Silverlight and Socket Policy

To use socket communication in a Silverlight app, you need to run a policy server on port 943.

[url]

If the policy request fails for any reason, all socket connections will return access denied.

The design is flawed and rediculous about requiring users to open a non-standard port. The policy should be accessible on port 80.

Ignoring that, is there a mechanism to retry to get the policy if the first attempt failed? It's lame if your first attempt fails so your app fails.

In my case I have two projects that I start at the same time. The policy server and the socket client. If for some reason the policy server isn't ready, the socket client fails. I can see other problems like connectivity issues being a problem.

According to [this post], SL4 will not require the policy server.

And SL4 [release notes] have something to say as well.

For Trusted applications *Enhancements to networking allow cross-domain access without a security policy file.

tgraupmann648 said:

According to [this post], SL4 will not require the policy server.

 

And SL4 [release notes] have something to say as well.

For Trusted applications *Enhancements to networking allow cross-domain access without a security policy file.

The Silverlight 4 user runtime hasn't shipped yet. It could be a while. Also SL4 requires VS 2010 which hasn't released either.

So now I'm back to my original question. How do you re-request the access policy?

tgraupmann648 said:

tgraupmann648 said:

*snip*

The Silverlight 4 user runtime hasn't shipped yet. It could be a while. Also SL4 requires VS 2010 which hasn't released either.

 

So now I'm back to my original question. How do you re-request the access policy?

The policy file is somewhat [Cloak and Dagger]. There must be a way to issue a manual policy request until it authentication is properly made?

tgraupmann648 said:

tgraupmann648 said:

*snip*

The policy file is somewhat [Cloak and Dagger]. There must be a way to issue a manual policy request until it authentication is properly made?

With SL4 you can get the [access policy over port 80]. [Pre-release docs].

These methods aren't available in SL3. Still looking....

tgraupmann648 said:

tgraupmann648 said:

*snip*

With SL4 you can get the [access policy over port 80]. [Pre-release docs].

 

These methods aren't available in SL3. Still looking....

SL V4 will be released in 2 weeks.  So in 14 days you can use it for a release app. you can get the RC right now and try it out.

that aside here is the thing, both Flash and Silverlight have security policy issues with an application coming from an unknown developer and allowing that application to access an unknown web site or tcp port.

UNKNOWN from the view point of the user.

if you want your app to run with full access then you will need to have it request that the user trust you as the developer.

Silverlight V4 makes this a much better user exp. you can sign your app so the user can get a dialog that tells them who developed the app and what it wants to have access to, like the local web cam for example.

I know it's a bit of a hassle but really I think they are trying to do the right thing for the right reason.

and look at how fast they have been working on this... and trying to keep it working on the mac and the pc and keep adding stuff we tell them we have to have and still keeping the download small and the runtime safe.

figuerres said:

tgraupmann648 said:

*snip*

SL V4 will be released in 2 weeks.  So in 14 days you can use it for a release app. you can get the RC right now and try it out.

 

that aside here is the thing, both Flash and Silverlight have security policy issues with an application coming from an unknown developer and allowing that application to access an unknown web site or tcp port.

 

UNKNOWN from the view point of the user.

 

if you want your app to run with full access then you will need to have it request that the user trust you as the developer.

Silverlight V4 makes this a much better user exp. you can sign your app so the user can get a dialog that tells them who developed the app and what it wants to have access to, like the local web cam for example.

 

I know it's a bit of a hassle but really I think they are trying to do the right thing for the right reason.

 

and look at how fast they have been working on this... and trying to keep it working on the mac and the pc and keep adding stuff we tell them we have to have and still keeping the download small and the runtime safe.

 

I have a page with two controls.

Control A is running Unity3d which runs the policy server.

Control B is Silverlight that runs a socket client.

When the page loads Silverlight connects to the policy server in the background. If the control hadn't loaded yet, the policy connection fails and all socket connections have access is denied.

