123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442 |
- # -*- coding: utf-8 -*-
- # Copyright 2019 New Vector Ltd
- #
- # Licensed under the Apache License, Version 2.0 (the "License");
- # you may not use this file except in compliance with the License.
- # You may obtain a copy of the License at
- #
- # http://www.apache.org/licenses/LICENSE-2.0
- #
- # Unless required by applicable law or agreed to in writing, software
- # distributed under the License is distributed on an "AS IS" BASIS,
- # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- # See the License for the specific language governing permissions and
- # limitations under the License.
- from __future__ import absolute_import
- import json
- import logging
- import random
- import time
- import attr
- from netaddr import IPAddress
- from zope.interface import implementer
- from twisted.internet import defer
- from twisted.internet.endpoints import HostnameEndpoint, wrapClientTLS
- from twisted.internet.interfaces import IStreamClientEndpoint
- from twisted.web.client import URI, Agent, HTTPConnectionPool, RedirectAgent, readBody
- from twisted.web.http import stringToDatetime
- from twisted.web.http_headers import Headers
- from twisted.web.iweb import IAgent
- from sydent.http.srvresolver import SrvResolver, pick_server_from_list
- from sydent.util.ttlcache import TTLCache
- # period to cache .well-known results for by default
- WELL_KNOWN_DEFAULT_CACHE_PERIOD = 24 * 3600
- # jitter to add to the .well-known default cache ttl
- WELL_KNOWN_DEFAULT_CACHE_PERIOD_JITTER = 10 * 60
- # period to cache failure to fetch .well-known for
- WELL_KNOWN_INVALID_CACHE_PERIOD = 1 * 3600
- # cap for .well-known cache period
- WELL_KNOWN_MAX_CACHE_PERIOD = 48 * 3600
- logger = logging.getLogger(__name__)
- well_known_cache = TTLCache('well-known')
- @implementer(IAgent)
- class MatrixFederationAgent(object):
- """An Agent-like thing which provides a `request` method which will look up a matrix
- server and send an HTTP request to it.
- Doesn't implement any retries. (Those are done in MatrixFederationHttpClient.)
- :param reactor: twisted reactor to use for underlying requests
- :type reactor: IReactor
- :param tls_client_options_factory: Factory to use for fetching client tls
- options, or none to disable TLS.
- :type tls_client_options_factory: ClientTLSOptionsFactory, None
- :param _well_known_tls_policy: TLS policy to use for fetching .well-known
- files. None to use a default (browser-like) implementation.
- :type _well_known_tls_policy: IPolicyForHTTPS, None
- :param _srv_resolver: SRVResolver impl to use for looking up SRV records.
- None to use a default implementation.
- :type _srv_resolver: SrvResolver, None
- :param _well_known_cache: TTLCache impl for storing cached well-known
- lookups. None to use a default implementation.
- :type _well_known_cache: TTLCache, None
- """
- def __init__(
- self, reactor, tls_client_options_factory,
- _well_known_tls_policy=None,
- _srv_resolver=None,
- _well_known_cache=well_known_cache,
- ):
- self._reactor = reactor
- self._tls_client_options_factory = tls_client_options_factory
- if _srv_resolver is None:
- _srv_resolver = SrvResolver()
- self._srv_resolver = _srv_resolver
- self._pool = HTTPConnectionPool(reactor)
- self._pool.retryAutomatically = False
- self._pool.maxPersistentPerHost = 5
- self._pool.cachedConnectionTimeout = 2 * 60
- agent_args = {}
- if _well_known_tls_policy is not None:
- # the param is called 'contextFactory', but actually passing a
- # contextfactory is deprecated, and it expects an IPolicyForHTTPS.
- agent_args['contextFactory'] = _well_known_tls_policy
- _well_known_agent = RedirectAgent(
- Agent(self._reactor, pool=self._pool, **agent_args),
- )
- self._well_known_agent = _well_known_agent
- # our cache of .well-known lookup results, mapping from server name
- # to delegated name. The values can be:
- # `bytes`: a valid server-name
- # `None`: there is no (valid) .well-known here
- self._well_known_cache = _well_known_cache
- @defer.inlineCallbacks
- def request(self, method, uri, headers=None, bodyProducer=None):
- """
- :param method: HTTP method (GET/POST/etc).
- :type method: bytes
- :param uri: Absolute URI to be retrieved.
- :type uri: bytes
- :param headers: HTTP headers to send with the request, or None to
- send no extra headers.
- :type headers: twisted.web.http_headers.Headers, None
- :param bodyProducer: An object which can generate bytes to make up the
- body of this request (for example, the properly encoded contents of
- a file for a file upload). Or None if the request is to have
- no body.
- :type bodyProducer: twisted.web.iweb.IBodyProducer, None
- :returns a deferred that fires when the header of the response has
- been received (regardless of the response status code). Fails if
- there is any problem which prevents that response from being received
- (including problems that prevent the request from being sent).
