1 files changed, 230 insertions, 0 deletions

diff --git a/OpenSim/Framework/UntrustedWebRequest.cs b/OpenSim/Framework/UntrustedWebRequest.cs
new file mode 100644
index 0000000..e6411cc
--- /dev/null
+++ b/OpenSim/Framework/UntrustedWebRequest.cs
@@ -0,0 +1,230 @@
+/*
+ * Copyright (c) Contributors, http://opensimulator.org/
+ * See CONTRIBUTORS.TXT for a full list of copyright holders.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of the OpenSimulator Project nor the
+ *       names of its contributors may be used to endorse or promote products
+ *       derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE DEVELOPERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Net;
+using System.Net.Security;
+using System.Text;
+using log4net;
+
+namespace OpenSim.Framework
+{
+    /// <summary>
+    /// Used for requests to untrusted endpoints that may potentially be
+    /// malicious
+    /// </summary>
+    public static class UntrustedHttpWebRequest
+    {
+        /// <summary>Setting this to true will allow HTTP connections to localhost</summary>
+        private const bool DEBUG = true;
+
+        private static readonly ILog m_log =
+                LogManager.GetLogger(
+                System.Reflection.MethodBase.GetCurrentMethod().DeclaringType);
+
+        private static readonly ICollection<string> allowableSchemes = new List<string> { "http", "https" };
+
+        /// <summary>
+        /// Creates an HttpWebRequest that is hardened against malicious
+        /// endpoints after ensuring the given Uri is safe to retrieve
+        /// </summary>
+        /// <param name="uri">Web location to request</param>
+        /// <returns>A hardened HttpWebRequest if the uri was determined to be safe</returns>
+        /// <exception cref="ArgumentNullException">If uri is null</exception>
+        /// <exception cref="ArgumentException">If uri is unsafe</exception>
+        public static HttpWebRequest Create(Uri uri)
+        {
+            return Create(uri, DEBUG, 1000 * 5, 1000 * 20, 10);
+        }
+
+        /// <summary>
+        /// Creates an HttpWebRequest that is hardened against malicious
+        /// endpoints after ensuring the given Uri is safe to retrieve
+        /// </summary>
+        /// <param name="uri">Web location to request</param>
+        /// <param name="allowLoopback">True to allow connections to localhost, otherwise false</param>
+        /// <param name="readWriteTimeoutMS">Read write timeout, in milliseconds</param>
+        /// <param name="timeoutMS">Connection timeout, in milliseconds</param>
+        /// <param name="maximumRedirects">Maximum number of allowed redirects</param>
+        /// <returns>A hardened HttpWebRequest if the uri was determined to be safe</returns>
+        /// <exception cref="ArgumentNullException">If uri is null</exception>
+        /// <exception cref="ArgumentException">If uri is unsafe</exception>
+        public static HttpWebRequest Create(Uri uri, bool allowLoopback, int readWriteTimeoutMS, int timeoutMS, int maximumRedirects)
+        {
+            if (uri == null)
+                throw new ArgumentNullException("uri");
+
+            if (!IsUriAllowable(uri, allowLoopback))
+                throw new ArgumentException("Uri " + uri + " was rejected");
+
+            HttpWebRequest httpWebRequest = (HttpWebRequest)HttpWebRequest.Create(uri);
+            httpWebRequest.MaximumAutomaticRedirections = maximumRedirects;
+            httpWebRequest.ReadWriteTimeout = readWriteTimeoutMS;
+            httpWebRequest.Timeout = timeoutMS;
+            httpWebRequest.KeepAlive = false;
+
+            return httpWebRequest;
+        }
+
+        public static string PostToUntrustedUrl(Uri url, string data)
+        {
+            try
+            {
+                byte[] requestData = System.Text.Encoding.UTF8.GetBytes(data);
+
+                HttpWebRequest request = Create(url);
+                request.Method = "POST";
+                request.ContentLength = requestData.Length;
+                request.ContentType = "application/x-www-form-urlencoded";
+
+                using (Stream requestStream = request.GetRequestStream())
+                    requestStream.Write(requestData, 0, requestData.Length);
+
+                using (WebResponse response = request.GetResponse())
+                {
+                    using (Stream responseStream = response.GetResponseStream())
+                        return responseStream.GetStreamString();
+                }
+            }
+            catch (Exception ex)
+            {
+                m_log.Warn("POST to untrusted URL " + url + " failed: " + ex.Message);
+                return null;
+            }
+        }
+
+        public static string GetUntrustedUrl(Uri url)
+        {
+            try
+            {
+                HttpWebRequest request = Create(url);
+
+                using (WebResponse response = request.GetResponse())
+                {
+                    using (Stream responseStream = response.GetResponseStream())
+                        return responseStream.GetStreamString();
+                }
+            }
+            catch (Exception ex)
+            {
+                m_log.Warn("GET from untrusted URL " + url + " failed: " + ex.Message);
+                return null;
+            }
+        }
+
+        /// <summary>
+        /// Determines whether a URI is allowed based on scheme and host name.