It's dumb to just get one chance to authenticate. I need to delay the authentication. Unity tells the page when the policy server is ready. I can notify SL that the policy server is ready. Now I just need a way to retry the Silverlight policy authentication.

Is there a reset or something?

figuerres said:

tgraupmann648 said:

*snip*

SL V4 will be released in 2 weeks.  So in 14 days you can use it for a release app. you can get the RC right now and try it out.

 

that aside here is the thing, both Flash and Silverlight have security policy issues with an application coming from an unknown developer and allowing that application to access an unknown web site or tcp port.

 

UNKNOWN from the view point of the user.

 

if you want your app to run with full access then you will need to have it request that the user trust you as the developer.

Silverlight V4 makes this a much better user exp. you can sign your app so the user can get a dialog that tells them who developed the app and what it wants to have access to, like the local web cam for example.

 

I know it's a bit of a hassle but really I think they are trying to do the right thing for the right reason.

 

and look at how fast they have been working on this... and trying to keep it working on the mac and the pc and keep adding stuff we tell them we have to have and still keeping the download small and the runtime safe.

 

I can't switch to SL4 until Telerik releases the controls built for the user runtime.

Also SL4 requires VS 2010, and I don't want to upgrade the projects until that releases.

But 14 days isn't too long to wait. Unless that's an April fools joke?

tgraupmann648 said:

figuerres said:

*snip*

I can't switch to SL4 until Telerik releases the controls built for the user runtime.

 

Also SL4 requires VS 2010, and I don't want to upgrade the projects until that releases.

 

But 14 days isn't too long to wait. Unless that's an April fools joke?

 

No not a joke at all.....

check around the VS 2010 lauch event is in Vegas mid-month.

about 2 weeks ago at MIX Scott Gu. said that SL 4.0 will ship at the same time as VS 2010.

I do not know details about Unity but you said the page has a control that runs the policy server.... that sounds kind of wrong.

the tcp policy server for SIlverlight should be running on the server regardless of any page loads.

unless you are talking about some other policy server??

SIlverlight looks for:

a silverlight client policy xml file on the root of the web site

and if not found then it looks for

a flash style client policy xml file on the root of the website

these are used for cross domain access to a web service, not needed if the service and the silverlight come from the same domain name.

then there is a tcp socket policy that is just a windows service that listens on a tcp port and serves an xml policy file for tcp connections.

is unity doing something else ?

I do feel that MS should help with how to get a tcp listener on a hosted platform.... if you have access to install a new service thats one ting but if it's a low cost hosted site package .... not so easy to manage.

figuerres said:

tgraupmann648 said:

*snip*

No not a joke at all.....

 

check around the VS 2010 lauch event is in Vegas mid-month.

about 2 weeks ago at MIX Scott Gu. said that SL 4.0 will ship at the same time as VS 2010.

 

I do not know details about Unity but you said the page has a control that runs the policy server.... that sounds kind of wrong.

 

the tcp policy server for SIlverlight should be running on the server regardless of any page loads.

unless you are talking about some other policy server??

 

SIlverlight looks for:

 

a silverlight client policy xml file on the root of the web site

and if not found then it looks for

a flash style client policy xml file on the root of the website

 

these are used for cross domain access to a web service, not needed if the service and the silverlight come from the same domain name.

 

then there is a tcp socket policy that is just a windows service that listens on a tcp port and serves an xml policy file for tcp connections.

 

is unity doing something else ?

 

I do feel that MS should help with how to get a tcp listener on a hosted platform.... if you have access to install a new service thats one ting but if it's a low cost hosted site package .... not so easy to manage.

 

Ah here's how I'm doing it.

On the page, the Unity object runs a policy server on localhost. The Unity object also runs a socket server on localhost. The Silverlight control runs a socket client which talks to the socket server in the Unity object.

Now why would someone want to do this?

Originally, I had the Unity object sending logs across the browser to the Silverlight object to log to the SL isolated storage. That way if the page closed, I could still have the logs saved. Unfortunately the way Unity works using browser communication to log 12M worth of logs is slow.