- :rtype: Deferred[twisted.web.iweb.IResponse]
- """
- parsed_uri = URI.fromBytes(uri, defaultPort=-1)
- res = yield self._route_matrix_uri(parsed_uri)
- # set up the TLS connection params
- #
- # XXX disabling TLS is really only supported here for the benefit of the
- # unit tests. We should make the UTs cope with TLS rather than having to make
- # the code support the unit tests.
- if self._tls_client_options_factory is None:
- tls_options = None
- else:
- tls_options = self._tls_client_options_factory.get_options(
- res.tls_server_name.decode("ascii")
- )
- # make sure that the Host header is set correctly
- if headers is None:
- headers = Headers()
- else:
- headers = headers.copy()
- if not headers.hasHeader(b'host'):
- headers.addRawHeader(b'host', res.host_header)
- class EndpointFactory(object):
- @staticmethod
- def endpointForURI(_uri):
- ep = LoggingHostnameEndpoint(
- self._reactor, res.target_host, res.target_port,
- )
- if tls_options is not None:
- ep = wrapClientTLS(tls_options, ep)
- return ep
- agent = Agent.usingEndpointFactory(self._reactor, EndpointFactory(), self._pool)
- res = yield agent.request(method, uri, headers, bodyProducer)
- defer.returnValue(res)
- @defer.inlineCallbacks
- def _route_matrix_uri(self, parsed_uri, lookup_well_known=True):
- """Helper for `request`: determine the routing for a Matrix URI
- :param parsed_uri: uri to route. Note that it should be parsed with
- URI.fromBytes(uri, defaultPort=-1) to set the `port` to -1 if there
- is no explicit port given.
- :type parsed_uri: twisted.web.client.URI
- :param lookup_well_known: True if we should look up the .well-known
- file if there is no SRV record.
- :type lookup_well_known: bool
- :returns a routing result.
- :rtype: Deferred[_RoutingResult]
- """
- # check for an IP literal
- try:
- ip_address = IPAddress(parsed_uri.host.decode("ascii"))
- except Exception:
- # not an IP address
- ip_address = None
- if ip_address:
- port = parsed_uri.port
- if port == -1:
- port = 8448
- defer.returnValue(_RoutingResult(
- host_header=parsed_uri.netloc,
- tls_server_name=parsed_uri.host,
- target_host=parsed_uri.host,
- target_port=port,
- ))
- if parsed_uri.port != -1:
- # there is an explicit port
- defer.returnValue(_RoutingResult(
- host_header=parsed_uri.netloc,
- tls_server_name=parsed_uri.host,
- target_host=parsed_uri.host,
- target_port=parsed_uri.port,
- ))
- if lookup_well_known:
- # try a .well-known lookup
- well_known_server = yield self._get_well_known(parsed_uri.host)
- if well_known_server:
- # if we found a .well-known, start again, but don't do another
- # .well-known lookup.
- # parse the server name in the .well-known response into host/port.
- # (This code is lifted from twisted.web.client.URI.fromBytes).
- if b':' in well_known_server:
- well_known_host, well_known_port = well_known_server.rsplit(b':', 1)
- try:
- well_known_port = int(well_known_port)
- except ValueError:
- # the part after the colon could not be parsed as an int
- # - we assume it is an IPv6 literal with no port (the closing
- # ']' stops it being parsed as an int)
- well_known_host, well_known_port = well_known_server, -1
- else:
- well_known_host, well_known_port = well_known_server, -1
- new_uri = URI(
- scheme=parsed_uri.scheme,
- netloc=well_known_server,
- host=well_known_host,
- port=well_known_port,
- path=parsed_uri.path,
- params=parsed_uri.params,
- query=parsed_uri.query,
- fragment=parsed_uri.fragment,
- )
- res = yield self._route_matrix_uri(new_uri, lookup_well_known=False)
- defer.returnValue(res)
- # try a SRV lookup
- service_name = b"_matrix._tcp.%s" % (parsed_uri.host,)
- server_list = yield self._srv_resolver.resolve_service(service_name)
- if not server_list:
- target_host = parsed_uri.host
- port = 8448
- logger.debug(
- "No SRV record for %s, using %s:%i",
- parsed_uri.host.decode("ascii"), target_host.decode("ascii"), port,
- )
- else:
- target_host, port = pick_server_from_list(server_list)
- logger.debug(
- "Picked %s:%i from SRV records for %s",
- target_host.decode("ascii"), port, parsed_uri.host.decode("ascii"),
- )
- defer.returnValue(_RoutingResult(
- host_header=parsed_uri.netloc,
- tls_server_name=parsed_uri.host,
- target_host=target_host,
- target_port=port,
- ))
- @defer.inlineCallbacks
- def _get_well_known(self, server_name):
- """Attempt to fetch and parse a .well-known file for the given server
- :param server_name: Name of the server, from the requested url.
- :type server_name: bytes
- :returns either the new server name, from the .well-known, or None if
- there was no .well-known file.
- :rtype: Deferred[bytes|None]
- """
- try:
- result = self._well_known_cache[server_name]
- except KeyError:
- # TODO: should we linearise so that we don't end up doing two .well-known
- # requests for the same server in parallel?
