feat: 引入最大报文长度配置，防御恶意报文

Author: xiaoyumuxi

rpc-core/src/main/java/com/xiaoyu/rpc/core/config/RpcConfig.java

@@ -34,6 +34,8 @@ public class RpcConfig {
     private String loadBalancer = "roundrobin";
     // 传输层类型
     private String transport = "netty";
+    // 最大报文长度
+    private Integer maxMessageSize = 8 * 1024 * 1024;
 
     private RpcConfig() {
         loadConfig();
@@ -74,10 +76,11 @@ private void loadConfig() {
                     this.proxyType = (String) rpcConfig.getOrDefault("proxy", "jdk");
                     this.loadBalancer = (String) rpcConfig.getOrDefault("load-balancer", "roundrobin");
                     this.transport = (String) rpcConfig.getOrDefault("transport", "netty");
+                    this.maxMessageSize = (Integer) rpcConfig.getOrDefault("max-message-size", 8 * 1024 * 1024);
 
-                    log.info("配置加载成功: 序列化方式={}, 服务器={}:{},使用的协议={}, 注册中心={}, 代理方式={}, 负载均衡={}, 传输层={}",
+                    log.info("配置加载成功: 序列化方式={}, 服务器={}:{},使用的协议={}, 注册中心={}, 代理方式={}, 负载均衡={}, 传输层={}, 最大报文={}",
                             serializerType, serverHost, serverPort, protocol, registryAddress, proxyType, loadBalancer,
-                            transport);
+                            transport, maxMessageSize);
                 } else {
                     log.warn("配置文件格式错误，使用默认配置");
                     setDefaultConfig();
@@ -126,6 +129,7 @@ private void setDefaultConfig() {
         this.serverHost = "127.0.0.1";
         this.protocol = "netty";
         this.transport = "netty";
+        this.maxMessageSize = 8 * 1024 * 1024;
     }
 
     /**
@@ -173,6 +177,10 @@ public String getTransport() {
         return transport;
     }
 
+    public Integer getMaxMessageSize() {
+        return maxMessageSize;
+    }
+
     @Override
     public String toString() {
         return "RpcConfig{" +
@@ -185,6 +193,7 @@ public String toString() {
                 ", proxyType='" + proxyType + '\'' +
                 ", loadBalancer='" + loadBalancer + '\'' +
                 ", transport='" + transport + '\'' +
+                ", maxMessageSize=" + maxMessageSize +
                 '}';
     }
 }

rpc-core/src/main/resources/rpc-config.yaml

@@ -7,3 +7,4 @@ rpc:
   serializer: "protobuf"
   proxy: "bytebuddy"
   load-balancer: "roundrobin"
+  max-message-size: 8388608 # 8MB

rpc-transport-netty/src/main/java/com/xiaoyu/rpc/core/protocol/netty/MyRpcDecoder.java

@@ -43,6 +43,12 @@ protected void decode(ChannelHandlerContext ctx, ByteBuf in, List<Object> out) {
 
         // 4. 读取 Body 长度
         int length = in.readInt();
+        int maxFrameSize = com.xiaoyu.rpc.core.config.RpcConfig.getInstance().getMaxMessageSize();
+        if (length > maxFrameSize || length < 0) {
+            log.error("拒绝过大的报文或非法长度: {} bytes, 远程地址: {}", length, ctx.channel().remoteAddress());
+            ctx.close(); // 直接断开物理连接，防止持续攻击
+            throw new RuntimeException("拒绝过大的报文: " + length);
+        }
 
         // 5. 读取 Body 数据
         byte[] body = new byte[length];