java安全机制其实有点不安全

看下面的这段代码，摘自《Java Examples in a Nutsbell》（java实例技术手册）：

就是一个简单的通用的多线程服务器

这个例子可以通过配置参数：

java je3.net.Server -control www 3333 je3.net.Server$HTTPMirror 5555

来启动，然后再ie中输入： http://localhost:5555就可以看到效果。

写一个policy文件放在同根目录下：叫server.policy

grant{
permission java.net.SocketPermission "*:1024-4444","connect,accept";
permission java.io.FilePermission "E://workspace//j2ee1.3//-", "read";
};

下面加上jvm虚拟机参数

java -Djava.security.manager -Djava.security.policy=server.policy

je3.net.Server -control www 3333 je3.net.Server$HTTPMirror 5555再次启动。

按道理，本不应该启动。因为端口5555并没有得到连接许可。但是很可惜输入 http://localhost:5555还是可以看到结果。因为在java的sdk中暗含了java.policy文件。那就把它改为-Djava.security.policy==server.policy应该就可以了。结果跑不了了。原因就在policy文件中的permission java.net.SocketPermission "*:1024-4444","connect,accept";其实，我一直不太清楚listen ，accept，connect的区别在什么地方。但是这里的例子说明你只用permission java.net.SocketPermission "*:1024-4444","listen";就可以了。端口该闭的就闭了。如果用accept和connect反而没有什么用。不知道java的安全性高在什么地方。因为java.policy文件中从1024以上的端口全都使用了listen。所以以后要配置端口时一定要注意。

/**//*
*Copyright(c)2004DavidFlanagan.Allrightsreserved.
*ThiscodeisfromthebookJavaExamplesinaNutshell,3ndEdition.
*ItisprovidedAS-IS,WITHOUTANYWARRANTYeitherexpressedorimplied.
*Youmaystudy,use,andmodifyitforanynon-commercialpurpose,
*includingteachinganduseinopen-sourceprojects.
*Youmaydistributeitnon-commerciallyaslongasyouretainthisnotice.
*Foracommercialuselicense,ortopurchasethebook,
*pleasevisithttp://www.davidflanagan.com/javaexamples3.
*/
packageje3.net;
importjava.io.*;
importjava.net.*;
importjava.util.*;
importjava.util.logging.*;

/***//**
*Thisclassisagenericframeworkforaflexible,multi-threadedserver.
*Itlistensonanynumberofspecifiedports,and,whenitreceivesa
*connectiononaport,passesinputandoutputstreamstoaspecifiedService
*objectwhichprovidestheactualservice.Itcanlimitthenumberof
*concurrentconnections,andlogsactivitytoaspecifiedstream.
**/
publicclassServer...{
/***//**
*Amain()methodforrunningtheserverasastandaloneprogram.The
*command-lineargumentstotheprogramshouldbepairsofservicenames
*andportnumbers.Foreachpair,theprogramwilldynamicallyloadthe
*namedServiceclass,instantiateit,andtelltheservertoprovide
*thatServiceonthespecifiedport.Thespecial-controlargument
*shouldbefollowedbyapasswordandport,andwillstartspecial
*servercontrolservicerunningonthespecifiedport,protectedbythe
*specifiedpassword.
**/
publicstaticvoidmain(String[]args)...{
try...{
if(args.length<2)//Checknumberofarguments
thrownewIllegalArgumentException("Mustspecifyaservice");

//Createaserverobjectthathasalimitof10concurrent
//connections,andlogstoaLoggerattheLevel.INFOlevel
//PriortoJava1.4wedidthis:newServer(System.out,10);
Servers=newServer(Logger.getLogger(Server.class.getName()),
Level.INFO,10);

//Parsetheargumentlist
inti=0;
while(i<args.length)...{
if(args[i].equals("-control"))...{//Handlethe-controlarg
i++;
Stringpassword=args[i++];
intport=Integer.parseInt(args[i++]);
//addcontrolservice
s.addService(newControl(s,password),port);
}
else...{
//Otherwisestartanamedserviceonthespecifiedport.
//DynamicallyloadandinstantiateaServiceclass
StringserviceName=args[i++];
ClassserviceClass=Class.forName(serviceName);
Serviceservice=(Service)serviceClass.newInstance();
intport=Integer.parseInt(args[i++]);
s.addService(service,port);
}
}
}
catch(Exceptione)...{//Displayamessageifanythinggoeswrong
System.err.println("Server:"+e);
System.err.println("Usage:javaServer"+
"[-control<password><port>]"+
"[<servicename><port>...]");
System.exit(1);
}
}