- result, cache_period = yield self._do_get_well_known(server_name)
- if cache_period > 0:
- self._well_known_cache.set(server_name, result, cache_period)
- defer.returnValue(result)
- @defer.inlineCallbacks
- def _do_get_well_known(self, server_name):
- """Actually fetch and parse a .well-known, without checking the cache
- :param server_name: Name of the server, from the requested url
- :type server_name: bytes
- :returns a tuple of (result, cache period), where result is one of:
- - the new server name from the .well-known (as a `bytes`)
- - None if there was no .well-known file.
- - INVALID_WELL_KNOWN if the .well-known was invalid
- :rtype: Deferred[Tuple[bytes|None|object],int]
- """
- uri = b"https://%s/.well-known/matrix/server" % (server_name, )
- uri_str = uri.decode("ascii")
- logger.info("Fetching %s", uri_str)
- try:
- response = yield self._well_known_agent.request(b"GET", uri)
- body = yield readBody(response)
- if response.code != 200:
- raise Exception("Non-200 response %s" % (response.code, ))
- parsed_body = json.loads(body.decode('utf-8'))
- logger.info("Response from .well-known: %s", parsed_body)
- if not isinstance(parsed_body, dict):
- raise Exception("not a dict")
- if "m.server" not in parsed_body:
- raise Exception("Missing key 'm.server'")
- except Exception as e:
- logger.info("Error fetching %s: %s", uri_str, e)
- # add some randomness to the TTL to avoid a stampeding herd every hour
- # after startup
- cache_period = WELL_KNOWN_INVALID_CACHE_PERIOD
- cache_period += random.uniform(0, WELL_KNOWN_DEFAULT_CACHE_PERIOD_JITTER)
- defer.returnValue((None, cache_period))
- result = parsed_body["m.server"].encode("ascii")
- cache_period = _cache_period_from_headers(
- response.headers,
- time_now=self._reactor.seconds,
- )
- if cache_period is None:
- cache_period = WELL_KNOWN_DEFAULT_CACHE_PERIOD
- # add some randomness to the TTL to avoid a stampeding herd every 24 hours
- # after startup
- cache_period += random.uniform(0, WELL_KNOWN_DEFAULT_CACHE_PERIOD_JITTER)
- else:
- cache_period = min(cache_period, WELL_KNOWN_MAX_CACHE_PERIOD)
- defer.returnValue((result, cache_period))
- @implementer(IStreamClientEndpoint)
- class LoggingHostnameEndpoint(object):
- """A wrapper for HostnameEndpint which logs when it connects"""
- def __init__(self, reactor, host, port, *args, **kwargs):
- self.host = host
- self.port = port
- self.ep = HostnameEndpoint(reactor, host, port, *args, **kwargs)
- logger.info("Endpoint created with %s:%d", host, port)
- def connect(self, protocol_factory):
- logger.info("Connecting to %s:%i", self.host.decode("ascii"), self.port)
- return self.ep.connect(protocol_factory)
- def _cache_period_from_headers(headers, time_now=time.time):
- cache_controls = _parse_cache_control(headers)
- if b'no-store' in cache_controls:
- return 0
- if b'max-age' in cache_controls:
- try:
- max_age = int(cache_controls[b'max-age'])
- return max_age
- except ValueError:
- pass
- expires = headers.getRawHeaders(b'expires')
- if expires is not None:
- try:
- expires_date = stringToDatetime(expires[-1])
- return expires_date - time_now()
- except ValueError:
- # RFC7234 says 'A cache recipient MUST interpret invalid date formats,
- # especially the value "0", as representing a time in the past (i.e.,
- # "already expired").
- return 0
- return None
- def _parse_cache_control(headers):
- cache_controls = {}
- for hdr in headers.getRawHeaders(b'cache-control', []):
- for directive in hdr.split(b','):
- splits = [x.strip() for x in directive.split(b'=', 1)]
- k = splits[0].lower()
- v = splits[1] if len(splits) > 1 else None
- cache_controls[k] = v
- return cache_controls
- @attr.s
- class _RoutingResult(object):
- """The result returned by `_route_matrix_uri`.
- Contains the parameters needed to direct a federation connection to a particular
- server.
- Where a SRV record points to several servers, this object contains a single server
- chosen from the list.
- """
- host_header = attr.ib()
- """
- The value we should assign to the Host header (host:port from the matrix
- URI, or .well-known).
- :type: bytes
- """
- tls_server_name = attr.ib()
- """
- The server name we should set in the SNI (typically host, without port, from the
- matrix URI or .well-known)
- :type: bytes
- """
- target_host = attr.ib()
- """
- The hostname (or IP literal) we should route the TCP connection to (the target of the
- SRV record, or the hostname from the URL/.well-known)
- :type: bytes
- """
- target_port = attr.ib()
- """
- The port we should route the TCP connection to (the target of the SRV record, or
- the port from the URL/.well-known, or 8448)
- :type: int
- """
|