|
|
|
|
@ -44,12 +44,13 @@ use ruma::{
|
|
|
|
|
room::{
|
|
|
|
|
create::RoomCreateEventContent,
|
|
|
|
|
member::{MembershipState, RoomMemberEventContent},
|
|
|
|
|
server_acl::RoomServerAclEventContent,
|
|
|
|
|
},
|
|
|
|
|
AnyEphemeralRoomEvent, EventType,
|
|
|
|
|
},
|
|
|
|
|
int,
|
|
|
|
|
receipt::ReceiptType,
|
|
|
|
|
serde::JsonObject,
|
|
|
|
|
serde::{Base64, JsonObject},
|
|
|
|
|
signatures::{CanonicalJsonObject, CanonicalJsonValue},
|
|
|
|
|
state_res::{self, RoomVersion, StateMap},
|
|
|
|
|
to_device::DeviceIdOrAllDevices,
|
|
|
|
|
@ -551,7 +552,7 @@ pub fn get_server_keys_route(db: DatabaseGuard) -> Json<String> {
|
|
|
|
|
.try_into()
|
|
|
|
|
.expect("found invalid server signing keys in DB"),
|
|
|
|
|
VerifyKey {
|
|
|
|
|
key: base64::encode_config(db.globals.keypair().public_key(), base64::STANDARD_NO_PAD),
|
|
|
|
|
key: Base64::new(db.globals.keypair().public_key().to_vec()),
|
|
|
|
|
},
|
|
|
|
|
);
|
|
|
|
|
let mut response = serde_json::from_slice(
|
|
|
|
|
@ -740,6 +741,8 @@ pub async fn send_transaction_message_route(
|
|
|
|
|
}
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
acl_check(&body.origin, &room_id, &db)?;
|
|
|
|
|
|
|
|
|
|
let mutex = Arc::clone(
|
|
|
|
|
db.globals
|
|
|
|
|
.roomid_mutex_federation
|
|
|
|
|
@ -854,7 +857,7 @@ pub async fn send_transaction_message_route(
|
|
|
|
|
// Check if this is a new transaction id
|
|
|
|
|
if db
|
|
|
|
|
.transaction_ids
|
|
|
|
|
.existing_txnid(&sender, None, &message_id)?
|
|
|
|
|
.existing_txnid(&sender, None, (&*message_id).into())?
|
|
|
|
|
.is_some()
|
|
|
|
|
{
|
|
|
|
|
continue;
|
|
|
|
|
@ -902,7 +905,7 @@ pub async fn send_transaction_message_route(
|
|
|
|
|
|
|
|
|
|
// Save transaction id with empty data
|
|
|
|
|
db.transaction_ids
|
|
|
|
|
.add_txnid(&sender, None, &message_id, &[])?;
|
|
|
|
|
.add_txnid(&sender, None, (&*message_id).into(), &[])?;
|
|
|
|
|
}
|
|
|
|
|
Edu::_Custom(_) => {}
|
|
|
|
|
}
|
|
|
|
|
@ -948,7 +951,7 @@ pub(crate) async fn handle_incoming_pdu<'a>(
|
|
|
|
|
value: BTreeMap<String, CanonicalJsonValue>,
|
|
|
|
|
is_timeline_event: bool,
|
|
|
|
|
db: &'a Database,
|
|
|
|
|
pub_key_map: &'a RwLock<BTreeMap<String, BTreeMap<String, String>>>,
|
|
|
|
|
pub_key_map: &'a RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
|
|
|
|
|
) -> Result<Option<Vec<u8>>, String> {
|
|
|
|
|
match db.rooms.exists(room_id) {
|
|
|
|
|
Ok(true) => {}
|
|
|
|
|
@ -1123,7 +1126,7 @@ fn handle_outlier_pdu<'a>(
|
|
|
|
|
room_id: &'a RoomId,
|
|
|
|
|
value: BTreeMap<String, CanonicalJsonValue>,
|
|
|
|
|
db: &'a Database,
|
|
|
|
|
pub_key_map: &'a RwLock<BTreeMap<String, BTreeMap<String, String>>>,
|
|
|
|
|
pub_key_map: &'a RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
|
|
|
|
|
) -> AsyncRecursiveType<'a, Result<(Arc<PduEvent>, BTreeMap<String, CanonicalJsonValue>), String>> {
|
|
|
|
|
Box::pin(async move {
|
|
|
|
|
// TODO: For RoomVersion6 we must check that Raw<..> is canonical do we anywhere?: https://matrix.org/docs/spec/rooms/v6#canonical-json
|
|
|
|
|
