3

So I've noticed that whenever I visit a adobe flash site I get entries in my outgoing iptables logs like

netfilter:out dropped: IN= OUT=eth1 SRC=192.168.1.79 DST=91.213.212.48 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=15830 DF PROTO=TCP SPT=46964 DPT=843 WINDOW=14600 RES=0x00 SYN URGP=0 

I discovered this port 843 is to do with Adobe's Socket Policy Server.

1) Given these packets are not getting through, how is it that flash content loads and plays fine? (Any benefit in me opening this outgoing port?)

2) Is the purpose of the policy file to decide which sockets on my home computer flash can use, or is it asking its host server what sockets it wants the client (me) to be allowed to connect to the web server on?

1 Answer 1

2

Hopefully this answers both questions:

Although port 843 is the authoritative source of information for the socket policy server, the player will make a request for the socket policy file on the connecting port. However, this is a fallback, and it will always try to make the connection on port 843 first:

Socket policy request process

Flash Player checks for a socket policy file in three places for each IP connection. The checks occur in the following order:

  1. Flash Player first checks port 843 to determine if there is a socket master policy file. If there is no socket master policy file or the socket master policy file has a site-control tag specifying "all", then Flash Player proceeds to the next step. If the site-control tag has a value of "none", then the process stops and the socket is denied a connection.

  2. If an ActionScript Security.loadPolicyFile() command exists within the SWF file, then the Flash Player runtime checks that location. Flash Player checks the destination of the loadPolicyFile() only after it has checked the master policy file on port 843 for permission to acknowledge other policy files. If the developer has not specified a loadPolicyFile() command, then Flash Player checks the destination port of the connection.

  3. The destination port of the connection is the last check made by Flash Player. This check is only performed if the socket master policy file permits Flash Player to check additional locations. If Flash Player still cannot locate a policy file granting permission, then the socket connection is denied.

The purpose of the socket policy file is for an administrator to whitelist/blacklist the hosts that can be connected to by the Flash Player by means of a TCP connection.

Reference: Setting up a socket policy file server

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .