From c05c2330cf5f27f660fc3677d0deefb73267f70a Mon Sep 17 00:00:00 2001 From: Stuart Marks Date: Mon, 5 Aug 2013 19:12:33 -0700 Subject: [PATCH 1/3] 8020854: change RMI javadocs to specify that remote objects are exported to the wildcard address Reviewed-by: rgallard, alanb --- .../java/rmi/server/RMISocketFactory.java | 40 +++++++++++++++++-- .../java/rmi/server/UnicastRemoteObject.java | 22 +++++++++- 2 files changed, 57 insertions(+), 5 deletions(-) diff --git a/jdk/src/share/classes/java/rmi/server/RMISocketFactory.java b/jdk/src/share/classes/java/rmi/server/RMISocketFactory.java index ccff225c87d..e7b7581820b 100644 --- a/jdk/src/share/classes/java/rmi/server/RMISocketFactory.java +++ b/jdk/src/share/classes/java/rmi/server/RMISocketFactory.java @@ -1,5 +1,5 @@ /* - * Copyright (c) 1996, 2002, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -33,15 +33,47 @@ import java.net.*; * in order to obtain client and server sockets for RMI calls. An * application may use the setSocketFactory method to * request that the RMI runtime use its socket factory instance - * instead of the default implementation.

+ * instead of the default implementation. * - * The default socket factory implementation used goes through a + *

The default socket factory implementation performs a * three-tiered approach to creating client sockets. First, a direct * socket connection to the remote VM is attempted. If that fails * (due to a firewall), the runtime uses HTTP with the explicit port * number of the server. If the firewall does not allow this type of * communication, then HTTP to a cgi-bin script on the server is used - * to POST the RMI call.

+ * to POST the RMI call. + * + *

The default socket factory implementation creates server sockets that + * are bound to the wildcard address, which accepts requests from all network + * interfaces. + * + * @implNote + *

You can use the {@code RMISocketFactory} class to create a server socket that + * is bound to a specific address, restricting the origin of requests. For example, + * the following code implements a socket factory that binds server sockets to the + * loopback address. This restricts RMI to processing requests only from the local host. + * + * 

{@code
+ *     class LoopbackSocketFactory extends RMISocketFactory {
+ *         public ServerSocket createServerSocket(int port) throws IOException {
+ *             return new ServerSocket(port, 5, InetAddress.getLoopbackAddress());
+ *         }
+ *
+ *         public Socket createSocket(String host, int port) throws IOException {
+ *             // just call the default client socket factory
+ *             return RMISocketFactory.getDefaultSocketFactory()
+ *                                    .createSocket(host, port);
+ *         }
+ *     }
+ *
+ *     // ...
+ *
+ *     RMISocketFactory.setSocketFactory(new LoopbackSocketFactory());
+ * }
+ * + * Set the {@code java.rmi.server.hostname} system property + * to a host name (typically {@code localhost}) that resolves to the loopback + * interface to ensure that the generated stubs use the right network interface. * * @author Ann Wollrath * @author Peter Jones diff --git a/jdk/src/share/classes/java/rmi/server/UnicastRemoteObject.java b/jdk/src/share/classes/java/rmi/server/UnicastRemoteObject.java index 7764627bceb..be86c275246 100644 --- a/jdk/src/share/classes/java/rmi/server/UnicastRemoteObject.java +++ b/jdk/src/share/classes/java/rmi/server/UnicastRemoteObject.java @@ -1,5 +1,5 @@ /* - * Copyright (c) 1996, 2003, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -100,6 +100,26 @@ import sun.rmi.server.UnicastServerRef2; * * * + *

If an object is exported with the + * {@link #exportObject(Remote) exportObject(Remote)} + * or + * {@link #exportObject(Remote, int) exportObject(Remote, port)} + * methods, or if a subclass constructor invokes one of the + * {@link #UnicastRemoteObject()} + * or + * {@link #UnicastRemoteObject(int) UnicastRemoteObject(port)} + * constructors, the object is exported with a server socket created using the + * {@link RMISocketFactory} + * class. + * + * @implNote + *

