Applet "codebase" to IP address resolution

**=?ISO-8859-1?Q?Arne_Vajh=F8j?=** · Aug 4 '08, 02:15 AM

Re: Applet "codebase& quot; to IP address resolution

Richard Maher wrote:

Can someone please tell me the strategy(ies) used by Java (the Security
Manager or whatever) to determine if a given IP address conforms to the
definition of the codebase from which an applet was retrieved?
>
For example, if an Applet was loaded from mycluster.mydom ain.com, and
"mycluster" was a cluster alias that was using DNS load-balancing (or
round-robin or a.n.other distribution technique) to distribute client
connections among available nodes in the cluster, could such an unsigned
applet connect a socket to *any* of the available nodes or interface
addresses?
>
Is the DNS translation done only once when the Object/Applet tag is
encountered and, from then on, all "codebase" checks must match that same IP
address?
>
Is it just an ASCII string check, so that one relative -vs- one absolute URL
specification could point to the same address yet fail the check?
>
But then, when it comes to UDP messages arriving at an Applet's socket, when
only the IP address is available, what criteria is used to say "Hey, did
this message come from my codebase?
>
Is the equivalent a C gethostent() call performed, and *all* alias addresses
and names are checked to say "It's in there somewhere"? (This would be nice
:-)

Oracle Java Technologies | Oracle

http://java.sun.com/sfaq/#socketOrig

says whatever name or number that was used to get the applet.

But that doc is from Java 1.1, so I would suggest a little test to check
if it has been changed since 1997 !

Arne

**Richard Maher** · Aug 4 '08, 02:35 PM

Re: Applet "codebase& quot; to IP address resolution

Hi Arne,

Thanks once more for your replies over the many months/years!

>
http://java.sun.com/sfaq/#socketOrig

I doubt that's the definitive work on the subject :-)

says whatever name or number that was used to get the applet.

Yeah, but what about the incoming UDP message-source check that must be
comparing IP addresses? When is the applet codebase address resolution
performed? (Please see the Tier3Pager and Tier3Talk classes below) And what
about that DNS cluster/interface load balancing?

Someone must have the source somewhere? Called a "Policy Manager/enforcer"
or some such? I'm guessing that consistency in this grey-area of "rules"
(more like guidelines realy :-) may be worthwhile across JVM
implementations ?

Cheers Richard Maher

/**
* Copyright Tier3 Software. All rights reserved.
*
* Author: Richard Maher
*
**/

import java.applet.App let;
import java.awt.*;
import java.net.*;
import java.io.IOExcep tion;
import netscape.javasc ript.JSObject;
import netscape.javasc ript.JSExceptio n;

public class Tier3Pager extends Applet
{
private String hostName;
private JSObject browser;
private static MessageThread socketThread;
private static Tier3Talk chat;

public class MessageThread extends Thread
{
private DatagramSocket socket;
private DatagramPacket packet;
private String threadData;

public MessageThread(S tring name, String txt) throws Exception
{
super(name);

byte[] buffer;
threadData = txt;

String port = getParameter("P ORT");
String maxBuf = getParameter("M AXBUF");
try
{
if (port == null)
socket = new DatagramSocket( );
else
socket = new DatagramSocket( Integer.parseIn t(port));

if (maxBuf == null)
buffer = new byte[512];
else
buffer = new byte[Integer.parseIn t(maxBuf)];

packet = new DatagramPacket( buffer, buffer.length);
}
catch (Exception e)
{
e.printStackTra ce();
System.out.prin tln("Unable to create UDP Socket");
throw new Exception("Mess age thread could not be created");
}

setDaemon(true) ;
start();
}

public void shutdown()
{
socket.close();
}

public int getLocalPort()
{
return socket.getLocal Port();
}

public InetAddress getLocalAddress ()
{
return socket.getLocal Address();
}

public void run()
{
System.out.prin tln("Started Message thread. ThreadData = " +
threadData);
String args[] = {"Started Message Thread " + threadData};
browser.call("a lert", args);
boolean stopThread = false;

readLoop:
while (!stopThread)
{
try
{
socket.receive( packet);
String received = new String(packet.g etData(), 0,
packet.getLengt h());
processMessage( received);
}
catch (SocketExceptio n e)
{
System.out.prin tln("Shutting up shop");
stopThread = true;
continue readLoop;
}
catch (IOException e)
{
e.printStackTra ce();
System.out.prin tln("Unable to retrieve UDP message");
}
}

