Security.loadPolicyFile(...) not wo

[SkyFire2008]

So, I need to establish a connection with a server, and to do that, I need to load a policy file, that's exactly, what the client does:

Security.allowDomain("*");
Security.allowInsecureDomain(hostName);

Security.loadPolicyFile("xmlsocket://"+hostName+":"+port);

var sock: XMLSocket=new XMLSocket(hostName, port);
sock.addEventListener(Event.CONNECT, onConnect);

where hostName is localhost and port is 5000. On localhost:5000 a server is listening, ready to provide a policy file. However, the server never receives a request, and I have no idea how to fix this.

[SkyFire2008]

I seem to have fixed it temporarily by changing the sandbox from local-with-file to local-with-networking via compiler flags. But still, even in local-with-file it should be able to use Security.loadPolicyFile() to request a policy file, right?

[Diki]

How is your server being run? And how did you confirm the request is not being received by the server?

[egg82]

I absolutely hate Flash's policy everything. It's the only language that bothers with things like that.

There's no onComplete method or anything for policy requesting, so you simply have to put in a three-second timer and hope it all worked.

Other than that, it's pretty straightforward. Make sure your policy response resembles something like this (or this) and everything should be fine.

I've written a hail-mary approach here. Not going to say that's the best method, but it works.

Please be aware I made my policy files VERY loose in security, so yeah.
To be fair, though, policy files and such are terrible security anyway so meh.

[SkyFire2008]

At 3/12/16 06:16 PM, Diki wrote: How is your server being run? And how did you confirm the request is not being received by the server?

Server has two threads: one reads commands from the console and the other accepts client's connection and prints out its messages. Here's the code for the second thread, it's haxe(and yes, I realize that there's a lot of room for improvements):

var parent: Thread=Thread.readMessage(true); //get reference to parent thread

var servSock: Socket=new Socket();
servSock.bind(host, portNum);
parent.sendMessage(servSock); //send socket back to parent

servSock.listen(1);
while(true){ //serve
	try{
		var polSock: Socket=servSock.accept(); //accept connection for policy request
		stderr.writeString("Sending policy...\n");
		polSock.write(Resource.getString("policy")+String.fromCharCode(0));
		stderr.writeString("Waiting for client...\n");

		var cliSock: Socket=servSock.accept(); //accept new connection
		stdout.writeString("Connection received from "+cliSock.peer().host.toString()+": "+cliSock.peer().port+"\n");
		while(true){ //print client messages
			try{
				stderr.writeString(cliSock.input.readLine()+"\n");
			}catch(e: Dynamic){ //exception occurs when client is closed
				stderr.writeString(""+e);
				stderr.writeString("Client socket closed\n");
				break;
			}
		}

	}catch(e: Dynamic){ //exception occurs when socket was closed by parent thread
		stderr.writeString("Server socket closed by parent\n");
		break;
	}
}

parent.sendMessage("OK!");

I confirm that it doesn't request the policy because the server doesn't output "Sending policy...", which should happen after it accepts the connection requesting the policy. And with local-with-network everything works.

[SkyFire2008]

At 3/13/16 01:48 AM, egg82 wrote: Other than that, it's pretty straightforward. Make sure your policy response resembles something like this (or this) and everything should be fine.

I've written a hail-mary approach here. Not going to say that's the best method, but it works.

Thanks, but my problem is that it doesn't request the policy file at all.

[Diki]

At 3/13/16 03:19 AM, SkyFire2008 wrote: Server has two threads: one reads commands from the console and the other accepts client's connection and prints out its messages. Here's the code for the second thread, it's haxe(and yes, I realize that there's a lot of room for improvements):

[...]

I confirm that it doesn't request the policy because the server doesn't output "Sending policy...", which should happen after it accepts the connection requesting the policy. And with local-with-network everything works.

I tested your server by code by compiling it and connecting to it via Python:

import socket

client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
client.connect(("localhost",5000))
print client.recv(10240)

and that showed the expected "Sending policy..." on the server and the Python client printed out the expected payload, so the issue is with your client.

I'm not familiar with Haxe, but I did some reading here, and according to that you need the local-with-networking to access network resources, which would explain why your client only works with that enabled, as you're attempting to access the policy resource over the network.

This Haxe example seems to have socket connections working without needing to use Flash's retarded XML policy crap, so it might be worth taking a look at.

[SkyFire2008]

At 3/13/16 12:27 PM, Diki wrote: I'm not familiar with Haxe, but I did some reading here, and according to that you need the local-with-networking to access network resources, which would explain why your client only works with that enabled, as you're attempting to access the policy resource over the network.

Yeah, I guessed so. Fortunately, I only need the server for debugging. But thanks for the help anyway!