From 7f2ec02802cabc98e93ac872999933b6e5be48e5 Mon Sep 17 00:00:00 2001
From: Adam Frisby
Date: Sun, 21 Oct 2007 22:15:41 +0000
Subject: * Disabled TCP Remoting Channel Security for InterRegion
communication, as it appears we are not implementing this correctly. (need to
set up certificates first) * Documented ACL class
---
.../Region/Communications/OGS1/OGS1GridServices.cs | 2 +-
OpenSim/Region/Environment/PermissionManager.cs | 653 +++++++++++----------
2 files changed, 328 insertions(+), 327 deletions(-)
(limited to 'OpenSim/Region')
diff --git a/OpenSim/Region/Communications/OGS1/OGS1GridServices.cs b/OpenSim/Region/Communications/OGS1/OGS1GridServices.cs
index 1a9584a..cc56078 100644
--- a/OpenSim/Region/Communications/OGS1/OGS1GridServices.cs
+++ b/OpenSim/Region/Communications/OGS1/OGS1GridServices.cs
@@ -327,7 +327,7 @@ namespace OpenSim.Region.Communications.OGS1
private void StartRemoting()
{
TcpChannel ch = new TcpChannel(this.serversInfo.RemotingListenerPort);
- ChannelServices.RegisterChannel(ch, true);
+ ChannelServices.RegisterChannel(ch, false); // Disabled security as Mono doesnt support this.
WellKnownServiceTypeEntry wellType = new WellKnownServiceTypeEntry(typeof(OGS1InterRegionRemoting), "InterRegions", WellKnownObjectMode.Singleton);
RemotingConfiguration.RegisterWellKnownServiceType(wellType);
diff --git a/OpenSim/Region/Environment/PermissionManager.cs b/OpenSim/Region/Environment/PermissionManager.cs
index d32ac0b..c40012d 100644
--- a/OpenSim/Region/Environment/PermissionManager.cs
+++ b/OpenSim/Region/Environment/PermissionManager.cs
@@ -1,327 +1,328 @@
-/*
-* Copyright (c) Contributors, http://opensimulator.org/
-* See CONTRIBUTORS.TXT for a full list of copyright holders.
-*
-* Redistribution and use in source and binary forms, with or without
-* modification, are permitted provided that the following conditions are met:
-* * Redistributions of source code must retain the above copyright
-* notice, this list of conditions and the following disclaimer.
-* * Redistributions in binary form must reproduce the above copyright
-* notice, this list of conditions and the following disclaimer in the
-* documentation and/or other materials provided with the distribution.
-* * Neither the name of the OpenSim Project nor the
-* names of its contributors may be used to endorse or promote products
-* derived from this software without specific prior written permission.
-*
-* THIS SOFTWARE IS PROVIDED BY THE DEVELOPERS AS IS AND ANY
-* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-* DISCLAIMED. IN NO EVENT SHALL THE CONTRIBUTORS BE LIABLE FOR ANY
-* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*
-*/
-
-using libsecondlife;
-using OpenSim.Region.Environment.LandManagement;
+/*
+* Copyright (c) Contributors, http://opensimulator.org/
+* See CONTRIBUTORS.TXT for a full list of copyright holders.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+* * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+* * Redistributions in binary form must reproduce the above copyright
+* notice, this list of conditions and the following disclaimer in the
+* documentation and/or other materials provided with the distribution.
+* * Neither the name of the OpenSim Project nor the
+* names of its contributors may be used to endorse or promote products
+* derived from this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE DEVELOPERS AS IS AND ANY
+* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE CONTRIBUTORS BE LIABLE FOR ANY
+* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*
+*/
+
+using libsecondlife;
+using OpenSim.Region.Environment.LandManagement;
using OpenSim.Region.Environment.Scenes;
-
-namespace OpenSim.Region.Environment
-{
- public class PermissionManager
- {
- protected Scene m_scene;
-
- // Bypasses the permissions engine (always returns OK)
- // disable in any production environment
- // TODO: Change this to false when permissions are a desired default
- // TODO: Move to configuration option.
