099829d5a9
use attr.s for VerifyKeyRequest
...
because namedtuple is awful
2019-05-30 17:39:28 +01:00
540f40f0cd
Merge pull request #5251 from matrix-org/rav/server_keys/01-check_sig
...
Ensure that server_keys fetched via a notary server are correctly signed.
2019-05-28 21:32:17 +01:00
fa1b293da2
Simplification to Keyring.wait_for_previous_lookups. ( #5250 )
...
The list of server names was redundant, since it was equivalent to the keys on
the server_to_deferred map. This reduces the number of large lists being passed
around, and has the benefit of deduplicating the entries in `wait_on`.
2019-05-24 22:17:18 +01:00
b825d1c800
Improve error handling/logging for perspectives-key fetching.
...
In particular, don't give up on the first failure.
2019-05-24 15:46:25 +01:00
753b1270da
Require sig from origin server on perspectives responses
2019-05-23 15:01:09 +01:00
895b79ac2e
Factor out KeyFetchers from KeyRing
...
Rather than have three methods which have to have the same interface,
factor out a separate interface which is provided by three implementations.
I find it easier to grok the code this way.
2019-05-23 13:46:47 +01:00
b75537beaf
Store key validity time in the storage layer
...
This is a first step to checking that the key is valid at the required moment.
The idea here is that, rather than passing VerifyKey objects in and out of the
storage layer, we instead pass FetchKeyResult objects, which simply wrap the
VerifyKey and add a valid_until_ts field.
2019-05-23 11:52:22 +01:00
84660d91b2
Simplify process_v2_response ( #5236 )
...
* Pass time_added_ms into process_v2_response
* Simplify process_v2_response
We can merge old_verify_keys into verify_keys, and reduce the number of dicts
flying around.
2019-05-23 11:51:39 +01:00
cc187f9337
Remove unused VerifyKey.expired and .time_added fields ( #5235 )
...
These were never used, and poking arbitary data into objects from other
packages seems confusing at best.
2019-05-23 11:46:05 +01:00
2e052110ee
Rewrite store_server_verify_key to store several keys at once ( #5234 )
...
Storing server keys hammered the database a bit. This replaces the
implementation which stored a single key, with one which can do many updates at
once.
2019-05-23 11:45:39 +01:00
1a94de60e8
Run black on synapse.crypto.keyring ( #5232 )
2019-05-22 18:39:33 +01:00
fd8fb32bdd
remove extraneous exception logging
2019-04-25 22:02:03 +01:00
7ca638c761
Clarify logging when PDU signature checking fails
2019-04-25 20:55:12 +01:00
6824ddd93d
Config option for verifying federation certificates (MSC 1711) ( #4967 )
2019-04-25 14:22:49 +01:00
caa76e6021
Remove periods from copyright headers ( #5046 )
2019-04-11 17:08:13 +01:00
18b69be00f
Rewrite Datastore.get_server_verify_keys
...
Rewrite this so that it doesn't hammer the database.
2019-04-09 00:00:10 +01:00
f88a9e6323
Remove redundant merged_keys dict
...
There's no point in collecting a merged dict of keys: it is sufficient to
consider just the new keys which have been fetched by the most recent
key_fetch_fns.
2019-04-08 22:36:18 +01:00
7d2a0c848e
Fix from_server buglet in get_keys_from_perspectives
...
make sure we store the name of the server the keys came from, rather than the
origin server, after doing a fetch-from-perspectives.
2019-04-08 12:51:16 +01:00
6ae9361510
Hoist server_name check out of process_v2_response
...
It's easier to check it in the caller than to complicate the interface with an
extra param.
2019-04-04 19:12:54 +01:00
ef27d434d1
Clean up Keyring.process_v2_response
...
Make this just return the key dict, rather than a single-entry dict mapping the
server name to the key dict. It's easy for the caller to get the server name
from from the response object anyway.
