, boolean log) {
         }
     }
 
+    /**
+     * Adjusts inner buffers to required message length. For security reason, the buffer size cannot exceed value
+     * specified in {@link RemotingOptions#MAX_RECEIVE_BUFFER_SIZE}
+     *
+     * @param   length
+     *          message length the buffers
+     *
+     * @throws  IllegalArgumentException
+     *          if requested length exceeds maximal allowed buffer size
+     */
+    void adjustToMessageLength(int length) {
+        if (channel instanceof RemotingMessageChannel) {
+            ((RemotingMessageChannel) channel).adjustToMessageLength(length);
+        }
+    }
+
     void send(final Pooled<ByteBuffer> pooled) {
         writeListener.send(pooled, false);
     }

diff --git a/src/main/java/org/jboss/remoting3/remote/RemoteConnectionProvider.java b/src/main/java/org/jboss/remoting3/remote/RemoteConnectionProvider.java
@@ -66,7 +66,6 @@
 import org.xnio.channels.AcceptingChannel;
 import org.xnio.channels.ConnectedSslStreamChannel;
 import org.xnio.channels.ConnectedStreamChannel;
-import org.xnio.channels.FramedMessageChannel;
 import org.xnio.ssl.XnioSsl;
 
 /**
@@ -88,7 +87,9 @@ final class RemoteConnectionProvider extends AbstractHandleableCloseable<Connect
         LEAK_DEBUGGING = leakDebugging;
     }
 
-    static final Pool<ByteBuffer> GLOBAL_POOL = new ByteBufferSlicePool(BufferAllocator.DIRECT_BYTE_BUFFER_ALLOCATOR, 8192, 2048 * 1024);
+    private static final int BUFFER_SIZE = 8192;
+
+    static final Pool<ByteBuffer> GLOBAL_POOL = new ByteBufferSlicePool(BufferAllocator.DIRECT_BYTE_BUFFER_ALLOCATOR, BUFFER_SIZE, 2048 * 1024);
 
     private final ProviderInterface providerInterface = new ProviderInterface();
     private final Xnio xnio;
@@ -180,9 +181,9 @@ public void handleEvent(final ConnectedStreamChannel channel) {
                 } catch (IOException e) {
                     // ignore
                 }
-                Pool<ByteBuffer> messageBufferPool = USE_POOLING ? GLOBAL_POOL : Buffers.allocatedBufferPool(BufferAllocator.BYTE_BUFFER_ALLOCATOR, 8192);
+                Pool<ByteBuffer> messageBufferPool = USE_POOLING ? GLOBAL_POOL : Buffers.allocatedBufferPool(BufferAllocator.BYTE_BUFFER_ALLOCATOR, BUFFER_SIZE);
                 if (LEAK_DEBUGGING) messageBufferPool = new DebuggingBufferPool(messageBufferPool);
-                final FramedMessageChannel messageChannel = new FramedMessageChannel(channel, ByteBuffer.allocate(8192 + 4), ByteBuffer.allocate(8192 + 4));
+                final RemotingMessageChannel messageChannel = new RemotingMessageChannel(channel, ByteBuffer.allocate(BUFFER_SIZE + 4), ByteBuffer.allocate(BUFFER_SIZE + 4));
                 final RemoteConnection remoteConnection = new RemoteConnection(messageBufferPool, channel, messageChannel, connectOptions, RemoteConnectionProvider.this);
                 cancellableResult.addCancelHandler(new Cancellable() {
                     @Override
@@ -332,7 +333,7 @@ private final class AcceptListener implements ChannelListener<AcceptingChannel<?
             this.serverOptionMap = serverOptionMap;
             this.serverAuthenticationProvider = serverAuthenticationProvider;
             this.accessControlContext = accessControlContext;
-            Pool<ByteBuffer> pool = USE_POOLING ? GLOBAL_POOL : Buffers.allocatedBufferPool(BufferAllocator.BYTE_BUFFER_ALLOCATOR, 8192);
+            Pool<ByteBuffer> pool = USE_POOLING ? GLOBAL_POOL : Buffers.allocatedBufferPool(BufferAllocator.BYTE_BUFFER_ALLOCATOR, BUFFER_SIZE);
             messageBufferPool = LEAK_DEBUGGING ? new DebuggingBufferPool(pool) : pool;
         }
 
@@ -353,7 +354,7 @@ public void handleEvent(final AcceptingChannel<? extends ConnectedStreamChannel>
                 // ignore
             }
 
-            final FramedMessageChannel messageChannel = new FramedMessageChannel(accepted, ByteBuffer.allocate(8192 + 4), ByteBuffer.allocate(8192 + 4));
+            final RemotingMessageChannel messageChannel = new RemotingMessageChannel(accepted, ByteBuffer.allocate(BUFFER_SIZE + 4), ByteBuffer.allocate(BUFFER_SIZE + 4));
             final RemoteConnection connection = new RemoteConnection(messageBufferPool, accepted, messageChannel, serverOptionMap, RemoteConnectionProvider.this);
             final ServerConnectionOpenListener openListener = new ServerConnectionOpenListener(connection, connectionProviderContext, serverAuthenticationProvider, serverOptionMap, accessControlContext);
             messageChannel.getWriteSetter().set(connection.getWriteListener());