- private bool m_bypassPermissions = true;
-
- public bool BypassPermissions
- {
- get { return m_bypassPermissions; }
- set { m_bypassPermissions = value; }
- }
-
-
- public PermissionManager(Scene scene)
- {
- m_scene = scene;
- }
-
- protected virtual void SendPermissionError(LLUUID user, string reason)
- {
- m_scene.EventManager.TriggerPermissionError(user, reason);
- }
-
- protected virtual bool IsAdministrator(LLUUID user)
- {
- if (m_bypassPermissions)
- {
- return true;
- }
-
- return m_scene.RegionInfo.MasterAvatarAssignedUUID == user;
- }
-
- protected virtual bool IsEstateManager(LLUUID user)
- {
- if (m_bypassPermissions)
- {
- return true;
- }
-
- return false;
- }
-
- protected virtual bool IsGridUser(LLUUID user)
- {
- return true;
- }
-
- protected virtual bool IsGuest(LLUUID user)
- {
- return false;
- }
-
- public virtual bool CanRezObject(LLUUID user, LLVector3 position)
- {
- bool permission = false;
-
- string reason = "Insufficient permission";
-
- if (IsAdministrator(user))
- {
- permission = true;
- }
- else
- {
- reason = "Not an administrator";
- }
-
- if (GenericParcelPermission(user, position))
- {
- permission = true;
- }
- else
- {
- reason = "Not the parcel owner";
- }
-
- if (!permission)
- SendPermissionError(user, reason);
-
- return permission;
- }
-
- #region Object Permissions
-
- protected virtual bool GenericObjectPermission(LLUUID user, LLUUID objId)
- {
- // Default: deny
- bool permission = false;
-
- if (!m_scene.Entities.ContainsKey(objId))
- {
- return false;
- }
-
- // If it's not an object, we cant edit it.
- if (!(m_scene.Entities[objId] is SceneObjectGroup))
- {
- return false;
- }
-
- SceneObjectGroup task = (SceneObjectGroup) m_scene.Entities[objId];
- LLUUID taskOwner = null;
-
- // Object owners should be able to edit their own content
- if (user == taskOwner)
- permission = true;
-
- // Users should be able to edit what is over their land.
- if (m_scene.LandManager.getLandObject(task.AbsolutePosition.X, task.AbsolutePosition.Y).landData.ownerID ==
- user)
- permission = true;
-
- // Estate users should be able to edit anything in the sim
- if (IsEstateManager(user))
- permission = true;
-
- // Admin objects should not be editable by the above
- if (IsAdministrator(taskOwner))
- permission = false;
-
- // Admin should be able to edit anything in the sim (including admin objects)
- if (IsAdministrator(user))
- permission = true;
-
- return permission;
- }
-
- ///
- /// Permissions check - can user delete an object?
- ///
- /// User attempting the delete
- /// Target object
- /// Has permission?
- public virtual bool CanDeRezObject(LLUUID user, LLUUID obj)
- {
- return GenericObjectPermission(user, obj);
- }
-
- public virtual bool CanEditObject(LLUUID user, LLUUID obj)
- {
- return GenericObjectPermission(user, obj);
- }
-
- public virtual bool CanReturnObject(LLUUID user, LLUUID obj)
- {
- return GenericObjectPermission(user, obj);
- }
-
- #endregion
-
- #region Communication Permissions
-
- public virtual bool GenericCommunicationPermission(LLUUID user, LLUUID target)
- {
- bool permission = false;
- string reason = "Only registered users may communicate with another account.";
-
- if (IsGridUser(user))
- permission = true;
-
- if (!IsGridUser(user))
- {
- permission = false;
- reason = "The person that you are messaging is not a registered user.";
- }
- if (IsAdministrator(user))
- permission = true;
-
- if (IsEstateManager(user))
- permission = true;
-
- if (!permission)
- SendPermissionError(user, reason);
-
- return permission;
- }
-
- public virtual bool CanInstantMessage(LLUUID user, LLUUID target)
- {
- return GenericCommunicationPermission(user, target);
- }
-
- public virtual bool CanInventoryTransfer(LLUUID user, LLUUID target)
- {
- return GenericCommunicationPermission(user, target);
- }
-
- #endregion
-
- public virtual bool CanEditScript(LLUUID user, LLUUID script)
- {
- return IsAdministrator(user);
- }
-
- public virtual bool CanRunScript(LLUUID user, LLUUID script)
- {
- return IsAdministrator(user);
- }
-
- public virtual bool CanTerraform(LLUUID user, LLVector3 position)
- {
- bool permission = false;
-
- // Estate override
- if (GenericEstatePermission(user))
- permission = true;
-
- // Land owner can terraform too
- if (GenericParcelPermission(user, m_scene.LandManager.getLandObject(position.X, position.Y)))
- permission = true;
-
- if (!permission)
- SendPermissionError(user, "Not authorized to terraform at this location.");
-
- return permission;
- }
-
- #region Estate Permissions
-
- protected virtual bool GenericEstatePermission(LLUUID user)
- {
- // Default: deny
- bool permission = false;
-
- // Estate admins should be able to use estate tools
- if (IsEstateManager(user))
- permission = true;
-
- // Administrators always have permission
- if (IsAdministrator(user))
- permission = true;
-
- return permission;
- }
-
- public virtual bool CanEditEstateTerrain(LLUUID user)
- {
- return GenericEstatePermission(user);
- }
-
- #endregion
-
- #region Parcel Permissions
-
- protected virtual bool GenericParcelPermission(LLUUID user, Land parcel)
- {
- bool permission = false;
-
- if (parcel.landData.ownerID == user)
- permission = true;
-
- if (parcel.landData.isGroupOwned)
- {
- // TODO: Need to do some extra checks here. Requires group code.
