Hi,
first thanks for your replies.
I finally bought a domain to perform some tests.
Here is my precise testing configuration:
- one physical server with one (public) IP: IP1
- antoher physical server with two network cards and two (public) IPs: IP2 and IP3
- one domain name (mydomain.com), with:
* mydomain.com => DNS A entry => IP1
* subdomain.mydomain.com => DNS A entry => IP1
* otherserver1.mydomain.com => DNS A entry => IP2
* otherserver2.mydomain.com => DNS A entry => IP3
- a free (sub) domain from the 'no-ip.com' service (it's like dyndns) : 'mytestdomain.no-ip.org' => IP1
- plus another (default) DNS entry provided by my server provider: serverid.myprovider.com => IP2
Here are the first results:
-> with no security restriction (applet ran locally), any host:port connexion succeeded.
-> with unsigned applet embedded (ie. sandbox active) in a web page of subdomain.mydomain.com, i get:
* 'mydomain.com:80 : connexion SUCCEEDED.
* 'subdomain.mydomain.com:80 : connexion SUCCEEDED.
* 'otherserver1.mydomain.com:80 : connexion FAILED
* 'otherserver2.mydomain.com:80 : connexion FAILED
* 'serverid.myprovider.com:80 : connexion FAILED
* 'mytestdomain.no-ip.org:80 : connexion SUCCEEDED.
So it seems the security check is well based on the IP resolved by the DNS request, which is a problem for me.
I think I'll try some tests with one applet and a different CODEBASE parameter, as proposed by SimonH. But my problem is that I use the 'archive' tag to define the applet's JAR location ; I suppose both won't be allowed, and (maybe) if I define a codebase with a different URL than the one where the JAR is located, the applet will throw a NoClassDefFound error because it won't find the applet's jar. don't you think ?
About having two applets in the same webpage: it's not really a solution for me, as:
- I did some tests a long time ago, and as far as I remember, compability with all browsers + all JRE (1.4+) was not guaranteed.
- I have constraints regarding network latency (think 'action game network requirements'). And I suppose that inter-applet communication will likely be a problem for that.
About cross-site functionality, it's not a solution for me too, as my applets must be compatible with any JRE 1.4+
Note1: when connexion failed, the exception looks like
"(java.security.AccessControlException: access denied (java.net.SocketPermission otherserver1.mydomain.com resolve))"Note2: the code of the applet itself looks like:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
| public class TestAppletSecurity extends Applet {
@Override
public void init() {
System.out.println("TestAppletSecurity initialization.");
testTcpConnexion("mydomain.com", 80);
testTcpConnexion("subdomain.mydomain.com", 80);
testTcpConnexion("otherserver1.mydomain.com", 80);
testTcpConnexion("otherserver2.mydomain.com", 80);
testTcpConnexion("serverid.myprovider.com", 80);
}
public void testTcpConnexion(String host, int port) {
try {
Socket s = new Socket(host, port);
s.close();
System.out.println(" -> '"+host+":"+port+" : connexion SUCCEEDED.");
} catch (Exception e) {
System.out.println(" -> '"+host+":"+port+" : connexion FAILED ("+e+")");
}
} |