@ -1285,7 +1288,7 @@ async fn upgrade_outlier_to_timeline_pdu(
|
|
|
|
|
origin: &ServerName,
|
|
|
|
|
db: &Database,
|
|
|
|
|
room_id: &RoomId,
|
|
|
|
|
pub_key_map: &RwLock<BTreeMap<String, BTreeMap<String, String>>>,
|
|
|
|
|
pub_key_map: &RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
|
|
|
|
|
) -> Result<Option<Vec<u8>>, String> {
|
|
|
|
|
if let Ok(Some(pduid)) = db.rooms.get_pdu_id(&incoming_pdu.event_id) {
|
|
|
|
|
return Ok(Some(pduid));
|
|
|
|
|
@ -1827,7 +1830,7 @@ pub(crate) fn fetch_and_handle_outliers<'a>(
|
|
|
|
|
events: &'a [Arc<EventId>],
|
|
|
|
|
create_event: &'a PduEvent,
|
|
|
|
|
room_id: &'a RoomId,
|
|
|
|
|
pub_key_map: &'a RwLock<BTreeMap<String, BTreeMap<String, String>>>,
|
|
|
|
|
pub_key_map: &'a RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
|
|
|
|
|
) -> AsyncRecursiveType<'a, Vec<(Arc<PduEvent>, Option<BTreeMap<String, CanonicalJsonValue>>)>> {
|
|
|
|
|
Box::pin(async move {
|
|
|
|
|
let back_off = |id| match db.globals.bad_event_ratelimiter.write().unwrap().entry(id) {
|
|
|
|
|
@ -1966,9 +1969,9 @@ pub(crate) async fn fetch_signing_keys(
|
|
|
|
|
db: &Database,
|
|
|
|
|
origin: &ServerName,
|
|
|
|
|
signature_ids: Vec<String>,
|
|
|
|
|
) -> Result<BTreeMap<String, String>> {
|
|
|
|
|
) -> Result<BTreeMap<String, Base64>> {
|
|
|
|
|
let contains_all_ids =
|
|
|
|
|
|keys: &BTreeMap<String, String>| signature_ids.iter().all(|id| keys.contains_key(id));
|
|
|
|
|
|keys: &BTreeMap<String, Base64>| signature_ids.iter().all(|id| keys.contains_key(id));
|
|
|
|
|
|
|
|
|
|
let permit = db
|
|
|
|
|
.globals
|
|
|
|
|
@ -2355,8 +2358,11 @@ pub fn get_event_route(
|
|
|
|
|
let room_id = <&RoomId>::try_from(room_id_str)
|
|
|
|
|
.map_err(|_| Error::bad_database("Invalid room id field in event in database"))?;
|
|
|
|
|
|
|
|
|
|
if !db.rooms.server_in_room(sender_servername, room_id)? {
|
|
|
|
|
return Err(Error::BadRequest(ErrorKind::NotFound, "Event not found."));
|
|
|
|
|
if !db.rooms.server_in_room(sender_servername, &room_id)? {
|
|
|
|
|
return Err(Error::BadRequest(
|
|
|
|
|
ErrorKind::Forbidden,
|
|
|
|
|
"Server is not in room",
|
|
|
|
|
));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
Ok(get_event::v1::Response {
|
|
|
|
|
@ -2395,6 +2401,8 @@ pub fn get_missing_events_route(
|
|
|
|
|
));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
acl_check(sender_servername, &body.room_id, &db)?;
|
|
|
|
|
|
|
|
|
|
let mut queued_events = body.latest_events.clone();
|
|
|
|
|
let mut events = Vec::new();
|
|
|
|
|
|
|
|
|
|
@ -2464,6 +2472,15 @@ pub fn get_event_authorization_route(
|
|
|
|
|
.as_ref()
|
|
|
|
|
.expect("server is authenticated");
|
|
|
|
|
|
|
|
|
|
if !db.rooms.server_in_room(sender_servername, &body.room_id)? {
|
|
|
|
|
return Err(Error::BadRequest(
|
|
|
|
|
ErrorKind::Forbidden,
|
|
|
|
|
"Server is not in room.",
|
|
|
|
|
));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
acl_check(sender_servername, &body.room_id, &db)?;
|
|
|
|
|
|
|
|
|
|
let event = db
|
|
|
|
|
.rooms
|
|
|
|
|
.get_pdu_json(&body.event_id)?
