serv/conduit
1
0
Fork 0
mirror of https://gitlab.com/famedly/conduit.git synced 2025-03-16 00:22:25 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: server resolution

Browse source
This commit is contained in:
Timo Kösters 2021-08-26 23:11:13 +02:00
parent ef104e0821
commit 6c8bc12419
No known key found for this signature in database
GPG key ID: 24DA7517711A2BA4
5 changed files with 109 additions and 94 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/appservice_server.rs
View file

@ -46,7 +46,11 @@ where
*reqwest_request.timeout_mut() = Some(Duration::from_secs(30));
let url = reqwest_request.url().clone();
let mut response = globals.reqwest_client().execute(reqwest_request).await?;
let mut response = globals
.reqwest_client()?
.build()?
.execute(reqwest_request)
.await?;
// reqwest::Response -> http::Response conversion
let status = response.status();

5
src/client_server/keys.rs
View file

@ -19,10 +19,7 @@ use ruma::{
DeviceId, DeviceKeyAlgorithm, UserId,
};
use serde_json::json;
use std::{
collections::{BTreeMap, HashMap, HashSet},
time::{Duration, Instant},
};
use std::collections::{BTreeMap, HashMap, HashSet};
#[cfg(feature = "conduit_bin")]
use rocket::{get, post};

