Java RMI. Algorithmen und Programmierung V Netzprogrammierung. Volker Roth. Wintersemester 2009/2010. Institut für Informatik Freie Universität Berlin

Transcription

1 Java RMI Algorithmen und Programmierung V Netzprogrammierung Volker Roth Institut für Informatik Freie Universität Berlin Wintersemester 2009/2010

2 Overview 1. Factory design pattern 2. Codebases 3. Remote code loading 4. Security policies

3 Factory Design Pattern

4 Dynamic Code Loading The Java VM interprets bytecode or compiles it on the fly can load and run code dynamically Bytecode loading is encapsulated in a ClassLoader Developers can write custom ClassLoaders Can load bytecode from anywhere Specifically from the network URLClassLoader (out of the box) loads from a Uniform Resource Locator (URL) file://, ftp://,

5 Java Applets Java became famous for its browser Applets ScottMcNealy (Sun Microsystems): The network is the computer Example of an Applet embedded in a Web page: <applet height=100 width=100 codebase="myclasses/" code="my.class"> <param name="ticker"> </applet> How does it work and what is the codebase?

6 Codebases Codebase Put simply, a pointer to where the VM can find classes By default CLASSPATH is local codebase Other codebases must be supported by a ClassLoader ClassLoaders form a hierarchy Asks parent ClassLoader for class first, if not found then Loads the class itself Same class loaded by two ClassLoaders different types!

7 Codebases for Applets Could be file:// or ftp:// but is most common 1. Initialize ClassLoader for Applet 2. ClassLoader first looks into CLASSPATH 3. If class not found then load from URL 4. Same for other classes the Applet needs

8 Codebases for Java RMI

9 Codebases for Java RMI Java RMI object registration Server that exported an object is started with -Djava.rmi.server.codebase= URL Java RMI object lookup Client requests object from registry Client receives serialized stub Serialized stub is annotated with codebase URL Client loads bytecode from codebase Instantiates stub

10 Codebases for Java RMI Invoking the stub invokes the remote object

11 Reminder: RMI Parameter Passing In remote method invocations: If formal parameter is of type Remote: Pass a stub Else, if formal parameter is of type Serializable: Pass a serialized object Else, throw a MarshalException

12 Codebases for Java RMI The client may pass to the remote object: 1. Primitive data types (easy) 2. Types that are found in the remote CLASSPATH (easy) 3. Types unknown to the remote object (... ) Implementation of known interface Subclass of known type How can the latter case be handled?

13 Codebases for Java RMI Client specifies codebase as well, server loads bytecode

14 Summary of RMI Operations

15 Intermediate Conclusions 1. Codebases and remote class loading is very flexible! 2. It is also very insecure when done wrong! 3. Well, often it is also very insecure when done right... SecurityManager must be set or else RMI refuses to work! More on this later Assume you deserialize a class and invoke a method on it. At what time is the first code of the class run?

16 Loopholes and Callbacks Callback into the class during deserialization private void readobject(java.io.objectinputstream in) throws IOException, ClassNotFoundException Initializers called during class initialization: Class variable initializers Static initializers Simple DoS attack on thread creation: synchronized(thread.class) { while (true); }

17 Loopholes and Callbacks Refusing to terminate: while (true) { try { while (true); } catch (Throwable t) {} } Attacks on the garbage collector: Implement finalize() Implement close() e.g., in FileInputStream (called by finalize())

18 Example: Compute Engine Write a task and submit it for execution by a remote server

19 Example: Compute Engine Server Interfaces Interface of object that accepts tasks: package compute; import java.rmi.remote; import java.rmi.remoteexception; public interface Compute extends Remote { <T> T executetask(task<t> t) throws RemoteException; } Interface of a task: package compute; public interface Task<T> { T execute(); }

20 Security Setting the security manager programmatically: System.setSecurityManager(new SecurityManager()) Setting the security manager on start: $ java -Djava.security.manager... SecurityManager loads policy files granting permissions /.java.policy $JAVAHOME/jre/lib/security/java.policy $ java -Djava.security.policy= file $ java -Djava.security.policy== file No file no permissions nothing is allowed!

21 Policy File Syntax Granting permissions keystore " grant signedby "alice,bob", codebase " { permission java.io.filepermission "/tmp/*", "read,write"; } grant signedby "sysadmin" { permission java.security.securitypermission "Security.insertProvider.*"; permission java.security.securitypermission "Security.removeProvider.*"; }; grant principal javax.security.auth.x500.x500principal "cn=alice" { permission java.io.filepermission "/home/alice", "read,write"; }; guides/security/policyfiles.html

22 Policy File Syntax Granting permissions Keystore is database of crypto keys and X.509 certificates Certificates are identified by an alias e.g., alice Certificates have principal e.g., cn=alice Permission is granted if all of this is true Code was signed with private keys belonging to public keys of principals with aliases alice and bob Code was loaded from given codebase