fix possible DoS condition when using the experimental NIO/AJP connector

git-svn-id: https://svn.apache.org/repos/asf/tomcat/tc6.0.x/trunk@588479 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/java/org/apache/jk/common/ChannelNioSocket.java b/java/org/apache/jk/common/ChannelNioSocket.java
index 98da709..30050e9 100644 (file)
--- a/java/org/apache/jk/common/ChannelNioSocket.java
+++ b/java/org/apache/jk/common/ChannelNioSocket.java
@@ -36,6 +36,7 @@ import java.net.InetSocketAddress;
 import java.net.ServerSocket;
 import java.net.Socket;
 import java.net.SocketException;
+import java.net.SocketTimeoutException;
 
 import javax.management.ListenerNotFoundException;
 import javax.management.MBeanNotificationInfo;
@@ -46,6 +47,7 @@ import javax.management.NotificationFilter;
 import javax.management.NotificationListener;
 import javax.management.ObjectName;
 
+import org.apache.commons.modeler.Registry;
 import org.apache.jk.core.JkHandler;
 import org.apache.jk.core.Msg;
 import org.apache.jk.core.MsgContext;
@@ -54,7 +56,6 @@ import org.apache.jk.core.WorkerEnv;
 import org.apache.coyote.Request;
 import org.apache.coyote.RequestGroupInfo;
 import org.apache.coyote.RequestInfo;
-import org.apache.tomcat.util.modeler.Registry;
 import org.apache.tomcat.util.threads.ThreadPool;
 import org.apache.tomcat.util.threads.ThreadPoolRunnable;
 
@@ -85,8 +86,8 @@ import org.apache.tomcat.util.threads.ThreadPoolRunnable;
  */
 public class ChannelNioSocket extends JkHandler
     implements NotificationBroadcaster, JkChannel {
-    private static org.apache.juli.logging.Log log =
-        org.apache.juli.logging.LogFactory.getLog( ChannelNioSocket.class );
+    private static org.apache.commons.logging.Log log =
+        org.apache.commons.logging.LogFactory.getLog( ChannelNioSocket.class );
 
     private int startPort=8009;
     private int maxPort=8019; // 0 for backward compat.
@@ -172,7 +173,6 @@ public class ChannelNioSocket extends JkHandler
         return packetSize;
     }
 
-
     /**
      * jmx:managed-attribute description="Bind on a specified address" access="READ_WRITE"
      */
@@ -883,6 +883,8 @@ public class ChannelNioSocket extends JkHandler
 
         synchronized void  process(SelectionKey sk) {
             if(!sk.isValid()) {
+                SocketInputStream sis = (SocketInputStream)ep.getNote(isNote);
+                sis.closeIt();
                 return;
             }
             if(sk.isReadable()) {
@@ -960,15 +962,11 @@ public class ChannelNioSocket extends JkHandler
                         Iterator it = sels.iterator();
                         while(it.hasNext()) {
                             SelectionKey sk = (SelectionKey)it.next();
-                            if(sk.isValid()) {
-                                if(sk.isAcceptable()) {
-                                    acceptConnections();
-                                } else {
-                                    SocketConnection sc = (SocketConnection)sk.attachment();
-                                    sc.process(sk);
-                                }
+                            if(sk.isAcceptable()) {
+                                acceptConnections();
                             } else {
-                                sk.cancel();
+                                SocketConnection sc = (SocketConnection)sk.attachment();
+                                sc.process(sk);
                             }
                             it.remove();
                         }
@@ -1082,8 +1080,7 @@ public class ChannelNioSocket extends JkHandler
                     nr = -1; // Can't handle this yet
                 }
                 if(nr < 0) {
-                    isClosed = true;
-                    notify();
+                    closeIt();
                     return false;
                 } else if(nr == 0) {
                     if(!nioIsBroken) {
@@ -1094,6 +1091,12 @@ public class ChannelNioSocket extends JkHandler
             return true;
         }
 
+        synchronized void closeIt() {
+            isClosed = true;
+            if(blocking)
+                notify();
+        }
+
         public int read(byte [] data) throws IOException {
             return read(data, 0, data.length);
         }
@@ -1133,7 +1136,9 @@ public class ChannelNioSocket extends JkHandler
                 if(fill(len) < 0) {
                     isClosed = true;
                 } 
-            }
+            } else if(!isClosed) {
+               throw new SocketTimeoutException("Read request timed out");
+           }
         }
     }