77
src/database/globals.rs
View file

@ -1,4 +1,4 @@
use crate::{database::Config, utils, ConduitResult, Error, Result};
use crate::{database::Config, server_server::FedDest, utils, ConduitResult, Error, Result};
use ruma::{
api::{
client::r0::sync::sync_events,
@ -6,25 +6,25 @@ use ruma::{
},
DeviceId, EventId, MilliSecondsSinceUnixEpoch, RoomId, ServerName, ServerSigningKeyId, UserId,
};
use rustls::{ServerCertVerifier, WebPKIVerifier};
use std::{
collections::{BTreeMap, HashMap},
fs,
future::Future,
net::IpAddr,
path::PathBuf,
sync::{Arc, Mutex, RwLock},
time::{Duration, Instant},
};
use tokio::sync::{broadcast, watch::Receiver, Mutex as TokioMutex, Semaphore};
use tracing::{error, info};
use tracing::error;
use trust_dns_resolver::TokioAsyncResolver;
use super::abstraction::Tree;
pub const COUNTER: &[u8] = b"c";
type WellKnownMap = HashMap<Box<ServerName>, (String, String)>;
type TlsNameMap = HashMap<String, webpki::DNSName>;
type WellKnownMap = HashMap<Box<ServerName>, (FedDest, String)>;
type TlsNameMap = HashMap<String, Vec<IpAddr>>;
type RateLimitState = (Instant, u32); // Time if last failed try, number of failed tries
type SyncHandle = (
Option<String>, // since
@ -37,7 +37,6 @@ pub struct Globals {
pub(super) globals: Arc<dyn Tree>,
config: Config,
keypair: Arc<ruma::signatures::Ed25519KeyPair>,
reqwest_client: reqwest::Client,
dns_resolver: TokioAsyncResolver,
jwt_decoding_key: Option<jsonwebtoken::DecodingKey<'static>>,
pub(super) server_signingkeys: Arc<dyn Tree>,
@ -51,40 +50,6 @@ pub struct Globals {
pub rotate: RotationHandler,
}
struct MatrixServerVerifier {
inner: WebPKIVerifier,
tls_name_override: Arc<RwLock<TlsNameMap>>,
}
impl ServerCertVerifier for MatrixServerVerifier {
#[tracing::instrument(skip(self, roots, presented_certs, dns_name, ocsp_response))]
fn verify_server_cert(
&self,
roots: &rustls::RootCertStore,
presented_certs: &[rustls::Certificate],
dns_name: webpki::DNSNameRef<'_>,
ocsp_response: &[u8],
) -> std::result::Result<rustls::ServerCertVerified, rustls::TLSError> {
if let Some(override_name) = self.tls_name_override.read().unwrap().get(dns_name.into()) {
let result = self.inner.verify_server_cert(
roots,
presented_certs,
override_name.as_ref(),
ocsp_response,
);
if result.is_ok() {
return result;
}
info!(
"Server {:?} is non-compliant, retrying TLS verification with original name",
dns_name
);
}
self.inner
.verify_server_cert(roots, presented_certs, dns_name, ocsp_response)
}
}
/// Handles "rotation" of long-polling requests. "Rotation" in this context is similar to "rotation" of log files and the like.
///
/// This is utilized to have sync workers return early and release read locks on the database.
@ -162,24 +127,6 @@ impl Globals {
};
let tls_name_override = Arc::new(RwLock::new(TlsNameMap::new()));
let verifier = Arc::new(MatrixServerVerifier {
inner: WebPKIVerifier::new(),
tls_name_override: tls_name_override.clone(),
});
let mut tlsconfig = rustls::ClientConfig::new();
tlsconfig.dangerous().set_certificate_verifier(verifier);
tlsconfig.root_store =
rustls_native_certs::load_native_certs().expect("Error loading system certificates");
let mut reqwest_client_builder = reqwest::Client::builder()
.connect_timeout(Duration::from_secs(30))
.timeout(Duration::from_secs(60 * 3))
.pool_max_idle_per_host(1)
.use_preconfigured_tls(tlsconfig);
if let Some(proxy) = config.proxy.to_proxy()? {
reqwest_client_builder = reqwest_client_builder.proxy(proxy);
}
let reqwest_client = reqwest_client_builder.build().unwrap();
let jwt_decoding_key = config
.jwt_secret
@ -190,7 +137,6 @@ impl Globals {
globals,
config,
keypair: Arc::new(keypair),
reqwest_client,
dns_resolver: TokioAsyncResolver::tokio_from_system_conf().map_err(|_| {
Error::bad_config("Failed to set up trust dns resolver with system config.")
})?,
@ -219,8 +165,17 @@ impl Globals {
}
/// Returns a reqwest client which can be used to send requests.
pub fn reqwest_client(&self) -> &reqwest::Client {
&self.reqwest_client
pub fn reqwest_client(&self) -> Result<reqwest::ClientBuilder> {
let mut reqwest_client_builder = reqwest::Client::builder()
.connect_timeout(Duration::from_secs(30))
.timeout(Duration::from_secs(60 * 3))
.pool_max_idle_per_host(1);
//.use_preconfigured_tls(tlsconfig);
if let Some(proxy) = self.config.proxy.to_proxy()? {
reqwest_client_builder = reqwest_client_builder.proxy(proxy);
}
Ok(reqwest_client_builder)
}
#[tracing::instrument(skip(self))]

6
src/database/pusher.rs
View file

@ -113,7 +113,11 @@ where
//*reqwest_request.timeout_mut() = Some(Duration::from_secs(5));
let url = reqwest_request.url().clone();
let response = globals.reqwest_client().execute(reqwest_request).await;
let response = globals
.reqwest_client()?
.build()?
.execute(reqwest_request)
.await;
match response {
Ok(mut response) => {

