9fbb20a531
Stop hardcoding trust of old matrix.org key ( #5374 )
...
There are a few changes going on here:
* We make checking the signature on a key server response optional: if no
verify_keys are specified, we trust to TLS to validate the connection.
* We change the default config so that it does not require responses to be
signed by the old key.
* We replace the old 'perspectives' config with 'trusted_key_servers', which
is also formatted slightly differently.
* We emit a warning to the logs every time we trust a key server response
signed by the old key.
2019-06-06 17:33:11 +01:00
71063a69b8
Fix missing logcontext for PresenceHandler.on_shutdown. ( #5369 )
...
Fixes some warnings, and a scary-looking stacktrace when sytest kills the
process.
2019-06-06 14:45:17 +01:00
89d3d7b2c0
Merge pull request #5221 from matrix-org/erikj/fix_worker_sytest
...
Fix get_max_topological_token to never return None
2019-06-06 13:54:46 +01:00
8f06344e11
Merge pull request #5089 from dnaf/m-heroes-empty-room-name
...
Make /sync return heroes if room name or canonical alias are empty
2019-06-06 11:18:13 +01:00
7f08a3523a
Better words
2019-06-06 11:09:38 +01:00
cb3b381fcb
Merge pull request #5359 from matrix-org/rav/enable_tls_verification
...
Validate federation server TLS certificates by default.
2019-06-06 10:50:42 +01:00
64fa928792
Simplify condition
2019-06-06 10:34:12 +01:00
b9c43c8463
Merge pull request #5355 from matrix-org/babolivier/heroes_left_members
...
Include left members in room summaries' heroes
2019-06-06 10:05:27 +01:00
99d3497949
Merge pull request #5354 from matrix-org/rav/server_keys/99-room-v5
...
Implement room v5 which enforces signing key validity
2019-06-06 09:42:13 +01:00
2eb47e5ee7
Merge pull request #5353 from matrix-org/rav/verify_key_logging
...
Associate a request_name with each verify request, for logging
2019-06-06 09:33:09 +01:00
7603a706eb
Merge branch 'rav/fix_custom_ca' into rav/enable_tls_verification
2019-06-05 16:32:35 +01:00
f8a45302c9
Fix `federation_custom_ca_list` configuration option.
...
Previously, setting this option would cause an exception at startup.
2019-06-05 16:19:07 +01:00
94f6c674df
Neilj/add r0.5 to versions ( #5360 )
...
* Update _matrix/client/versions to reference support for r0.5.0
2019-06-05 16:11:31 +01:00
75538813fc
Fix background updates to handle redactions/rejections ( #5352 )
...
* Fix background updates to handle redactions/rejections
In background updates based on current state delta stream we need to
handle that we may not have all the events (or at least that
`get_events` may raise an exception).
2019-06-06 00:45:46 +10:00
e2dfb922e1
Validate federation server TLS certificates by default.
2019-06-05 14:17:50 +01:00
0a2f522644
Simplify condition
2019-06-05 14:02:29 +01:00
d53faa40e9
Merge pull request #5317 from matrix-org/erikj/make_do_auth_non_essential
...
Fix handling of failures when calling /event_auth.
2019-06-05 14:01:32 +01:00
40596aec0e
Merge branch 'develop' into m-heroes-empty-room-name
2019-06-05 13:38:01 +01:00
26713515de
Neilj/mau tracking config explainer ( #5284 )
...
Improve documentation of monthly active user blocking and mau_trial_days
2019-06-05 13:16:23 +01:00
dbbaf25dd3
Do user_id != me checks before deciding whether we should pick heroes from the joined members or the parted ones
2019-06-05 11:50:27 +01:00
bc3d6b918b
Add logging when request fails and clarify we ignore errors.
2019-06-05 11:37:51 +01:00
d18e4ea0d4
Implement room v5 which enforces signing key validity
...
Implements [MSC2077](https://github.com/matrix-org/matrix-doc/pull/2077 ) and
fixes #5247 and #4364 .
2019-06-05 11:00:47 +01:00
cea9750d11
Associate a request_name with each verify request, for logging
...
Also:
* rename VerifyKeyRequest->VerifyJsonRequest
* calculate key_ids on VerifyJsonRequest construction
* refactor things to pass around VerifyJsonRequests instead of 4-tuples
2019-06-05 10:46:26 +01:00
14f13babb0
Add a test room version where we enforce key validity ( #5348 )
2019-06-05 10:38:25 +01:00
2615c6bd9e
Clean up debug logging ( #5347 )
...
