[svn] 3048: Always map urls through the rootURL property, even for the non-proxy case.

Question

Revision: 3048
Author: [email protected]
Date: 2008-08-29 15:40:17 -0700 (Fri, 29 Aug 2008)
Log Message:
Always map urls through the rootURL property, even for the non-proxy case. This might
change the behavior slightly if you set rootURL on HTTPService for the non-proxy case
as that would have been ignored in the current code path but it seem less consistent.
If rootURL is not set, it defaults to the swf's URL which should give the same relative
URL semantics we get today by default when rootURL is not set.
blazeDS checkintests pass
Modified Paths:
flex/sdk/trunk/frameworks/projects/rpc/src/mx/rpc/http/AbstractOperation.as

Answer 1

Of the second and third scripts, the latter could perhaps be deemed the "most secure"; however, it might block more than you want. If you really want to use one of those, then I'd suggest using the second script. Otherwise, I'd recommend that you take a look here. (I only slightly examined the first script.... I do not understand the language of the comments, and I'm no iptables whiz. )
Also, note that you don't have to use an actual script to set up the rules; rather, you can save the rules you want to a file that will be read by iptables automatically (/etc/iptables/iptables.rules). Here's a modified version of mine:
# /etc/iptables/iptables.rules
# These rules (and the commented instructions) derived from:
# http://ubuntuforums.org/showthread.php?t=159661
*nat
:PREROUTING ACCEPT [163:50538]
:POSTROUTING ACCEPT [40:2451]
:OUTPUT ACCEPT [40:2451]
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:FIREWALL - [0:0]
:TRUSTED - [0:0]
-A INPUT -j FIREWALL
-A FORWARD -j DROP
-A FIREWALL -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FIREWALL -i lo -j ACCEPT
-A FIREWALL -j TRUSTED
-A FIREWALL -j DROP
# put your own exceptions here, like so (replacing <tcp/udp> with either "tcp" or
# "udp" -- minus the quotes -- and <port number> with the port you'd like to open):
# -A TRUSTED -p <tcp/udp> -m <tcp/udp> --dport <port number> -j ACCEPT
COMMIT
Of course, there are benefits to keeping the rules in a script. For instance, you could then easily set the default iptables rules, allow all traffic, etc. Plus, some firewall-related things (such as the various echo commands in the scripts you provided) cannot (to my knowledge) be done by iptables alone.
If you already have a script that sets up the rules you would like to use, you can save yourself the hassle of creating a rules file by following the directions outlined here.
Last edited by ssjlegendx (2008-08-06 20:17:00)