13 files changed, 228 insertions, 47 deletions

diff --git a/linden/indra/llmessage/llares.cpp b/linden/indra/llmessage/llares.cpp
index 5a310b3..7f573d2 100644
--- a/linden/indra/llmessage/llares.cpp
+++ b/linden/indra/llmessage/llares.cpp
@@ -100,9 +100,16 @@ void LLAres::QueryResponder::queryError(int code)
                         << LLAres::strerror(code) << llendl;
 }
 
-LLAres::LLAres()
+LLAres::LLAres() :
+chan_(NULL), mInitSuccess(false)
 {
-        ares_init(&chan_);
+        if (ares_init(&chan_) != ARES_SUCCESS)
+        {
+                llwarns << "Could not succesfully initialize ares!" << llendl;
+                return;
+        }
+
+        mInitSuccess = true;
 }
 
 LLAres::~LLAres()
diff --git a/linden/indra/llmessage/llares.h b/linden/indra/llmessage/llares.h
index 5d72170..17f6085 100644
--- a/linden/indra/llmessage/llares.h
+++ b/linden/indra/llmessage/llares.h
@@ -437,9 +437,11 @@ public:
          */
         static const char *strerror(int code);
 
+        bool isInitialized(void) { return mInitSuccess; }
+
 protected:
         ares_channel chan_;
-
+        bool mInitSuccess;
 };
         
 /**
diff --git a/linden/indra/llmessage/llhttpclient.cpp b/linden/indra/llmessage/llhttpclient.cpp
index caeaee1..fc2612f 100644
--- a/linden/indra/llmessage/llhttpclient.cpp
+++ b/linden/indra/llmessage/llhttpclient.cpp
@@ -56,7 +56,7 @@ namespace
         {
         public:
                 LLHTTPClientURLAdaptor(LLCurl::ResponderPtr responder)
-                        : mResponder(responder), mStatus(499),
+                        : LLURLRequestComplete(), mResponder(responder), mStatus(499),
                           mReason("LLURLRequest complete w/no status")
                 {
                 }
@@ -67,6 +67,8 @@ namespace
 
                 virtual void httpStatus(U32 status, const std::string& reason)
                 {
+                        LLURLRequestComplete::httpStatus(status,reason);
+
                         mStatus = status;
                         mReason = reason;
                 }
diff --git a/linden/indra/llmessage/llmessagetemplate.h b/linden/indra/llmessage/llmessagetemplate.h
index f92c4b7..716c618 100644
--- a/linden/indra/llmessage/llmessagetemplate.h
+++ b/linden/indra/llmessage/llmessagetemplate.h
@@ -265,6 +265,7 @@ enum EMsgDeprecation
 {
         MD_NOTDEPRECATED,
         MD_UDPDEPRECATED,
+        MD_UDPBLACKLISTED,
         MD_DEPRECATED
 };
 
@@ -299,7 +300,7 @@ public:
         ~LLMessageTemplate()
         {
                 for_each(mMemberBlocks.begin(), mMemberBlocks.end(), DeletePointer());
-}
+        }
 
         void addBlock(LLMessageBlock *blockp)
         {
@@ -380,6 +381,11 @@ public:
                 return trustedSource ? mBanFromTrusted : mBanFromUntrusted;
         }
 
+        bool isUdpBanned() const
+        {
+                return mDeprecation == MD_UDPBLACKLISTED;
+        }
+
         friend std::ostream&     operator<<(std::ostream& s, LLMessageTemplate &msg);
 
