2020-07-26 03:08:00 +00:00
|
|
|
use crate::Error;
|
2020-08-06 12:29:59 +00:00
|
|
|
use ruma::{
|
2021-04-13 13:00:45 +00:00
|
|
|
api::OutgoingResponse,
|
2020-08-06 12:29:59 +00:00
|
|
|
identifiers::{DeviceId, UserId},
|
2020-10-27 23:10:09 +00:00
|
|
|
Outgoing,
|
2020-08-06 12:29:59 +00:00
|
|
|
};
|
2021-04-13 13:00:45 +00:00
|
|
|
use std::ops::Deref;
|
2020-07-26 03:08:00 +00:00
|
|
|
|
|
|
|
#[cfg(feature = "conduit_bin")]
|
|
|
|
use {
|
2021-04-21 12:06:39 +00:00
|
|
|
crate::{server_server, utils},
|
2020-12-08 09:33:44 +00:00
|
|
|
log::{debug, warn},
|
2020-07-26 03:08:00 +00:00
|
|
|
rocket::{
|
2021-04-23 16:54:17 +00:00
|
|
|
data::{self, ByteUnit, Data, FromData},
|
2020-07-26 03:08:00 +00:00
|
|
|
http::Status,
|
2020-07-27 15:38:00 +00:00
|
|
|
outcome::Outcome::*,
|
2020-07-26 03:08:00 +00:00
|
|
|
response::{self, Responder},
|
|
|
|
tokio::io::AsyncReadExt,
|
|
|
|
Request, State,
|
|
|
|
},
|
2021-04-21 12:06:39 +00:00
|
|
|
ruma::{
|
|
|
|
api::{AuthScheme, IncomingRequest},
|
|
|
|
signatures::CanonicalJsonValue,
|
|
|
|
ServerName,
|
|
|
|
},
|
2021-04-22 09:26:20 +00:00
|
|
|
std::collections::BTreeMap,
|
2021-03-18 17:33:43 +00:00
|
|
|
std::convert::TryFrom,
|
2020-07-26 03:08:00 +00:00
|
|
|
std::io::Cursor,
|
2020-04-03 15:27:08 +00:00
|
|
|
};
|
2020-02-15 21:42:21 +00:00
|
|
|
|
2020-03-28 22:08:59 +00:00
|
|
|
/// This struct converts rocket requests into ruma structs by converting them into http requests
|
|
|
|
/// first.
|
2021-04-05 19:25:10 +00:00
|
|
|
pub struct Ruma<T: Outgoing> {
|
2020-09-08 15:32:03 +00:00
|
|
|
pub body: T::Incoming,
|
2020-10-18 18:33:12 +00:00
|
|
|
pub sender_user: Option<UserId>,
|
|
|
|
pub sender_device: Option<Box<DeviceId>>,
|
2021-04-23 17:04:59 +00:00
|
|
|
// This is None when body is not a valid string
|
|
|
|
pub json_body: Option<Box<serde_json::value::RawValue>>,
|
2020-12-08 09:33:44 +00:00
|
|
|
pub from_appservice: bool,
|
2020-03-28 17:50:02 +00:00
|
|
|
}
|
2020-03-28 22:08:59 +00:00
|
|
|
|
2020-07-26 03:08:00 +00:00
|
|
|
#[cfg(feature = "conduit_bin")]
|
2021-04-23 16:54:17 +00:00
|
|
|
#[rocket::async_trait]
|
|
|
|
impl<'a, T: Outgoing> FromData<'a> for Ruma<T>
|
2020-09-08 15:32:03 +00:00
|
|
|
where
|
2020-12-22 17:45:35 +00:00
|
|
|
T::Incoming: IncomingRequest,
|
2020-09-08 15:32:03 +00:00
|
|
|
{
|
2021-02-06 14:27:43 +00:00
|
|
|
type Error = ();
|
2020-04-04 18:50:01 +00:00
|
|
|
|
2021-04-23 16:54:17 +00:00
|
|
|
async fn from_data(request: &'a Request<'_>, data: Data) -> data::Outcome<Self, Self::Error> {
|
2021-04-05 19:25:10 +00:00
|
|
|
let metadata = T::Incoming::METADATA;
|
2021-04-23 16:54:17 +00:00
|
|
|
let db = request
|
|
|
|
.guard::<State<'_, crate::Database>>()
|
|
|
|
.await
|
|
|
|
.expect("database was loaded");
|
|
|
|
|
|
|
|
// Get token from header or query value
|
|
|
|
let token = request
