mirror of
https://github.com/matrix-construct/construct
synced 2024-08-22 17:44:45 +02:00
448 lines
8.1 KiB
C++
448 lines
8.1 KiB
C++
// Matrix Construct
|
|
//
|
|
// Copyright (C) Matrix Construct Developers, Authors & Contributors
|
|
// Copyright (C) 2016-2018 Jason Volk <jason@zemos.net>
|
|
//
|
|
// Permission to use, copy, modify, and/or distribute this software for any
|
|
// purpose with or without fee is hereby granted, provided that the above
|
|
// copyright notice and this permission notice is present in all copies. The
|
|
// full license for this software is available in the LICENSE file.
|
|
|
|
using namespace ircd::m;
|
|
using namespace ircd;
|
|
|
|
static bool verify(const m::keys &) noexcept;
|
|
static bool get_local(const string_view &server_name, const m::keys::closure &);
|
|
static event::id::buf set_keys(const m::keys &);
|
|
|
|
mapi::header
|
|
IRCD_MODULE
|
|
{
|
|
"Federation 2.3 :Retrieving Server Keys"
|
|
};
|
|
|
|
extern "C" void
|
|
get__keys(const string_view &server_name,
|
|
const m::keys::closure &closure)
|
|
{
|
|
assert(!server_name.empty());
|
|
|
|
if(get_local(server_name, closure))
|
|
return;
|
|
|
|
if(server_name == my_host())
|
|
throw m::NOT_FOUND
|
|
{
|
|
"keys for '%s' (that's myself) not found", server_name
|
|
};
|
|
|
|
m::log.debug("Keys for %s not cached; querying network...",
|
|
server_name);
|
|
|
|
//TODO: XXX
|
|
const unique_buffer<mutable_buffer> buffer
|
|
{
|
|
32_KiB
|
|
};
|
|
|
|
const mutable_buffer out_head
|
|
{
|
|
data(buffer), 8_KiB
|
|
};
|
|
|
|
using buffer::size;
|
|
const mutable_buffer in
|
|
{
|
|
data(out_head) + size(out_head), size(buffer) - size(out_head)
|
|
};
|
|
|
|
m::request request
|
|
{
|
|
my_host(), server_name, "GET", "/_matrix/key/v2/server/", {}
|
|
};
|
|
|
|
const auto request_head
|
|
{
|
|
request(out_head)
|
|
};
|
|
|
|
const net::hostport host
|
|
{
|
|
server_name
|
|
};
|
|
|
|
server::request tag
|
|
{
|
|
host, { request_head }, { in }
|
|
};
|
|
|
|
//TODO: conf
|
|
if(!tag.wait(seconds(20), std::nothrow))
|
|
{
|
|
cancel(tag);
|
|
throw m::error
|
|
{
|
|
http::REQUEST_TIMEOUT, "M_TIMEOUT",
|
|
"Failed to fetch keys for '%s' in time",
|
|
server_name
|
|
};
|
|
}
|
|
|
|
const http::code status
|
|
{
|
|
tag.get()
|
|
};
|
|
|
|
const json::object response
|
|
{
|
|
tag.in.content
|
|
};
|
|
|
|
const m::keys &keys
|
|
{
|
|
response
|
|
};
|
|
|
|
if(!verify(keys))
|
|
throw m::error
|
|
{
|
|
http::UNAUTHORIZED, "M_INVALID_SIGNATURE",
|
|
"Failed to verify keys for '%s'",
|
|
server_name
|
|
};
|
|
|
|
m::log.debug("Verified keys from '%s'",
|
|
server_name);
|
|
|
|
set_keys(keys);
|
|
closure(keys);
|
|
}
|
|
|
|
extern "C" void
|
|
query__keys(const string_view &server_name,
|
|
const string_view &key_id,
|
|
const string_view &query_server,
|
|
const m::keys::closure &closure)
|
|
try
|
|
{
|
|
assert(!server_name.empty());
|
|
assert(!query_server.empty());
|
|
|
|
thread_local char url_buf[2_KiB];
|
|
thread_local char key_id_buf[1_KiB];
|
|
thread_local char server_name_buf[1_KiB];
|
|
const string_view url{fmt::sprintf
|
|
{
|
|
url_buf, "/_matrix/key/v2/query/%s/%s/",
|
|