         const LLMessageBlock* getBlock(char* name) const
diff --git a/linden/indra/llmessage/llmessagetemplateparser.cpp b/linden/indra/llmessage/llmessagetemplateparser.cpp
index d6adba8..9f6eeca 100644
--- a/linden/indra/llmessage/llmessagetemplateparser.cpp
+++ b/linden/indra/llmessage/llmessagetemplateparser.cpp
@@ -525,6 +525,10 @@ LLMessageTemplate * LLTemplateParser::parseMessage(LLTemplateTokenizer & tokens)
         {
                 templatep->setDeprecation(MD_UDPDEPRECATED);
         }
+        else if (tokens.want("UDPBlackListed"))
+        {
+                templatep->setDeprecation(MD_UDPBLACKLISTED);
+        }
         else if (tokens.want("NotDeprecated"))
         {
                 // this is the default value, but it can't hurt to set it twice
diff --git a/linden/indra/llmessage/lltemplatemessagebuilder.cpp b/linden/indra/llmessage/lltemplatemessagebuilder.cpp
index cd06c07..6d3ff8f 100644
--- a/linden/indra/llmessage/lltemplatemessagebuilder.cpp
+++ b/linden/indra/llmessage/lltemplatemessagebuilder.cpp
@@ -60,7 +60,6 @@ LLTemplateMessageBuilder::~LLTemplateMessageBuilder()
         mCurrentSMessageData = NULL;
 }
 
-
 // virtual
 void LLTemplateMessageBuilder::newMessage(const char *name)
 {
diff --git a/linden/indra/llmessage/lltemplatemessagereader.cpp b/linden/indra/llmessage/lltemplatemessagereader.cpp
index f5da14b..2c457e8 100644
--- a/linden/indra/llmessage/lltemplatemessagereader.cpp
+++ b/linden/indra/llmessage/lltemplatemessagereader.cpp
@@ -791,12 +791,16 @@ bool LLTemplateMessageReader::isTrusted() const
         return mCurrentRMessageTemplate->getTrust() == MT_TRUST;
 }
 
-//virtual 
 bool LLTemplateMessageReader::isBanned(bool trustedSource) const
 {
         return mCurrentRMessageTemplate->isBanned(trustedSource);
 }
 
+bool LLTemplateMessageReader::isUdpBanned() const
+{
+        return mCurrentRMessageTemplate->isUdpBanned();
+}
+
 //virtual 
 void LLTemplateMessageReader::copyToBuilder(LLMessageBuilder& builder) const
 {
diff --git a/linden/indra/llmessage/lltemplatemessagereader.h b/linden/indra/llmessage/lltemplatemessagereader.h
index 98f41ae..ff124f3 100644
--- a/linden/indra/llmessage/lltemplatemessagereader.h
+++ b/linden/indra/llmessage/lltemplatemessagereader.h
@@ -109,7 +109,8 @@ public:
 
         bool isTrusted() const;
         bool isBanned(bool trusted_source) const;
-
+        bool isUdpBanned() const;
+        
 private:
 
         void getData(const char *blockname, const char *varname, void *datap, 
diff --git a/linden/indra/llmessage/llurlrequest.cpp b/linden/indra/llmessage/llurlrequest.cpp
index 42f3f04..ee62798 100644
--- a/linden/indra/llmessage/llurlrequest.cpp
+++ b/linden/indra/llmessage/llurlrequest.cpp
@@ -461,26 +461,62 @@ size_t LLURLRequest::upCallback(
 
 static size_t headerCallback(void* data, size_t size, size_t nmemb, void* user)
 {
-        const char* headerLine = (const char*)data;
-        size_t headerLen = size * nmemb;
+        const char* header_line = (const char*)data;
+        size_t header_len = size * nmemb;
         LLURLRequestComplete* complete = (LLURLRequestComplete*)user;
 
+        if (!complete || !header_line)
+        {
+                return header_len;
+        }
+
         // *TODO: This should be a utility in llstring.h: isascii()
-        for (size_t i = 0; i < headerLen; ++i)
+        for (size_t i = 0; i < header_len; ++i)
+        {
+                if (header_line[i] < 0)
+                {
+                        return header_len;
+                }
+        }
+
+        std::string header(header_line, header_len);
+
+        // Per HTTP spec the first header line must be the status line.
+        if (!complete->haveHTTPStatus())
         {
-                if (headerLine[i] < 0)
+                if (header.substr(0,5) == "HTTP/")
                 {
-                        return headerLen;
+                        std::string::iterator end = header.end();
+                        std::string::iterator pos1 = std::find(header.begin(), end, ' ');
+                        if (pos1 != end) ++pos1;
+                        std::string::iterator pos2 = std::find(pos1, end, ' ');
+                        if (pos2 != end) ++pos2;
+                        std::string::iterator pos3 = std::find(pos2, end, '\r');
+
+                        std::string version(header.begin(), pos1);
+                        std::string status(pos1, pos2);
+                        std::string reason(pos2, pos3);
+
+                        int statusCode = atoi(status.c_str());
+                        if (statusCode >= 300 && statusCode < 400)
+                        {
+                                // This is a redirect, ignore it and all headers
+                                // until we find a normal status code.
+                        }
+                        else if (statusCode > 0)
+                        {
+                                complete->httpStatus((U32)statusCode, reason);
+                        }
                 }
+                return header_len;
         }
 
