mirror of
https://mau.dev/maunium/synapse.git
synced 2024-11-05 14:18:55 +01:00
Merge pull request #565 from matrix-org/erikj/macaroon_config
Derive macaroon_secret_key from signing key.
This commit is contained in:
commit
6ad9586c84
3 changed files with 34 additions and 19 deletions
|
@ -22,8 +22,14 @@ from signedjson.key import (
|
||||||
read_signing_keys, write_signing_keys, NACL_ED25519
|
read_signing_keys, write_signing_keys, NACL_ED25519
|
||||||
)
|
)
|
||||||
from unpaddedbase64 import decode_base64
|
from unpaddedbase64 import decode_base64
|
||||||
|
from synapse.util.stringutils import random_string_with_symbols
|
||||||
|
|
||||||
import os
|
import os
|
||||||
|
import hashlib
|
||||||
|
import logging
|
||||||
|
|
||||||
|
|
||||||
|
logger = logging.getLogger(__name__)
|
||||||
|
|
||||||
|
|
||||||
class KeyConfig(Config):
|
class KeyConfig(Config):
|
||||||
|
@ -40,9 +46,29 @@ class KeyConfig(Config):
|
||||||
config["perspectives"]
|
config["perspectives"]
|
||||||
)
|
)
|
||||||
|
|
||||||
def default_config(self, config_dir_path, server_name, **kwargs):
|
self.macaroon_secret_key = config.get(
|
||||||
|
"macaroon_secret_key", self.registration_shared_secret
|
||||||
|
)
|
||||||
|
|
||||||
|
if not self.macaroon_secret_key:
|
||||||
|
# Unfortunately, there are people out there that don't have this
|
||||||
|
# set. Lets just be "nice" and derive one from their secret key.
|
||||||
|
logger.warn("Config is missing missing macaroon_secret_key")
|
||||||
|
seed = self.signing_key[0].seed
|
||||||
|
self.macaroon_secret_key = hashlib.sha256(seed)
|
||||||
|
|
||||||
|
def default_config(self, config_dir_path, server_name, is_generating_file=False,
|
||||||
|
**kwargs):
|
||||||
base_key_name = os.path.join(config_dir_path, server_name)
|
base_key_name = os.path.join(config_dir_path, server_name)
|
||||||
|
|
||||||
|
if is_generating_file:
|
||||||
|
macaroon_secret_key = random_string_with_symbols(50)
|
||||||
|
else:
|
||||||
|
macaroon_secret_key = None
|
||||||
|
|
||||||
return """\
|
return """\
|
||||||
|
macaroon_secret_key: "%(macaroon_secret_key)s"
|
||||||
|
|
||||||
## Signing Keys ##
|
## Signing Keys ##
|
||||||
|
|
||||||
# Path to the signing key to sign messages with
|
# Path to the signing key to sign messages with
|
||||||
|
|
|
@ -32,26 +32,14 @@ class RegistrationConfig(Config):
|
||||||
)
|
)
|
||||||
|
|
||||||
self.registration_shared_secret = config.get("registration_shared_secret")
|
self.registration_shared_secret = config.get("registration_shared_secret")
|
||||||
self.macaroon_secret_key = config.get("macaroon_secret_key")
|
|
||||||
if self.macaroon_secret_key is None:
|
|
||||||
raise Exception(
|
|
||||||
"Config is missing missing macaroon_secret_key - please set it"
|
|
||||||
" in your config file."
|
|
||||||
)
|
|
||||||
self.bcrypt_rounds = config.get("bcrypt_rounds", 12)
|
self.bcrypt_rounds = config.get("bcrypt_rounds", 12)
|
||||||
self.trusted_third_party_id_servers = config["trusted_third_party_id_servers"]
|
self.trusted_third_party_id_servers = config["trusted_third_party_id_servers"]
|
||||||
self.allow_guest_access = config.get("allow_guest_access", False)
|
self.allow_guest_access = config.get("allow_guest_access", False)
|
||||||
|
|
||||||
def default_config(self, is_generating_file=False, **kwargs):
|
def default_config(self, **kwargs):
|
||||||
registration_shared_secret = random_string_with_symbols(50)
|
registration_shared_secret = random_string_with_symbols(50)
|
||||||
|
|
||||||
macaroon_line = ""
|
|
||||||
if is_generating_file:
|
|
||||||
macaroon_line += '\n macaroon_secret_key: "%s"\n' % (
|
|
||||||
random_string_with_symbols(50),
|
|
||||||
)
|
|
||||||
|
|
||||||
macaroon_secret_key = random_string_with_symbols(50)
|
|
||||||
return """\
|
return """\
|
||||||
## Registration ##
|
## Registration ##
|
||||||
|
|
||||||
|
@ -61,7 +49,7 @@ class RegistrationConfig(Config):
|
||||||
# If set, allows registration by anyone who also has the shared
|
# If set, allows registration by anyone who also has the shared
|
||||||
# secret, even if registration is otherwise disabled.
|
# secret, even if registration is otherwise disabled.
|
||||||
registration_shared_secret: "%(registration_shared_secret)s"
|
registration_shared_secret: "%(registration_shared_secret)s"
|
||||||
%(macaroon_line)s
|
|
||||||
# Set the number of bcrypt rounds used to generate password hash.
|
# Set the number of bcrypt rounds used to generate password hash.
|
||||||
# Larger numbers increase the work factor needed to generate the hash.
|
# Larger numbers increase the work factor needed to generate the hash.
|
||||||
# The default number of rounds is 12.
|
# The default number of rounds is 12.
|
||||||
|
|
|
@ -54,10 +54,11 @@ class ConfigLoadingTestCase(unittest.TestCase):
|
||||||
"was: %r" % (config.macaroon_secret_key,)
|
"was: %r" % (config.macaroon_secret_key,)
|
||||||
)
|
)
|
||||||
|
|
||||||
def test_load_fails_if_macaroon_secret_key_missing(self):
|
def test_load_succeeds_if_macaroon_secret_key_missing(self):
|
||||||
self.generate_config_and_remove_lines_containing("macaroon")
|
self.generate_config_and_remove_lines_containing("macaroon")
|
||||||
with self.assertRaises(Exception):
|
config1 = HomeServerConfig.load_config("", ["-c", self.file])
|
||||||
HomeServerConfig.load_config("", ["-c", self.file])
|
config2 = HomeServerConfig.load_config("", ["-c", self.file])
|
||||||
|
self.assertEqual(config1.macaroon_secret_key, config2.macaroon_secret_key)
|
||||||
|
|
||||||
def generate_config(self):
|
def generate_config(self):
|
||||||
HomeServerConfig.load_config("", [
|
HomeServerConfig.load_config("", [
|
||||||
|
|
Loading…
Reference in a new issue