+        /// No requireSSL check is done here
+        /// </summary>
+        /// <param name="allowLoopback">True to allow loopback addresses to be used</param>
+        /// <param name="uri">The URI to test for whether it should be allowed.</param>
+        /// <returns>
+        ///     <c>true</c> if [is URI allowable] [the specified URI]; otherwise, <c>false</c>.
+        /// </returns>
+        private static bool IsUriAllowable(Uri uri, bool allowLoopback)
+        {
+            if (!allowableSchemes.Contains(uri.Scheme))
+            {
+                m_log.WarnFormat("Rejecting URL {0} because it uses a disallowed scheme.", uri);
+                return false;
+            }
+
+            // Try to interpret the hostname as an IP address so we can test for internal
+            // IP address ranges.  Note that IP addresses can appear in many forms 
+            // (e.g. http://127.0.0.1, http://2130706433, http://0x0100007f, http://::1
+            // So we convert them to a canonical IPAddress instance, and test for all
+            // non-routable IP ranges: 10.*.*.*, 127.*.*.*, ::1
+            // Note that Uri.IsLoopback is very unreliable, not catching many of these variants.
+            IPAddress hostIPAddress;
+            if (IPAddress.TryParse(uri.DnsSafeHost, out hostIPAddress))
+            {
+                byte[] addressBytes = hostIPAddress.GetAddressBytes();
+
+                // The host is actually an IP address.
+                switch (hostIPAddress.AddressFamily)
+                {
+                    case System.Net.Sockets.AddressFamily.InterNetwork:
+                        if (!allowLoopback && (addressBytes[0] == 127 || addressBytes[0] == 10))
+                        {
+                            m_log.WarnFormat("Rejecting URL {0} because it is a loopback address.", uri);
+                            return false;
+                        }
+                        break;
+                    case System.Net.Sockets.AddressFamily.InterNetworkV6:
+                        if (!allowLoopback && IsIPv6Loopback(hostIPAddress))
+                        {
+                            m_log.WarnFormat("Rejecting URL {0} because it is a loopback address.", uri);
+                            return false;
+                        }
+                        break;
+                    default:
+                        m_log.WarnFormat("Rejecting URL {0} because it does not use an IPv4 or IPv6 address.", uri);
+                        return false;
+                }
+            }
+            else
+            {
+                // The host is given by name.  We require names to contain periods to
+                // help make sure it's not an internal address.
+                if (!allowLoopback && !uri.Host.Contains("."))
+                {
+                    m_log.WarnFormat("Rejecting URL {0} because it does not contain a period in the host name.", uri);
+                    return false;
+                }
+            }
+
+            return true;
+        }
+
+        /// <summary>
+        /// Determines whether an IP address is the IPv6 equivalent of "localhost/127.0.0.1".
+        /// </summary>
+        /// <param name="ip">The ip address to check.</param>
+        /// <returns>
+        ///     <c>true</c> if this is a loopback IP address; <c>false</c> otherwise.
+        /// </returns>
+        private static bool IsIPv6Loopback(IPAddress ip)
+        {
+            if (ip == null)
+                throw new ArgumentNullException("ip");
+
+            byte[] addressBytes = ip.GetAddressBytes();
+            for (int i = 0; i < addressBytes.Length - 1; i++)
+            {
+                if (addressBytes[i] != 0)
+                    return false;
+            }
+
+            if (addressBytes[addressBytes.Length - 1] != 1)
+                return false;
+
+            return true;
+        }
+    }
+}