Unity implements a security model very similar to the one used by the Adobe Flash player™. This security restrictions apply to SamsungTV. The security model has several parts:
В настоящий момент только первые две части модели безопасности эмулируются в редакторе.
Встроенный в Unity функционал мультиплеера (классы UnityEngine.Network, UnityEngine.NetworkView и т.п.) не влияют на модель безопасности.
WWW класс и сокеты используют схожую схему, но совершенно разные системы. WWW только определяет права доступа на веб сервис, где политика состоялась, но сокеты применяются ко всем TCP/UDP соединениям.
The Unity editor comes with an “Emulate Web Security” feature, that imposes the security model. This makes it easy to detect problems from the comfort of the editor. You can find this setting in Edit->Project Settings->Editor. See also the Editor settings.
Unity needs a socket served policy in order to connect to a particular host. This policy is by default hosted by the target host on port 843 but it can be hosted on other ports as well. The functional difference with a non-default port is that it must be manually fetched with Security.PrefetchSocketPolicy() API call and if it is hosted on a port higher than 1024 the policy can only give access to other ports higher than 1024.
When using the default port it works like this: Unity tries to make a TCP socket connection to a host, it first checks that the host server will accept the connection. It does this by opening a TCP socket on port 843, issues a request, and expects to receive a socket policy over the new connection. Unity then checks that the host’s policy permits the connection to go ahead and it will proceed without error if so. This process happens transparently to the user’s code, which does not need to be modified to use this security model. An example of a socket policy look like this:
<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*" to-ports="1200-1220"/>
</cross-domain-policy>"
This policy effectively says “Content from any domain is free to make socket connections at ports 1200–1220”. Unity will respect this, and reject any attempted socket connection using a port outside that range (a SecurityException will be thrown).
Когда используется UDP соединения, политика может быть автоматически получена таким же образом, как и при TCP. Разница лишь в том, что при TCP автоматическое получение происходит когда вы подключаетесь к чему то (гарантирует вам разрешение подключатся к серверу), а при UDP, т.к. нет установления соединения, это случается когда вы вызываете метод любого API, который отправляет или получает данные (гарантирует разрешение отправлять/принимать траффик в сервер и из сервера).
Политика сокетов, применяемая и к TCP и к UDP соединениям, может контролироваться одним сервером.
For your convenience, we provide a small program which simply listens at port 843; when on a connection it receives a request string, it will reply with a valid socket policy. The server code can be found inside the Unity install folder, in Data/Tools/SocketPolicyServer on Windows or /Unity.app/Contents/Tools/SocketPolicyServer on OS X. Note that the pre-built executable can be run on Mac since it is a Mono executable. Just type “mono sockpol.exe” to run it. Note that this example code shows the correct behaviour of a socket policy server. Specifically the server expects to receive a zero-terminated string that contains <policy-file-request/>. It only sends to the client the socket policy xml document when this string (and exactly this string) has been received. Further, it is required that the xml header and xml body are sent with a single socket write. Breaking the header and body into separate socket write operations can cause security exceptions due to Unity receiving an incomplete policy. If you experience any problems with your own server please consider using the example that we provide. This should help you diagnose whether you have server or network issues.
Треть сетевых библиотек, используемых для многопользовательских игр, должна быть способна работать с этими требованиями до тех пор, пока они не зависят от функционала peer 2 peer (см. ниже), но использовать выделенные серверы. Они даже иногда приходят из коробки с поддержкой хостинг политики.
Можете использовать telnet для подключения к серверу политики сокетов. Пример приведен ниже:
host$ telnet localhost 843
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
<policy-file-request/>
<?xml version='1.0'?>
<cross-domain-policy>
<allow-access-from domain="*" to-ports="*" />
</cross-domain-policy>Connection closed by foreign host.
host$
В этом примере, telnet используется для соединения к локальному хосту на порту 843. Telnet отвечает с тремя линиями и ожидает от пользователя ввода данных. Пользователь вводит строку запрос политики <policy-file-request/>, которую сокет сервер политики получает и отвечает с политикой сокета. Затем сервер разрывает соединение, сообщая telnet что соединение было закрыто.
When using TCP sockets you can only connect to remote endpoints provided it is allowed through the socket policy system. For UDP it works the same but the concept is a little bit different as it is a connectionless protocol, you don’t have to connect/listen to send/receive packets. It works by enforcing that you can only receive packets from a server if he has responded first with a valid policy with the allow-access-from domain tag.
The socket and WWW security features exist to protect people who install SamsungTV Player. Without these restrictions, an attack such as the following would be possible:
With the WWW and socket security features, this attack will fail, because before downloading the pdf, Unity checks http://internal.whitehouse.gov/crossdomain.xml, with the intent to ask that server: “is the data you have on your server available for public usage?”. Placing a crossdomain.xml on a webserver can be seen as the response to that question. In the case of this example, the system operator of internal.whitehouse.gov will not place a crossdomain.xml on its server, which will lead Unity to not download the pdf.