* Added three new helper utility files to OpenSim.Framework. MultipartForm is used for constructing multipart/form-data requests. UntrustedWebRequest places sanity checks and policy on requests to HTTP endpoints that are not in the same trust domain (useful for Hypergrid, OpenID, etc). WebUtil contains misc. functions for managing URLs and network streams

1 files changed, 203 insertions, 0 deletions

diff --git a/OpenSim/Framework/UntrustedWebRequest.cs b/OpenSim/Framework/UntrustedWebRequest.cs
new file mode 100644
index 0000000..1af7c41
--- /dev/null
+++ b/OpenSim/Framework/UntrustedWebRequest.cs
@@ -0,0 +1,203 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Net;
+using System.Net.Security;
+using System.Text;
+using log4net;
+
+namespace OpenSim.Framework
+{
+    /// <summary>
+    /// Used for requests to untrusted endpoints that may potentially be
+    /// malicious
+    /// </summary>
+    public static class UntrustedHttpWebRequest
+    {
+        /// <summary>Setting this to true will allow HTTP connections to localhost</summary>
+        private const bool DEBUG = true;
+
+        private static readonly ILog m_log =
+                LogManager.GetLogger(
+                System.Reflection.MethodBase.GetCurrentMethod().DeclaringType);
+
+        private static readonly ICollection<string> allowableSchemes = new List<string> { "http", "https" };
+
+        /// <summary>
+        /// Creates an HttpWebRequest that is hardened against malicious
+        /// endpoints after ensuring the given Uri is safe to retrieve
+        /// </summary>
+        /// <param name="uri">Web location to request</param>
+        /// <returns>A hardened HttpWebRequest if the uri was determined to be safe</returns>
+        /// <exception cref="ArgumentNullException">If uri is null</exception>
+        /// <exception cref="ArgumentException">If uri is unsafe</exception>
+        public static HttpWebRequest Create(Uri uri)
+        {
+            return Create(uri, DEBUG, 1000 * 5, 1000 * 20, 10);
+        }
+
+        /// <summary>
+        /// Creates an HttpWebRequest that is hardened against malicious
+        /// endpoints after ensuring the given Uri is safe to retrieve
+        /// </summary>
+        /// <param name="uri">Web location to request</param>
+        /// <param name="allowLoopback">True to allow connections to localhost, otherwise false</param>
+        /// <param name="readWriteTimeoutMS">Read write timeout, in milliseconds</param>
+        /// <param name="timeoutMS">Connection timeout, in milliseconds</param>
+        /// <param name="maximumRedirects">Maximum number of allowed redirects</param>
+        /// <returns>A hardened HttpWebRequest if the uri was determined to be safe</returns>
+        /// <exception cref="ArgumentNullException">If uri is null</exception>
+        /// <exception cref="ArgumentException">If uri is unsafe</exception>
+        public static HttpWebRequest Create(Uri uri, bool allowLoopback, int readWriteTimeoutMS, int timeoutMS, int maximumRedirects)
+        {
+            if (uri == null)
+                throw new ArgumentNullException("uri");
+
+            if (!IsUriAllowable(uri, allowLoopback))
+                throw new ArgumentException("Uri " + uri + " was rejected");
+
+            HttpWebRequest httpWebRequest = (HttpWebRequest)HttpWebRequest.Create(uri);
+            httpWebRequest.MaximumAutomaticRedirections = maximumRedirects;
+            httpWebRequest.ReadWriteTimeout = readWriteTimeoutMS;
+            httpWebRequest.Timeout = timeoutMS;
+            httpWebRequest.KeepAlive = false;
+
+            return httpWebRequest;
+        }
+
+        public static string PostToUntrustedUrl(Uri url, string data)
+        {
+            try
+            {
+                byte[] requestData = System.Text.Encoding.UTF8.GetBytes(data);
+
+                HttpWebRequest request = Create(url);
+                request.Method = "POST";
+                request.ContentLength = requestData.Length;
+                request.ContentType = "application/x-www-form-urlencoded";
+
+                using (Stream requestStream = request.GetRequestStream())
+                    requestStream.Write(requestData, 0, requestData.Length);
+
+                using (WebResponse response = request.GetResponse())
+                {
+                    using (Stream responseStream = response.GetResponseStream())
+                        return responseStream.GetStreamString();
+                }
+            }
+            catch (Exception ex)
+            {
+                m_log.Warn("POST to untrusted URL " + url + " failed: " + ex.Message);
+                return null;
+            }
+        }
+
+        public static string GetUntrustedUrl(Uri url)
+        {
+            try
+            {
+                HttpWebRequest request = Create(url);
+
+                using (WebResponse response = request.GetResponse())
+                {
+                    using (Stream responseStream = response.GetResponseStream())
+                        return responseStream.GetStreamString();
+                }
+            }
+            catch (Exception ex)
+            {
+                m_log.Warn("GET from untrusted URL " + url + " failed: " + ex.Message);
+                return null;
+            }
+        }
+
+        /// <summary>
+        /// Determines whether a URI is allowed based on scheme and host name.
