ogb912/opensim
1
0
Fork 0
mirror of https://github.com/opensim/opensim.git synced 2026-08-11 03:45:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add outbound URL filter to llHttpRequest() and osSetDynamicTextureURL*() script functions.

Browse Source 
This is to address an issue where HTTP script functions could make calls to localhost and other endpoints inside the simulator's LAN.
By default, calls to all private addresses are now blocked as per http://en.wikipedia.org/wiki/Reserved_IP_addresses
If you require exceptions to this, configure [Network] OutboundDisallowForUserScriptsExcept in OpenSim.ini
This commit is contained in:
Justin Clark-Casey (justincc)
2015-03-04 17:43:00 +00:00
parent 2d8c1806ca
commit 7d3bafd5ab
10 changed files with 499 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
bin/OpenSimDefaults.ini
View File

@@ -492,6 +492,26 @@
; (on Windows this mean NETBIOS name - useably only inside local network)
; ExternalHostNameForLSL=127.0.0.1
; Disallow the following address ranges for user scripting calls (e.g. llHttpRequest())
; This is based on http://en.wikipedia.org/wiki/Reserved_IP_addresses
; This stops users making HTTP calls to machines in the simulator's local network.
; If you need to allow some LAN calls we recommend you use OutboundDisallowForUserScriptsExcept documented in OpenSim.ini.example
; If you override OutboundDisallowForUserScripts directly you need to be very careful.
;
; Network ranges are specified in CIDR notation (http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation) with multiple entries separated by |
; To specify an individual IP address use the /32 netmask (e.g. 192.168.1.3/32)
; You can also specify individual <addr>:<port> endpoints (e.g. 192.168.1.3:8003)
; If an address if given without a port number then port 80 is assumed.
OutboundDisallowForUserScripts = 0.0.0.0/8|10.0.0.0/8|100.64.0.0/10|127.0.0.0/8|169.254.0.0/16|172.16.0.0/12|192.0.0.0/24|192.0.2.0/24|192.88.99.0/24|192.168.0.0/16|198.18.0.0/15|198.51.100.0/24|203.0.113.0/24|224.0.0.0/4|240.0.0.0/4|255.255.255.255/32
;
; You can also prevent all user script outgoing calls with the following override in OpenSim.ini
;
; OutboundDisallowForUserScripts = 0.0.0.0/0
;
; You can also disable the blacklist entirely with an empty entry
;
; OutboundDisallowForUserScripts = ""
; What is reported as the "X-Secondlife-Shard"
; Defaults to the user server url if not set
; The old default is "OpenSim", set here for compatibility