From 1f7e0d1dd9c517fc4a09c9b3a330dcb453554de2 Mon Sep 17 00:00:00 2001 From: UbitUmarov Date: Sun, 21 Jul 2024 00:14:29 +0100 Subject: [PATCH 01/13] fix typo --- .../Serialization/External/RegionSettingsSerializer.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OpenSim/Framework/Serialization/External/RegionSettingsSerializer.cs b/OpenSim/Framework/Serialization/External/RegionSettingsSerializer.cs index 648c9b6025..66d00516a6 100644 --- a/OpenSim/Framework/Serialization/External/RegionSettingsSerializer.cs +++ b/OpenSim/Framework/Serialization/External/RegionSettingsSerializer.cs @@ -150,7 +150,7 @@ namespace OpenSim.Framework.Serialization.External settings.TerrainPBR3 = UUID.Parse(xtr.ReadElementContentAsString()); break; case "PBR4": - settings.TerrainPBR3 = UUID.Parse(xtr.ReadElementContentAsString()); + settings.TerrainPBR4 = UUID.Parse(xtr.ReadElementContentAsString()); break; case "ElevationLowSW": settings.Elevation1SW = double.Parse(xtr.ReadElementContentAsString(), Culture.NumberFormatInfo); From d9cfb3bcae4365bb1a20652d4465a25f6db191d7 Mon Sep 17 00:00:00 2001 From: UbitUmarov Date: Thu, 1 Aug 2024 19:58:12 +0100 Subject: [PATCH 02/13] improve script cpu time resolution specially on windows --- OpenSim/Region/ScriptEngine/YEngine/XMRInstRun.cs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/OpenSim/Region/ScriptEngine/YEngine/XMRInstRun.cs b/OpenSim/Region/ScriptEngine/YEngine/XMRInstRun.cs index 88969e8fec..105bb44f20 100644 --- a/OpenSim/Region/ScriptEngine/YEngine/XMRInstRun.cs +++ b/OpenSim/Region/ScriptEngine/YEngine/XMRInstRun.cs @@ -396,10 +396,10 @@ namespace OpenSim.Region.ScriptEngine.Yengine e = StartEventHandler(evc, evt.Params); } //m_RunOnePhase = "done running"; - m_CPUTime += DateTime.UtcNow.Subtract(now).TotalMilliseconds; + m_CPUTime += Util.GetTimeStampMS() - m_SliceStart; - // Maybe it puqued. - if(e is not null) + // Maybe it puqued. + if (e is not null) { //m_RunOnePhase = "handling exception " + e.Message; HandleScriptException(e); From 70fa48280cd0fe93dff10537aec75d2ac7db4fb3 Mon Sep 17 00:00:00 2001 From: UbitUmarov Date: Thu, 1 Aug 2024 20:00:25 +0100 Subject: [PATCH 03/13] catch some possible null refs --- .../Framework/Scenes/SceneObjectGroup.cs | 104 +++++++++++------- 1 file changed, 62 insertions(+), 42 deletions(-) diff --git a/OpenSim/Region/Framework/Scenes/SceneObjectGroup.cs b/OpenSim/Region/Framework/Scenes/SceneObjectGroup.cs index 6a85c90507..93ac79bd12 100644 --- a/OpenSim/Region/Framework/Scenes/SceneObjectGroup.cs +++ b/OpenSim/Region/Framework/Scenes/SceneObjectGroup.cs @@ -5150,31 +5150,41 @@ namespace OpenSim.Region.Framework.Scenes if (engines.Length == 0) // No engine at all return 0.0f; - float time = 0.0f; - - // get all the scripts in all parts - SceneObjectPart[] parts = m_parts.GetArray(); - List scripts = new(); - for (int i = 0; i < parts.Length; i++) + try { - scripts.AddRange(parts[i].Inventory.GetInventoryItems(InventoryType.LSL)); - } - // extract the UUIDs - HashSet unique = new(); - foreach (TaskInventoryItem script in scripts) - unique.Add(script.ItemID); + float time = 0.0f; - List ids = unique.ToList(); - - // Offer the list of script UUIDs to each engine found and accumulate the time - foreach (IScriptModule e in engines) - { - if (e is not null) + // get all the scripts in all parts + SceneObjectPart[] parts = m_parts.GetArray(); + List scripts = new(); + for (int i = 0; i < parts.Length; i++) { - time += e.GetScriptExecutionTime(ids); + IEntityInventory inv = parts[i].Inventory; + if (inv is not null) + scripts.AddRange(parts[i].Inventory.GetInventoryItems(InventoryType.LSL)); } + + // extract the UUIDs + HashSet unique = new(); + foreach (TaskInventoryItem script in scripts) + unique.Add(script.ItemID); + + List ids = unique.ToList(); + + // Offer the list of script UUIDs to each engine found and accumulate the time + foreach (IScriptModule e in engines) + { + if (e is not null) + { + time += e.GetScriptExecutionTime(ids); + } + } + return time; + } + catch + { + return 0.0f; } - return time; } public bool ScriptsMemory(out int memory) @@ -5184,32 +5194,42 @@ namespace OpenSim.Region.Framework.Scenes if (engines.Length == 0) // No engine at all return false; - // get all the scripts in all parts - SceneObjectPart[] parts = m_parts.GetArray(); - List scripts = new(); - for (int i = 0; i < parts.Length; i++) + try { - scripts.AddRange(parts[i].Inventory.GetInventoryItems(InventoryType.LSL)); - } - - if (scripts.Count == 0) - return false; - - // extract the UUIDs - HashSet unique = new(); - foreach (TaskInventoryItem script in scripts) - unique.Add(script.ItemID); - - List ids = unique.ToList(); - // Offer the list of script UUIDs to each engine found and accumulate the memory - foreach (IScriptModule e in engines) - { - if (e is not null) + // get all the scripts in all parts + SceneObjectPart[] parts = m_parts.GetArray(); + List scripts = new(); + for (int i = 0; i < parts.Length; i++) { - memory += e.GetScriptsMemory(ids); + IEntityInventory inv = parts[i].Inventory; + if(inv is not null) + scripts.AddRange(inv.GetInventoryItems(InventoryType.LSL)); } + + if (scripts.Count == 0) + return false; + + // extract the UUIDs + HashSet unique = new(); + foreach (TaskInventoryItem script in scripts) + unique.Add(script.ItemID); + + List ids = unique.ToList(); + // Offer the list of script UUIDs to each engine found and accumulate the memory + foreach (IScriptModule e in engines) + { + if (e is not null) + { + memory += e.GetScriptsMemory(ids); + } + } + return true; } - return true; + catch + { + return false; + } + } /// From f1b6d9186e26d4219bf13f7f972c378de895e5b5 Mon Sep 17 00:00:00 2001 From: UbitUmarov Date: Fri, 2 Aug 2024 03:29:40 +0100 Subject: [PATCH 04/13] mantis 9135: avoid null ref --- .../Region/CoreModules/World/Estate/EstateManagementModule.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OpenSim/Region/CoreModules/World/Estate/EstateManagementModule.cs b/OpenSim/Region/CoreModules/World/Estate/EstateManagementModule.cs index 55c5bf2781..2cd458ea31 100644 --- a/OpenSim/Region/CoreModules/World/Estate/EstateManagementModule.cs +++ b/OpenSim/Region/CoreModules/World/Estate/EstateManagementModule.cs @@ -541,7 +541,7 @@ namespace OpenSim.Region.CoreModules.World.Estate if (texture.IsZero()) return; - if((remoteClient.ViewerFlags & ViewerFlags.TPBR) != 0) + if(remoteClient is not null && (remoteClient.ViewerFlags & ViewerFlags.TPBR) != 0) { switch (level) { From 2361876f46a448351e7d496b7d2d20b80509b2c1 Mon Sep 17 00:00:00 2001 From: UbitUmarov Date: Thu, 8 Aug 2024 05:41:35 +0100 Subject: [PATCH 05/13] another null ref, thx Tampa --- .../Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs index 6e24a26d7c..1d914d3770 100644 --- a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs +++ b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/LSL_Api.cs @@ -13660,7 +13660,7 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api ScenePresence presence = World.GetScenePresence(agentID); // we are not interested in child-agents - if (presence.IsChildAgent) + if (presence is null || presence.IsChildAgent) return; presence.ControllingClient.SendClearFollowCamProperties(objectID); From b0d006c53a087165dab61463cc77d6e01e3ff8b0 Mon Sep 17 00:00:00 2001 From: UbitUmarov Date: Mon, 12 Aug 2024 20:55:28 +0100 Subject: [PATCH 06/13] another typo, thx Tampa --- OpenSim/Region/ScriptEngine/YEngine/XMRInstMain.