|
|
|
|
|
@ -2477,10 +2494,6 @@ pub fn get_event_authorization_route(
|
|
|
|
|
let room_id = <&RoomId>::try_from(room_id_str)
|
|
|
|
|
.map_err(|_| Error::bad_database("Invalid room id field in event in database"))?;
|
|
|
|
|
|
|
|
|
|
if !db.rooms.server_in_room(sender_servername, room_id)? {
|
|
|
|
|
return Err(Error::BadRequest(ErrorKind::NotFound, "Event not found."));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
let auth_chain_ids = get_auth_chain(room_id, vec![Arc::from(&*body.event_id)], &db)?;
|
|
|
|
|
|
|
|
|
|
Ok(get_event_authorization::v1::Response {
|
|
|
|
|
@ -2520,6 +2533,8 @@ pub fn get_room_state_route(
|
|
|
|
|
));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
acl_check(sender_servername, &body.room_id, &db)?;
|
|
|
|
|
|
|
|
|
|
let shortstatehash = db
|
|
|
|
|
.rooms
|
|
|
|
|
.pdu_shortstatehash(&body.event_id)?
|
|
|
|
|
@ -2583,6 +2598,8 @@ pub fn get_room_state_ids_route(
|
|
|
|
|
));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
acl_check(sender_servername, &body.room_id, &db)?;
|
|
|
|
|
|
|
|
|
|
let shortstatehash = db
|
|
|
|
|
.rooms
|
|
|
|
|
.pdu_shortstatehash(&body.event_id)?
|
|
|
|
|
@ -2626,10 +2643,17 @@ pub fn create_join_event_template_route(
|
|
|
|
|
if !db.rooms.exists(&body.room_id)? {
|
|
|
|
|
return Err(Error::BadRequest(
|
|
|
|
|
ErrorKind::NotFound,
|
|
|
|
|
"Server is not in room.",
|
|
|
|
|
"Room is unknown to this server.",
|
|
|
|
|
));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
let sender_servername = body
|
|
|
|
|
.sender_servername
|
|
|
|
|
.as_ref()
|
|
|
|
|
.expect("server is authenticated");
|
|
|
|
|
|
|
|
|
|
acl_check(sender_servername, &body.room_id, &db)?;
|
|
|
|
|
|
|
|
|
|
let prev_events: Vec<_> = db
|
|
|
|
|
.rooms
|
|
|
|
|
.get_pdu_leaves(&body.room_id)?