-        size_t sep;
-        for (sep = 0; sep < headerLen  &&  headerLine[sep] != ':'; ++sep) { }
+        std::string::iterator sep = std::find(header.begin(),header.end(),':');
 
-        if (sep < headerLen && complete)
+        if (sep != header.end())
         {
-                std::string key(headerLine, sep);
-                std::string value(headerLine + sep + 1, headerLen - sep - 1);
+                std::string key(header.begin(), sep);
+                std::string value(sep + 1, header.end());
 
                 key = utf8str_tolower(utf8str_trim(key));
                 value = utf8str_trim(value);
@@ -489,30 +525,14 @@ static size_t headerCallback(void* data, size_t size, size_t nmemb, void* user)
         }
         else
         {
-                std::string s(headerLine, headerLen);
-
-                std::string::iterator end = s.end();
-                std::string::iterator pos1 = std::find(s.begin(), end, ' ');
-                if (pos1 != end) ++pos1;
-                std::string::iterator pos2 = std::find(pos1, end, ' ');
-                if (pos2 != end) ++pos2;
-                std::string::iterator pos3 = std::find(pos2, end, '\r');
-
-                std::string version(s.begin(), pos1);
-                std::string status(pos1, pos2);
-                std::string reason(pos2, pos3);
-
-                int statusCode = atoi(status.c_str());
-                if (statusCode > 0)
+                LLStringUtil::trim(header);
+                if (!header.empty())
                 {
-                        if (complete)
-                        {
-                                complete->httpStatus((U32)statusCode, reason);
-                        }
+                        llwarns << "Unable to parse header: " << header << llendl;
                 }
         }
 
-        return headerLen;
+        return header_len;
 }
 
 /**
@@ -553,7 +573,8 @@ LLIOPipe::EStatus LLContextURLExtractor::process_impl(
  * LLURLRequestComplete
  */
 LLURLRequestComplete::LLURLRequestComplete() :
-        mRequestStatus(LLIOPipe::STATUS_ERROR)
+        mRequestStatus(LLIOPipe::STATUS_ERROR),
+        mHaveHTTPStatus(false)
 {
         LLMemType m1(LLMemType::MTYPE_IO_URL_REQUEST);
 }
@@ -572,6 +593,7 @@ void LLURLRequestComplete::header(const std::string& header, const std::string&
 //virtual 
 void LLURLRequestComplete::httpStatus(U32 status, const std::string& reason)
 {
+        mHaveHTTPStatus = true;
 }
 
 //virtual 
diff --git a/linden/indra/llmessage/llurlrequest.h b/linden/indra/llmessage/llurlrequest.h
index 888b962..f965dad 100644
--- a/linden/indra/llmessage/llurlrequest.h
+++ b/linden/indra/llmessage/llurlrequest.h
@@ -327,6 +327,9 @@ public:
         LLURLRequestComplete();
         virtual ~LLURLRequestComplete();
 
+        // The first line of an http response must be the status line
+        // true if we have already parsed this line.
+        bool haveHTTPStatus() const { return mHaveHTTPStatus; }
 protected:
         /* @name LLIOPipe virtual implementations
          */
@@ -345,6 +348,8 @@ protected:
         // value to note if we actually got the response. This value
         // depends on correct useage from the LLURLRequest instance.
         EStatus mRequestStatus;
+
+        bool mHaveHTTPStatus;
 };
 
 
diff --git a/linden/indra/llmessage/llxfermanager.cpp b/linden/indra/llmessage/llxfermanager.cpp
index f40612c..8173b7c 100644
--- a/linden/indra/llmessage/llxfermanager.cpp
+++ b/linden/indra/llmessage/llxfermanager.cpp
@@ -713,6 +713,78 @@ void LLXferManager::sendConfirmPacket (LLMessageSystem *mesgsys, U64 id, S32 pac
 