2019-04-04 19:12:54 +01:00
78c563b77c
Correctly log expected errors when fetching server keys
2019-03-11 14:11:10 +00:00
65d1003d01
raise_from already raises
2019-02-25 14:34:03 +00:00
41285ffe5b
Handle errors when fetching remote server keys
2019-02-23 15:09:39 +00:00
561eebe170
fix to use makeContext so that we don't need to rebuild the certificateoptions each time
2019-02-19 16:18:05 +11:00
7fc1196a36
Correctly handle RequestSendFailed exceptions
...
This mainly reduces the number of exceptions we log.
2019-02-14 14:01:04 +00:00
9645728619
Don't create server contexts when TLS is disabled
...
we aren't going to use them anyway.
2019-02-11 21:32:01 +00:00
554ca58ea1
Make add_hashes_and_signatures operate on dicts
2019-01-29 11:12:38 +00:00
855a151015
Refactor event signing to work on dicts
...
This is in preparation for making EventBuilder format agnostic, which
means event signing should be done against the event dict rather than
the EventBuilder object.
2019-01-28 16:42:10 +00:00
97fd29c019
Don't send IP addresses as SNI ( #4452 )
...
The problem here is that we have cut-and-pasted an impl from Twisted, and then
failed to maintain it. It was fixed in Twisted in
https://github.com/twisted/twisted/pull/1047/files ; let's do the same here.
2019-01-24 09:34:44 +00:00
6bfa735a69
Make key fetches use regular federation client ( #4426 )
...
All this magic is redundant.
2019-01-22 11:04:20 +00:00
23b0813599
Require ECDH key exchange & remove dh_params ( #4429 )
...
* remove dh_params and set better cipher string
2019-01-22 21:58:50 +11:00
916efc8249
Remove fetching keys via the deprecated v1 kex method ( #4120 )
2018-10-31 23:14:39 +11:00
ef771cc4c2
Fix a number of flake8 errors
...
Broadly three things here:
* disable W504 which seems a bit whacko
* remove a bunch of `as e` expressions from exception handlers that don't use
them
* use `r""` for strings which include backslashes
Also, we don't use pep8 any more, so we can get rid of the duplicate config
there.
2018-10-24 10:39:03 +01:00
33716c4aea
Merge pull request #3826 from matrix-org/rav/logging_for_keyring
...
add some logging for the keyring queue
2018-09-12 20:43:47 +10:00
8fd93b5eea
Port crypto/ to Python 3 ( #3822 )
2018-09-12 20:16:31 +10:00
806964b5de
add some logging for the keyring queue
...
why is it so damn slow?
2018-09-06 18:51:06 +01:00
808d8e06aa
Don't log exceptions when failing to fetch server keys
...
Not being able to resolve or connect to remote servers is an expected
error, so we shouldn't log at ERROR with stacktraces.
2018-08-21 11:19:26 +01:00
2e9c73e8ca
more generic conversion of str/bytes to unicode
2018-08-09 21:31:26 +02:00
64899341dc
include private functions from twisted
2018-08-09 21:04:22 +02:00
d5c0ce4cad
updated docstring for ServerContextFactory
2018-08-08 19:25:01 +02:00
2903e65aff
fix isort
2018-07-29 19:47:08 +02:00
8e3f75b39a
fix accidental removal of hs
2018-07-27 12:17:31 +02:00
505530f36a
Merge remote-tracking branch 'upstream/develop' into send_sni_for_federation_requests
...
# Conflicts:
# synapse/crypto/context_factory.py
2018-07-14 20:24:46 +02:00
b5e157d895
Merge branch 'develop' into send_sni_for_federation_requests
...
# Conflicts:
# synapse/http/endpoint.py
2018-07-09 08:51:11 +02:00
49af402019
run isort
2018-07-09 16:09:20 +10:00
6350bf925e
Attempt to be more performant on PyPy ( #3462 )
2018-06-28 14:49:57 +01:00
95341a8f6f
take idna implementation from twisted
2018-06-26 21:15:14 +02:00
b7f34ee348
allow self-signed certificates
2018-06-26 20:41:05 +02:00
07b4f88de9
formatting changes for pep8
2018-06-25 12:31:16 +02:00
3d605853c8
send SNI for federation requests
2018-06-24 22:38:43 +02:00
Richard van der Hoff