|
|
|
|
.headers()
|
|
|
|
.get_one("Authorization")
|
|
|
|
.map(|s| s[7..].to_owned()) // Split off "Bearer "
|
|
|
|
.or_else(|| request.query_value("access_token").and_then(|r| r.ok()));
|
|
|
|
|
|
|
|
let limit = db.globals.max_request_size();
|
|
|
|
let mut handle = data.open(ByteUnit::Byte(limit.into()));
|
|
|
|
let mut body = Vec::new();
|
|
|
|
handle.read_to_end(&mut body).await.unwrap();
|
|
|
|
|
|
|
|
let (sender_user, sender_device, from_appservice) = if let Some((_id, registration)) = db
|
|
|
|
.appservice
|
|
|
|
.iter_all()
|
|
|
|
.filter_map(|r| r.ok())
|
|
|
|
.find(|(_id, registration)| {
|
|
|
|
registration
|
|
|
|
.get("as_token")
|
|
|
|
.and_then(|as_token| as_token.as_str())
|
|
|
|
.map_or(false, |as_token| token.as_deref() == Some(as_token))
|
|
|
|
}) {
|
|
|
|
match metadata.authentication {
|
|
|
|
AuthScheme::AccessToken | AuthScheme::QueryOnlyAccessToken => {
|
|
|
|
let user_id = request.query_value::<String>("user_id").map_or_else(
|
|
|
|
|| {
|
|
|
|
UserId::parse_with_server_name(
|
|
|
|
registration
|
|
|
|
.get("sender_localpart")
|
2020-12-08 09:33:44 +00:00
|
|
|
.unwrap()
|
2021-04-23 16:54:17 +00:00
|
|
|
.as_str()
|
|
|
|
.unwrap(),
|
|
|
|
db.globals.server_name(),
|
|
|
|
)
|
|
|
|
.unwrap()
|
|
|
|
},
|
|
|
|
|string| {
|
|
|
|
UserId::try_from(string.expect("parsing to string always works"))
|
|
|
|
.unwrap()
|
|
|
|
},
|
|
|
|
);
|
2020-12-08 09:33:44 +00:00
|
|
|
|
2021-04-23 16:54:17 +00:00
|
|
|
if !db.users.exists(&user_id).unwrap() {
|
|
|
|
// Forbidden
|
|
|
|
return Failure((Status::raw(580), ()));
|
2020-12-08 09:33:44 +00:00
|
|
|
}
|
2021-04-23 16:54:17 +00:00
|
|
|
|
|
|
|
// TODO: Check if appservice is allowed to be that user
|
|
|
|
(Some(user_id), None, true)
|
2020-12-08 09:33:44 +00:00
|
|
|
}
|
2021-04-23 16:54:17 +00:00
|
|
|
AuthScheme::ServerSignatures => (None, None, true),
|
|
|
|
AuthScheme::None => (None, None, true),
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
match metadata.authentication {
|
|
|
|
AuthScheme::AccessToken | AuthScheme::QueryOnlyAccessToken => {
|
|
|
|
if let Some(token) = token {
|
|
|
|
match db.users.find_from_token(&token).unwrap() {
|
|
|
|
// Unknown Token
|
|
|
|
None => return Failure((Status::raw(581), ())),
|
|
|
|
Some((user_id, device_id)) => {
|
|
|
|
(Some(user_id), Some(device_id.into()), false)
|
2020-12-08 09:33:44 +00:00
|
|
|
}
|
|
|
|
}
|
2021-04-23 16:54:17 +00:00
|
|
|
} else {
|
|
|
|
// Missing Token
|
|
|
|
return Failure((Status::raw(582), ()));
|
2020-10-27 23:10:09 +00:00
|
|
|
}
|
2021-04-23 16:54:17 +00:00
|
|
|
}
|
|
|
|
AuthScheme::ServerSignatures => {
|
|
|
|
// Get origin from header
|
2021-04-23 17:04:59 +00:00
|
|
|
let x_matrix = match request.headers().get_one("Authorization").map(|s| {
|
|
|
|
// Split off "X-Matrix " and parse the rest
|
|
|
|
s[9..]