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OpenSim/Region/ScriptEngine/YEngine/XMRInstMain.cs b/OpenSim/Region/ScriptEngine/YEngine/XMRInstMain.cs index 36d62e315a..fcff9ef1bf 100644 --- a/OpenSim/Region/ScriptEngine/YEngine/XMRInstMain.cs +++ b/OpenSim/Region/ScriptEngine/YEngine/XMRInstMain.cs @@ -138,7 +138,7 @@ namespace OpenSim.Region.ScriptEngine.Yengine // guards m_DetachQuantum, m_EventQueue, m_EventCounts, m_Running, m_Suspended public Object m_QueueLock = new Object(); - // true iff allowed to accept new events + // true if allowed to accept new events public bool m_Running = true; // queue of events that haven't been acted upon yet From e2b655a93949ec8a66c512db47617400b036c428 Mon Sep 17 00:00:00 2001 From: UbitUmarov Date: Wed, 14 Aug 2024 13:28:33 +0100 Subject: [PATCH 07/13] verify vivox requests --- .../FreeSwitchVoice/FreeSwitchVoiceModule.cs | 24 ++++++++++++++++--- .../Voice/VivoxVoice/VivoxVoiceModule.cs | 19 +++++++++++++++ 2 files changed, 40 insertions(+), 3 deletions(-) diff --git a/OpenSim/Region/OptionalModules/Avatar/Voice/FreeSwitchVoice/FreeSwitchVoiceModule.cs b/OpenSim/Region/OptionalModules/Avatar/Voice/FreeSwitchVoice/FreeSwitchVoiceModule.cs index 4b1142820f..ba442275b0 100644 --- a/OpenSim/Region/OptionalModules/Avatar/Voice/FreeSwitchVoice/FreeSwitchVoiceModule.cs +++ b/OpenSim/Region/OptionalModules/Avatar/Voice/FreeSwitchVoice/FreeSwitchVoiceModule.cs @@ -66,7 +66,7 @@ namespace OpenSim.Region.OptionalModules.Avatar.Voice.FreeSwitchVoice //private static readonly string m_chatSessionRequestPath = "0209/"; // Control info - private static bool m_Enabled = false; + private static bool m_Enabled = false; // FreeSwitch server is going to contact us and ask us all // sorts of things. @@ -111,8 +111,7 @@ namespace OpenSim.Region.OptionalModules.Avatar.Voice.FreeSwitchVoice try { - string serviceDll = m_Config.GetString("LocalServiceModule", - String.Empty); + string serviceDll = m_Config.GetString("LocalServiceModule", String.Empty); if (serviceDll.Length == 0) { @@ -325,6 +324,25 @@ namespace OpenSim.Region.OptionalModules.Avatar.Voice.FreeSwitchVoice m_log.DebugFormat( "[FreeSwitchVoice][PROVISIONVOICE]: ProvisionVoiceAccountRequest() request for {0}", agentID.ToString()); + Stream inputStream = request.InputStream; + if (inputStream.Length > 0) + { + OSD tmp = OSDParser.DeserializeLLSDXml(inputStream); + request.InputStream.Dispose(); + + if (tmp is OSDMap map) + { + if (map.TryGetValue("voice_server_type", out OSD vstosd)) + { + if (vstosd is OSDString vst && !((string)vst).Equals("vivox", StringComparison.OrdinalIgnoreCase)) + { + response.RawBuffer = Util.UTF8.GetBytes(""); + return; + } + } + } + } + response.StatusCode = (int)HttpStatusCode.OK; ScenePresence avatar = scene.GetScenePresence(agentID); diff --git a/OpenSim/Region/OptionalModules/Avatar/Voice/VivoxVoice/VivoxVoiceModule.cs b/OpenSim/Region/OptionalModules/Avatar/Voice/VivoxVoice/VivoxVoiceModule.cs index e9ccaa50d8..258db57118 100644 --- a/OpenSim/Region/OptionalModules/Avatar/Voice/VivoxVoice/VivoxVoiceModule.cs +++ b/OpenSim/Region/OptionalModules/Avatar/Voice/VivoxVoice/VivoxVoiceModule.cs @@ -459,6 +459,25 @@ namespace OpenSim.Region.OptionalModules.Avatar.Voice.VivoxVoice response.StatusCode = (int)HttpStatusCode.OK; try { + Stream inputStream = request.InputStream; + if (inputStream.Length > 0) + { + OSD tmp = OSDParser.DeserializeLLSDXml(inputStream); + request.InputStream.Dispose(); + + if (tmp is OSDMap map) + { + if (map.TryGetValue("voice_server_type", out OSD vstosd)) + { + if (vstosd is OSDString vst && !((string)vst).Equals("vivox", StringComparison.OrdinalIgnoreCase)) + { + response.RawBuffer = Util.UTF8.GetBytes(""); + return; + } + } + } + } + ScenePresence avatar = null; string avatarName = null; From c2c3ca418acb314ff94178f792c3fbe0815fd416 Mon Sep 17 00:00:00 2001 From: Adil El Farissi <144741970+AdilElFarissi@users.noreply.github.com> Date: Wed, 20 Mar 2024 01:12:49 +0000 Subject: [PATCH 08/13] Basic implementation of SSL selfsigned certificates creation and renewal Allows selfsigned certificates creation and renewal for local and external use. When enabled, will create a folder SSL\ and 2 sub folders SSL\ssl\ and SSL\src\. Next creates and store an RSA private key in SSL\src\ and the derived selfsigned certificates in SSL\ssl\ folder. Is also possible to renew the certificate on every server restart if CertRenewOnStartup is set to true. Note: The SSL related params in the network section was adapted to be user friendly and allow the usage just by uncommenting the SSL params in both sections and a password change. --- .../Servers/HttpServer/BaseHttpServer.cs | 2 +- OpenSim/Framework/Util.cs | 66 +++++++++++++++++++ OpenSim/Region/Application/OpenSimBase.cs | 17 ++++- bin/OpenSim.ini.example | 45 ++++++++++--- bin/OpenSimDefaults.ini | 23 +++++++ 5 files changed, 142 insertions(+), 11 deletions(-) diff --git a/OpenSim/Framework/Servers/HttpServer/BaseHttpServer.cs b/OpenSim/Framework/Servers/HttpServer/BaseHttpServer.cs index 9fa9edfe2e..153acdf27a 100644 --- a/OpenSim/Framework/Servers/HttpServer/BaseHttpServer.cs +++ b/OpenSim/Framework/Servers/HttpServer/BaseHttpServer.cs @@ -308,7 +308,7 @@ namespace OpenSim.Framework.Servers.HttpServer if(htype == UriHostNameType.Unknown || htype == UriHostNameType.Basic) return false; - if(htype == UriHostNameType.Dns) + if(htype == UriHostNameType.Dns || htype == UriHostNameType.IPv4) { foreach(string name in m_certNames) { diff --git a/OpenSim/Framework/Util.cs b/OpenSim/Framework/Util.cs index 011fa8eff0..3840773af9 100644 --- a/OpenSim/Framework/Util.cs +++ b/OpenSim/Framework/Util.cs @@ -56,6 +56,7 @@ using OpenMetaverse.StructuredData; using Amib.Threading; using System.Collections.Concurrent; using System.Net.Http; +using System.Security.Cryptography.X509Certificates; namespace OpenSim.Framework { @@ -1480,6 +1481,71 @@ namespace OpenSim.Framework return streamReader.ReadToEnd(); } + [MethodImpl(MethodImplOptions.AggressiveInlining)] + public static void CreateOrUpdateSelfsignedCert(string certFileName, string certHostName, string certHostIp, string certPassword) + { + CreateOrUpdateSelfsignedCertificate(certFileName, certHostName, certHostIp, certPassword); + } + + /// + /// Create or renew an SSL selfsigned certificate using the parameters set in the startup section of OpenSim.ini + /// + /// The certificate file name. + /// The certificate host DNS name (CN). + /// The certificate host IP address. + /// The certificate password. + private static void CreateOrUpdateSelfsignedCertificate(string certFileName, string certHostName, string certHostIp, string certPassword) + { + SubjectAlternativeNameBuilder san = new(); + san.AddDnsName(certHostName); + san.AddIpAddress(IPAddress.Parse(certHostIp)); + + // What OpenSim check (CN). + X500DistinguishedName dn = new($"CN={certHostName}"); + + using (RSA rsa = RSA.Create(2048)) + { + CertificateRequest request = new(dn, rsa, HashAlgorithmName.SHA256,RSASignaturePadding.Pkcs1); + + // (Optional)... + request.CertificateExtensions.Add( + new X509KeyUsageExtension(X509KeyUsageFlags.DataEncipherment | X509KeyUsageFlags.KeyEncipherment | X509KeyUsageFlags.DigitalSignature , false)); + + // (Optional) SSL Server Authentication... + request.CertificateExtensions.Add( + new X509EnhancedKeyUsageExtension( + new OidCollection { new Oid("1.3.6.1.5.5.7.3.1") }, false)); + + request.CertificateExtensions.Add(san.Build()); + + X509Certificate2 certificate = request.CreateSelfSigned(new DateTimeOffset(DateTime.UtcNow), new DateTimeOffset(DateTime.UtcNow.AddDays(3650))); + + string privateKey = Convert.ToBase64String(rsa.ExportRSAPrivateKey(), Base64FormattingOptions.InsertLineBreaks); + + // Create the SSL folder and sub folders if not exists. + if (!Directory.Exists("SSL\\src\\")) + Directory.CreateDirectory("SSL\\src\\"); + + if (!Directory.Exists("SSL\\ssl\\")) + Directory.CreateDirectory("SSL\\ssl\\"); + + // Store the RSA key in SSL\src\ + File.WriteAllText($"SSL\\src\\{certFileName}.txt", privateKey); + + // Export and store the .pfx and .p12 certificates in SSL\ssl\. + // Note: Pfx is a Pkcs12 certificate and both files work for OpenSim. + byte[] pfxCertBytes = string.IsNullOrEmpty(certPassword) + ? certificate.Export(X509ContentType.Pfx) + : certificate.Export(X509ContentType.Pfx, certPassword); + File.WriteAllBytes($"SSL\\ssl\\{certFileName}.pfx", pfxCertBytes); + + byte[] p12CertBytes = string.IsNullOrEmpty(certPassword) + ? certificate.Export(X509ContentType.Pkcs12) + : certificate.Export(X509ContentType.Pkcs12, certPassword); + File.WriteAllBytes($"SSL\\ssl\\{certFileName}.p12", p12CertBytes); + } + } + public static int fast_distance2d(int x, int y) { x = Math.Abs(x); diff --git a/OpenSim/Region/Application/OpenSimBase.cs b/OpenSim/Region/Application/OpenSimBase.cs index e18419a933..72de81ee67 100755 --- a/OpenSim/Region/Application/OpenSimBase.cs +++ b/OpenSim/Region/Application/OpenSimBase.cs @@ -352,7 +352,22 @@ namespace OpenSim IConfig startupConfig = Config.Configs["Startup"]; if (startupConfig == null || startupConfig.GetBoolean("JobEngineEnabled", true)) WorkManager.JobEngine.Start(); - + + // Sure is not the right place for this but do the job... + // Must always be called before (all) / the HTTP servers starting for the Certs creation or renewals. + if(startupConfig.GetBoolean("EnbleSelfsignedCertSupport")) + { + if(!File.Exists("SSL\\ssl\\"+ startupConfig.GetString("CertFileName") +".p12") || startupConfig.GetBoolean("CertRenewOnStartup")) + { + Util.CreateOrUpdateSelfsignedCert( + string.IsNullOrEmpty(startupConfig.GetString("CertFileName")) ? "OpenSim" : startupConfig.GetString("CertFileName"), + string.IsNullOrEmpty(startupConfig.GetString("CertHostName")) ? "localhost" : startupConfig.GetString("CertHostName"), + string.IsNullOrEmpty(startupConfig.GetString("CertHostIp")) ? "127.0.0.1" : startupConfig.GetString("CertHostIp"), + string.IsNullOrEmpty(startupConfig.GetString("CertPassword")) ? string.Empty : startupConfig.GetString("CertPassword") + ); + } + } + if(m_networkServersInfo.HttpUsesSSL) { m_httpServerSSL = true; diff --git a/bin/OpenSim.ini.example b/bin/OpenSim.ini.example index 2f64bca803..5d62ad3c4d 100644 --- a/bin/OpenSim.ini.example +++ b/bin/OpenSim.ini.example @@ -310,6 +310,33 @@ ; TelehubAllowLandmark = false + ;; SSL selfsigned certificate settings. + ;; Enable selfsigned certificate creation for local and external use. When set to true, will create a folder SSL\ and 2 sub folders SSL\ssl\ and SSL\src\. Next creates and store an RSA private key in SSL\src\ and the derived selfsigned certificate in SSL\ssl\ folder. Is also possible to renew the certificate on every server restart if CertRenewOnStartup is set to true. + ;# {EnbleSelfsignedCertSupport} {} {Enable selfsigned certificate creation and renew} {true false} false + ;EnbleSelfsignedCertSupport = true + + ;; Is free... so why not :). Renew the selfsigned certificate on every server startup ? + ;# {CertRenewOnStartup} {} {renew the selfsigned certificate on the server startup} {true false} true + ;CertRenewOnStartup = true + + ;; Certificate options: + ;; Set the certificate file name. the output files extensions are CertFileName.p12 and CertFileName.pfx. + ;# {CertFileName} {} {set the certificate file name} {} "OpenSim" + ;CertFileName = "OpenSim" + + ;; Set the certificate password. + ;# {CertPassword} {} {set the certificate password} {} "" + ;CertPassword = "mycertpass" + + ;; The certificate host name (domain or IP of this machine CN). + ;# {CertHostName} {} {set the certificate host name} {} ${Const|BaseHostname} + ;CertHostName = ${Const|BaseHostname} + + ;; The certificate host IP (IP of this machine). + ;# {CertHostIp} {} {set the certificate host IP} {} + ;CertHostIp = "127.0.0.1" + + ;; SSL certificate validation options ;; you can allow selfsigned certificates or no official CA with next option set to true ;# {NoVerifyCertChain} {} {do not verify SSL Cert Chain} {true false} true @@ -317,7 +344,7 @@ ;; you can also bypass the hostname or domain verification ;# {NoVerifyCertHostname} {} {do not verify SSL Cert name versus peer name} {true false} true - ; NoVerifyCertHostname = true + ; NoVerifyCertHostname = false ;; having both options true does provide encryption but with low security ;; set both true if you don't care to use SSL, they are needed to contact regions or grids that do use it. @@ -581,24 +608,24 @@ ; the main unsecure port will still open for some services. this may change in future. ; set http_listener_ssl to enable main server ssl. it will replace unsecure port on most functions - ;# {http_listener_ssl}{} {enable main server ssl port)} {} false + ;# {http_listener_ssl}{} {enable main server ssl port} {} false ;http_listener_ssl = false ; Set port for main SSL connections - ;# {http_listener_sslport}{} {main server ssl port)} {} 9001 + ;# {http_listener_sslport}{} {main server ssl port} {} 9001 ;http_listener_sslport = 9001 ; ; currently if using ssl, regions ExternalHostName must the the same and equal to http_listener_cn ; this may be removed in future - ;# {http_listener_cn}{} {main server ssl externalHostName)} {} "" - ;http_listener_cn = "myRegionsExternalHostName" + ;# {http_listener_cn}{} {main server ssl externalHostName} {} "" + ;http_listener_cn = ${Const|BaseHostname} ; the path for the certificate path - ;# {http_listener_cert_path}{} {main server ssl certificate file path)} {} "" - ;http_listener_cert_path = "mycert.p12" + ;# {http_listener_cert_path}{} {main server ssl certificate file path} {} "" + ;http_listener_cert_path = "SSL\ssl\OpenSim.p12" - ;# {http_listener_cert_pass}{} {main server ssl certificate password)} {} "" - ;http_listener_cert_pass = "mycertpass" ; the cert passwork + ;# {http_listener_cert_pass}{} {main server ssl certificate password} {} "" + ;http_listener_cert_pass = "mycertpass" ; By default, OpenSimulator does not allow scripts to make HTTP calls to addresses on the simulator's LAN. ; See the OutboundDisallowForUserScripts parameter in OpenSimDefaults.ini for more information on this filter. diff --git a/bin/OpenSimDefaults.ini b/bin/OpenSimDefaults.ini index b3282a8b4e..69ca1474a9 100644 --- a/bin/OpenSimDefaults.ini +++ b/bin/OpenSimDefaults.ini @@ -399,6 +399,29 @@ ; routing and land at the landmark coordinates when set to true ; default is false ; TelehubAllowLandmark = false + + ; # + ; # SSL selfsigned certificate settings. + ; # + + ; Enable selfsigned certificate creation for local and external use. When set to true, will create a folder SSL\ and 2 sub folders SSL\ssl\ and SSL\src\. Next creates and store an RSA private key in SSL\src\ and the derived selfsigned certificate in SSL\ssl\ folder. Is also possible to renew the certificate on every server restart if CertRenewOnStartup is set to true. + EnbleSelfsignedCertSupport = false + + ; Is free... so why not :). Renew the selfsigned certificate on every server startup ? + ;CertRenewOnStartup = true + + ; # Certificate options: + ; Set the certificate file name. the output files extensions are CertFileName.p12 and CertFileName.pfx. + ;CertFileName = "OpenSim" + + ; Set