//Thisisthestatefortheserver
Mapservices;//HashtablemappingportstoListeners
Setconnections;//Thesetofcurrentconnections
intmaxConnections;//Theconcurrentconnectionlimit
ThreadGroupthreadGroup;//Thethreadgroupforallourthreads

//Thisclasswasoriginallywrittentosendloggingoutputtoastream.
//Ithasbeenretrofittedtoalsosupportthejava.util.loggingAPIof
//Java1.4.Youcanuseeither,neither,orboth.
PrintWriterlogStream;//Wherewesendourloggingoutputto
Loggerlogger;//AJava1.4loggingdestination
LevellogLevel;//theleveltologmessagesat

/***//**
*ThisistheServer()constructor.Itmustbepassedastream
*tosendlogoutputto(maybenull),andthelimitonthenumberof
*concurrentconnections.
**/
publicServer(OutputStreamlogStream,intmaxConnections)...{
this(maxConnections);
setLogStream(logStream);
log("Startingserver");
}

/***//**
*ThisconstructoraddedtosupportloggingwiththeJava1.4Loggerclass
**/
publicServer(Loggerlogger,LevellogLevel,intmaxConnections)...{
this(maxConnections);
setLogger(logger,logLevel);
log("Startingserver");
}

/***//**
*Thisconstructorsupportsnologging
**/
publicServer(intmaxConnections)...{
threadGroup=newThreadGroup(Server.class.getName());
this.maxConnections=maxConnections;
services=newHashMap();
connections=newHashSet(maxConnections);
}

/***//**
*Apublicmethodtosetthecurrentloggingstream.Passnull
*toturnloggingoff.
**/
publicsynchronizedvoidsetLogStream(OutputStreamout)...{
if(out!=null)logStream=newPrintWriter(out);
elselogStream=null;
}

/***//**
*SetthecurrentLoggerandlogginglevel.Passnulltoturnloggingoff.
**/
publicsynchronizedvoidsetLogger(Loggerlogger,Levellevel)...{
this.logger=logger;
this.logLevel=level;
}

/***//**Writethespecifiedstringtothelog*/
protectedsynchronizedvoidlog(Strings)...{
if(logger!=null)logger.log(logLevel,s);
if(logStream!=null)...{
logStream.println("["+newDate()+"]"+s);
logStream.flush();
}
}
/***//**Writethespecifiedobjecttothelog*/
protectedvoidlog(Objecto)...{log(o.toString());}

/***//**
*Thismethodmakestheserverstartprovidinganewservice.
*ItrunsthespecifiedServiceobjectonthespecifiedport.
**/
publicsynchronizedvoidaddService(Serviceservice,intport)
throwsIOException
...{
Integerkey=newInteger(port);//thehashtablekey
//Checkwhetheraserviceisalreadyonthatport
if(services.get(key)!=null)
thrownewIllegalArgumentException("Port"+port+
"alreadyinuse.");
//CreateaListenerobjecttolistenforconnectionsontheport
Listenerlistener=newListener(threadGroup,port,service);
//Storeitinthehashtable
services.put(key,listener);
//Logit
log("Startingservice"+service.getClass().getName()+
"onport"+port);
//Startthelistenerrunning.
listener.start();
}

/***//**
*Thismethodmakestheserverstopprovidingaserviceonaport.
*Itdoesnotterminateanypendingconnectionstothatservice,merely
*causestheservertostopacceptingnewconnections
**/
publicsynchronizedvoidremoveService(intport)...{
Integerkey=newInteger(port);//hashtablekey
//LookuptheListenerobjectfortheportinthehashtable
finalListenerlistener=(Listener)services.get(key);
if(listener==null)return;
//Askthelistenertostop
listener.pleaseStop();
//Removeitfromthehashtable
services.remove(key);
//Andlogit.
log("Stoppingservice"+listener.service.getClass().getName()+
"onport"+port);
}