I tried a faster approach with using a named pipe. Unfortunately Unity doesn't support a named pipes because the version of Mono is too old. A newer version of Unity with Mono will ship summer time. I'll likely prefer a named pipe solution summer time.

I then tried the socket approach. The unity object runs a socket server on the page bound to localhost and I can connect to it with putty to get the logs. So far so good. Silverlight runs the socket client, but all socket connections are denied. I then read up on the policy server, and added a policy server. Policy requests on 943 are now serving the access policy. I was still seeing access denied on the socket. I then started the policy server before loading the page and all socket requests succeeded. So I then realized the policy authentication must happen at page load time.

I'm using Unity for a game. I don't want to require a service for the logger. I have a version of the page without any SL components. If the user runs into a problem they use the page with the SL controls which send logs to my team.

I don't think there's any kind of problem with the Unity side. It just comes down to being able to delay or reattempt the policy check.

tgraupmann648 said:

figuerres said:

*snip*

Ah here's how I'm doing it.

 

On the page, the Unity object runs a policy server on localhost. The Unity object also runs a socket server on localhost. The Silverlight control runs a socket client which talks to the socket server in the Unity object.

 

Now why would someone want to do this?

 

Originally, I had the Unity object sending logs across the browser to the Silverlight object to log to the SL isolated storage. That way if the page closed, I could still have the logs saved. Unfortunately the way Unity works using browser communication to log 12M worth of logs is slow.

 

I tried a faster approach with using a named pipe. Unfortunately Unity doesn't support a named pipes because the version of Mono is too old. A newer version of Unity with Mono will ship summer time. I'll likely prefer a named pipe solution summer time.

 

I then tried the socket approach. The unity object runs a socket server on the page bound to localhost and I can connect to it with putty to get the logs. So far so good. Silverlight runs the socket client, but all socket connections are denied. I then read up on the policy server, and added a policy server. Policy requests on 943 are now serving the access policy. I was still seeing access denied on the socket. I then started the policy server before loading the page and all socket requests succeeded. So I then realized the policy authentication must happen at page load time.

 

I'm using Unity for a game. I don't want to require a service for the logger. I have a version of the page without any SL components. If the user runs into a problem they use the page with the SL controls which send logs to my team.

 

I don't think there's any kind of problem with the Unity side. It just comes down to being able to delay or reattempt the policy check.

Here's a great [tutorial video] and at exactly 10:00 you see some breakpoints are set. From the video it looks like the policy server is contacted right when socket.ConnectAsync is called for the first time.

They leave out whether any reattempts are made on failure.

tgraupmann648 said:

tgraupmann648 said:

*snip*

Here's a great [tutorial video] and at exactly 10:00 you see some breakpoints are set. From the video it looks like the policy server is contacted right when socket.ConnectAsync is called for the first time.

 

They leave out whether any reattempts are made on failure.

Somehow the newlines in the access policy matter. I used the following hardcoded string and it seems to work.

string hardcodePolicy = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<access-policy>\r\n  <cross-domain-access>\r\n    <policy>\r\n      <allow-from>\r\n        <domain uri=\"*\" />\r\n      </allow-from>\r\n      <grant-to>\r\n        <socket-resource port=\"4502-4506\" protocol=\"tcp\"/>\n      </grant-to>\r\n    </policy>\r\n  </cross-domain-access>\r\n</access-policy>";

tgraupmann648 said:

tgraupmann648 said:

*snip*

Somehow the newlines in the access policy matter. I used the following hardcoded string and it seems to work.

 

string hardcodePolicy = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\r\n<access-policy>\r\n  <cross-domain-access>\r\n    <policy>\r\n      <allow-from>\r\n        <domain uri=\"*\" />\r\n      </allow-from>\r\n      <grant-to>\r\n        <socket-resource port=\"4502-4506\" protocol=\"tcp\"/>\n      </grant-to>\r\n    </policy>\r\n  </cross-domain-access>\r\n</access-policy>";

This is working reliably now. It must have been the lack of whitespace after the XML declaration element.