xmlserializer and sockets

[Ultrakorne]

hi, i have some problems with my client talk to my server...
i am using xmlserializer to serialize object and send them to the other
side of the connection. I need to send / recive by both client and
server. client after login waits all the time listening for objects on a
thread, and sends objects on users events on the main thread. server
waits connections, start a new thread for each connection and after
validating login waits for object, and answer with an object to every
incoming object.

If i send only one packet, all works fine, i tryed many solution but i
cannot send 2 packets, or send and recive...

here is my code:

LoginPacket is a class with informations

SERVER SIDE:
the method run of this class is launched as a thread to serve a client,
with a socket initializated (and passed as parameter)
now for testing it will only waits for 2 login packets

public class ServeClient {
private Socket sock;
public ServeClient(Soc ket s) {
this.sock = s;
}
public void Run(){
NetworkStream networkStream = new NetworkStream(s ock);

//waiting for login request
LoginPacket lp;
this.Deserializ eMessage( networkStream, out lp);

LoginPacket lp2;
this.Deserializ eMessage( networkStream, out lp2);
Console.WriteLi ne("Incoming login request: {0}", lp.Nick);

networkStream.C lose();
sock.Close();
}
// this will deserialize the message, and put it in message
public bool DeserializeMess age(NetworkStre am networkStream,o ut
LoginPacket message) {
Byte []buffer=new Byte[500];
XmlSerializer deserializer=ne w XmlSerializer(t ypeof(LoginPack et));
int count=networkSt ream.Read(buffe r,0,buffer.Leng th);
if(count <= 0) {
message=null;
return false;
}
MemoryStream memoryStream=ne w MemoryStream(bu ffer,0,count);
message= ((LoginPacket)d eserializer.Des erialize(memory Stream));
return true;
}
}

CLIENT SIDE:
// run is launched as a thread, this thread will wait listening after
// login succed. now for testing it will only send 2 login requests
class ListenerThread {
private TcpClient client; //FIXME : it is no syncronized
public void Run() {
client = new TcpClient( "localhost" , 6666);;
LoginPacket login = new LoginPacket( PacketType.LOGI N_REQUEST,
"nick", "pass");

LoginPacket login2 = new LoginPacket( PacketType.LOGI N_REQUEST,
"nick2", "pass2");
this.Send(login );
this.Send(login 2);

client.Close();

}
//send a loginpacket
public void Send(LoginPacke t message) {
NetworkStream netWorkStream=n ull;
XmlSerializer serializer=new XmlSerializer(m essage.GetType( ));
//Fixme: metterlo fuori dal metodo
netWorkStream = client.GetStrea m();
Stream stream=(Stream) netWorkStream;
serializer.Seri alize(stream,me ssage);
}
}

thx if someone can solve my problems.

[Sami Vaaraniemi]

What is the error message you get?

Anyway, there are some invalid assumptions in your code. See below:

"Ultrakorne " <ul********@fre eweb.org> wrote in message
news:1S******** **************@ news4.tin.it...

hi, i have some problems with my client talk to my server...
i am using xmlserializer to serialize object and send them to the other
side of the connection. I need to send / recive by both client and server.
client after login waits all the time listening for objects on a thread,
and sends objects on users events on the main thread. server waits
connections, start a new thread for each connection and after validating
login waits for object, and answer with an object to every incoming
object.

If i send only one packet, all works fine, i tryed many solution but i
cannot send 2 packets, or send and recive...

here is my code:

LoginPacket is a class with informations

SERVER SIDE:
the method run of this class is launched as a thread to serve a client,
with a socket initializated (and passed as parameter)
now for testing it will only waits for 2 login packets

public class ServeClient {
private Socket sock;
public ServeClient(Soc ket s) {
this.sock = s;
}
public void Run(){
NetworkStream networkStream = new NetworkStream(s ock);

//waiting for login request
LoginPacket lp;
this.Deserializ eMessage( networkStream, out lp);

LoginPacket lp2;
this.Deserializ eMessage( networkStream, out lp2);
Console.WriteLi ne("Incoming login request: {0}", lp.Nick);

networkStream.C lose();
sock.Close();
}
// this will deserialize the message, and put it in message
public bool DeserializeMess age(NetworkStre am networkStream,o ut
LoginPacket message) {
Byte []buffer=new Byte[500];
XmlSerializer deserializer=ne w XmlSerializer(t ypeof(LoginPack et));
int count=networkSt ream.Read(buffe r,0,buffer.Leng th);
if(count <= 0) {
message=null;
return false;
}

You assume that 'buffer' now contains the serialized data for one
LoginPacket, but this is not necessarily the case. It could contain data for
half of a LoginPacket, one and a half, two LoginPackets, or anything in
between. The basic issue here is that TCP is a stream-oriented protocol and
the stuff you send arrives to its destination as an unstructured stream of
bytes.

One way to solve the problem would be to first send the size of the
serialized LoginPacket (number of bytes) and then the LoginPacket itself.
The receiver would first read the size and then the expected number of bytes
into the buffer. The receiver should deserialize the LoginPacket only after
the expected number of bytes have arrived and are in the buffer.

Another way that might work (don't have the time to try it now) would be to
have the XmlSerializer deserialize straight from the NetworkStream.