/***//**
*ThisnestedThreadsubclassisa"listener".Itlistensfor
*connectionsonaspecifiedport(usingaServerSocket)andwhenitgets
*aconnectionrequest,itcallstheserversaddConnection()methodto
*accept(orreject)theconnection.ThereisoneListenerforeach
*ServicebeingprovidedbytheServer.
**/
publicclassListenerextendsThread...{
ServerSocketlisten_socket;//Thesockettolistenforconnections
intport;//Theportwe'relisteningon
Serviceservice;//Theservicetoprovideonthatport
volatilebooleanstop=false;//Whetherwe'vebeenaskedtostop

/***//**
*TheListenerconstructorcreatesathreadforitselfinthe
*threadgroup.ItcreatesaServerSockettolistenforconnections
*onthespecifiedport.ItarrangesfortheServerSockettobe
*interruptible,sothatservicescanberemovedfromtheserver.
**/
publicListener(ThreadGroupgroup,intport,Serviceservice)
throwsIOException
...{
super(group,"Listener:"+port);
listen_socket=newServerSocket(port);
//giveitanon-zerotimeoutsoaccept()canbeinterrupted
listen_socket.setSoTimeout(5000);
this.port=port;
this.service=service;
}

/***//**
*ThisisthepolitewaytogetaListenertostopaccepting
*connections
***/
publicvoidpleaseStop()...{
this.stop=true;//Setthestopflag
this.interrupt();//Stopblockinginaccept()
try...{listen_socket.close();}//Stoplistening.
catch(IOExceptione)...{}
}

/***//**
*AListenerisaThread,andthisisitsbody.
*Waitforconnectionrequests,acceptthem,andpassthesocketon
*totheaddConnectionmethodoftheserver.
**/
publicvoidrun()...{
while(!stop)...{//loopuntilwe'reaskedtostop.
try...{
Socketclient=listen_socket.accept();
addConnection(client,service);
}
catch(InterruptedIOExceptione)...{}
catch(IOExceptione)...{log(e);}
}
}
}

/***//**
*ThisisthemethodthatListenerobjectscallwhentheyaccepta
*connectionfromaclient.IteithercreatesaConnectionobject
*fortheconnectionandaddsittothelistofcurrentconnections,
*or,ifthelimitonconnectionshasbeenreached,itclosesthe
*connection.
**/
protectedsynchronizedvoidaddConnection(Sockets,Serviceservice)...{
//Iftheconnectionlimithasbeenreached
if(connections.size()>=maxConnections)...{
try...{
//Thentelltheclientitisbeingrejected.
PrintWriterout=newPrintWriter(s.getOutputStream());
out.print("Connectionrefused;"+
"theserverisbusy;pleasetryagainlater. ");
out.flush();
//Andclosetheconnectiontotherejectedclient.
s.close();
//Andlogit,ofcourse
log("Connectionrefusedto"+
s.getInetAddress().getHostAddress()+
":"+s.getPort()+":maxconnectionsreached.");
}catch(IOExceptione)...{log(e);}
}
else...{//Otherwise,ifthelimithasnotbeenreached
//CreateaConnectionthreadtohandlethisconnection
Connectionc=newConnection(s,service);
//Addittothelistofcurrentconnections
connections.add(c);
//Logthisnewconnection
log("Connectedto"+s.getInetAddress().getHostAddress()+
":"+s.getPort()+"onport"+s.getLocalPort()+
"forservice"+service.getClass().getName());
//AndstarttheConnectionthreadtoprovidetheservice
c.start();
}
}

/***//**
*AConnectionthreadcallsthismethodjustbeforeitexits.Itremoves
*thespecifiedConnectionfromthesetofconnections.
**/
protectedsynchronizedvoidendConnection(Connectionc)...{
connections.remove(c);
log("Connectionto"+c.client.getInetAddress().getHostAddress()+
":"+c.client.getPort()+"closed.");
}

/***//**Changethecurrentconnectionlimit*/
publicsynchronizedvoidsetMaxConnections(intmax)...{
maxConnections=max;
}

