Simple denial of service attack for Jeri?

Hi,
    Please let me know if there is a better place to ask for this.
    I want a server using Jeri to be available on the internet, and I
have found a very easy attack that eats the server memory and also it
sockets.

    I made a test with a simple setup for the server.

  Exporter myExporter =   new
BasicJeriExporter(TcpServerEndpoint.getInstance(2024),new
BasicILFactory());
  HelloImpl myServer = new HelloImpl();
  Hello myRemoteRef = (Hello) myExporter.export(myServer);

  And this is what the attacker does on the client side:
    while(true)
	new Socket(serverHost,2024);

  After a few seconds the server starts throwing repeatedly this error
on the standard output:

Jul 31, 2008 12:08:48 PM com.sun.jini.jeri.internal.mux.StreamConnectionIO start
WARNING: could not create thread for request dispatch
java.lang.OutOfMemoryError: unable to create new native thread
	at java.lang.Thread.start0(Native Method)
	at java.lang.Thread.start(Thread.java:597)
	at com.sun.jini.thread.ThreadPool.execute(ThreadPool.java:101)
	at com.sun.jini.jeri.internal.mux.StreamConnectionIO.start(StreamConnectionIO.java:98)
	at com.sun.jini.jeri.internal.mux.Mux.start(Mux.java:196)
	at net.jini.jeri.connection.ServerConnectionManager$InboundMux.create(ServerConnectionManager.java:260)
	at net.jini.jeri.connection.ServerConnectionManager.handleConnection(ServerConnectionManager.java:355)
	at net.jini.jeri.tcp.TcpServerEndpoint$3.run(TcpServerEndpoint.java:812)
	at java.security.AccessController.doPrivileged(Native Method)
	at net.jini.jeri.tcp.TcpServerEndpoint$LH.executeAcceptLoop(TcpServerEndpoint.java:809)
	at net.jini.jeri.tcp.TcpServerEndpoint$LH.access$400(TcpServerEndpoint.java:735)
	at net.jini.jeri.tcp.TcpServerEndpoint$2.run(TcpServerEndpoint.java:767)
	at com.sun.jini.thread.ThreadPool$Worker.run(ThreadPool.java:136)
	at java.lang.Thread.run(Thread.java:619)

The are three things I would like to do about this behavior:
  1- enforce a time out for sending data to the server. Currently
opening the socket to the server and waiting without transmitting
anything keeps the connection opened forever.
  2- limit the amount of connections the server can accept,
  3- limit the amount of threads the server can use to handle
connections, I don't want to have the server run out of memory if
there are too many requests.

After some thought I think I can achieve (1) and (2) fiddling with
socket factories, and I do not know how to do about (3). As this issue
is common to every java server using Jeri on the internet, I wonder if
there may be a more simple approach I'm overlooking.

Thanks,
           Facundo

--------------------------------------------------------------------------
Getting Started:     http://www.jini.org/wiki/Category:Getting_Started
Community Web Site:  http://jini.org
jini-users Archive:  http://archives.java.sun.com/archives/jini-users.html
Unsubscribing:       email "signoff JINI-USERS"  to [email protected]