By default, server sockets created by the {@link RMISocketFactory} class + * listen on all network interfaces. See the + * {@link RMISocketFactory} class and the section + * RMI Socket Factories + * in the + * Java RMI Specification. + * * @author Ann Wollrath * @author Peter Jones * @since JDK1.1 From b65847a20663e72b88bb81c3e8da858b30858b9b Mon Sep 17 00:00:00 2001 From: Dmitry Samersoff Date: Tue, 6 Aug 2013 14:04:49 +0400 Subject: [PATCH 2/3] 8011038: sourceObj validation during desereliazation of RelationNotification should be relaxed SourceObj could be set to null by setSource() relax a validation of deserialized object. Reviewed-by: sjiang, skoivu, dfuchs --- .../relation/RelationNotification.java | 24 ++++++++++++++----- 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/jdk/src/share/classes/javax/management/relation/RelationNotification.java b/jdk/src/share/classes/javax/management/relation/RelationNotification.java index a05aa719b1b..7edbc895ac2 100644 --- a/jdk/src/share/classes/javax/management/relation/RelationNotification.java +++ b/jdk/src/share/classes/javax/management/relation/RelationNotification.java @@ -260,7 +260,7 @@ public class RelationNotification extends Notification { super(notifType, sourceObj, sequence, timeStamp, message); - if (!isValidBasic(notifType,sourceObj,id,typeName) || !isValidCreate(notifType)) { + if (!isValidBasicStrict(notifType,sourceObj,id,typeName) || !isValidCreate(notifType)) { throw new IllegalArgumentException("Invalid parameter."); } @@ -310,7 +310,7 @@ public class RelationNotification extends Notification { super(notifType, sourceObj, sequence, timeStamp, message); - if (!isValidBasic(notifType,sourceObj,id,typeName) || !isValidUpdate(notifType,name,newValue,oldValue)) { + if (!isValidBasicStrict(notifType,sourceObj,id,typeName) || !isValidUpdate(notifType,name,newValue,oldValue)) { throw new IllegalArgumentException("Invalid parameter."); } @@ -457,14 +457,26 @@ public class RelationNotification extends Notification { // - no role old value (for role update) // - no role new value (for role update) + // Despite the fact, that validation in constructor of RelationNotification prohibit + // creation of the class instance with null sourceObj its possible to set it to null later + // by public setSource() method. + // So we should relax validation rules to preserve serialization behavior compatibility. + + private boolean isValidBasicStrict(String notifType, Object sourceObj, String id, String typeName){ + if (sourceObj == null) { + return false; + } + return isValidBasic(notifType,sourceObj,id,typeName); + } + private boolean isValidBasic(String notifType, Object sourceObj, String id, String typeName){ - if (notifType == null || sourceObj == null || - id == null || typeName == null) { + if (notifType == null || id == null || typeName == null) { return false; } - if (!(sourceObj instanceof RelationService) && - !(sourceObj instanceof ObjectName)) { + if (sourceObj != null && ( + !(sourceObj instanceof RelationService) && + !(sourceObj instanceof ObjectName))) { return false; } From 04449cd1a910973c5e5d8656fe4bc29a0d9fdf29 Mon Sep 17 00:00:00 2001 From: Chris Hegarty Date: Tue, 6 Aug 2013 15:35:20 +0100 Subject: [PATCH 3/3] 8022344: Additional debug info for test/java/net/NetworkInterface/IndexTest.java Reviewed-by: michaelm, alanb --- .../java/net/NetworkInterface/IndexTest.java | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/jdk/test/java/net/NetworkInterface/IndexTest.java b/jdk/test/java/net/NetworkInterface/IndexTest.java index f52c56ac788..4d5a0150be9 100644 --- a/jdk/test/java/net/NetworkInterface/IndexTest.java +++ b/jdk/test/java/net/NetworkInterface/IndexTest.java @@ -27,7 +27,10 @@ */ import java.net.*; +import java.util.Arrays; +import java.util.Collections; import java.util.Enumeration; +import static java.lang.System.out; public class IndexTest { public static void main(String[] args) throws Exception { @@ -39,12 +42,17 @@ public class IndexTest { if (index >= 0) { NetworkInterface nif2 = NetworkInterface.getByIndex(index); if (! nif.equals(nif2)) { + out.printf("%nExpected interfaces to be the same, but got:%n"); + displayInterfaceInformation(nif); + displayInterfaceInformation(nif2); throw new RuntimeException("both interfaces should be equal"); } } } try { nif = NetworkInterface.getByIndex(-1); + out.printf("%ngetByIndex(-1) should have thrown, but instead returned:%n"); + displayInterfaceInformation(nif); throw new RuntimeException("Should have thrown IllegalArgumentException"); } catch (IllegalArgumentException e) { // OK @@ -52,7 +60,29 @@ public class IndexTest { // In all likelyhood, this interface should not exist. nif = NetworkInterface.getByIndex(Integer.MAX_VALUE - 1); if (nif != null) { + out.printf("%ngetByIndex(MAX_VALUE - 1), expected null, got:%n"); + displayInterfaceInformation(nif); throw new RuntimeException("getByIndex() should have returned null"); } } + + static void displayInterfaceInformation(NetworkInterface netint) throws SocketException { + out.printf("Display name: %s%n", netint.getDisplayName()); + out.printf("Name: %s%n", netint.getName()); + Enumeration inetAddresses = netint.getInetAddresses(); + + for (InetAddress inetAddress : Collections.list(inetAddresses)) + out.printf("InetAddress: %s%n", inetAddress); + + out.printf("Up? %s%n", netint.isUp()); + out.printf("Loopback? %s%n", netint.isLoopback()); + out.printf("PointToPoint? %s%n", netint.isPointToPoint()); + out.printf("Supports multicast? %s%n", netint.supportsMulticast()); + out.printf("Virtual? %s%n", netint.isVirtual()); + out.printf("Hardware address: %s%n", + Arrays.toString(netint.getHardwareAddress())); + out.printf("MTU: %s%n", netint.getMTU()); + out.printf("Index: %s%n", netint.getIndex()); + out.printf("%n"); + } }