RMI SocketPermission exception from Applet - works from Netbeans

[Tannis Bo]

I have created an RMI server and an applet that accesses the server.

When I run the applet from Netbeans, everything works great and I get the response back from the server. I have also created a non-applet client and that seems to work as well.
Even though the code was developed using Netbeans, I didn't use any of the GUI tools.

If I run it from my browser (either FireFox or IE), the applet loads, but when I push the button that calls the RMI method I get the following exception:

java.security.AccessControlException: access denied (java.net.SocketPermission 127.0.0.1:1099 connect,resolve)

I have found lots of topics and tips on this, but can't really seem to get anything to work.

This is the first RMI server / applet combination I have written, so bear with me if it's an obvious problem.

Server Code:

 package tme4;

import java.math.BigInteger;
import java.rmi.Remote;
import java.rmi.RemoteException;

/**
 *
 * @author tbo
 */
public interface PrimeGen extends Remote {
    public BigInteger getLargestPrime(BigInteger min, BigInteger max) throws RemoteException;

}   

 package tme4;

import java.rmi.*;
import java.rmi.server.UnicastRemoteObject;
import java.math.BigInteger;

/**
 *
 * @author tbo
 */
public class PrimeGenImp extends UnicastRemoteObject implements PrimeGen{

    public PrimeGenImp() throws RemoteException{
        super();
    }

    public BigInteger getLargestPrime(BigInteger min, BigInteger max) throws RemoteException{
        BigInteger largestPrime = BigInteger.ZERO;
        System.out.println("Calculating the largest prime in the range " + min.toString() + " to " + max.toString());
        return largestPrime;
    }



}
   

 package tme4;

import java.net.MalformedURLException;
import java.rmi.Naming;
import java.rmi.RemoteException;

/**
 *
 * @author tbo
 */
public class PrimeGenServer {

    public static void main(String... args){
        try{
      
            PrimeGenImp pgi = new PrimeGenImp();
            Naming.rebind("primegen", pgi);
            System.out.println("Prime Generator Server ready.");
        }
        catch (RemoteException rmex){
            System.out.println("PrimeGenServer " + rmex.getMessage());
        }
        catch (MalformedURLException muex){
            System.out.println("MalformedURL " + muex.getMessage());
        }
    }

}   

Applet:

 package tme4;

import java.applet.Applet;
import java.awt.BorderLayout;
import java.awt.Button;
import java.awt.GridLayout;
import java.awt.Label;
import java.awt.Panel;
import java.awt.TextArea;
import java.awt.TextField;
import java.awt.event.ActionEvent;
import java.awt.event.ActionListener;
import java.io.PrintWriter;
import java.io.StringWriter;
import java.math.BigInteger;
import java.rmi.Naming;

/**
 *
 * @author tbo
 */
public class PrimeGeneratorApplet extends Applet {

    private TextArea resultArea = new TextArea("",20, 72, TextArea.SCROLLBARS_BOTH);
    private TextField inputMinRange = new TextField(24);
    private TextField inputMaxRange = new TextField(24);

    private Button calculate = new Button ("Calculate Prime");
    private String server;
    /**
     * Initialization method that will be called after the applet is loaded
     * into the browser.
     */
    public void init() {
        this.setLayout(new BorderLayout());

        Panel north = new Panel();
        north.setLayout(new GridLayout(0, 1));
        north.add(new Label("Type a non-negative integer for the bottom end of range:"));
        north.add(inputMinRange);
        north.add(new Label("Type a non-negative integer for the top end of range:") );
        north.add(inputMaxRange);
        north.add(calculate);
        this.add(resultArea, BorderLayout.CENTER);
        this.add(north, BorderLayout.NORTH);
        PGCalculator pg = new PGCalculator();
        inputMinRange.addActionListener(pg);
        inputMaxRange.addActionListener(pg);
        calculate.addActionListener(pg);
        resultArea.setEditable(false);

        server = "rmi://" + this.getCodeBase().getHost() + "/primegen";
       // server = "rmi://192.168.0.100:1099/primegen";
    }

    class PGCalculator implements ActionListener {
        public void actionPerformed(ActionEvent evt){
            try {
                String minInput = inputMinRange.getText();
                String maxInput = inputMaxRange.getText();
                if (minInput != null && maxInput != null){
                    BigInteger minBI = new BigInteger(minInput);
                    BigInteger maxBI = new BigInteger(maxInput);
                    PrimeGen pg = (PrimeGen) Naming.lookup(server);
                    BigInteger primeResult = pg.getLargestPrime(minBI, maxBI);
                    resultArea.setText(primeResult.toString());
                }

            }
            catch (Exception ex){
               StringWriter sw = new StringWriter();
            PrintWriter pw = new PrintWriter(sw);
              ex.printStackTrace(pw);
             System.out.println("Exeption is :"  + ex.toString());
                resultArea.setText("Exception is: " + ex.toString() + " " + ex.getMessage() + "/r/nStacktrace: " + sw.toString());


            }
        }   

HTML

<html>
<head>
<title>Prime Number Generator </title>
</head>
<body>
<h1>Prime Number Generator</h1>
<p>
<applet align="center" code="tme4.PrimeGeneratorApplet" width ="300" height="400">
</applet>
<hr />
</p>
</body>
</html>
    

I have verified that the server is running using the netstat command.
I am running Java version 1.6.0_13.
Also, I'm just trying to get this to work, that's why the getLargestPrime method is really rather useless....

Any help on this would be greatly appreciated!

[K. Tsang]

You got a SocketPermission exception. And what does this tell you? What port are you using on the client and server? These ports should match. 1099 for server then 1099 for client.

Not sure if this may relate to security since applets have their own sandbox restrictions. And RMI security manager may or may not help. Did you use one?

