0

ignite configuration：

IgniteConfiguration igniteCfg = new IgniteConfiguration();
    return igniteCfg.setDiscoverySpi(buildTcpDiscoverySpi())
        .setCommunicationSpi(buildTcpCommunicationSpi())
        .setDataStorageConfiguration(buildDataStorageConfiguration())
        .setClientConnectorConfiguration(null)
        .setConnectorConfiguration(null)
        .setNetworkTimeout(getTimeOut())
        .setGridLogger(new IgniteLoggerImp())
        .setSslContextFactory(new IgniteSslFactory())
        .setLocalHost(igniteManager.getLocalHost())

protocol：

TLSv1.3

However, the following nio code can be used locally to connect to port 23055.

public void initClient(String ip, int port) throws IOException {
    SocketChannel channel = SocketChannel.open();
    channel.configureBlocking(false);
    this.selector = Selector.open();
    channel.connect(new InetSocketAddress(ip, port));
    channel.register(selector, SelectionKey.OP_CONNECT);
}

Why Can a Socket Without a Certificate Connect to the Port to Which Ignite Needs Authentication?

DoS attacks on ignite ports。

[2021-12-01 14:12:59,056][WARN ][0][0][grid-nio-worker-tcp-comm-4-#43%TcpCommunicationSpi%][ROOT][IgniteLoggerImp][88] Caught unhandled exception in NIO worker thread (restart the node). java.lang.OutOfMemoryError: Direct buffer memory
at java.nio.Bits.reserveMemory(Bits.java:695)
at java.nio.DirectByteBuffer.<init>(DirectByteBuffer.java:123)
at java.nio.ByteBuffer.allocateDirect(ByteBuffer.java:311)
at org.apache.ignite.internal.util.nio.GridNioServer$AbstractNioClientWorker.register(GridNioServer.java:2672)
at org.apache.ignite.internal.util.nio.GridNioServer$AbstractNioClientWorker.bodyInternal(GridNioServer.java:2089)
at org.apache.ignite.internal.util.nio.GridNioServer$AbstractNioClientWorker.body(GridNioServer.java:1910)
at org.apache.ignite.internal.util.worker.GridWorker.run(GridWorker.java:120)
at java.lang.Thread.run(Thread.java:748)
biandeqiang
  • 51
  • 3
  • The first step of authenticating is connecting. If the client does not then authenticate properly, the server will likely just hang up. – Chris Dodd Dec 02 '21 at 07:51
  • The initClient does not have identity authentication. He can send requests to the bodyInternal() of AbstractNioClientWorker，and org.apache.ignite.internal.util.nio.GridNioServer.AbstractNioClientWorker#registerorg.method applies for the direct buffer. If there are too many requests, OutOfMemoryError: Direct buffer memory。The bodyInternal() method of the AbstractNioClientWorker does not limit the maximum number of connections. The method is similar to the maxConnections of the Tomcat and does not verify the identity of the initClient. – biandeqiang Dec 02 '21 at 08:56
  • DoS attacks on ignite ports – biandeqiang Dec 02 '21 at 09:02
  • Looks like the server is not designed/written to be DoS resistent. Dealing with authentication DoS attacks is a tricky problem in general; if it is failing in buffer allocation, it is not even getting that far. – Chris Dodd Dec 02 '21 at 18:17
  • Is this a problem? – biandeqiang Dec 03 '21 at 03:02
  • I can write a program that keeps creating connections, and ignite overflows. for i in range(10000): self.s.append(socket.socket(socket.AF_INET, socket.SOCK_STREAM)) self.s[i].connect((ip, port)) – biandeqiang Dec 03 '21 at 03:04

0 Answers0