 ///////////////////////////////////////////////////////////
 
+static bool find_and_remove(std::multiset<std::string>& files,
+                const std::string& filename)
+{
+        std::multiset<std::string>::iterator ptr;
+        if ( (ptr = files.find(filename)) != files.end())
+        {
+                //erase(filename) erases *all* entries with that key
+                files.erase(ptr);
+                return true;
+        }
+        return false;
+}
+
+void LLXferManager::expectFileForRequest(const std::string& filename)
+{
+        mExpectedRequests.insert(filename);
+}
+
+bool LLXferManager::validateFileForRequest(const std::string& filename)
+{
+        return find_and_remove(mExpectedRequests, filename);
+}
+
+void LLXferManager::expectFileForTransfer(const std::string& filename)
+{
+        mExpectedTransfers.insert(filename);
+}
+
+bool LLXferManager::validateFileForTransfer(const std::string& filename)
+{
+        return find_and_remove(mExpectedTransfers, filename);
+}
+
+static bool remove_prefix(std::string& filename, const std::string& prefix)
+{
+        if (std::equal(prefix.begin(), prefix.end(), filename.begin()))
+        {
+                filename = filename.substr(prefix.length());
+                return true;
+        }
+        return false;
+}
+
+static bool verify_cache_filename(const std::string& filename)
+{
+        //NOTE: This routine is only used to check file names that our own
+        // code places in the cache directory.  As such, it can be limited
+        // to this very restrictive file name pattern.  It does not need to
+        // handle other characters.
+
+        size_t len = filename.size();
+        //const boost::regex expr("[a-zA-Z0-9][-_.a-zA-Z0-9]<0,49>");
+        if (len < 1 || len > 50)
+        {
+                return false;
+        }
+        for(unsigned i=0; i<len; ++i)
+        {
+                char c = filename[i];
+                bool ok = isalnum(c);
+                if (!ok && i > 0)
+                {
+                        ok = '_'==c || '-'==c || '.'==c;
+                }
+                if (!ok)
+                {
+                        return false;
+                }
+        }
+        return true;
+}
+
 void LLXferManager::processFileRequest (LLMessageSystem *mesgsys, void ** /*user_data*/)
 {
                 
@@ -734,16 +806,11 @@ void LLXferManager::processFileRequest (LLMessageSystem *mesgsys, void ** /*user
 
         mesgsys->getStringFast(_PREHASH_XferID, _PREHASH_Filename, local_filename);
         
-        U8 local_path_u8;
-        mesgsys->getU8("XferID", "FilePath", local_path_u8);
-        if( local_path_u8 < (U8)LL_PATH_LAST )
         {
+                U8 local_path_u8;
+                mesgsys->getU8("XferID", "FilePath", local_path_u8);
                 local_path = (ELLPath)local_path_u8;
         }
-        else
-        {
-                llwarns << "Invalid file path in LLXferManager::processFileRequest() " << (U32)local_path_u8 << llendl;
-        }
 