the certificate password. + ;CertPassword = "mycertpass" + + ; The certificate host name (domain or IP of this machine CN). + ;CertHostName = ${Const|BaseHostname} + + ; The certificate host IP (IP of this machine). + ;CertHostIp = "127.0.0.1" ; # ; # SSL certificates validation options From ac9ed3d5d140ae2ad0d7f2d4d92551b75fc833eb Mon Sep 17 00:00:00 2001 From: Adil El Farissi <144741970+AdilElFarissi@users.noreply.github.com> Date: Fri, 29 Mar 2024 03:56:03 +0000 Subject: [PATCH 09/13] Add selfsigned certificates support to Robust and osGetLinkInventoryKeys plus some fixes --- OpenSim/Region/Application/OpenSimBase.cs | 2 +- .../Shared/Api/Implementation/OSSL_Api.cs | 39 ++++++++++++++++++- .../Shared/Api/Interface/IOSSL_Api.cs | 1 + .../Shared/Api/Runtime/OSSL_Stub.cs | 6 +++ OpenSim/Server/Base/ServicesServerBase.cs | 13 +++++++ .../Services/GridService/HypergridLinker.cs | 8 +++- bin/OpenSim.ini.example | 12 +++--- bin/OpenSimDefaults.ini | 12 +++--- bin/Robust.HG.ini.example | 32 +++++++++++++-- bin/Robust.ini.example | 33 ++++++++++++++-- 10 files changed, 136 insertions(+), 22 deletions(-) diff --git a/OpenSim/Region/Application/OpenSimBase.cs b/OpenSim/Region/Application/OpenSimBase.cs index 72de81ee67..6927b9e734 100755 --- a/OpenSim/Region/Application/OpenSimBase.cs +++ b/OpenSim/Region/Application/OpenSimBase.cs @@ -355,7 +355,7 @@ namespace OpenSim // Sure is not the right place for this but do the job... // Must always be called before (all) / the HTTP servers starting for the Certs creation or renewals. - if(startupConfig.GetBoolean("EnbleSelfsignedCertSupport")) + if(startupConfig.GetBoolean("EnableSelfsignedCertSupport")) { if(!File.Exists("SSL\\ssl\\"+ startupConfig.GetString("CertFileName") +".p12") || startupConfig.GetBoolean("CertRenewOnStartup")) { diff --git a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs index c3a1e540f7..6f8354dec0 100644 --- a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs +++ b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs @@ -2481,7 +2481,7 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api { UserAgentServiceConnector userConnection = new(serverURI); - if (userConnection is not null) + if (userConnection is not null && serverURI.StartsWith("http://")) { userID = userConnection.GetUUID(realFirstName, realLastName); if (!userID.IsZero()) @@ -2490,6 +2490,21 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api return userID.ToString(); } } + else + { + // Override hardcoded http in Util.ParseForeignAvatarName + string SSLserverURI = serverURI.Replace("http://", "https://"); + userConnection = new(SSLserverURI); + if (userConnection is not null) + { + userID = userConnection.GetUUID(realFirstName, realLastName); + if (!userID.IsZero()) + { + userManager.AddUser(userID, realFirstName, realLastName, SSLserverURI); + return userID.ToString(); + } + } + } } catch (Exception /*e*/) { @@ -5561,6 +5576,28 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api return LSL_String.NullKey; } + public LSL_List osGetLinkInventoryKeys(LSL_Integer linkNumber, LSL_Integer type) + { + LSL_List ret = new(); + + SceneObjectPart part = GetSingleLinkPart(linkNumber); + if(part == null) + return ret; + + part.TaskInventory.LockItemsForRead(true); + foreach (KeyValuePair inv in part.TaskInventory) + { + if (inv.Value.Type == type || type == -1 && + (inv.Value.CurrentPermissions + & (uint)(PermissionMask.Copy | PermissionMask.Transfer | PermissionMask.Modify)) + == (uint)(PermissionMask.Copy | PermissionMask.Transfer | PermissionMask.Modify)) + ret.Add(inv.Value.AssetID.ToString()); + } + + part.TaskInventory.LockItemsForRead(false); + return ret; + } + public LSL_Key osGetLinkInventoryItemKey(LSL_Integer linkNumber, LSL_String name) { SceneObjectPart part = GetSingleLinkPart(linkNumber); diff --git a/OpenSim/Region/ScriptEngine/Shared/Api/Interface/IOSSL_Api.cs b/OpenSim/Region/ScriptEngine/Shared/Api/Interface/IOSSL_Api.cs index dd9bba1c14..604c349976 100644 --- a/OpenSim/Region/ScriptEngine/Shared/Api/Interface/IOSSL_Api.cs +++ b/OpenSim/Region/ScriptEngine/Shared/Api/Interface/IOSSL_Api.cs @@ -562,6 +562,7 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api.Interfaces LSL_Key osGetInventoryLastOwner(LSL_String itemNameOrId); LSL_Key osGetInventoryItemKey(LSL_String name); LSL_Key osGetLinkInventoryKey(LSL_Integer linkNumber, LSL_String name, LSL_Integer type); + LSL_List osGetLinkInventoryKeys(LSL_Integer linkNumber, LSL_Integer type); LSL_Key osGetLinkInventoryItemKey(LSL_Integer linkNumber, LSL_String name); LSL_String osGetInventoryName(LSL_Key itemId); LSL_String osGetLinkInventoryName(LSL_Integer linkNumber, LSL_Key itemId); diff --git a/OpenSim/Region/ScriptEngine/Shared/Api/Runtime/OSSL_Stub.cs b/OpenSim/Region/ScriptEngine/Shared/Api/Runtime/OSSL_Stub.cs index b16c905122..3c181623b1 100644 --- a/OpenSim/Region/ScriptEngine/Shared/Api/Runtime/OSSL_Stub.cs +++ b/OpenSim/Region/ScriptEngine/Shared/Api/Runtime/OSSL_Stub.cs @@ -1465,6 +1465,12 @@ namespace OpenSim.Region.ScriptEngine.Shared.ScriptBase { return m_OSSL_Functions.osGetLinkInventoryKey(linkNumber, name, type); } + + [MethodImpl(MethodImplOptions.AggressiveInlining)] + public LSL_List osGetLinkInventoryKeys(LSL_Integer linkNumber, LSL_Integer type) + { + return m_OSSL_Functions.osGetLinkInventoryKeys(linkNumber, type); + } [MethodImpl(MethodImplOptions.AggressiveInlining)] public LSL_Key osGetLinkInventoryItemKey(LSL_Integer linkNumber, LSL_String name) diff --git a/OpenSim/Server/Base/ServicesServerBase.cs b/OpenSim/Server/Base/ServicesServerBase.cs index ca8d02a841..220dad044e 100755 --- a/OpenSim/Server/Base/ServicesServerBase.cs +++ b/OpenSim/Server/Base/ServicesServerBase.cs @@ -133,6 +133,19 @@ namespace OpenSim.Server.Base m_configDirectory = startupConfig.GetString("ConfigDirectory", m_configDirectory); prompt = startupConfig.GetString("Prompt", prompt); + + if(startupConfig.GetBoolean("EnableRobustSelfsignedCertSupport")) + { + if(!File.Exists("SSL\\ssl\\"+ startupConfig.GetString("RobustCertFileName") +".p12") || startupConfig.GetBoolean("RobustCertRenewOnStartup")) + { + Util.CreateOrUpdateSelfsignedCert( + string.IsNullOrEmpty(startupConfig.GetString("RobustCertFileName")) ? "Robust" : startupConfig.GetString("RobustCertFileName"), + string.IsNullOrEmpty(startupConfig.GetString("RobustCertHostName")) ? "localhost" : startupConfig.GetString("RobustCertHostName"), + string.IsNullOrEmpty(startupConfig.GetString("RobustCertHostIp")) ? "127.0.0.1" : startupConfig.GetString("RobustCertHostIp"), + string.IsNullOrEmpty(startupConfig.GetString("RobustCertPassword")) ? string.Empty : startupConfig.GetString("RobustCertPassword") + ); + } + } } // Allow derived classes to load config before the console is opened. ReadConfig(); diff --git a/OpenSim/Services/GridService/HypergridLinker.cs b/OpenSim/Services/GridService/HypergridLinker.cs index d9f5a22e20..ba2dc78c6f 100644 --- a/OpenSim/Services/GridService/HypergridLinker.cs +++ b/OpenSim/Services/GridService/HypergridLinker.cs @@ -617,7 +617,7 @@ namespace OpenSim.Services.GridService } //this should be the prefererred way of setting up hg links now - if (cmdparams[2].StartsWith("http")) + if (cmdparams[2].StartsWith("http") || cmdparams[2].StartsWith("https")) { RunLinkRegionCommand(cmdparams); } @@ -632,7 +632,11 @@ namespace OpenSim.Services.GridService parameters.Insert(3, parts[2]); cmdparams = (string[])parameters.ToArray(typeof(string)); } - cmdparams[2] = "http://" + parts[0] + ':' + parts[1]; + string uri = cmdparams[2].StartsWith("https") + ? "https://" + parts[0] + ':' + parts[1] + : "http://" + parts[0] + ':' + parts[1]; + + cmdparams[2] = uri; RunLinkRegionCommand(cmdparams); } diff --git a/bin/OpenSim.ini.example b/bin/OpenSim.ini.example index 5d62ad3c4d..e855442c6c 100644 --- a/bin/OpenSim.ini.example +++ b/bin/OpenSim.ini.example @@ -313,28 +313,28 @@ ;; SSL selfsigned certificate settings. ;; Enable selfsigned certificate creation for local and external use. When set to true, will create a folder SSL\ and 2 sub folders SSL\ssl\ and SSL\src\. Next creates and store an RSA private key in SSL\src\ and the derived selfsigned certificate in SSL\ssl\ folder. Is also possible to renew the certificate on every server restart if CertRenewOnStartup is set to true. ;# {EnbleSelfsignedCertSupport} {} {Enable selfsigned certificate creation and renew} {true false} false - ;EnbleSelfsignedCertSupport = true + EnableSelfsignedCertSupport = false ;; Is free... so why not :). Renew the selfsigned certificate on every server startup ? ;# {CertRenewOnStartup} {} {renew the selfsigned certificate on the server startup} {true false} true - ;CertRenewOnStartup = true + CertRenewOnStartup = true ;; Certificate options: ;; Set the certificate file name. the output files extensions are CertFileName.p12 and CertFileName.pfx. ;# {CertFileName} {} {set the certificate file name} {} "OpenSim" - ;CertFileName = "OpenSim" + CertFileName = "OpenSim" ;; Set the certificate password. ;# {CertPassword} {} {set the certificate password} {} "" - ;CertPassword = "mycertpass" + CertPassword = "mycertpass" ;; The certificate host name (domain or IP of this machine CN). ;# {CertHostName} {} {set the certificate host name} {} ${Const|BaseHostname} - ;CertHostName = ${Const|BaseHostname} + CertHostName = ${Const|BaseHostname} ;; The certificate host IP (IP of this machine). ;# {CertHostIp} {} {set the certificate host IP} {} - ;CertHostIp = "127.0.0.1" + CertHostIp = "127.0.0.1" ;; SSL certificate validation options diff --git a/bin/OpenSimDefaults.ini b/bin/OpenSimDefaults.ini index 69ca1474a9..dd094b19cc 100644 --- a/bin/OpenSimDefaults.ini +++ b/bin/OpenSimDefaults.ini @@ -405,23 +405,23 @@ ; # ; Enable selfsigned certificate creation for local and external use. When set to true, will create a folder SSL\ and 2 sub folders SSL\ssl\ and SSL\src\. Next creates and store an RSA private key in SSL\src\ and the derived selfsigned certificate in SSL\ssl\ folder. Is also possible to renew the certificate on every server restart if CertRenewOnStartup is set to true. - EnbleSelfsignedCertSupport = false + EnableSelfsignedCertSupport = false ; Is free... so why not :). Renew the selfsigned certificate on every server startup ? - ;CertRenewOnStartup = true + CertRenewOnStartup = true ; # Certificate options: ; Set the certificate file name. the output files extensions are CertFileName.p12 and CertFileName.pfx. - ;CertFileName = "OpenSim" + CertFileName = "OpenSim" ; Set the certificate password. - ;CertPassword = "mycertpass" + CertPassword = "mycertpass" ; The certificate host name (domain or IP of this machine CN). - ;CertHostName = ${Const|BaseHostname} + CertHostName = ${Const|BaseHostname} ; The certificate host IP (IP of this machine). - ;CertHostIp = "127.0.0.1" + CertHostIp = "127.0.0.1" ; # ; # SSL certificates validation options diff --git a/bin/Robust.HG.ini.example b/bin/Robust.HG.ini.example index d3bc92fca7..2b7fa6aefe 100644 --- a/bin/Robust.HG.ini.example +++ b/bin/Robust.HG.ini.example @@ -23,9 +23,15 @@ ; * uses to write data. ; * [Const] + ; The domain or IP of the Robust server. + BaseHostname = "127.0.0.1" - ; The URL of the Robust server - BaseURL = "http://127.0.0.1" + ; The http URL of the Robust server. + BaseURL = "http://${Const|BaseHostname}" + + ; The https URL of the Robust server. + ; Use this if you have the SSL enabled. + ; BaseURL = "https://${Const|BaseHostname}" ; The public port of the Robust server PublicPort = "8002" @@ -72,12 +78,32 @@ ; Time stamp commands in history file (default false) ; ConsoleHistoryTimeStamp = false + + ;; SSL selfsigned certificate settings. + ; Enable selfsigned certificate creation for local and external use. When set to true, will create a folder SSL\ and 2 sub folders SSL\ssl\ and SSL\src\. Next creates and store an RSA private key in SSL\src\ and the derived selfsigned certificate in SSL\ssl\ folder. Is also possible to renew the certificate on every server restart if CertRenewOnStartup is set to true. + EnableRobustSelfsignedCertSupport = false + + ; Is free... so why not :). Renew the selfsigned certificate on every server startup ? + RobustCertRenewOnStartup = true + + ;; Certificate options: + ; Set the certificate file name. the output files extensions are CertFileName.p12 and RobustCertFileName.pfx. This must be different than CertFileName in OpenSim.ini + RobustCertFileName = "Robust" + + ; Set the certificate password. + RobustCertPassword = "mycertpass" + + ; The certificate host name (CN). + RobustCertHostName = ${Const|BaseHostname} + + ; The certificate host IP. + RobustCertHostIp = "127.0.0.1" ; peers SSL certificate validation options ; you can allow selfsigned certificates or no official CA with next option set to true NoVerifyCertChain = true ; you can also bypass the hostname or domain verification - NoVerifyCertHostname = true + NoVerifyCertHostname = false ; having both options true does provide encryption but with low security ; set both true if you don't care to use SSL, they are needed to contact regions or grids that do use it. diff --git a/bin/Robust.ini.example b/bin/Robust.ini.example index bb8df149a8..6ddfb7bb22 100644 --- a/bin/Robust.ini.example +++ b/bin/Robust.ini.example @@ -15,8 +15,15 @@ ; * [Const] - ; The URL of the Robust server - BaseURL = "http://127.0.0.1" + ; The domain or IP of the Robust server. + BaseHostname = "127.0.0.1" + + ; The http URL of the Robust server. + BaseURL = "http://${Const|BaseHostname}" + + ; The https URL of the Robust server. + ; Use this if you have the SSL enabled. + ; BaseURL = "https://${Const|BaseHostname}" ; The public port of the Robust server PublicPort = "8002" @@ -64,12 +71,32 @@ ; Time stamp commands in history file (default false) ; ConsoleHistoryTimeStamp = false + + ;; SSL selfsigned certificate settings. + ; Enable selfsigned certificate creation for local and external use. When set to true, will create a folder SSL\ and 2 sub folders SSL\ssl\ and SSL\src\. Next creates and store an RSA private key in SSL\src\ and the derived selfsigned certificate in SSL\ssl\ folder. Is also possible to renew the certificate on every server restart if CertRenewOnStartup is set to true. + EnableRobustSelfsignedCertSupport = false + + ; Is free... so why not :). Renew the selfsigned certificate on every server startup ? + RobustCertRenewOnStartup = true + + ;; Certificate options: + ; Set the certificate file name. the output files extensions are RobustCertFileName.p12 and RobustCertFileName.pfx. + RobustCertFileName = "Robust" + + ; Set the certificate password. + RobustCertPassword = "mycertpass" + + ; The certificate host name (CN). + RobustCertHostName = ${Const|BaseHostname} + + ; The certificate host IP. + RobustCertHostIp = "127.0.0.1" ; peers SSL certificate validation options ; you can allow selfsigned certificates or no official CA with next option set to true NoVerifyCertChain = true ; you can also bypass the hostname or domain verification - NoVerifyCertHostname = true + NoVerifyCertHostname = false ; having both options true does provide encryption but with low security ; set both true if you don't care to use SSL, they are needed to contact regions or grids that do use it. From 207c3d1e71b00bdba4dabd63d7274e8f4a395a59 Mon Sep 17 00:00:00 2001 From: Adil El Farissi <144741970+AdilElFarissi@users.noreply.github.com> Date: Fri, 26 Apr 2024 06:12:29 +0000 Subject: [PATCH 10/13] Revert some default params and fixes to SSL support --- OpenSim/Region/Application/ConfigurationLoader.cs | 2 +- .../CoreModules/Scripting/LSLHttp/UrlModule.cs | 5 ++++- OpenSim/Server/Base/ServicesServerBase.cs | 4 ++-- OpenSim/Tools/Configger/ConfigurationLoader.cs | 2 +- bin/OpenSim.ini.example | 14 +++++++------- bin/OpenSimDefaults.ini | 4 ++-- 6 files changed, 17 insertions(+), 14 deletions(-) diff --git a/OpenSim/Region/Application/ConfigurationLoader.cs b/OpenSim/Region/Application/ConfigurationLoader.cs index 66e46cb087..a13a34d09b 100644 --- a/OpenSim/Region/Application/ConfigurationLoader.cs +++ b/OpenSim/Region/Application/ConfigurationLoader.cs @@ -285,7 +285,7 @@ namespace OpenSim Uri configUri; return Uri.TryCreate(file, UriKind.Absolute, - out configUri) && configUri.Scheme == Uri.UriSchemeHttp; + out configUri) && (configUri.Scheme == Uri.UriSchemeHttp || configUri.Scheme == Uri.UriSchemeHttps); } /// diff --git a/OpenSim/Region/CoreModules/Scripting/LSLHttp/UrlModule.cs b/OpenSim/Region/CoreModules/Scripting/LSLHttp/UrlModule.cs index 2428e660dd..9f1e462014 100644 --- a/OpenSim/Region/CoreModules/Scripting/LSLHttp/UrlModule.cs +++ b/OpenSim/Region/CoreModules/Scripting/LSLHttp/UrlModule.cs @@ -92,6 +92,7 @@ namespace OpenSim.Region.CoreModules.Scripting.LSLHttp protected bool m_enabled = false; protected string m_ErrorStr; protected uint m_HttpsPort = 0; + protected uint m_HttpPort = 0; protected IHttpServer m_HttpServer = null; protected IHttpServer m_HttpsServer = null; @@ -134,6 +135,8 @@ namespace OpenSim.Region.CoreModules.Scripting.LSLHttp bool ssl_enabled = config.Configs["Network"].GetBoolean("https_listener", false); + m_HttpPort = (uint)config.Configs["Network"].GetInt("http_listener_port", 9000); + if (ssl_enabled) m_HttpsPort = (uint)config.Configs["Network"].GetInt("https_port", (int)m_HttpsPort); } @@ -180,7 +183,7 @@ namespace OpenSim.Region.CoreModules.Scripting.LSLHttp { // There can only be one // - m_HttpServer = MainServer.Instance; + m_HttpServer = MainServer.GetHttpServer(m_HttpPort); // // We can use the https if it is enabled if (m_HttpsPort > 0) diff --git a/OpenSim/Server/Base/ServicesServerBase.cs b/OpenSim/Server/Base/ServicesServerBase.cs index 220dad044e..402f853a34 100755 --- a/OpenSim/Server/Base/ServicesServerBase.cs +++ b/OpenSim/Server/Base/ServicesServerBase.cs @@ -339,7 +339,7 @@ namespace OpenSim.Server.Base Uri configUri; return Uri.TryCreate(file, UriKind.Absolute, - out configUri) && configUri.Scheme == Uri.UriSchemeHttp; + out configUri) && (configUri.Scheme == Uri.UriSchemeHttp || configUri.Scheme == Uri.UriSchemeHttps); } IConfigSource ReadConfigSource(string iniFile) @@ -352,7 +352,7 @@ namespace OpenSim.Server.Base try { if (Uri.TryCreate(iniFile, UriKind.Absolute, out configUri) && - configUri.Scheme == Uri.UriSchemeHttp) + (configUri.Scheme == Uri.UriSchemeHttp || configUri.Scheme == Uri.UriSchemeHttps)) { XmlReader r = XmlReader.Create(iniFile); s = new XmlConfigSource(r); diff --git a/OpenSim/Tools/Configger/ConfigurationLoader.cs b/OpenSim/Tools/Configger/ConfigurationLoader.cs index f23c80a7b0..7889e52048 100644 --- a/OpenSim/Tools/Configger/ConfigurationLoader.cs +++ b/OpenSim/Tools/Configger/ConfigurationLoader.cs @@ -201,7 +201,7 @@ namespace OpenSim.Tools.Configger Uri configUri; return Uri.TryCreate(file, UriKind.Absolute, - out configUri) && configUri.Scheme == Uri.UriSchemeHttp; + out configUri) && (configUri.Scheme == Uri.UriSchemeHttp || configUri.Scheme == Uri.UriSchemeHttps); } /// diff --git a/bin/OpenSim.ini.example b/bin/OpenSim.ini.example index e855442c6c..9f226fd993 100644 --- a/bin/OpenSim.ini.example +++ b/bin/OpenSim.ini.example @@ -52,7 +52,7 @@ ;# {BaseHostname} {} {BaseHostname} {"example.com" "127.0.0.1"} "127.0.0.1" BaseHostname = "127.0.0.1" - ;# {BaseURL} {} {BaseURL} {"http://${Const|BaseHostname}} "http://${Const|BaseHostname}" + ;# {BaseURL} {} {BaseURL} {"http://${Const|BaseHostname"}} "http://${Const|BaseHostname}" BaseURL = http://${Const|BaseHostname} ; If you run a grid, several services should not be availble to world, access to them should be blocked on firewall @@ -328,9 +328,9 @@ ;# {CertPassword} {} {set the certificate password} {} "" CertPassword = "mycertpass" - ;; The certificate host name (domain or IP of this machine CN). - ;# {CertHostName} {} {set the certificate host name} {} ${Const|BaseHostname} - CertHostName = ${Const|BaseHostname} + ;; The certificate host name (domain or IP of this machine CN). Must be the same as "ExternalHostName" in Regions.ini + ;# {CertHostName} {} {set the certificate host name} {} "myRegionsExternalHostName" + CertHostName = "myRegionsExternalHostName" ;; The certificate host IP (IP of this machine). ;# {CertHostIp} {} {set the certificate host IP} {} @@ -344,7 +344,7 @@ ;; you can also bypass the hostname or domain verification ;# {NoVerifyCertHostname} {} {do not verify SSL Cert name versus peer name} {true false} true - ; NoVerifyCertHostname = false + ; NoVerifyCertHostname = true ;; having both options true does provide encryption but with low security ;; set both true if you don't care to use SSL, they are needed to contact regions or grids that do use it. @@ -445,7 +445,7 @@ ;; ;; If set to false, then, in theory, the server never carries out ;; permission checks (allowing anybody to copy - ;; any item, etc. This may not yet be implemented uniformally. + ;; any item, etc). This may not yet be implemented uniformally. ;; If set to true, then all permissions checks are carried out ; serverside_object_permissions = true @@ -618,7 +618,7 @@ ; currently if using ssl, regions ExternalHostName must the the same and equal to http_listener_cn ; this may be removed in future ;# {http_listener_cn}{} {main server ssl externalHostName} {} "" - ;http_listener_cn = ${Const|BaseHostname} + ;http_listener_cn = "myRegionsExternalHostName" ; the path for the certificate path ;# {http_listener_cert_path}{} {main server ssl certificate file path} {} "" diff --git a/bin/OpenSimDefaults.ini b/bin/OpenSimDefaults.ini index dd094b19cc..559f0dc678 100644 --- a/bin/OpenSimDefaults.ini +++ b/bin/OpenSimDefaults.ini @@ -417,8 +417,8 @@ ; Set the certificate password. CertPassword = "mycertpass" - ; The certificate host name (domain or IP of this machine CN). - CertHostName = ${Const|BaseHostname} + ; The certificate host name (domain or IP of this machine CN). Must be the same as "ExternalHostName" in Regions.ini + CertHostName = "myRegionsExternalHostName" ; The certificate host IP (IP of this machine). CertHostIp = "127.0.0.1" From 79dbca84f96064a92e20ff27e2d3829e7801fa38 Mon Sep 17 00:00:00 2001 From: UbitUmarov Date: Sat, 17 Aug 2024 00:30:18 +0100 Subject: [PATCH 11/13] a few changes. in same cases http/https can't be determined. possible both need to be present, possible with http a redir to https. TODO --- .../Shared/Api/Implementation/OSSL_Api.cs | 17 +------ .../Services/GridService/HypergridLinker.cs | 2 +- bin/OpenSim.ini.example | 50 ++++++++++--------- bin/OpenSimDefaults.ini | 38 +++++++------- bin/Robust.HG.ini.example | 42 ++++++++-------- bin/Robust.ini.example | 42 ++++++++-------- 