feat: 通信协议解码时进行数据校验

(cherry picked from commit 187e800)

Author: meethigher

src/main/java/top/meethigher/proxy/tcp/tunnel/codec/TunnelMessageParser.java

@@ -2,6 +2,9 @@
 
 import io.vertx.core.Handler;
 import io.vertx.core.buffer.Buffer;
+import io.vertx.core.net.NetSocket;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * 自定义消息结构解析器
@@ -12,8 +15,14 @@
  */
 public class TunnelMessageParser implements Handler<Buffer> {
 
+    private static final Logger log = LoggerFactory.getLogger(TunnelMessageParser.class);
     private Buffer buf = Buffer.buffer();
 
+    /**
+     * 最大长度，单位字节。防止对方构造超长字段，占用内存。
+     */
+    private final int maxLength = 1024 * 1024;
+
     /**
      * 预设长度起始位置
      */
@@ -40,8 +49,12 @@ public class TunnelMessageParser implements Handler<Buffer> {
 
     private final Handler<Buffer> outputHandler;
 
-    public TunnelMessageParser(Handler<Buffer> outputHandler) {
+    private final NetSocket netSocket;
+
+    public TunnelMessageParser(Handler<Buffer> outputHandler,
+                               NetSocket netSocket) {
         this.outputHandler = outputHandler;
+        this.netSocket = netSocket;
     }
 
     @Override
@@ -51,6 +64,25 @@ public void handle(Buffer buffer) {
             return;
         } else {
             int totalLength = buf.getInt(lengthFieldOffset);
+            // 校验最大长度
+            if (totalLength > maxLength) {
+                log.warn("too many bytes in length field, connection {} will be closed", netSocket.remoteAddress());
+                netSocket.close();
+                return;
+            }
+            // 校验类型编码是否在预设范围内
+            if (totalLength >= (lengthFieldLength + typeFieldLength)) {
+                short code = buf.getShort(lengthFieldLength);
+                try {
+                    TunnelMessageType.fromCode(code);
+                } catch (Exception e) {
+                    log.error("invalid type, connection {} will be closed", netSocket.remoteAddress(), e);
+                    netSocket.close();
+                    return;
+                }
+            }
+
+            // 校验是否达到预设总长度
             if (buf.length() < totalLength) {
                 return;
             } else {