         mesgsys->getUUIDFast(_PREHASH_XferID, _PREHASH_VFileID, uuid);
         mesgsys->getS16Fast(_PREHASH_XferID, _PREHASH_VFileType, type_s16);
@@ -782,6 +849,43 @@ void LLXferManager::processFileRequest (LLMessageSystem *mesgsys, void ** /*user
         }
         else if (!local_filename.empty())
         {
+                // See DEV-21775 for detailed security issues
+
+                if (local_path == LL_PATH_NONE)
+                {
+                        // this handles legacy simulators that are passing objects
+                        // by giving a filename that explicitly names the cache directory
+                        static const std::string legacy_cache_prefix = "data/";
+                        if (remove_prefix(local_filename, legacy_cache_prefix))
+                        {
+                                local_path = LL_PATH_CACHE;
+                        }
+                }
+
+                switch (local_path)
+                {
+                        case LL_PATH_NONE:
+                                if(!validateFileForTransfer(local_filename))
+                                {
+                                        llwarns << "SECURITY: Unapproved filename '" << local_filename << llendl;
+                                        return;
+                                }
+                                break;
+
+                        case LL_PATH_CACHE:
+                                if(!verify_cache_filename(local_filename))
+                                {
+                                        llwarns << "SECURITY: Illegal cache filename '" << local_filename << llendl;
+                                        return;
+                                }
+                                break;
+
+                        default:
+                                llwarns << "SECURITY: Restricted file dir enum: " << (U32)local_path << llendl;
+                                return;
+                }
+
+
                 std::string expanded_filename = gDirUtilp->getExpandedFilename( local_path, local_filename );
                 llinfos << "starting file transfer: " <<  expanded_filename << " to " << mesgsys->getSender() << llendl;
 
@@ -861,6 +965,7 @@ void LLXferManager::processFileRequest (LLMessageSystem *mesgsys, void ** /*user
         }
 }
 
+
 ///////////////////////////////////////////////////////////
 
 void LLXferManager::processConfirmation (LLMessageSystem *mesgsys, void ** /*user_data*/)
diff --git a/linden/indra/llmessage/llxfermanager.h b/linden/indra/llmessage/llxfermanager.h
index 77f3f60..4bcf5de 100644
--- a/linden/indra/llmessage/llxfermanager.h
+++ b/linden/indra/llmessage/llxfermanager.h
@@ -108,6 +108,8 @@ class LLXferManager
         // implementation methods
         virtual void startPendingDownloads();
         virtual void addToList(LLXfer* xferp, LLXfer*& head, BOOL is_priority);
+        std::multiset<std::string> mExpectedTransfers; // files that are authorized to transfer out
+        std::multiset<std::string> mExpectedRequests;  // files that are authorized to be downloaded on top of
 
  public:
         LLXferManager(LLVFS *vfs);
@@ -168,6 +170,20 @@ class LLXferManager
                                                           const LLHost& remote_host,
                                                           void (*callback)(void**,S32,LLExtStat), void** user_data,
                                                           BOOL is_priority = FALSE);
+        /**
+                When arbitrary files are requested to be transfered (by giving a dir of LL_PATH_NONE)
+           they must be "expected", but having something pre-authorize them. This pair of functions
+           maintains a pre-authorized list. The first function adds something to the list, the second
+           checks if is authorized, removing it if so.  In this way, a file is only authorized for
+           a single use.
+        */
+        virtual void expectFileForTransfer(const std::string& filename);
+        virtual bool validateFileForTransfer(const std::string& filename);
+        /**
+                Same idea, but for the viewer about to call InitiateDownload to track what it requested.
+        */
+        virtual void expectFileForRequest(const std::string& filename);
+        virtual bool validateFileForRequest(const std::string& filename);
 
 /*
 // xfer request (may be memory or file)
diff --git a/linden/indra/llmessage/message.cpp b/linden/indra/llmessage/message.cpp
index 27f9d12..b20731a 100644
--- a/linden/indra/llmessage/message.cpp
+++ b/linden/indra/llmessage/message.cpp
@@ -754,11 +754,19 @@ BOOL LLMessageSystem::checkMessages( S64 frame_count )
                                 clearReceiveState();
                                 valid_packet = FALSE;
                         }
+
+                        if( valid_packet && mTemplateMessageReader->isUdpBanned())
+                        {
+                                llwarns << "Received UDP black listed message "
+                                                <<  mTemplateMessageReader->getMessageName()
+                                                << " from " << host << llendl;
+                                clearReceiveState();
+                                valid_packet = FALSE;
+                        }
                         
                         if( valid_packet )
                         {
                                 logValidMsg(cdp, host, recv_reliable, recv_resent, (BOOL)(acks>0) );
-
                                 valid_packet = mTemplateMessageReader->readMessage(buffer, host);
                         }