/***//**
*Thismethoddisplaysstatusinformationabouttheserveronthe
*specifiedstream.Itcanbeusedfordebugging,andisusedbythe
*Controlservicelaterinthisexample.
**/
publicsynchronizedvoiddisplayStatus(PrintWriterout)...{
//DisplayalistofallServicesthatarebeingprovided
Iteratorkeys=services.keySet().iterator();
while(keys.hasNext())...{
Integerport=(Integer)keys.next();
Listenerlistener=(Listener)services.get(port);
out.print("SERVICE"+listener.service.getClass().getName()
+"ONPORT"+port+" ");
}

//Displaythecurrentconnectionlimit
out.print("MAXCONNECTIONS:"+maxConnections+" ");

//Displayalistofallcurrentconnections
Iteratorconns=connections.iterator();
while(conns.hasNext())...{
Connectionc=(Connection)conns.next();
out.print("CONNECTEDTO"+
c.client.getInetAddress().getHostAddress()+
":"+c.client.getPort()+"ONPORT"+
c.client.getLocalPort()+"FORSERVICE"+
c.service.getClass().getName()+" ");
}
}

/***//**
*ThisclassisasubclassofThreadthathandlesanindividual
*connectionbetweenaclientandaServiceprovidedbythisserver.
*Becauseeachsuchconnectionhasathreadofitsown,eachServicecan
*havemultipleconnectionspendingatonce.Despitealltheother
*threadsinuse,thisisthekeyfeaturethatmakesthisa
*multi-threadedserverimplementation.
**/
publicclassConnectionextendsThread...{
Socketclient;//Thesockettotalktotheclientthrough
Serviceservice;//Theservicebeingprovidedtothatclient

/***//**
*Thisconstructorjustsavessomestateandcallsthesuperclass
*constructortocreateathreadtohandletheconnection.Connection
*objectsarecreatedbyListenerthreads.Thesethreadsarepartof
*theserver'sThreadGroup,soallConnectionthreadsarepartofthat
*group,too.
**/
publicConnection(Socketclient,Serviceservice)...{
super("Server.Connection:"+
client.getInetAddress().getHostAddress()+
":"+client.getPort());
this.client=client;
this.service=service;
}

/***//**
*ThisisthebodyofeachandeveryConnectionthread.
*Allitdoesispasstheclientinputandoutputstreamstothe
*serve()methodofthespecifiedServiceobject.Thatmethodis
*responsibleforreadingfromandwritingtothosestreamsto
*providetheactualservice.RecallthattheServiceobjecthas
*beenpassedfromtheServer.addService()methodtoaListener
*objecttotheaddConnection()methodtothisConnectionobject,and
*isnowfinallybeingusedtoprovidetheservice.Notethatjust
*beforethisthreadexitsitalwayscallstheendConnection()method
*toremoveitselffromthesetofconnections
**/
publicvoidrun()...{
try...{
InputStreamin=client.getInputStream();
OutputStreamout=client.getOutputStream();
service.serve(in,out);
}
catch(IOExceptione)...{log(e);}
finally...{endConnection(this);}
}
}

/***//**
*HereistheServiceinterfacethatwehaveseensomuchof.Itdefines
*onlyasinglemethodwhichisinvokedtoprovidetheservice.serve()
*willbepassedaninputstreamandanoutputstreamtotheclient.It
*shoulddowhateveritwantswiththem,andshouldclosethembefore
*returning.
*
*Allconnectionsthroughthesameporttothisserviceshareasingle
*Serviceobject.Thus,anystatelocaltoanindividualconnectionmust
*bestoredinlocalvariableswithintheserve()method.Statethat
*shouldbeglobaltoallconnectionsonthesameportshouldbestored
*ininstancevariablesoftheServiceclass.IfthesameServiceis
*runningonmorethanoneport,therewilltypicallybedifferent
*Serviceinstancesforeachport.Datathatshouldbeglobaltoall
*connectionsonanyportshouldbestoredinstaticvariables.
*
*Notethatimplementationsofthisinterfacemusthaveano-argument
*constructoriftheyaretobedynamicallyinstantiatedbythemain()
*methodoftheServerclass.
**/
publicinterfaceService...{
publicvoidserve(InputStreamin,OutputStreamout)throwsIOException;
}