url::encode(server_name, server_name_buf),
|
|
url::encode(key_id, key_id_buf)
|
|
}};
|
|
|
|
// This buffer will hold the HTTP request and response
|
|
//TODO: XXX
|
|
const unique_buffer<mutable_buffer> buffer
|
|
{
|
|
32_KiB
|
|
};
|
|
|
|
m::request request
|
|
{
|
|
my_host(), server_name, "GET", url, {}
|
|
};
|
|
|
|
// Generates the HTTP request head into the front of buffer
|
|
const string_view head
|
|
{
|
|
request(buffer)
|
|
};
|
|
|
|
// Partition the remainder of buffer for the response data
|
|
using buffer::size;
|
|
assert(size(head) < size(buffer) / 2);
|
|
const mutable_buffer in
|
|
{
|
|
data(buffer) + size(head), size(buffer) - size(head)
|
|
};
|
|
|
|
// The request to the remote is transmitted
|
|
server::request tag
|
|
{
|
|
server_name, { head }, { in }
|
|
};
|
|
|
|
if(!tag.wait(seconds(30), std::nothrow))
|
|
throw m::error
|
|
{
|
|
http::REQUEST_TIMEOUT, "M_TIMEOUT",
|
|
"Failed to fetch keys for '%s' from '%s' in time",
|
|
server_name,
|
|
query_server
|
|
};
|
|
|
|
// The response from the remote is received
|
|
const auto code
|
|
{
|
|
tag.get()
|
|
};
|
|
|
|
// The content received is here
|
|
const json::object response
|
|
{
|
|
tag.in.content
|
|
};
|
|
|
|
// This parses the content for our key.
|
|
const json::array &keys
|
|
{
|
|
response.at("server_keys")
|
|
};
|
|
|
|
m::log.debug("Fetched %zu candidate keys seeking '%s' for '%s' from '%s'",
|
|
keys.count(),
|
|
empty(key_id)? "*" : key_id,
|
|
server_name,
|
|
query_server);
|
|
|
|
bool ret{false};
|
|
for(auto it(begin(keys)); it != end(keys); ++it)
|
|
{
|
|
const m::keys &keys{*it};
|
|
const auto &_server_name
|
|
{
|
|
at<"server_name"_>(keys)
|
|
};
|
|
|
|
if(!verify(keys))
|
|
throw m::error
|
|
{
|
|
http::UNAUTHORIZED, "M_INVALID_SIGNATURE",
|
|
"Failed to verify keys for '%s' from '%s'",
|
|
_server_name,
|
|
query_server
|
|
};
|
|
|
|
m::log.debug("Verified keys for '%s' from '%s'",
|
|
_server_name,
|
|
query_server);
|
|
|
|
set_keys(keys);
|
|
const json::object vks{json::get<"verify_keys"_>(keys)};
|
|
if(_server_name == server_name)
|
|
{
|
|
closure(keys);
|
|
ret = true;
|
|
}
|
|
}
|
|
|
|
if(!ret)
|
|
throw m::NOT_FOUND
|
|
{
|
|
"Failed to get any keys for '%s' from '%s' (got %zu total keys otherwise)",
|
|
server_name,
|
|
query_server,
|
|
keys.count()
|
|
};
|
|
}
|
|
catch(const json::not_found &e)
|
|
{
|
|
throw m::NOT_FOUND
|
|
{
|
|
"Failed to find key '%s' for '%s' when querying '%s': %s",
|
|
key_id,
|
|
server_name,
|
|
query_server,
|
|
e.what()
|
|
};
|
|
}
|
|
|
|
event::id::buf
|
|
set_keys(const m::keys &keys)
|
|
{
|
|
const auto &server_name
|
|
{
|
|
unquote(at<"server_name"_>(keys))
|
|
};
|
|
|
|
const m::node::id::buf node_id
|
|
{
|
|
"", server_name
|
|
};
|
|
|
|
const m::node::room node_room
|
|
{
|
|
node_id
|
|
};
|
|
|
|
if(!exists(node_room.room_id))
|
|
create(node_room, m::me.user_id);
|
|
|
|
const json::strung derp
|
|
{
|
|
keys
|
|
};
|
|
|
|
return send(node_room, m::me.user_id, "ircd.keys", "", json::object{derp});
|
|
}
|
|
|
|
bool
|
|
get_local(const string_view &server_name,
|
|
const m::keys::closure &closure)
|
|
{
|
|
const node::id::buf node_id