+        /// No requireSSL check is done here
+        /// </summary>
+        /// <param name="allowLoopback">True to allow loopback addresses to be used</param>
+        /// <param name="uri">The URI to test for whether it should be allowed.</param>
+        /// <returns>
+        ///     <c>true</c> if [is URI allowable] [the specified URI]; otherwise, <c>false</c>.
+        /// </returns>
+        private static bool IsUriAllowable(Uri uri, bool allowLoopback)
+        {
+            if (!allowableSchemes.Contains(uri.Scheme))
+            {
+                m_log.WarnFormat("Rejecting URL {0} because it uses a disallowed scheme.", uri);
+                return false;
+            }
+
+            // Try to interpret the hostname as an IP address so we can test for internal
+            // IP address ranges.  Note that IP addresses can appear in many forms 
+            // (e.g. http://127.0.0.1, http://2130706433, http://0x0100007f, http://::1
+            // So we convert them to a canonical IPAddress instance, and test for all
+            // non-routable IP ranges: 10.*.*.*, 127.*.*.*, ::1
+            // Note that Uri.IsLoopback is very unreliable, not catching many of these variants.
+            IPAddress hostIPAddress;
+            if (IPAddress.TryParse(uri.DnsSafeHost, out hostIPAddress))
+            {
+                byte[] addressBytes = hostIPAddress.GetAddressBytes();
+
+                // The host is actually an IP address.
+                switch (hostIPAddress.AddressFamily)
+                {
+                    case System.Net.Sockets.AddressFamily.InterNetwork:
+                        if (!allowLoopback && (addressBytes[0] == 127 || addressBytes[0] == 10))
+                        {
+                            m_log.WarnFormat("Rejecting URL {0} because it is a loopback address.", uri);
+                            return false;
+                        }
+                        break;
+                    case System.Net.Sockets.AddressFamily.InterNetworkV6:
+                        if (!allowLoopback && IsIPv6Loopback(hostIPAddress))
+                        {
+                            m_log.WarnFormat("Rejecting URL {0} because it is a loopback address.", uri);
+                            return false;
+                        }
+                        break;
+                    default:
+                        m_log.WarnFormat("Rejecting URL {0} because it does not use an IPv4 or IPv6 address.", uri);
+                        return false;
+                }
+            }
+            else
+            {
+                // The host is given by name.  We require names to contain periods to
+                // help make sure it's not an internal address.
+                if (!allowLoopback && !uri.Host.Contains("."))
+                {
+                    m_log.WarnFormat("Rejecting URL {0} because it does not contain a period in the host name.", uri);
+                    return false;
+                }
+            }
+
+            return true;
+        }
+
+        /// <summary>
+        /// Determines whether an IP address is the IPv6 equivalent of "localhost/127.0.0.1".
+        /// </summary>
+        /// <param name="ip">The ip address to check.</param>
+        /// <returns>
+        ///     <c>true</c> if this is a loopback IP address; <c>false</c> otherwise.
+        /// </returns>
+        private static bool IsIPv6Loopback(IPAddress ip)
+        {
+            if (ip == null)
+                throw new ArgumentNullException("ip");
+
+            byte[] addressBytes = ip.GetAddressBytes();
+            for (int i = 0; i < addressBytes.Length - 1; i++)
+            {
+                if (addressBytes[i] != 0)
+                    return false;
+            }
+
+            if (addressBytes[addressBytes.Length - 1] != 1)
+                return false;
+
+            return true;
+        }
+    }
+}