A simple Flash socket policy server for NodeJS.

flashpolicy.xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "/xml/dtds/cross-domain-policy.dtd">

<!-- Policy file for xmlsocket://socks.example.com -->
<cross-domain-policy> 

   <!-- This is a master socket policy file -->
   <!-- No other socket policies on the host will be permitted -->
   <site-control permitted-cross-domain-policies="master-only"/>

   <!-- Instead of setting to-ports="*", administrator's can use ranges and commas -->
   <!-- This will allow access to ports 123, 456, 457 and 458 -->
   <allow-access-from domain="swf.example.com" to-ports="123,456-458" />

</cross-domain-policy>

node_fsps.js

/*
A simple Flash socket policy server for NodeJS. Request must be, and response is, null-terminated, according to Adobe spec.
*/

var file = process.argv[2] || '/etc/flashpolicy.xml',
	host = process.argv[3] || 'localhost',
	port = process.argv[4] || 843,
	poli;

var fsps = require('net').createServer(function (stream) {
	stream.setEncoding('utf8');
	stream.setTimeout(3000); // 3s
	stream.on('connect', function () {
		console.log('Got connection from ' + stream.remoteAddress + '.');
	});
	stream.on('data', function (data) {
		if (data == '<policy-file-request/>\0') {
			console.log('Good request. Sending file to ' + stream.remoteAddress + '.')
			stream.end(poli + '\0');
		} else {
			console.log('Bad request from ' + stream.remoteAddress + '.');
			stream.end();
		}
	});
	stream.on('end', function () {
		stream.end();
	});
	stream.on('timeout', function () {
		console.log('Request from ' + stream.remoteAddress + ' timed out.');
		stream.end();
	});
});

require('fs').readFile(file, 'utf8', function (err, poli) {
	if (err) throw err;
	fsps.listen(port, host);
	process.setgid('nobody');
	process.setuid('nobody');
	console.log('Flash socket policy server running at ' + host + ':' + port + ' and serving ' + file);
});

When I try to run on ports < 1024, I get error EACCES even though I'm root.
Then I try commenting out the two lines process.setgid('nobody') and process.setuid('nobody'), then it works.

Update: OK, even though I am getting good requests, the browser is rejecting. I'm going back to using their Python sample script (http://www.adobe.com/devnet/flashplayer/articles/socket_policy_files.html). Note: don't use the Perl script, it's single threaded.

You getting EACCESS error because you need to run it under sudo, like sudo node app.js

Error: EPERM, Operation not permitted. i dont have sudo rights on webfaction. is there a way to make it work?
//process.setgid('nobody');
//process.setuid('nobody');
works now.

Taken from the official documentation.

How to test if it's working:

python -c 'print "<policy-file-request/>%c" % 0' | nc 127.0.0.1 843

or

perl -e 'printf "<policy-file-request/>%c",0' | nc 127.0.0.1 843

Here a patch in node_fsps.js to work for me:

require('fs').readFile(file, 'utf8', function (err, content) {
	if (err) throw err;
        poli = content;
        ...

Without the patch, the global var 'poli' remain undefined and nothing is send to the client.