|
|
|
|
.split_terminator(',')
|
|
|
|
.map(|field| {
|
|
|
|
let mut splits = field.splitn(2, '=');
|
|
|
|
(splits.next(), splits.next().map(|s| s.trim_matches('"')))
|
|
|
|
})
|
|
|
|
.collect::<BTreeMap<_, _>>()
|
|
|
|
}) {
|
|
|
|
Some(t) => t,
|
|
|
|
None => {
|
|
|
|
warn!("No Authorization header");
|
2021-04-21 12:06:39 +00:00
|
|
|
|
2021-04-23 17:04:59 +00:00
|
|
|
// Forbidden
|
|
|
|
return Failure((Status::raw(580), ()));
|
|
|
|
}
|
|
|
|
};
|
2021-04-21 12:06:39 +00:00
|
|
|
|
2021-04-23 16:54:17 +00:00
|
|
|
let origin_str = match x_matrix.get(&Some("origin")) {
|
|
|
|
Some(Some(o)) => *o,
|
|
|
|
_ => {
|
|
|
|
warn!("Invalid X-Matrix header origin field: {:?}", x_matrix);
|
2021-04-21 12:06:39 +00:00
|
|
|
|
2021-04-23 16:54:17 +00:00
|
|
|
// Forbidden
|
|
|
|
return Failure((Status::raw(580), ()));
|
|
|
|
}
|
|
|
|
};
|
2021-04-21 12:06:39 +00:00
|
|
|
|
2021-04-23 16:54:17 +00:00
|
|
|
let origin = match Box::<ServerName>::try_from(origin_str) {
|
|
|
|
Ok(s) => s,
|
|
|
|
_ => {
|
|
|
|
warn!(
|
|
|
|
"Invalid server name in X-Matrix header origin field: {:?}",
|
|
|
|
x_matrix
|
|
|
|
);
|
2021-04-21 12:06:39 +00:00
|
|
|
|
2021-04-23 16:54:17 +00:00
|
|
|
// Forbidden
|
|
|
|
return Failure((Status::raw(580), ()));
|
|
|
|
}
|
|
|
|
};
|
2021-04-21 12:06:39 +00:00
|
|
|
|
2021-04-23 16:54:17 +00:00
|
|
|
let key = match x_matrix.get(&Some("key")) {
|
|
|
|
Some(Some(k)) => *k,
|
|
|
|
_ => {
|
|
|
|
warn!("Invalid X-Matrix header key field: {:?}", x_matrix);
|
2021-04-21 12:06:39 +00:00
|
|
|
|
2021-04-23 16:54:17 +00:00
|
|
|
// Forbidden
|
|
|
|
return Failure((Status::raw(580), ()));
|
|
|
|
}
|
|
|
|
};
|
2021-04-21 12:06:39 +00:00
|
|
|
|
2021-04-23 16:54:17 +00:00
|
|
|
let sig = match x_matrix.get(&Some("sig")) {
|
|
|
|
Some(Some(s)) => *s,
|
|
|
|
_ => {
|
|
|
|
warn!("Invalid X-Matrix header sig field: {:?}", x_matrix);
|
2021-04-21 12:06:39 +00:00
|
|
|
|
2021-04-23 16:54:17 +00:00
|
|
|
// Forbidden
|
|
|
|
return Failure((Status::raw(580), ()));
|
|
|
|
}
|
|
|
|
};
|
|
|
|
|
|
|
|
let json_body = serde_json::from_slice::<CanonicalJsonValue>(&body);
|
|
|
|
|
|
|
|
let mut request_map = BTreeMap::<String, CanonicalJsonValue>::new();
|
|
|
|
|
|
|
|
if let Ok(json_body) = json_body {
|
|
|
|
request_map.insert("content".to_owned(), json_body);
|
|
|
|
};
|
|
|
|
|
|
|
|
request_map.insert(
|
|
|
|
"method".to_owned(),
|
|
|
|
CanonicalJsonValue::String(request.method().to_string()),
|
|
|
|
);
|
|
|
|
request_map.insert(
|
|
|
|
"uri".to_owned(),
|
|
|
|
CanonicalJsonValue::String(request.uri().to_string()),
|
|
|
|
);
|
|
|
|
request_map.insert(
|
|
|
|
"origin".to_owned(),
|
|
|
|
CanonicalJsonValue::String(origin.as_str().to_owned()),
|
|
|
|
);
|
|
|
|
request_map.insert(
|
|
|
|
"destination".to_owned(),
|
|
|
|
CanonicalJsonValue::String(db.globals.server_name().as_str().to_owned()),
|
|
|
|
);
|
|
|
|
|
|
|
|
let mut origin_signatures = BTreeMap::new();
|
|
|
|
origin_signatures
|
|
|
|
.insert(key.to_owned(), CanonicalJsonValue::String(sig.to_owned()));
|
|
|
|
|
|
|
|
let mut signatures = BTreeMap::new();
|
|
|
|
signatures.insert(
|
|
|
|
