v3.1.8

Release v3.1.8

This release contains security fixes and a breaking change to how server certificates are checked. Please read "Before you upgrade".

Before you upgrade

Server certificates are now validated. Earlier versions accepted every certificate presented by a server, so anyone on the network path could impersonate a grid and read login credentials and session capabilities. Certificates are now checked against the platform's trust store.

• Second Life: nothing to do. Login and asset servers present certificates that verify normally.
• A grid whose certificate doesn't verify (self-signed, a private CA, or a platform with an incomplete trust store) is now refused. The log shows the host, the error, and the certificate's SHA-256 fingerprint. Configure Settings.Security:

// Trust one specific certificate (the way to connect to a self-signed server)
client.Settings.Security.TrustCertificate("D1:E0:FE:13:...");

// Trust the roots in a PEM file, like the viewer's ca-bundle.crt
client.Settings.Security.CaBundlePath = "/path/to/ca-bundle.pem";

// Decide per connection, for example by asking the user
client.Settings.Security.CertificateValidationCallback = (host, cert, errors) => AskUser(host, cert);

// Restore the old behaviour (not recommended; logs a warning)
client.Settings.Security.VerifyServerCertificates = false;

Collada textures are now only loaded from the model file's directory and its subdirectories. A model that keeps textures in a sibling directory (for example ../textures/x.tga) loads without those textures unless you set ColladaLoader.RestrictTexturesToModelDirectory = false.

Security fixes

• Mesh decoding: a crafted mesh asset could use very large amounts of memory. Part sizes are checked against the data, and the number of parts, the inflated size, and the number of decoded values are limited. (GHSA-6vc8-53gc-q925)
• Texture decoding: a crafted JPEG 2000 file could make the decoder use large amounts of memory and time, and AssetTexture.Decode threw instead of returning false. The header is now checked before decoding, and failures return false. (GHSA-rmcv-62w3-w3pf)
• Compressed and binary LLSD: Helpers.DecompressOSD and ZDecompressOSD limit inflated output. The binary LLSD parser checks lengths against the data present, and limits nesting and the number of values. The XML and notation LLSD parsers limit nesting depth.
• Decoded geometry: meshes with too many faces, vertices, triangles or joints, out-of-range triangle indices, or non-finite values are rejected.
• Animations: joint and keyframe counts are checked against the data before allocating.
• UDP: datagrams shorter than a packet header, and appended ACK lists that don't fit, are refused instead of being built from leftover buffer bytes. Malformed packets log at most 64 bytes.
• Mute list: a line of many digits no longer stalls the parser.
• RLV: @notify, @redirchat and @rediremote refuse channel 0 (public chat), and blacklisted commands no longer reply on it.

Other behaviour changes

• AssetTexture.Decode returns false and sets Image to null on malformed data instead of throwing.
• FacetedMesh.TryDecodeFromAsset leaves mesh null when it returns false.
• MeshFoundry.MeshSubMeshAsSimpleMesh returns null instead of throwing on bad data.
• New public settings, all adjustable if a grid needs larger assets: Settings.Security, AssetMesh.MaxParts, MaxInflatedPartBytes, MaxInflatedAssetBytes, MaxDecodedElements, AssetTexture.MaxDimension and related limits, FacetedMesh.MaxFaces, MaxVerticesPerFace, MaxTrianglesPerFace, MaxSkinJoints, Helpers.MaxInflatedOSDBytes, OSDParser.MaxBinaryElements, MaxBinaryNestingDepth, MaxXmlNestingDepth, MaxNotationNestingDepth, BinBVHAnimationReader.MaxJoints.