6 files changed, 92 insertions(+), 99 deletions(-) diff --git a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs index 6f8354dec0..2bfa6c047d 100644 --- a/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs +++ b/OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs @@ -2481,7 +2481,7 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api { UserAgentServiceConnector userConnection = new(serverURI); - if (userConnection is not null && serverURI.StartsWith("http://")) + if (userConnection is not null) { userID = userConnection.GetUUID(realFirstName, realLastName); if (!userID.IsZero()) @@ -2490,21 +2490,6 @@ namespace OpenSim.Region.ScriptEngine.Shared.Api return userID.ToString(); } } - else - { - // Override hardcoded http in Util.ParseForeignAvatarName - string SSLserverURI = serverURI.Replace("http://", "https://"); - userConnection = new(SSLserverURI); - if (userConnection is not null) - { - userID = userConnection.GetUUID(realFirstName, realLastName); - if (!userID.IsZero()) - { - userManager.AddUser(userID, realFirstName, realLastName, SSLserverURI); - return userID.ToString(); - } - } - } } catch (Exception /*e*/) { diff --git a/OpenSim/Services/GridService/HypergridLinker.cs b/OpenSim/Services/GridService/HypergridLinker.cs index ba2dc78c6f..5ce31f767c 100644 --- a/OpenSim/Services/GridService/HypergridLinker.cs +++ b/OpenSim/Services/GridService/HypergridLinker.cs @@ -617,7 +617,7 @@ namespace OpenSim.Services.GridService } //this should be the prefererred way of setting up hg links now - if (cmdparams[2].StartsWith("http") || cmdparams[2].StartsWith("https")) + if (cmdparams[2].StartsWith("http")) { RunLinkRegionCommand(cmdparams); } diff --git a/bin/OpenSim.ini.example b/bin/OpenSim.ini.example index 9f226fd993..4f49f1f46d 100644 --- a/bin/OpenSim.ini.example +++ b/bin/OpenSim.ini.example @@ -311,30 +311,32 @@ ;; SSL selfsigned certificate settings. - ;; Enable selfsigned certificate creation for local and external use. When set to true, will create a folder SSL\ and 2 sub folders SSL\ssl\ and SSL\src\. Next creates and store an RSA private key in SSL\src\ and the derived selfsigned certificate in SSL\ssl\ folder. Is also possible to renew the certificate on every server restart if CertRenewOnStartup is set to true. - ;# {EnbleSelfsignedCertSupport} {} {Enable selfsigned certificate creation and renew} {true false} false - EnableSelfsignedCertSupport = false - - ;; Is free... so why not :). Renew the selfsigned certificate on every server startup ? - ;# {CertRenewOnStartup} {} {renew the selfsigned certificate on the server startup} {true false} true - CertRenewOnStartup = true - - ;; Certificate options: - ;; Set the certificate file name. the output files extensions are CertFileName.p12 and CertFileName.pfx. - ;# {CertFileName} {} {set the certificate file name} {} "OpenSim" - CertFileName = "OpenSim" - - ;; Set the certificate password. - ;# {CertPassword} {} {set the certificate password} {} "" - CertPassword = "mycertpass" - - ;; The certificate host name (domain or IP of this machine CN). Must be the same as "ExternalHostName" in Regions.ini - ;# {CertHostName} {} {set the certificate host name} {} "myRegionsExternalHostName" - CertHostName = "myRegionsExternalHostName" - - ;; The certificate host IP (IP of this machine). - ;# {CertHostIp} {} {set the certificate host IP} {} - CertHostIp = "127.0.0.1" + ;; Enable selfsigned certificate creation for local and external use. When set to true, will create a folder SSL\ and 2 sub folders SSL\ssl\ and SSL\src\. + ;; Next creates and store an RSA private key in SSL\src\ and the derived selfsigned certificate in SSL\ssl\ folder. + ;;Is also possible to renew the certificate on every server restart if CertRenewOnStartup is set to true. + ;# {EnbleSelfsignedCertSupport} {} {Enable selfsigned certificate creation and renew} {true false} false + EnableSelfsignedCertSupport = false + + ;; Renew the selfsigned certificate on every server startup ? + ;# {CertRenewOnStartup} {} {renew the selfsigned certificate on the server startup} {true false} true + CertRenewOnStartup = false + + ;; Certificate options: + ;; Set the certificate file name. the output files extensions are CertFileName.p12 and CertFileName.pfx. + ;# {CertFileName} {} {set the certificate file name} {} "OpenSim" + CertFileName = "OpenSim" + + ;; Set the certificate password. + ;# {CertPassword} {} {set the certificate password} {} "" + CertPassword = "mycertpass" + + ;; The certificate host name (domain or IP of this machine CN). Must be the same as "ExternalHostName" in Regions.ini + ;# {CertHostName} {} {set the certificate host name} {} "myRegionsExternalHostName" + CertHostName = "myRegionsExternalHostName" + + ;; The certificate host IP (IP of this machine). + ;# {CertHostIp} {} {set the certificate host IP} {} + CertHostIp = "127.0.0.1" ;; SSL certificate validation options diff --git a/bin/OpenSimDefaults.ini b/bin/OpenSimDefaults.ini index 559f0dc678..57c20cd414 100644 --- a/bin/OpenSimDefaults.ini +++ b/bin/OpenSimDefaults.ini @@ -404,24 +404,26 @@ ; # SSL selfsigned certificate settings. ; # - ; Enable selfsigned certificate creation for local and external use. When set to true, will create a folder SSL\ and 2 sub folders SSL\ssl\ and SSL\src\. Next creates and store an RSA private key in SSL\src\ and the derived selfsigned certificate in SSL\ssl\ folder. Is also possible to renew the certificate on every server restart if CertRenewOnStartup is set to true. - EnableSelfsignedCertSupport = false - - ; Is free... so why not :). Renew the selfsigned certificate on every server startup ? - CertRenewOnStartup = true - - ; # Certificate options: - ; Set the certificate file name. the output files extensions are CertFileName.p12 and CertFileName.pfx. - CertFileName = "OpenSim" - - ; Set the certificate password. - CertPassword = "mycertpass" - - ; The certificate host name (domain or IP of this machine CN). Must be the same as "ExternalHostName" in Regions.ini - CertHostName = "myRegionsExternalHostName" - - ; The certificate host IP (IP of this machine). - CertHostIp = "127.0.0.1" + ; Enable selfsigned certificate creation for local and external use. When set to true, will create a folder SSL\ and 2 sub folders SSL\ssl\ and SSL\src\. + ; Next creates and store an RSA private key in SSL\src\ and the derived selfsigned certificate in SSL\ssl\ folder. + ; Is also possible to renew the certificate on every server restart if CertRenewOnStartup is set to true. + EnableSelfsignedCertSupport = false + + ;Renew the selfsigned certificate on every server startup ? + CertRenewOnStartup = false + + ; # Certificate options: + ; Set the certificate file name. the output files extensions are CertFileName.p12 and CertFileName.pfx. + CertFileName = "OpenSim" + + ; Set the certificate password. + CertPassword = "mycertpass" + + ; The certificate host name (domain or IP of this machine CN). Must be the same as "ExternalHostName" in Regions.ini + CertHostName = "myRegionsExternalHostName" + + ; The certificate host IP (IP of this machine). + CertHostIp = "127.0.0.1" ; # ; # SSL certificates validation options diff --git a/bin/Robust.HG.ini.example b/bin/Robust.HG.ini.example index 2b7fa6aefe..bd78316da6 100644 --- a/bin/Robust.HG.ini.example +++ b/bin/Robust.HG.ini.example @@ -80,30 +80,32 @@ ; ConsoleHistoryTimeStamp = false ;; SSL selfsigned certificate settings. - ; Enable selfsigned certificate creation for local and external use. When set to true, will create a folder SSL\ and 