Remove some spurious stuff, clarify some other stuff
2019-06-05 10:35:40 +01:00
016af01598
Rename VerifyKeyRequest.deferred field ( #5343 )
...
it's a bit confusing
2019-06-05 10:35:13 +01:00
aa530e6800
Call RetryLimiter correctly ( #5340 )
...
Fixes a regression introduced in #5335 .
2019-06-04 22:02:53 +01:00
dae224a73f
Fix failure to fetch batches of PDUs ( #5342 )
...
FederationClient.get_pdu is called in a loop to fetch a batch of PDUs. A
failure to fetch one should not result in a failure of the whole batch. Add the
missing `continue`.
2019-06-04 18:05:06 +01:00
b4189b112f
Rename get_events->get_events_from_store_or_dest ( #5344 )
...
We have too many things called get_event, and it's hard to figure out what we
mean. Also remove some unused params from the signature, and add some logging.
2019-06-04 18:01:09 +01:00
f6dd12d1e2
Merge pull request #5341 from matrix-org/babolivier/email_config
...
Make account validity renewal emails work when email notifs are disabled
2019-06-04 14:49:06 +01:00
2f62e1f6ff
Only parse from email if provided
2019-06-04 14:24:36 +01:00
d1d38081a7
Merge pull request #5324 from matrix-org/erikj/ignore_null
...
Ignore room state with null bytes in for room stats
2019-06-04 14:20:08 +01:00
1cc5fc1f6c
Lint
2019-06-04 13:51:23 +01:00
ac3cc32367
Make account validity renewal emails work when email notifs are disabled
2019-06-04 13:47:44 +01:00
df9c100542
Avoid rapidly backing-off a server if we ignore the retry interval ( #5335 )
2019-06-04 11:53:29 +01:00
4d08b8f30c
Don't do long retries when calling the key notary server. ( #5334 )
...
It takes at least 20 minutes to work through the long_retries schedule (11
attempts, each with a 60 second timeout, and 60 seconds between each request),
so if the notary server isn't returning within the timeout, we'll just end up
blocking whatever request is happening for 20 minutes.
Ain't nobody got time for that.
2019-06-04 11:53:07 +01:00
cb683d3e3c
Merge pull request #5333 from matrix-org/rav/server_keys/09_improve_notary_server
...
Fixes for the key-notary server
2019-06-04 11:48:18 +01:00
5bdb189f86
Improve docstrings on MatrixFederationClient. ( #5332 )
2019-06-04 11:14:16 +01:00
b2b90b7d34
Hawkowl/fix missing auth ( #5328 )
2019-06-04 15:54:27 +10:00
c5d60eadd5
Notary server: make requests to origins in parallel
...
... else we're guaranteed to time out.
2019-06-04 00:16:56 +01:00
def5ea4062
Don't bomb out on direct key fetches as soon as one fails
2019-06-04 00:16:56 +01:00
dce6e9e0c1
Avoid rapidly backing-off a server if we ignore the retry interval
2019-06-03 23:58:42 +01:00
06a1f3e207
Reduce timeout for outbound /key/v2/server requests.
2019-06-03 23:17:38 +01:00
fec2dcb1a5
Enforce validity period on server_keys for fed requests. ( #5321 )
...
When handling incoming federation requests, make sure that we have an
up-to-date copy of the signing key.
We do not yet enforce the validity period for event signatures.
2019-06-03 22:59:51 +01:00
0a56966f7d
Fix
2019-06-03 17:42:52 +01:00
fa4b54aca5
Ignore room state with null bytes in for room stats
2019-06-03 17:06:54 +01:00
862b2f9ad5
Merge pull request #5307 from matrix-org/rav/server_keys/07-fix-notary-cache-poison
...
Stop overwriting server keys with other keys
2019-06-03 13:19:20 +01:00
2889b05554
Unify v1 and v2 REST client APIs ( #5226 )
2019-06-03 21:28:59 +10:00
220a733d73
Fix handling of failures when calling /event_auth.
...
When processing an incoming event over federation, we may try and
resolve any unexpected differences in auth events. This is a
non-essential process and so should not stop the processing of the event
if it fails (e.g. due to the remote disappearing or not implementing the
necessary endpoints).
Fixes #3330
2019-06-03 09:56:45 +01:00
d828d1dc57
Merge pull request #5309 from matrix-org/rav/limit_displayname_length
...
Limit displaynames and avatar URLs
2019-06-01 11:34:50 +01:00
Richard van der Hoff