109
src/server_server.rs
View file

@ -83,7 +83,7 @@ use rocket::{get, post, put};
/// FedDest::Named("198.51.100.5".to_owned(), "".to_owned());
/// ```
#[derive(Clone, Debug, PartialEq)]
enum FedDest {
pub enum FedDest {
Literal(SocketAddr),
Named(String, String),
}
@ -109,6 +109,13 @@ impl FedDest {
Self::Named(host, _) => host.clone(),
}
}
fn port(&self) -> Option<u16> {
match &self {
Self::Literal(addr) => Some(addr.port()),
Self::Named(_, port) => port[1..].parse().ok(),
}
}
}
#[tracing::instrument(skip(globals, request))]
@ -124,41 +131,34 @@ where
return Err(Error::bad_config("Federation is disabled."));
}
let maybe_result = globals
let mut write_destination_to_cache = false;
let cached_result = globals
.actual_destination_cache
.read()
.unwrap()
.get(destination)
.cloned();
let (actual_destination, host) = if let Some(result) = maybe_result {
let (actual_destination, host) = if let Some(result) = cached_result {
result
} else {
write_destination_to_cache = true;
let result = find_actual_destination(globals, &destination).await;
let (actual_destination, host) = result.clone();
let result_string = (result.0.into_https_string(), result.1.into_uri_string());
globals
.actual_destination_cache
.write()
.unwrap()
.insert(Box::<ServerName>::from(destination), result_string.clone());
let dest_hostname = actual_destination.hostname();
let host_hostname = host.hostname();
if dest_hostname != host_hostname {
globals.tls_name_override.write().unwrap().insert(
dest_hostname,
webpki::DNSNameRef::try_from_ascii_str(&host_hostname)
.unwrap()
.to_owned(),
);
}
result_string
(result.0, result.1.clone().into_uri_string())
};
let actual_destination_str = actual_destination.clone().into_https_string();
let mut http_request = request
.try_into_http_request::<Vec<u8>>(&actual_destination, SendAccessToken::IfRequired(""))
.try_into_http_request::<Vec<u8>>(&actual_destination_str, SendAccessToken::IfRequired(""))
.map_err(|e| {
warn!("Failed to find destination {}: {}", actual_destination, e);
warn!(
"Failed to find destination {}: {}",
actual_destination_str, e
);
Error::BadServerResponse("Invalid destination")
})?;
@ -232,7 +232,22 @@ where
.expect("all http requests are valid reqwest requests");
let url = reqwest_request.url().clone();
let response = globals.reqwest_client().execute(reqwest_request).await;
let mut client = globals.reqwest_client()?;
if let Some(override_name) = globals
.tls_name_override
.read()
.unwrap()
.get(&actual_destination.hostname())
{
client = client.resolve(
&actual_destination.hostname(),
SocketAddr::new(override_name[0], 0),
);
// port will be ignored
}
let response = client.build()?.execute(reqwest_request).await;
match response {
Ok(mut response) => {
@ -271,6 +286,13 @@ where
if status == 200 {
let response = T::IncomingResponse::try_from_http_response(http_response);
if response.is_ok() && write_destination_to_cache {
globals.actual_destination_cache.write().unwrap().insert(
Box::<ServerName>::from(destination),
(actual_destination, host),
);
}
response.map_err(|e| {
warn!(
"Invalid 200 response from {} on: {} {}",
@ -348,11 +370,41 @@ async fn find_actual_destination(
let (host, port) = delegated_hostname.split_at(pos);
FedDest::Named(host.to_string(), port.to_string())
} else {
match query_srv_record(globals, &delegated_hostname).await {
if let Some(hostname_override) =
query_srv_record(globals, &delegated_hostname).await
{
// 3.3: SRV lookup successful
Some(hostname) => hostname,
let host = match delegated_hostname.find(':') {
None => delegated_hostname.clone(),
Some(pos) => {
delegated_hostname.split_at(pos).0.to_owned()
}
};
if let Ok(override_ip) = globals
.dns_resolver()
.lookup_ip(hostname_override.hostname())
.await
{
globals
.tls_name_override
.write()
.unwrap()
.insert(host.clone(), override_ip.iter().collect());
} else {
warn!("Using SRV record, but could not resolve to IP");
}
let force_port = hostname_override.port();
if let Some(port) = force_port {
FedDest::Named(host, format!(":{}", port.to_string()))
} else {
add_port_to_hostname(&delegated_hostname)
}
} else {
// 3.4: No SRV records, just use the hostname from .well-known
None => add_port_to_hostname(&delegated_hostname),
add_port_to_hostname(&delegated_hostname)
}
}
}
@ -423,6 +475,9 @@ pub async fn request_well_known(
let body: serde_json::Value = serde_json::from_str(
&globals
.reqwest_client()
.ok()?
.build()
.ok()?
.get(&format!(
"https://{}/.well-known/matrix/server",
destination