origin.as_str().to_owned(),
|
|
|
|
CanonicalJsonValue::Object(origin_signatures),
|
|
|
|
);
|
|
|
|
|
|
|
|
request_map.insert(
|
|
|
|
"signatures".to_owned(),
|
|
|
|
CanonicalJsonValue::Object(signatures),
|
|
|
|
);
|
|
|
|
|
|
|
|
let keys = match server_server::fetch_signing_keys(
|
|
|
|
&db,
|
|
|
|
&origin,
|
|
|
|
vec![&key.to_owned()],
|
|
|
|
)
|
|
|
|
.await
|
|
|
|
{
|
|
|
|
Ok(b) => b,
|
|
|
|
Err(e) => {
|
|
|
|
warn!("Failed to fetch signing keys: {}", e);
|
2021-04-21 12:06:39 +00:00
|
|
|
|
2021-04-23 16:54:17 +00:00
|
|
|
// Forbidden
|
|
|
|
return Failure((Status::raw(580), ()));
|
|
|
|
}
|
|
|
|
};
|
2021-04-21 12:06:39 +00:00
|
|
|
|
2021-04-23 16:54:17 +00:00
|
|
|
let mut pub_key_map = BTreeMap::new();
|
|
|
|
pub_key_map.insert(origin.as_str().to_owned(), keys);
|
2021-04-21 12:06:39 +00:00
|
|
|
|
2021-04-23 16:54:17 +00:00
|
|
|
match ruma::signatures::verify_json(&pub_key_map, &request_map) {
|
|
|
|
Ok(()) => (None, None, false),
|
|
|
|
Err(e) => {
|
2021-04-24 10:27:46 +00:00
|
|
|
warn!("Failed to verify json request from {}: {}", origin, e);
|
|
|
|
|
|
|
|
if request.uri().to_string().contains('@') {
|
|
|
|
warn!("Request uri contained '@' character. Make sure your reverse proxy gives Conduit the raw uri (apache: use nocanon)");
|
|
|
|
}
|
2021-04-21 12:06:39 +00:00
|
|
|
|
2021-04-23 16:54:17 +00:00
|
|
|
// Forbidden
|
|
|
|
return Failure((Status::raw(580), ()));
|
2021-04-21 12:06:39 +00:00
|
|
|
}
|
|
|
|
}
|
2020-12-04 22:16:29 +00:00
|
|
|
}
|
2021-04-23 16:54:17 +00:00
|
|
|
AuthScheme::None => (None, None, false),
|
2020-03-29 19:05:20 +00:00
|
|
|
}
|
2021-04-23 16:54:17 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
let mut http_request = http::Request::builder()
|
|
|
|
.uri(request.uri().to_string())
|
|
|
|
.method(&*request.method().to_string());
|
|
|
|
for header in request.headers().iter() {
|
|
|
|
http_request = http_request.header(header.name.as_str(), &*header.value);
|
|
|
|
}
|
|
|
|
|
|
|
|
let http_request = http_request.body(&*body).unwrap();
|
|
|
|
debug!("{:?}", http_request);
|
|
|
|
match <T::Incoming as IncomingRequest>::try_from_http_request(http_request) {
|
|
|
|
Ok(t) => Success(Ruma {
|
|
|
|
body: t,
|
|
|
|
sender_user,
|
|
|
|
sender_device,
|
|
|
|
// TODO: Can we avoid parsing it again? (We only need this for append_pdu)
|
|
|
|
json_body: utils::string_from_bytes(&body)
|
|
|
|
.ok()
|
|
|
|
.and_then(|s| serde_json::value::RawValue::from_string(s).ok()),
|
|
|
|
from_appservice,
|
|
|
|
}),
|
|
|
|
Err(e) => {
|
|
|
|
warn!("{:?}", e);
|
|
|
|
Failure((Status::raw(583), ()))
|
2020-02-18 21:07:57 +00:00
|
|
|
}
|
2021-04-23 16:54:17 +00:00
|
|
|
}
|
2020-02-15 21:42:21 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-04-05 19:25:10 +00:00
|
|
|
impl<T: Outgoing> Deref for Ruma<T> {
|
2020-09-08 15:32:03 +00:00
|
|
|
type Target = T::Incoming;
|
2020-02-15 21:42:21 +00:00
|
|
|
|
|
|
|
fn deref(&self) -> &Self::Target {
|
2020-03-28 17:50:02 +00:00
|
|
|
&self.body
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-03-28 22:08:59 +00:00
|
|
|
/// This struct converts ruma responses into rocket http responses.