- }
-
- if (IsEstateManager(user))
- permission = true;
-
- if (IsAdministrator(user))
- permission = true;
-
- return permission;
- }
-
- protected virtual bool GenericParcelPermission(LLUUID user, LLVector3 pos)
- {
- return GenericParcelPermission(user, m_scene.LandManager.getLandObject(pos.X, pos.Y));
- }
-
- public virtual bool CanEditParcel(LLUUID user, Land parcel)
- {
- return GenericParcelPermission(user, parcel);
- }
-
- public virtual bool CanSellParcel(LLUUID user, Land parcel)
- {
- return GenericParcelPermission(user, parcel);
- }
-
- public virtual bool CanAbandonParcel(LLUUID user, Land parcel)
- {
- return GenericParcelPermission(user, parcel);
- }
-
- #endregion
- }
-}
+using OpenSim.Framework.PolicyManager;
+
+namespace OpenSim.Region.Environment
+{
+ public class PermissionManager
+ {
+ protected Scene m_scene;
+
+ // Bypasses the permissions engine (always returns OK)
+ // disable in any production environment
+ // TODO: Change this to false when permissions are a desired default
+ // TODO: Move to configuration option.
+ private bool m_bypassPermissions = true;
+
+ public bool BypassPermissions
+ {
+ get { return m_bypassPermissions; }
+ set { m_bypassPermissions = value; }
+ }
+
+
+ public PermissionManager(Scene scene)
+ {
+ m_scene = scene;
+ }
+
+ protected virtual void SendPermissionError(LLUUID user, string reason)
+ {
+ m_scene.EventManager.TriggerPermissionError(user, reason);
+ }
+
+ protected virtual bool IsAdministrator(LLUUID user)
+ {
+ if (m_bypassPermissions)
+ {
+ return true;
+ }
+
+ return m_scene.RegionInfo.MasterAvatarAssignedUUID == user;
+ }
+
+ protected virtual bool IsEstateManager(LLUUID user)
+ {
+ if (m_bypassPermissions)
+ {
+ return true;
+ }
+
+ return false;
+ }
+
+ protected virtual bool IsGridUser(LLUUID user)
+ {
+ return true;
+ }
+
+ protected virtual bool IsGuest(LLUUID user)
+ {
+ return false;
+ }
+
+ public virtual bool CanRezObject(LLUUID user, LLVector3 position)
+ {
+ bool permission = false;
+
+ string reason = "Insufficient permission";
+
+ if (IsAdministrator(user))
+ {
+ permission = true;
+ }
+ else
+ {
+ reason = "Not an administrator";
+ }
+
+ if (GenericParcelPermission(user, position))
+ {
+ permission = true;
+ }
+ else
+ {
+ reason = "Not the parcel owner";
+ }
+
+ if (!permission)
+ SendPermissionError(user, reason);
+
+ return permission;
+ }
+
+ #region Object Permissions
+
+ protected virtual bool GenericObjectPermission(LLUUID user, LLUUID objId)
+ {
+ // Default: deny
+ bool permission = false;
+
+ if (!m_scene.Entities.ContainsKey(objId))
+ {
+ return false;
+ }
+
+ // If it's not an object, we cant edit it.
+ if (!(m_scene.Entities[objId] is SceneObjectGroup))
+ {
+ return false;
+ }
+
+ SceneObjectGroup task = (SceneObjectGroup) m_scene.Entities[objId];
+ LLUUID taskOwner = null;
+
+ // Object owners should be able to edit their own content
+ if (user == taskOwner)
+ permission = true;
+
+ // Users should be able to edit what is over their land.
