test_keyring.py 29 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762
  1. # Copyright 2017-2021 The Matrix.org Foundation C.I.C
  2. #
  3. # Licensed under the Apache License, Version 2.0 (the "License");
  4. # you may not use this file except in compliance with the License.
  5. # You may obtain a copy of the License at
  6. #
  7. # http://www.apache.org/licenses/LICENSE-2.0
  8. #
  9. # Unless required by applicable law or agreed to in writing, software
  10. # distributed under the License is distributed on an "AS IS" BASIS,
  11. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12. # See the License for the specific language governing permissions and
  13. # limitations under the License.
  14. import time
  15. from typing import Any, Dict, List, Optional, cast
  16. from unittest.mock import Mock
  17. import attr
  18. import canonicaljson
  19. import signedjson.key
  20. import signedjson.sign
  21. from signedjson.key import encode_verify_key_base64, get_verify_key
  22. from signedjson.types import SigningKey, VerifyKey
  23. from twisted.internet import defer
  24. from twisted.internet.defer import Deferred, ensureDeferred
  25. from twisted.test.proto_helpers import MemoryReactor
  26. from synapse.api.errors import SynapseError
  27. from synapse.crypto import keyring
  28. from synapse.crypto.keyring import (
  29. PerspectivesKeyFetcher,
  30. ServerKeyFetcher,
  31. StoreKeyFetcher,
  32. )
  33. from synapse.logging.context import (
  34. ContextRequest,
  35. LoggingContext,
  36. current_context,
  37. make_deferred_yieldable,
  38. )
  39. from synapse.server import HomeServer
  40. from synapse.storage.keys import FetchKeyResult
  41. from synapse.types import JsonDict
  42. from synapse.util import Clock
  43. from tests import unittest
  44. from tests.test_utils import make_awaitable
  45. from tests.unittest import logcontext_clean, override_config
  46. class MockPerspectiveServer:
  47. def __init__(self) -> None:
  48. self.server_name = "mock_server"
  49. self.key = signedjson.key.generate_signing_key("0")
  50. def get_verify_keys(self) -> Dict[str, str]:
  51. vk = signedjson.key.get_verify_key(self.key)
  52. return {"%s:%s" % (vk.alg, vk.version): encode_verify_key_base64(vk)}
  53. def get_signed_key(self, server_name: str, verify_key: VerifyKey) -> JsonDict:
  54. key_id = "%s:%s" % (verify_key.alg, verify_key.version)
  55. res = {
  56. "server_name": server_name,
  57. "old_verify_keys": {},
  58. "valid_until_ts": time.time() * 1000 + 3600,
  59. "verify_keys": {key_id: {"key": encode_verify_key_base64(verify_key)}},
  60. }
  61. self.sign_response(res)
  62. return res
  63. def sign_response(self, res: JsonDict) -> None:
  64. signedjson.sign.sign_json(res, self.server_name, self.key)
  65. @attr.s(slots=True, auto_attribs=True)
  66. class FakeRequest:
  67. id: str
  68. @logcontext_clean
  69. class KeyringTestCase(unittest.HomeserverTestCase):
  70. def check_context(
  71. self, val: ContextRequest, expected: Optional[ContextRequest]
  72. ) -> ContextRequest:
  73. self.assertEqual(getattr(current_context(), "request", None), expected)
  74. return val
  75. def test_verify_json_objects_for_server_awaits_previous_requests(self) -> None:
  76. mock_fetcher = Mock()
  77. mock_fetcher.get_keys = Mock()
  78. kr = keyring.Keyring(self.hs, key_fetchers=(mock_fetcher,))
  79. # a signed object that we are going to try to validate
  80. key1 = signedjson.key.generate_signing_key("1")
  81. json1: JsonDict = {}
  82. signedjson.sign.sign_json(json1, "server10", key1)
  83. # start off a first set of lookups. We make the mock fetcher block until this
  84. # deferred completes.