Before you change any code, try it with the appletviewer.

[Tannis Bo]

I'm thinking SocketPermission exception indicates that the socket the client is attempting to connect to and the socket the server is listening on are different. I started the rmiregistry explicitly like 'start rmiregistry 1099' just to make sure it is using the expected port. After I started the RMI Server, I ran netstat and found this line 'TCP 192.168.0.100:1099 myPC:49695 ESTABLISHED'. The IP address here corresponds to my PCs IP address.

Using the appletviewer, I'm getting the same Exception as I'm getting from the browsers. Here is the Stacktrace:

java.security.AccessControlException: access denied (java.net.SocketPermission 127.0.0.1:1099 connect,resolve)
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323)
at java.security.AccessController.checkPermission(AccessController.java:546)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
at java.lang.SecurityManager.checkConnect(SecurityManager.java:1034)
at java.net.Socket.connect(Socket.java:513)
at java.net.Socket.connect(Socket.java:469)
at java.net.Socket.<init>(Socket.java:366)
at java.net.Socket.<init>(Socket.java:180)
at sun.rmi.transport.proxy.RMIDirectSocketFactory.createSocket(RMIDirectSocketFactory.java:22)
at sun.rmi.transport.proxy.RMIMasterSocketFactory.createSocket(RMIMasterSocketFactory.java:128)
at sun.rmi.transport.tcp.TCPEndpoint.newSocket(TCPEndpoint.java:595)
at sun.rmi.transport.tcp.TCPChannel.createConnection(TCPChannel.java:198)
at sun.rmi.transport.tcp.TCPChannel.newConnection(TCPChannel.java:184)
at sun.rmi.server.UnicastRef.newCall(UnicastRef.java:322)
at sun.rmi.registry.RegistryImpl_Stub.lookup(Unknown Source)
at java.rmi.Naming.lookup(Naming.java:84)
at tme4.PrimeGeneratorApplet$PGCalculator.actionPerformed(PrimeGeneratorApplet.java:74)
at java.awt.Button.processActionEvent(Button.java:392)
at java.awt.Button.processEvent(Button.java:360)
at java.awt.Component.dispatchEventImpl(Component.java:4583)
at java.awt.Component.dispatchEvent(Component.java:4413)
at java.awt.EventQueue.dispatchEvent(EventQueue.java:599)
at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:269)
at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:184)
at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:174)
at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:169)
at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:161)
at java.awt.EventDispatchThread.run(EventDispatchThread.java:122)

Am I correct in my understanding that the RMI Server will use the same port as the RMI Registry?

As far as using a security manager, I didn't have much luck, however it could have been that I didn't fully understand how to use it. Also, I thought that the security manager was for applications and not for applets?

I was just reading some documentation that talked about hosting both the applet, server and html on a webserver. Do I need to be doing this? (Very new to all of this!) I realize if I want the world to see it, it needs to be hosted, but I just need it to work locally.

[K. Tsang]

Are you running this on Windows or Unix? On windows if your IP address is say 192.168.0.100 then the server log should say "192.168.0.100:1099" but I it said "127.0.0.1:1099". Only unix can produce 127.0.0.1 without changing the networking hosts file.

Also how are you binding your remote object? I'm not sure if applet binds with RMI different from application or not because your applet code does not have some sort of lookup code for the RMI remote object that applications do.

For your server main method, try adding the createRegistry line and specifying the rmi protocol:

PrimeGen primeGen = new PrimeGenImpl();
String hostIP = InetAddress.getLocalHost().getHostAddress(); // get 192.168.x.x
String serverStr = "rmi://" + hostIP + ":" + 1099 + " primegen";
Registry reg = LocateRegistry.createRegistry(1099); // add this line
Naming.rebind(serverStr, primeGen);

[Tannis Bo]

I have made the code changes you suggested and am now getting the following Exception when I attempt to run the client:

tme4.PrimeGenServer PrimeGenServer Port already in use: 1099; nested exception is java.net.BindException: Address is already in use: JVM_Bind

I am assuming I am getting this because the RMI Registry is using port 1099. I checked before I ran the 'start rmiregistry' command and nothing was running on port 1099.

I am running on Windows [Vista 32-bit].

I guess the part of this that perplexes me is what is Netbeans doing that allows the Applet to run from the IDE with no issues?

Unfortunately I have no other option but to run this as an Applet as that is the requirement...

[K. Tsang]

Then you need to change the client code

String server = "rmi://" + address + ":" + 1099 + " primegen"; // address is the IP
Registry registry = LocateRegistry.getRegistry(address, 1099);
// PrimeGen is your remote service interface not the impl class
PrimeGen remoteService = (PrimeGen) registry.lookup(server); 

Try that and see it dislike that. You may get another error.

[Tannis Bo]

Thanks.
I made the change to the Applet code and now I'm getting the same error but it is referencing the 127.0.0.1:1099 IP, even though I hard coded my regular IP in the java.

[Tannis Bo]

So..... I finally got this working with the original code I had.

The problem the entire time was the java.policy file in the jre/lib/security folder. I had done a search for a 'java.policy' file on my PC when I was trying to diagnose the issue, but apparently the default search in Vista doesn't look at non-indexed files, even if you say to look at all files.

I replaced the default with a 'grant all permissions' file and voila everything is working! Now, I just need to figure out how to do this in a more appropriate fashion as I really don't want to be giving all permissions to all java files...

Thanks K. Tsang for all the pointers and assistance - I learned quite a bit during the whole process!

[K. Tsang]

Nice to hear that you got it working. Well you are running applet and applets are bound by that sandbox security issue. I guess you can play around with the policy file and set it to the most secured way (ie allowing least privilege).