|
2020-06-09 13:13:17 +00:00
|
|
|
pub type ConduitResult<T> = std::result::Result<RumaResponse<T>, Error>;
|
2020-04-04 18:50:01 +00:00
|
|
|
|
2021-04-13 13:00:45 +00:00
|
|
|
pub struct RumaResponse<T: OutgoingResponse>(pub T);
|
2020-02-18 21:07:57 +00:00
|
|
|
|
2021-04-13 13:00:45 +00:00
|
|
|
impl<T: OutgoingResponse> From<T> for RumaResponse<T> {
|
2020-06-09 13:13:17 +00:00
|
|
|
fn from(t: T) -> Self {
|
|
|
|
Self(t)
|
2020-02-18 21:07:57 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-07-26 03:08:00 +00:00
|
|
|
#[cfg(feature = "conduit_bin")]
|
2020-07-14 16:23:26 +00:00
|
|
|
impl<'r, 'o, T> Responder<'r, 'o> for RumaResponse<T>
|
2020-04-06 15:37:13 +00:00
|
|
|
where
|
2021-04-13 13:00:45 +00:00
|
|
|
T: Send + OutgoingResponse,
|
2020-07-25 16:35:22 +00:00
|
|
|
'o: 'r,
|
2020-04-06 15:37:13 +00:00
|
|
|
{
|
2020-07-14 16:23:26 +00:00
|
|
|
fn respond_to(self, _: &'r Request<'_>) -> response::Result<'o> {
|
2021-04-23 16:16:24 +00:00
|
|
|
let http_response = self
|
|
|
|
.0
|
2021-04-23 16:45:06 +00:00
|
|
|
.try_into_http_response::<Vec<u8>>()
|
2021-04-23 16:16:24 +00:00
|
|
|
.map_err(|_| Status::InternalServerError)?;
|
2020-02-15 21:42:21 +00:00
|
|
|
|
2021-04-23 16:16:24 +00:00
|
|
|
let mut response = rocket::response::Response::build();
|
2020-04-07 11:21:05 +00:00
|
|
|
|
2021-04-23 16:16:24 +00:00
|
|
|
let status = http_response.status();
|
|
|
|
response.raw_status(status.into(), "");
|
2020-03-28 17:50:02 +00:00
|
|
|
|
2021-04-23 16:16:24 +00:00
|
|
|
for header in http_response.headers() {
|
|
|
|
response.raw_header(header.0.to_string(), header.1.to_str().unwrap().to_owned());
|
2020-02-15 21:42:21 +00:00
|
|
|
}
|
2021-04-23 16:16:24 +00:00
|
|
|
|
|
|
|
let http_body = http_response.into_body();
|
|
|
|
|
|
|
|
response.sized_body(http_body.len(), Cursor::new(http_body));
|
|
|
|
|
|
|
|
response.raw_header("Access-Control-Allow-Origin", "*");
|
|
|
|
response.raw_header(
|
|
|
|
"Access-Control-Allow-Methods",
|
|
|
|
"GET, POST, PUT, DELETE, OPTIONS",
|
|
|
|
);
|
|
|
|
response.raw_header(
|
|
|
|
"Access-Control-Allow-Headers",
|
|
|
|
"Origin, X-Requested-With, Content-Type, Accept, Authorization",
|
|
|
|
);
|
|
|
|
response.raw_header("Access-Control-Max-Age", "86400");
|
|
|
|
response.ok()
|
2020-02-15 21:42:21 +00:00
|
|
|
}
|
|
|
|
}
|