|
|
|
|
|
@ -2782,6 +2806,7 @@ pub fn create_join_event_template_route(
|
|
|
|
|
|
|
|
|
|
async fn create_join_event(
|
|
|
|
|
db: &DatabaseGuard,
|
|
|
|
|
sender_servername: &ServerName,
|
|
|
|
|
room_id: &RoomId,
|
|
|
|
|
pdu: &RawJsonValue,
|
|
|
|
|
) -> Result<RoomState> {
|
|
|
|
|
@ -2789,6 +2814,15 @@ async fn create_join_event(
|
|
|
|
|
return Err(Error::bad_config("Federation is disabled."));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if !db.rooms.exists(room_id)? {
|
|
|
|
|
return Err(Error::BadRequest(
|
|
|
|
|
ErrorKind::NotFound,
|
|
|
|
|
"Room is unknown to this server.",
|
|
|
|
|
));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
acl_check(sender_servername, room_id, &db)?;
|
|
|
|
|
|
|
|
|
|
// We need to return the state prior to joining, let's keep a reference to that here
|
|
|
|
|
let shortstatehash = db
|
|
|
|
|
.rooms
|
|
|
|
|
@ -2888,7 +2922,12 @@ pub async fn create_join_event_v1_route(
|
|
|
|
|
db: DatabaseGuard,
|
|
|
|
|
body: Ruma<create_join_event::v1::Request<'_>>,
|
|
|
|
|
) -> ConduitResult<create_join_event::v1::Response> {
|
|
|
|
|
let room_state = create_join_event(&db, &body.room_id, &body.pdu).await?;
|
|
|
|
|
let sender_servername = body
|
|
|
|
|
.sender_servername
|
|
|
|
|
.as_ref()
|
|
|
|
|
.expect("server is authenticated");
|
|
|
|
|
|
|
|
|
|
let room_state = create_join_event(&db, sender_servername, &body.room_id, &body.pdu).await?;
|
|
|
|
|
|
|
|
|
|
Ok(create_join_event::v1::Response { room_state }.into())
|
|
|
|
|
}
|
|
|
|
|
@ -2905,7 +2944,12 @@ pub async fn create_join_event_v2_route(
|
|
|
|
|
db: DatabaseGuard,
|
|
|
|
|
body: Ruma<create_join_event::v2::Request<'_>>,
|
|
|
|
|
) -> ConduitResult<create_join_event::v2::Response> {
|
|
|
|
|
let room_state = create_join_event(&db, &body.room_id, &body.pdu).await?;
|
|
|
|
|
let sender_servername = body
|
|
|
|
|
.sender_servername
|
|
|
|
|
.as_ref()
|
|
|
|
|
.expect("server is authenticated");
|
|
|
|
|
|
|
|
|
|
let room_state = create_join_event(&db, sender_servername, &body.room_id, &body.pdu).await?;
|
|
|
|
|
|
|
|
|
|
Ok(create_join_event::v2::Response { room_state }.into())
|
|
|
|
|
}
|
|
|
|
|
@ -2926,6 +2970,13 @@ pub async fn create_invite_route(
|
|
|
|
|
return Err(Error::bad_config("Federation is disabled."));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
let sender_servername = body
|
|
|
|
|
.sender_servername
|
|
|
|
|
.as_ref()
|
|
|
|
|
.expect("server is authenticated");
|
|
|
|
|
|
|
|
|
|
acl_check(sender_servername, &body.room_id, &db)?;
|
|
|
|
|
|
|
|
|
|
if body.room_version != RoomVersionId::V5 && body.room_version != RoomVersionId::V6 {
|
|
|
|
|
return Err(Error::BadRequest(
|
|
|
|
|
ErrorKind::IncompatibleRoomVersion {
|
|
|
|
|
@ -3199,7 +3250,7 @@ pub async fn claim_keys_route(
|
|
|
|
|
#[tracing::instrument(skip(event, pub_key_map, db))]
|
|
|
|
|
pub(crate) async fn fetch_required_signing_keys(
|
|
|
|
|
event: &BTreeMap<String, CanonicalJsonValue>,
|
|
|
|
|
pub_key_map: &RwLock<BTreeMap<String, BTreeMap<String, String>>>,