System.out.prin tln("Thread run() unit terminating");
}

public void processMessage( String msgText)
{
int msgType = Integer.parseIn t(msgText.subst ring(0,2));
switch (msgType){
case 1:
chat.append(msg Text.substring( 2));
break;
case 2:
String args[] = {msgText.substr ing(2)};
try {browser.call(" priceUpdate", args);}
catch (JSException e)
{
System.out.prin tln("Error when calling JS
priceUpdate()") ;
}
break;
default:
System.out.prin tln("Unknown rec type
"+msgText);
}
}
}

public void init()
{
System.out.prin tln("Initializi ng. . .");
hostName = getCodeBase().g etHost();

chat = new Tier3Talk("Tier 3 Messages");
requestFocus();

browser = JSObject.getWin dow(this);

if (socketThread == null)
{
try
{
socketThread = new MessageThread(" MsgDaemon", "SomeData") ;
}
catch (Exception e)
{
e.printStackTra ce();
System.out.prin tln("Could not init Tier3Pager");
}
}
}

public void alert(String alertText)
{
String args[] = {alertText};
browser.call("a lert", args);
}

public void destroy()
{
if (chat != null)
chat.dispose();

boolean stillDying;

if (socketThread != null){
socketThread.sh utdown();
do
{
stillDying = false;
System.out.prin tln("Joining MessageThread") ;
try {socketThread.j oin();}
catch (InterruptedExc eption e){
System.out.prin tln("Interrupte d Join");
stillDying = true;
}
} while (stillDying);

socketThread = null;
}

System.out.prin tln("Tier3Pager Applet Rundown complete");
super.destroy() ;
}
}

/**
* Copyright Tier3 Software. All rights reserved.
*
* Author: Richard Maher
*
**/

import java.awt.*;
import java.awt.event. *;

public class Tier3Talk extends Frame
implements WindowStateList ener
{
TextArea chatPanel = new TextArea("Serve r messages will appear
below: -", 10, 50);
Toolkit toolkit = Toolkit.getDefa ultToolkit();
boolean windowDown = true;

public Tier3Talk(Strin g heading)
{
super(heading);
setBackground(C olor.gray);

chatPanel.setEd itable(false);

Panel panel = new Panel();
panel.setLayout (new FlowLayout(Flow Layout.CENTER)) ;
panel.add(chatP anel);
add("Center", panel);

Dimension screenDim = toolkit.getScre enSize();
pack();
Dimension windowDim = getSize();
setLocation((sc reenDim.width - windowDim.width ),(screenDim.he ight -
windowDim.heigh t));

setResizable(fa lse);
addWindowStateL istener(this);
setExtendedStat e(Frame.ICONIFI ED);
setVisible(true );
}

public void append(String newMsg)
{
chatPanel.appen d("\n" + newMsg);
if (windowDown)
setExtendedStat e(Frame.NORMAL) ;
toolkit.beep();
}

public void windowStateChan ged(WindowEvent we)
{
switch (we.getNewState ())
{
case Frame.ICONIFIED :
windowDown = true;
break;
case Frame.NORMAL:
windowDown = false;
break;
default:
System.out.prin tln("Event of no interest" +
we.getNewState( ));
}
}
}

"Arne Vajhøj" <arne@vajhoej.d kwrote in message
news:489664d0$0 $90271$14726298 @news.sunsite.d k...

Richard Maher wrote:

Can someone please tell me the strategy(ies) used by Java (the Security
Manager or whatever) to determine if a given IP address conforms to the
definition of the codebase from which an applet was retrieved?

For example, if an Applet was loaded from mycluster.mydom ain.com, and
"mycluster" was a cluster alias that was using DNS load-balancing (or
round-robin or a.n.other distribution technique) to distribute client
connections among available nodes in the cluster, could such an unsigned
applet connect a socket to *any* of the available nodes or interface
addresses?

Is the DNS translation done only once when the Object/Applet tag is
encountered and, from then on, all "codebase" checks must match that

same IP

address?

Is it just an ASCII string check, so that one relative -vs- one absolute

URL

specification could point to the same address yet fail the check?

But then, when it comes to UDP messages arriving at an Applet's socket,

when

only the IP address is available, what criteria is used to say "Hey, did
this message come from my codebase?

Is the equivalent a C gethostent() call performed, and *all* alias

addresses

and names are checked to say "It's in there somewhere"? (This would be

nice

:-)

>

Oracle Java Technologies | Oracle

http://java.sun.com/sfaq/#socketOrig

>
says whatever name or number that was used to get the applet.
>
But that doc is from Java 1.1, so I would suggest a little test to check
if it has been changed since 1997 !
>
Arne

Applet "codebase" to IP address resolution

Applet "codebase" to IP address resolution

Comment

Comment