+ if (m_scene.LandManager.getLandObject(task.AbsolutePosition.X, task.AbsolutePosition.Y).landData.ownerID ==
+ user)
+ permission = true;
+
+ // Estate users should be able to edit anything in the sim
+ if (IsEstateManager(user))
+ permission = true;
+
+ // Admin objects should not be editable by the above
+ if (IsAdministrator(taskOwner))
+ permission = false;
+
+ // Admin should be able to edit anything in the sim (including admin objects)
+ if (IsAdministrator(user))
+ permission = true;
+
+ return permission;
+ }
+
+ ///
+ /// Permissions check - can user delete an object?
+ ///
+ /// User attempting the delete
+ /// Target object
+ /// Has permission?
+ public virtual bool CanDeRezObject(LLUUID user, LLUUID obj)
+ {
+ return GenericObjectPermission(user, obj);
+ }
+
+ public virtual bool CanEditObject(LLUUID user, LLUUID obj)
+ {
+ return GenericObjectPermission(user, obj);
+ }
+
+ public virtual bool CanReturnObject(LLUUID user, LLUUID obj)
+ {
+ return GenericObjectPermission(user, obj);
+ }
+
+ #endregion
+
+ #region Communication Permissions
+
+ public virtual bool GenericCommunicationPermission(LLUUID user, LLUUID target)
+ {
+ bool permission = false;
+ string reason = "Only registered users may communicate with another account.";
+
+ if (IsGridUser(user))
+ permission = true;
+
+ if (!IsGridUser(user))
+ {
+ permission = false;
+ reason = "The person that you are messaging is not a registered user.";
+ }
+ if (IsAdministrator(user))
+ permission = true;
+
+ if (IsEstateManager(user))
+ permission = true;
+
+ if (!permission)
+ SendPermissionError(user, reason);
+
+ return permission;
+ }
+
+ public virtual bool CanInstantMessage(LLUUID user, LLUUID target)
+ {
+ return GenericCommunicationPermission(user, target);
+ }
+
+ public virtual bool CanInventoryTransfer(LLUUID user, LLUUID target)
+ {
+ return GenericCommunicationPermission(user, target);
+ }
+
+ #endregion
+
+ public virtual bool CanEditScript(LLUUID user, LLUUID script)
+ {
+ return IsAdministrator(user);
+ }
+
+ public virtual bool CanRunScript(LLUUID user, LLUUID script)
+ {
+ return IsAdministrator(user);
+ }
+
+ public virtual bool CanTerraform(LLUUID user, LLVector3 position)
+ {
+ bool permission = false;
+
+ // Estate override
+ if (GenericEstatePermission(user))
+ permission = true;
+
+ // Land owner can terraform too
+ if (GenericParcelPermission(user, m_scene.LandManager.getLandObject(position.X, position.Y)))
+ permission = true;
+
+ if (!permission)
+ SendPermissionError(user, "Not authorized to terraform at this location.");
+
+ return permission;
+ }
+
+ #region Estate Permissions
+
+ protected virtual bool GenericEstatePermission(LLUUID user)
+ {
+ // Default: deny
+ bool permission = false;
+
+ // Estate admins should be able to use estate tools
+ if (IsEstateManager(user))
+ permission = true;
+
+ // Administrators always have permission
+ if (IsAdministrator(user))
+ permission = true;
+
+ return permission;
+ }
+
+ public virtual bool CanEditEstateTerrain(LLUUID user)
+ {
+ return GenericEstatePermission(user);
+ }
+
+ #endregion
+
+ #region Parcel Permissions
+
+ protected virtual bool GenericParcelPermission(LLUUID user, Land parcel)
+ {
+ bool permission = false;
+
+ if (parcel.landData.ownerID == user)
+ permission = true;
+
+ if (parcel.landData.isGroupOwned)
+ {
+ // TODO: Need to do some extra checks here. Requires group code.
+ }
+
+ if (IsEstateManager(user))
+ permission = true;
+
+ if (IsAdministrator(user))
+ permission = true;
+
+ return permission;
+ }
+
+ protected virtual bool GenericParcelPermission(LLUUID user, LLVector3 pos)
+ {
+ return GenericParcelPermission(user, m_scene.LandManager.getLandObject(pos.X, pos.Y));
+ }
+
+ public virtual bool CanEditParcel(LLUUID user, Land parcel)
+ {
+ return GenericParcelPermission(user, parcel);
+ }
+
+ public virtual bool CanSellParcel(LLUUID user, Land parcel)
+ {
+ return GenericParcelPermission(user, parcel);
+ }
+
+ public virtual bool CanAbandonParcel(LLUUID user, Land parcel)
+ {
+ return GenericParcelPermission(user, parcel);
+ }
+
+ #endregion
+ }
+}
--
cgit v1.1