Regards,
Sami

[William Stacey [MVP]]

> Another way that might work (don't have the time to try it now) would be
to

have the XmlSerializer deserialize straight from the NetworkStream.

I was thinking that too. However it probably exposes server to DoS attacks.
If you know the len before hand, you can decide if want to read that many
bytes or not. So the safe way is to send the len (i.e. uint) before hand
and read that many bytes, then deserialize that byte[]. Maybe something
like:

// Object
XmlRequest xr = new XmlRequest();
xr.Data = "Hello";

// Serialize it.
MemoryStream ms = new MemoryStream();
ms.Position = 4; // leave 4 bytes for our len.
XmlSerializer ser = new XmlSerializer(t ypeof(XmlReques t));
ser.Serialize(m s, xr);
int size = (int)ms.Length - 4;
byte[] lenBytes = BitConverter.Ge tBytes(size);
ms.Position = 0;
ms.Write(lenByt es, 0, 4);

// Write ms bytes to socket.

// Deserialize it.
ms.Position = 0; // pretent we blocking on first byte.
ms.Read(lenByte s, 0, 4); // pretent we read four bytes.
int len = BitConverter.To Int32(lenBytes, 0);
byte[] bytes = new byte[len];
ms.Read(bytes, 0, len); // read len count data bytes only.
string xmlString = Encoding.UTF8.G etString(bytes, 0, bytes.Length); //
Used by Stream overload on xmlserializer.
Console.WriteLi ne("Raw:"+xmlSt ring);
XmlSerializer ser2 = new XmlSerializer(t ypeof(XmlReques t));
using (StringReader sr = new StringReader(xm lString))
{
xr = (XmlRequest)ser .Deserialize(sr );
Console.WriteLi ne("Data:"+xr.D ata);
}

--
William Stacey, MVP
http://mvp.support.microsoft.com

[ultrakorne]

Sami Vaaraniemi wrote:

What is the error message you get?

Anyway, there are some invalid assumptions in your code. See below:

i have changed the recive method and make it simpler:

public LoginPacket DeserializeMess age() {
NetworkStream networkStream = new NetworkStream(s ock);
LoginPacket message = null;
try {
message = ((LoginPacket)d eserializer.Des erialize(networ kStream));
} catch(Exception e) { Console.WriteLi ne("EXC 3"); return null; }
finally {
networkStream.C lose();
}
return message;
}

deserializer is XmlSerializer = new XmlSerializer(t ypeof(LoginPack et));

the problem is the same: exception is raised by .Deserialize:
System.Xml.XmlE xception: XML declaration cannot appear in this state.
Line 5, position 20.

William Stancey wrote:
I was thinking that too. However it probably exposes server to DoS
attacks.
If you know the len before hand, you can decide if want to read that
many
bytes or not. So the safe way is to send the len (i.e. uint) before
hand
and read that many bytes, then deserialize that byte[]. Maybe
something like:

thanks for your hit, but first i have to solve and understand whats
wrong with my code

[Sami Vaaraniemi]

I did a bit of digging and here's what I found out.

It seems that XmlSerializer.D eserialize blocks until it gets end-of-file or
its internal buffer of 4k is full. If the sender closes the socket after the
LoginPacket is sent, then it works and the deserialized object is returned
properly. But this is hardly a solution as you want to send more than just
the one LoginPacket. On the other hand, if there is more data coming from
the socket after the last closing tag, then XML parsing fails and there is
an exception.

Bottom line, it appears you cannot call XmlSerializer.D eserialize with a
NetworkStream, or at least I could not figure out how to make it work. Even
if it were possible, you probably don't want to do it this way as the server
would be vulnerable to a DoS attack just like William pointed out.

So the solution is to first send the length of the serialized object, and
then the serialized object itself. The receiver should copy the bytes from
the socket into a temporary buffer, then deserialize out of the buffer.

Alternatively, you could use the BinaryFormatter instead of XmlSerializer as
it does not suffer from the blocking problem.

Regards,
Sami

"ultrakorne " <ul********@par anoici.org> wrote in message
news:41******** ******@paranoic i.org...

Sami Vaaraniemi wrote:

What is the error message you get?

Anyway, there are some invalid assumptions in your code. See below:

i have changed the recive method and make it simpler:

public LoginPacket DeserializeMess age() {
NetworkStream networkStream = new NetworkStream(s ock);
LoginPacket message = null;
try {
message = ((LoginPacket)d eserializer.Des erialize(networ kStream));
} catch(Exception e) { Console.WriteLi ne("EXC 3"); return null; }
finally {
networkStream.C lose();
}
return message;
}

deserializer is XmlSerializer = new XmlSerializer(t ypeof(LoginPack et));

the problem is the same: exception is raised by .Deserialize:
System.Xml.XmlE xception: XML declaration cannot appear in this state. Line
5, position 20.

William Stancey wrote:
I was thinking that too. However it probably exposes server to DoS
attacks.
If you know the len before hand, you can decide if want to read that
many
bytes or not. So the safe way is to send the len (i.e. uint) before
hand
and read that many bytes, then deserialize that byte[]. Maybe
something like:

thanks for your hit, but first i have to solve and understand whats wrong
with my code