/***//**
*Averysimpleservice.Itdisplaysthecurrenttimeontheserver
*totheclient,andclosestheconnection.
**/
publicstaticclassTimeimplementsService...{
publicvoidserve(InputStreami,OutputStreamo)throwsIOException...{
PrintWriterout=newPrintWriter(o);
out.print(newDate()+" ");
out.close();
i.close();
}
}

/***//**
*Thisisanotherexampleservice.Itreadslinesofinputfromthe
*client,andsendsthemback,reversed.Italsodisplaysawelcome
*messageandinstructions,andclosestheconnectionwhentheuser
*entersa'.'onalinebyitself.
**/
publicstaticclassReverseimplementsService...{
publicvoidserve(InputStreami,OutputStreamo)throwsIOException...{
BufferedReaderin=newBufferedReader(newInputStreamReader(i));
PrintWriterout=
newPrintWriter(newBufferedWriter(newOutputStreamWriter(o)));
out.print("Welcometothelinereversalserver. ");
out.print("Enterlines.Endwitha'.'onalinebyitself. ");
for(;;)...{
out.print(">");
out.flush();
Stringline=in.readLine();
if((line==null)||line.equals("."))break;
for(intj=line.length()-1;j>=0;j--)
out.print(line.charAt(j));
out.print(" ");
}
out.close();
in.close();
}
}

/***//**
*ThisserviceisanHTTPmirror,justliketheHttpMirrorclass
*implementedearlierinthischapter.Itechosbacktheclient's
*HTTPrequest
**/
publicstaticclassHTTPMirrorimplementsService...{
publicvoidserve(InputStreami,OutputStreamo)throwsIOException...{
BufferedReaderin=newBufferedReader(newInputStreamReader(i));
PrintWriterout=newPrintWriter(o);
out.print("HTTP/1.0200 ");
out.print("Content-Type:text/plain ");
Stringline;
while((line=in.readLine())!=null)...{
if(line.length()==0)break;
out.print(line+" ");
}
out.close();
in.close();
}
}

/***//**
*Thisservicedemonstrateshowtomaintainstateacrossconnectionsby
*savingitininstancevariablesandusingsynchronizedaccesstothose
*variables.Itmaintainsacountofhowmanyclientshaveconnectedand
*tellseachclientwhatnumberitis
**/
publicstaticclassUniqueIDimplementsService...{
publicintid=0;
publicsynchronizedintnextId()...{returnid++;}
publicvoidserve(InputStreami,OutputStreamo)throwsIOException...{
PrintWriterout=newPrintWriter(o);
out.print("Youareclient#:"+nextId()+" ");
out.close();
i.close();
}
}

/***//**
*Thisisanon-trivialservice.Itimplementsacommand-basedprotocol
*thatgivespassword-protectedruntimecontrolovertheoperationofthe
*server.Seethemain()methodoftheServerclasstoseehowthis
*serviceisstarted.
*
*Therecognizedcommandsare:
*password:givepassword;authorizationisrequiredformostcommands
*add:dynamicallyaddanamedserviceonaspecifiedport
*remove:dynamicallyremovetheservicerunningonaspecifiedport
*max:changethecurrentmaximumconnectionlimit.
*status:displaycurrentservices,connections,andconnectionlimit
*help:displayahelpmessage
*quit:disconnect
*
*Thisservicedisplaysaprompt,andsendsallofitsoutputtotheuser
*incapitalletters.Onlyoneclientisallowedtoconnecttothis
*serviceatatime.
**/
publicstaticclassControlimplementsService...{
Serverserver;//Theserverwecontrol
Stringpassword;//Thepasswordwerequire
booleanconnected=false;//Whetheraclientisalreadyconnected

/***//**
*CreateanewControlservice.ItwillcontrolthespecifiedServer
*object,andwillrequirethespecifiedpasswordforauthorization
*NotethatthisServicedoesnothaveanoargumentconstructor,
*whichmeansthatitcannotbedynamicallyinstantiatedandaddedas
*theother,genericservicesabovecanbe.
**/
publicControl(Serverserver,Stringpassword)...{
this.server=server;
this.password=password;
}