|
|
{
|
|
"", server_name
|
|
};
|
|
|
|
const m::node::room node_room
|
|
{
|
|
node_id
|
|
};
|
|
|
|
return node_room.get(std::nothrow, "ircd.keys", "", [&closure]
|
|
(const m::event &event)
|
|
{
|
|
closure(json::get<"content"_>(event));
|
|
});
|
|
}
|
|
|
|
bool
|
|
verify(const m::keys &keys)
|
|
noexcept try
|
|
{
|
|
const auto &valid_until_ts
|
|
{
|
|
at<"valid_until_ts"_>(keys)
|
|
};
|
|
|
|
if(valid_until_ts < ircd::time<milliseconds>())
|
|
throw ircd::error("Key was valid until %s", timestr(valid_until_ts));
|
|
|
|
const json::object &verify_keys
|
|
{
|
|
at<"verify_keys"_>(keys)
|
|
};
|
|
|
|
const string_view &key_id
|
|
{
|
|
begin(verify_keys)->first
|
|
};
|
|
|
|
const json::object &key
|
|
{
|
|
begin(verify_keys)->second
|
|
};
|
|
|
|
const ed25519::pk pk
|
|
{
|
|
[&key](auto &pk)
|
|
{
|
|
b64decode(pk, unquote(key.at("key")));
|
|
}
|
|
};
|
|
|
|
const json::object &signatures
|
|
{
|
|
at<"signatures"_>(keys)
|
|
};
|
|
|
|
const string_view &server_name
|
|
{
|
|
unquote(at<"server_name"_>(keys))
|
|
};
|
|
|
|
const json::object &server_signatures
|
|
{
|
|
signatures.at(server_name)
|
|
};
|
|
|
|
const ed25519::sig sig{[&server_signatures, &key_id](auto &sig)
|
|
{
|
|
b64decode(sig, unquote(server_signatures.at(key_id)));
|
|
}};
|
|
|
|
///TODO: XXX
|
|
m::keys copy{keys};
|
|
at<"signatures"_>(copy) = string_view{};
|
|
const json::strung preimage{copy};
|
|
return pk.verify(const_buffer{preimage}, sig);
|
|
}
|
|
catch(const std::exception &e)
|
|
{
|
|
m::log.error("key verification for '%s' failed: %s",
|
|
json::get<"server_name"_>(keys, "<no server name>"_sv),
|
|
e.what());
|
|
|
|
return false;
|
|
}
|
|
|
|
static void
|
|
create_my_key(const m::event &)
|
|
{
|
|
const json::strung verify_keys
|
|
{
|
|
json::members
|
|
{{
|
|
string_view{self::public_key_id},
|
|
{
|
|
{ "key", self::public_key_b64 }
|
|
}
|
|
}}
|
|
};
|
|
|
|
m::keys my_key;
|
|
json::get<"verify_keys"_>(my_key) = verify_keys;
|
|
json::get<"server_name"_>(my_key) = my_host();
|
|
json::get<"old_verify_keys"_>(my_key) = "{}";
|
|
json::get<"valid_until_ts"_>(my_key) = ircd::time<milliseconds>() + duration_cast<milliseconds>(hours(2160)).count();
|
|
|
|
const json::members tlsfps
|
|
{
|
|
{ "sha256", self::tls_cert_der_sha256_b64 }
|
|
};
|
|
|
|
const json::value tlsfp[1]
|
|
{
|
|
{ tlsfps }
|
|
};
|
|
|
|
const json::strung tls_fingerprints{json::value
|
|
{
|
|
tlsfp, 1
|
|
}};
|
|
|
|
json::get<"tls_fingerprints"_>(my_key) = tls_fingerprints;
|
|
|
|
const auto presig
|
|
{
|
|
json::strung(my_key)
|
|
};
|
|
|
|
const ed25519::sig sig
|
|
{
|
|
self::secret_key.sign(const_buffer{presig})
|
|
};
|
|
|
|
static char signature[256];
|
|
const json::strung signatures{json::members
|
|
{
|
|
{ my_host(), json::members
|
|
{
|
|
{ string_view{self::public_key_id}, b64encode_unpadded(signature, sig) }
|
|
}}
|
|
}};
|
|
|
|
json::get<"signatures"_>(my_key) = signatures;
|
|
set_keys(my_key);
|
|
}
|
|
|
|
const m::hook
|
|
create_my_key_hook
|
|
{
|
|
create_my_key,
|
|
{
|
|
{ "_site", "vm.notify" },
|
|
{ "room_id", m::my_node.room_id() },
|
|
{ "type", "m.room.create" },
|
|
}
|
|
};
|