2 sub folders SSL\ssl\ and SSL\src\. Next creates and store an RSA private key in SSL\src\ and the derived selfsigned certificate in SSL\ssl\ folder. Is also possible to renew the certificate on every server restart if CertRenewOnStartup is set to true. - EnableRobustSelfsignedCertSupport = false - - ; Is free... so why not :). Renew the selfsigned certificate on every server startup ? - RobustCertRenewOnStartup = true - - ;; Certificate options: - ; Set the certificate file name. the output files extensions are CertFileName.p12 and RobustCertFileName.pfx. This must be different than CertFileName in OpenSim.ini - RobustCertFileName = "Robust" - - ; Set the certificate password. - RobustCertPassword = "mycertpass" - - ; The certificate host name (CN). - RobustCertHostName = ${Const|BaseHostname} - - ; The certificate host IP. - RobustCertHostIp = "127.0.0.1" - + ; Enable selfsigned certificate creation for local and external use. When set to true, will create a folder SSL\ and 2 sub folders SSL\ssl\ and SSL\src\. + ; Next creates and store an RSA private key in SSL\src\ and the derived selfsigned certificate in SSL\ssl\ folder. + ; Is also possible to renew the certificate on every server restart if CertRenewOnStartup is set to true. + EnableRobustSelfsignedCertSupport = false + + ;Renew the selfsigned certificate on every server startup ? + RobustCertRenewOnStartup = false + + ;; Certificate options: + ; Set the certificate file name. the output files extensions are CertFileName.p12 and RobustCertFileName.pfx. This must be different than CertFileName in OpenSim.ini + RobustCertFileName = "Robust" + + ; Set the certificate password. + RobustCertPassword = "mycertpass" + + ; The certificate host name (CN). + RobustCertHostName = ${Const|BaseHostname} + + ; The certificate host IP. + RobustCertHostIp = "127.0.0.1" + ; peers SSL certificate validation options ; you can allow selfsigned certificates or no official CA with next option set to true NoVerifyCertChain = true ; you can also bypass the hostname or domain verification - NoVerifyCertHostname = false + NoVerifyCertHostname = true ; having both options true does provide encryption but with low security ; set both true if you don't care to use SSL, they are needed to contact regions or grids that do use it. diff --git a/bin/Robust.ini.example b/bin/Robust.ini.example index 6ddfb7bb22..2e37861c94 100644 --- a/bin/Robust.ini.example +++ b/bin/Robust.ini.example @@ -73,30 +73,32 @@ ; ConsoleHistoryTimeStamp = false ;; SSL selfsigned certificate settings. - ; Enable selfsigned certificate creation for local and external use. When set to true, will create a folder SSL\ and 2 sub folders SSL\ssl\ and SSL\src\. Next creates and store an RSA private key in SSL\src\ and the derived selfsigned certificate in SSL\ssl\ folder. Is also possible to renew the certificate on every server restart if CertRenewOnStartup is set to true. - EnableRobustSelfsignedCertSupport = false - - ; Is free... so why not :). Renew the selfsigned certificate on every server startup ? - RobustCertRenewOnStartup = true - - ;; Certificate options: - ; Set the certificate file name. the output files extensions are RobustCertFileName.p12 and RobustCertFileName.pfx. - RobustCertFileName = "Robust" - - ; Set the certificate password. - RobustCertPassword = "mycertpass" - - ; The certificate host name (CN). - RobustCertHostName = ${Const|BaseHostname} - - ; The certificate host IP. - RobustCertHostIp = "127.0.0.1" - + ; Enable selfsigned certificate creation for local and external use. When set to true, will create a folder SSL\ and 2 sub folders SSL\ssl\ and SSL\src\. + ; Next creates and store an RSA private key in SSL\src\ and the derived selfsigned certificate in SSL\ssl\ folder. + ; Is also possible to renew the certificate on every server restart if CertRenewOnStartup is set to true. + EnableRobustSelfsignedCertSupport = false + + ; Renew the selfsigned certificate on every server startup ? + RobustCertRenewOnStartup = false + + ;; Certificate options: + ; Set the certificate file name. the output files extensions are RobustCertFileName.p12 and RobustCertFileName.pfx. + RobustCertFileName = "Robust" + + ; Set the certificate password. + RobustCertPassword = "mycertpass" + + ; The certificate host name (CN). + RobustCertHostName = ${Const|BaseHostname} + + ; The certificate host IP. + RobustCertHostIp = "127.0.0.1" + ; peers SSL certificate validation options ; you can allow selfsigned certificates or no official CA with next option set to true NoVerifyCertChain = true ; you can also bypass the hostname or domain verification - NoVerifyCertHostname = false + NoVerifyCertHostname = true ; having both options true does provide encryption but with low security ; set both true if you don't care to use SSL, they are needed to contact regions or grids that do use it. From 8eef70ec9cde95d0eb03c9cc47f1ab18475d8ce6 Mon Sep 17 00:00:00 2001 From: UbitUmarov Date: Sat, 17 Aug 2024 00:33:02 +0100 Subject: [PATCH 12/13] ... in same cases http/https can't be determined. possible both need to be present, possible with http a redir to https. TODO --- OpenSim/Services/GridService/HypergridLinker.cs | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/OpenSim/Services/GridService/HypergridLinker.cs b/OpenSim/Services/GridService/HypergridLinker.cs index 5ce31f767c..d9f5a22e20 100644 --- a/OpenSim/Services/GridService/HypergridLinker.cs +++ b/OpenSim/Services/GridService/HypergridLinker.cs @@ -632,11 +632,7 @@ namespace OpenSim.Services.GridService parameters.Insert(3, parts[2]); cmdparams = (string[])parameters.ToArray(typeof(string)); } - string uri = cmdparams[2].StartsWith("https") - ? "https://" + parts[0] + ':' + parts[1] - : "http://" + parts[0] + ':' + parts[1]; - - cmdparams[2] = uri; + cmdparams[2] = "http://" + parts[0] + ':' + parts[1]; RunLinkRegionCommand(cmdparams); } From 4a72e92a749a1d5447182be78cab260c4a5e5554 Mon Sep 17 00:00:00 2001 From: UbitUmarov Date: Tue, 20 Aug 2024 04:24:16 +0100 Subject: [PATCH 13/13] fixed check of EnableSelfsignedCertSupport option --- OpenSim/Region/Application/OpenSimBase.cs | 2 +- OpenSim/Server/Base/ServicesServerBase.cs | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/OpenSim/Region/Application/OpenSimBase.cs b/OpenSim/Region/Application/OpenSimBase.cs index 6927b9e734..2971f61326 100755 --- a/OpenSim/Region/Application/OpenSimBase.cs +++ b/OpenSim/Region/Application/OpenSimBase.cs @@ -355,7 +355,7 @@ namespace OpenSim // Sure is not the right place for this but do the job... // Must always be called before (all) / the HTTP servers starting for the Certs creation or renewals. - if(startupConfig.GetBoolean("EnableSelfsignedCertSupport")) + if(startupConfig.GetBoolean("EnableSelfsignedCertSupport", false)) { if(!File.Exists("SSL\\ssl\\"+ startupConfig.GetString("CertFileName") +".p12") || startupConfig.GetBoolean("CertRenewOnStartup")) { diff --git a/OpenSim/Server/Base/ServicesServerBase.cs b/OpenSim/Server/Base/ServicesServerBase.cs index 402f853a34..368dc36660 100755 --- a/OpenSim/Server/Base/ServicesServerBase.cs +++ b/OpenSim/Server/Base/ServicesServerBase.cs @@ -134,7 +134,7 @@ namespace OpenSim.Server.Base prompt = startupConfig.GetString("Prompt", prompt); - if(startupConfig.GetBoolean("EnableRobustSelfsignedCertSupport")) + if(startupConfig.GetBoolean("EnableRobustSelfsignedCertSupport", false)) { if(!File.Exists("SSL\\ssl\\"+ startupConfig.GetString("RobustCertFileName") +".p12") || startupConfig.GetBoolean("RobustCertRenewOnStartup")) {