Re: How to limit the argument size or rmi methods?

Facundo Domínguez wrote:
> Hi,
>     I'm programming a server application using jdk 1.5. It connects
> with its clients using rmi.
>     The rmi methods have parameters of various types, being String and
> byte[] some of them.
> 
>      First, I don't want an attacker to have the oportunity to invoke
> one of these methods with a big parameter,
> say 1 GB, and take the bandwidth and the server memory with it.
>      Second, I want to constraint the size of specific arguments,
> knowing that they are not reasonable if bigger than 1 MB, for
> instance.
> 
>      I've been searching the web, this list, and the java
> documentation, but I could not find any clue of whether or not this is
> possible to do.
>     Any suggestions?

If you use a smart proxy, then that proxy can check the size of arguments before 
making the call to the real proxy object that it carries, or through the 
communications channel that it uses, if not an RMI proxy.

public interface MyService extends Remote {
	public void doSomething( byte[]arr ) throws RemoteException;
}

public class MySmartServiceProxy implements MyService,Serializable {
	private MyService svc;
	public MySmartServiceProxy( MyService service ) {
		svc = service;
	}
	public void doSomething( byte[]arr ) throws RemoteException {
		if( arr.length > 1024*1024 )
			throw new IllegalArgumentException("Payload, "+
				arr.length+" bytes, too large" );
		svc.doSomething( arr );
	}
}

You would export the real service instance, by then always return

	new MySmartServiceProxy( service );

to all users of the service, including the RMIRegistry etc.

If you are doing lots of RMI stuff, you might want to check up on using Jini. 
The Apache River podling project is where Jini lives now.

Gregg Wonderly

===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff RMI-USERS".  For general help, send email to
[email protected] and include in the body of the message "help".

For a list of frequently asked RMI questions please refer to:
http://java.sun.com/j2se/1.3/docs/guide/rmi/faq.html

To view past RMI-USERS postings, please see:
http://archives.java.sun.com/archives/rmi-users.html