  85. first_lookup_deferred: "Deferred[None]" = Deferred()
  86. async def first_lookup_fetch(
  87. server_name: str, key_ids: List[str], minimum_valid_until_ts: int
  88. ) -> Dict[str, FetchKeyResult]:
  89. # self.assertEqual(current_context().request.id, "context_11")
  90. self.assertEqual(server_name, "server10")
  91. self.assertEqual(key_ids, [get_key_id(key1)])
  92. self.assertEqual(minimum_valid_until_ts, 0)
  93. await make_deferred_yieldable(first_lookup_deferred)
  94. return {get_key_id(key1): FetchKeyResult(get_verify_key(key1), 100)}
  95. mock_fetcher.get_keys.side_effect = first_lookup_fetch
  96. async def first_lookup() -> None:
  97. with LoggingContext(
  98. "context_11", request=cast(ContextRequest, FakeRequest("context_11"))
  99. ):
  100. res_deferreds = kr.verify_json_objects_for_server(
  101. [("server10", json1, 0), ("server11", {}, 0)]
  102. )
  103. # the unsigned json should be rejected pretty quickly
  104. self.assertTrue(res_deferreds[1].called)
  105. try:
  106. await res_deferreds[1]
  107. self.assertFalse("unsigned json didn't cause a failure")
  108. except SynapseError:
  109. pass
  110. self.assertFalse(res_deferreds[0].called)
  111. res_deferreds[0].addBoth(self.check_context, None)
  112. await make_deferred_yieldable(res_deferreds[0])
  113. d0 = ensureDeferred(first_lookup())
  114. self.pump()
  115. mock_fetcher.get_keys.assert_called_once()
  116. # a second request for a server with outstanding requests
  117. # should block rather than start a second call
  118. async def second_lookup_fetch(
  119. server_name: str, key_ids: List[str], minimum_valid_until_ts: int
  120. ) -> Dict[str, FetchKeyResult]:
  121. # self.assertEqual(current_context().request.id, "context_12")
  122. return {get_key_id(key1): FetchKeyResult(get_verify_key(key1), 100)}
  123. mock_fetcher.get_keys.reset_mock()
  124. mock_fetcher.get_keys.side_effect = second_lookup_fetch
  125. second_lookup_state = [0]
  126. async def second_lookup() -> None:
  127. with LoggingContext(
  128. "context_12", request=cast(ContextRequest, FakeRequest("context_12"))
  129. ):
  130. res_deferreds_2 = kr.verify_json_objects_for_server(
  131. [
  132. (
  133. "server10",
  134. json1,
  135. 0,
  136. )
  137. ]
  138. )
  139. res_deferreds_2[0].addBoth(self.check_context, None)
  140. second_lookup_state[0] = 1
  141. await make_deferred_yieldable(res_deferreds_2[0])
  142. second_lookup_state[0] = 2
  143. d2 = ensureDeferred(second_lookup())
  144. self.pump()
  145. # the second request should be pending, but the fetcher should not yet have been
  146. # called
  147. self.assertEqual(second_lookup_state[0], 1)
  148. mock_fetcher.get_keys.assert_not_called()
  149. # complete the first request
  150. first_lookup_deferred.callback(None)
  151. # and now both verifications should succeed.
  152. self.get_success(d0)
  153. self.get_success(d2)
  154. def test_verify_json_for_server(self) -> None:
  155. kr = keyring.Keyring(self.hs)
  156. key1 = signedjson.key.generate_signing_key("1")
  157. r = self.hs.get_datastores().main.store_server_keys_json(
  158. "server9",
  159. get_key_id(key1),
  160. from_server="test",
  161. ts_now_ms=int(time.time() * 1000),
  162. ts_expires_ms=1000,
  163. # The entire response gets signed & stored, just include the bits we
  164. # care about.