|
|
|
|
|
pub_key_map: &RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
|
|
|
|
|
db: &Database,
|
|
|
|
|
) -> Result<()> {
|
|
|
|
|
let signatures = event
|
|
|
|
|
@ -3253,7 +3304,7 @@ fn get_server_keys_from_cache(
|
|
|
|
|
pdu: &RawJsonValue,
|
|
|
|
|
servers: &mut BTreeMap<Box<ServerName>, BTreeMap<Box<ServerSigningKeyId>, QueryCriteria>>,
|
|
|
|
|
room_version: &RoomVersionId,
|
|
|
|
|
pub_key_map: &mut RwLockWriteGuard<'_, BTreeMap<String, BTreeMap<String, String>>>,
|
|
|
|
|
pub_key_map: &mut RwLockWriteGuard<'_, BTreeMap<String, BTreeMap<String, Base64>>>,
|
|
|
|
|
db: &Database,
|
|
|
|
|
) -> Result<()> {
|
|
|
|
|
let value: CanonicalJsonObject = serde_json::from_str(pdu.get()).map_err(|e| {
|
|
|
|
|
@ -3306,7 +3357,7 @@ fn get_server_keys_from_cache(
|
|
|
|
|
let signature_ids = signature_object.keys().cloned().collect::<Vec<_>>();
|
|
|
|
|
|
|
|
|
|
let contains_all_ids =
|
|
|
|
|
|keys: &BTreeMap<String, String>| signature_ids.iter().all(|id| keys.contains_key(id));
|
|
|
|
|
|keys: &BTreeMap<String, Base64>| signature_ids.iter().all(|id| keys.contains_key(id));
|
|
|
|
|
|
|
|
|
|
let origin = <&ServerName>::try_from(signature_server.as_str()).map_err(|_| {
|
|
|
|
|
Error::BadServerResponse("Invalid servername in signatures of server response pdu.")
|
|
|
|
|
@ -3339,7 +3390,7 @@ fn get_server_keys_from_cache(
|
|
|
|
|
pub(crate) async fn fetch_join_signing_keys(
|
|
|
|
|
event: &create_join_event::v2::Response,
|
|
|
|
|
room_version: &RoomVersionId,
|
|
|
|
|
pub_key_map: &RwLock<BTreeMap<String, BTreeMap<String, String>>>,
|
|
|
|
|
pub_key_map: &RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
|
|
|
|
|
db: &Database,
|
|
|
|
|
) -> Result<()> {
|
|
|
|
|
let mut servers: BTreeMap<Box<ServerName>, BTreeMap<Box<ServerSigningKeyId>, QueryCriteria>> =
|
|
|
|
|
@ -3439,6 +3490,35 @@ pub(crate) async fn fetch_join_signing_keys(
|
|
|
|
|
Ok(())
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/// Returns Ok if the acl allows the server
|
|
|
|
|
fn acl_check(server_name: &ServerName, room_id: &RoomId, db: &Database) -> Result<()> {
|
|
|
|
|
let acl_event = match db
|
|
|
|
|
.rooms
|
|
|
|
|
.room_state_get(room_id, &EventType::RoomServerAcl, "")?
|
|
|
|
|
{
|
|
|
|
|
Some(acl) => acl,
|
|
|
|
|
None => return Ok(()),
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
let acl_event_content: RoomServerAclEventContent =
|
|
|
|
|
match serde_json::from_str(acl_event.content.get()) {
|
|
|
|
|
Ok(content) => content,
|
|
|
|
|
Err(_) => {
|
|
|
|
|
warn!("Invalid ACL event");
|
|
|
|
|
return Ok(());
|
|
|
|
|
}
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
if acl_event_content.is_allowed(server_name) {
|
|
|
|
|
Ok(())
|
|
|
|
|
} else {
|
|
|
|
|
Err(Error::BadRequest(
|
|
|
|
|
ErrorKind::Forbidden,
|
|
|
|
|
"Server was denied by ACL",
|
|
|
|
|
))
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[cfg(test)]
|
|
|
|
|
mod tests {
|
|
|
|
|
use super::{add_port_to_hostname, get_ip_with_port, FedDest};
|
|
|
|
|
|
Timo Kösters
2 years ago