/***//**
*Thisistheservemethodthatprovidestheservice.Itreadsa
*linetheclient,andusesjava.util.StringTokenizertoparseit
*intocommandsandarguments.Itdoesvariousthingsdependingon
*thecommand.
**/
publicvoidserve(InputStreami,OutputStreamo)throwsIOException...{
//Setupthestreams
BufferedReaderin=newBufferedReader(newInputStreamReader(i));
PrintWriterout=newPrintWriter(o);
Stringline;//Forreadingclientinputlines
//Hastheuserhasgiventhepasswordyet?
booleanauthorized=false;

//Ifthereisalreadyaclientconnectedtothisservice,display
//amessagetothisclientandclosetheconnection.Weusea
//synchronizedblocktopreventaracecondition.
synchronized(this)...{
if(connected)...{
out.print("ONLYONECONTROLCONNECTIONALLOWED. ");
out.close();
return;
}
elseconnected=true;
}

//Thisisthemainloop:readacommand,parseit,andhandleit
for(;;)...{//infiniteloop
out.print(">");//Displayaprompt
out.flush();//Makeitappearrightaway
line=in.readLine();//Gettheuser'sinput
if(line==null)break;//QuitifwegetEOF.
try...{
//UseaStringTokenizertoparsetheuser'scommand
StringTokenizert=newStringTokenizer(line);
if(!t.hasMoreTokens())continue;//ifinputwasempty
//Getfirstwordoftheinputandconverttolowercase
Stringcommand=t.nextToken().toLowerCase();
//Nowcomparetoeachofthepossiblecommands,doingthe
//appropriatethingforeachcommand
if(command.equals("password"))...{//Passwordcommand
Stringp=t.nextToken();//Getthenextword
if(p.equals(this.password))...{//Isitthepassword?
out.print("OK ");//Sayso
authorized=true;//Grantauthorization
}
elseout.print("INVALIDPASSWORD ");
}
elseif(command.equals("add"))...{//AddServicecommand
//Checkwhetherpasswordhasbeengiven
if(!authorized)out.print("PASSWORDREQUIRED ");
else...{
//Getthenameoftheserviceandtryto
//dynamicallyloadandinstantiateit.
//Exceptionswillbehandledbelow
StringserviceName=t.nextToken();
ClassserviceClass=Class.forName(serviceName);
Serviceservice;
try...{
service=(Service)serviceClass.newInstance();
}
catch(NoSuchMethodErrore)...{
thrownewIllegalArgumentException(
"Servicemusthavea"+
"no-argumentconstructor");
}
intport=Integer.parseInt(t.nextToken());
//Ifnoexceptionsoccurred,addtheservice
server.addService(service,port);
out.print("SERVICEADDED ");//acknowledge
}
}
elseif(command.equals("remove"))...{//Removeservice
if(!authorized)out.print("PASSWORDREQUIRED ");
else...{
intport=Integer.parseInt(t.nextToken());
server.removeService(port);//removetheservice
out.print("SERVICEREMOVED ");//acknowledge
}
}
elseif(command.equals("max"))...{//Setconnectionlimit
if(!authorized)out.print("PASSWORDREQUIRED ");
else...{
intmax=Integer.parseInt(t.nextToken());
server.setMaxConnections(max);
out.print("MAXCONNECTIONSCHANGED ");
}
}
elseif(command.equals("status"))...{//StatusDisplay
if(!authorized)out.print("PASSWORDREQUIRED ");
elseserver.displayStatus(out);
}
elseif(command.equals("help"))...{//Helpcommand
//Displaycommandsyntax.Passwordnotrequired
out.print("COMMANDS: "+
" password<password> "+
" add<service><port> "+
" remove<port> "+
" max<max-connections> "+
" status "+
" help "+
" quit ");
}
elseif(command.equals("quit"))break;//Quitcommand.
elseout.print("UNRECOGNIZEDCOMMAND ");//Error
}
catch(Exceptione)...{
//Ifanexceptionoccurredduringthecommand,printan
//errormessage,thenoutputdetailsoftheexception.
out.print("ERRORWHILEPARSINGOREXECUTINGCOMMAND: "+
e+" ");
}
}
//Finally,whentheloopcommandloopends,closethestreams
//andsetourconnectedflagtofalsesothatotherclientscan
//nowconnect.
connected=false;
out.close();
in.close();
}
}
}