ource ConstrainableFiddlerLease lease { Fiddler server3 }//end lease }//end eventReg }//end FiddlerRegistration
Thus, in order to verify that an instance of this class is trusted, trust must be verified in the following objects from the diagram above:
- server1
- registrationID
- eventReg
When a client obtains an instance of this proxy class, the deserialization process which delivers the proxy to the client invokes the
readObject method of this class, as well as the
readObject method for each subsidiary object, as the mechanism "walks" through the serialization graph. For each object that must be verified, part of that trust verification process is performed in the various
readObject methods, and the remaining part is performed when the client prepares the proxy. This class' participation in the trust verification process can be summarized as follows:
- server1
- readObject
- verify server1 != null
- verify registrationID != null
- verify eventReg != null
- verify eventReg is an instance of EventRegistration, but NOT a subclass of EventRegistration (if it's a subclass, then it's possible that the subclass contains methods that override the methods of EventRegistration with untrusted, un-constrained implementations)
- verify eventReg.source != null
- verify eventReg.source is an instance of FiddlerProxy
- verify server2 != null (this is done in the readObject() of FiddlerProxy)
- verify eventReg.lease is an instance of FiddlerLease
- verify server3 != null (this is done in the readObject() of FiddlerLease)
- verify server1 implements RemoteMethodControl
- verify server1's method constraints are the same as those placed on the corresponding public Remote methods of its outer proxy class
- verify eventReg.source is an instance of ConstrainableFiddlerProxy
- verify lease is instance of ConstrainableFiddlerLease
- proxy preparation
- Security.verifyObjectTrust() which calls
- ProxyVerifier.isTrustedObject(this) which calls
- ProxyVerifier.isTrustedObject(source) which calls canonicalServerObject.checkTrustEquivalence(server2)
- ProxyVerifier.isTrustedObject(lease) which calls canonicalServerObject.checkTrustEquivalence(server3)
- canonicalServerObject.checkTrustEquivalence(server1) (whose implementation is supplied by the particular RMI implementation that was used to export the server)
@since 2.0