  165. key_json_bytes=canonicaljson.encode_canonical_json(
  166. {
  167. "verify_keys": {
  168. get_key_id(key1): {
  169. "key": encode_verify_key_base64(get_verify_key(key1))
  170. }
  171. }
  172. }
  173. ),
  174. )
  175. self.get_success(r)
  176. json1: JsonDict = {}
  177. signedjson.sign.sign_json(json1, "server9", key1)
  178. # should fail immediately on an unsigned object
  179. d = kr.verify_json_for_server("server9", {}, 0)
  180. self.get_failure(d, SynapseError)
  181. # should succeed on a signed object
  182. d = kr.verify_json_for_server("server9", json1, 500)
  183. # self.assertFalse(d.called)
  184. self.get_success(d)
  185. def test_verify_for_local_server(self) -> None:
  186. """Ensure that locally signed JSON can be verified without fetching keys
  187. over federation
  188. """
  189. kr = keyring.Keyring(self.hs)
  190. json1: JsonDict = {}
  191. signedjson.sign.sign_json(json1, self.hs.hostname, self.hs.signing_key)
  192. # Test that verify_json_for_server succeeds on a object signed by ourselves
  193. d = kr.verify_json_for_server(self.hs.hostname, json1, 0)
  194. self.get_success(d)
  195. OLD_KEY = signedjson.key.generate_signing_key("old")
  196. @override_config(
  197. {
  198. "old_signing_keys": {
  199. f"{OLD_KEY.alg}:{OLD_KEY.version}": {
  200. "key": encode_verify_key_base64(
  201. signedjson.key.get_verify_key(OLD_KEY)
  202. ),
  203. "expired_ts": 1000,
  204. }
  205. }
  206. }
  207. )
  208. def test_verify_for_local_server_old_key(self) -> None:
  209. """Can also use keys in old_signing_keys for verification"""
  210. json1: JsonDict = {}
  211. signedjson.sign.sign_json(json1, self.hs.hostname, self.OLD_KEY)
  212. kr = keyring.Keyring(self.hs)
  213. d = kr.verify_json_for_server(self.hs.hostname, json1, 0)
  214. self.get_success(d)
  215. def test_verify_for_local_server_unknown_key(self) -> None:
  216. """Local keys that we no longer have should be fetched via the fetcher"""
  217. # the key we'll sign things with (nb, not known to the Keyring)
  218. key2 = signedjson.key.generate_signing_key("2")
  219. # set up a mock fetcher which will return the key
  220. async def get_keys(
  221. server_name: str, key_ids: List[str], minimum_valid_until_ts: int
  222. ) -> Dict[str, FetchKeyResult]:
  223. self.assertEqual(server_name, self.hs.hostname)
  224. self.assertEqual(key_ids, [get_key_id(key2)])
  225. return {get_key_id(key2): FetchKeyResult(get_verify_key(key2), 1200)}
  226. mock_fetcher = Mock()
  227. mock_fetcher.get_keys = Mock(side_effect=get_keys)
  228. kr = keyring.Keyring(
  229. self.hs, key_fetchers=(StoreKeyFetcher(self.hs), mock_fetcher)
  230. )
  231. # sign the json
  232. json1: JsonDict = {}
  233. signedjson.sign.sign_json(json1, self.hs.hostname, key2)
  234. # ... and check we can verify it.
  235. d = kr.verify_json_for_server(self.hs.hostname, json1, 0)
  236. self.get_success(d)
  237. def test_verify_json_for_server_with_null_valid_until_ms(self) -> None:
  238. """Tests that we correctly handle key requests for keys we've stored
  239. with a null `ts_valid_until_ms`
  240. """
  241. mock_fetcher = Mock()
  242. mock_fetcher.get_keys = Mock(return_value=make_awaitable({}))
  243. key1 = signedjson.key.generate_signing_key("1")
  244. r = self.hs.get_datastores().main.store_server_signature_keys(
  245. "server9",
  246. int(time.time() * 1000),
  247. # None is not a valid value in FetchKeyResult, but we're abusing this
  248. # API to insert null values into the database. The nulls get converted
  249. # to 0 when fetched in KeyStore.get_server_signature_keys.
  250. {("server9", get_key_id(key1)): FetchKeyResult(get_verify_key(key1), None)}, # type: ignore[arg-type]
  251. )
  252. self.get_success(r)
  253. json1: JsonDict = {}
  254. signedjson.sign.sign_json(json1, "server9", key1)
  255. # should succeed on a signed object with a 0 minimum_valid_until_ms
  256. d = self.hs.get_datastores().main.get_server_signature_keys(
  257. [("server9", get_key_id(key1))]
  258. )
  259. result = self.get_success(d)
  260. self.assertEquals(result[("server9", get_key_id(key1))].valid_until_ts, 0)
  261. def test_verify_json_dedupes_key_requests(self) -> None:
  262. """Two requests for the same key should be deduped."""
  263. key1 = signedjson.key.generate_signing_key("1")
  264. async def get_keys(
  265. server_name: str, key_ids: List[str], minimum_valid_until_ts: int
  266. ) -> Dict[str, FetchKeyResult]:
  267. # there should only be one request object (with the max validity)
  268. self.assertEqual(server_name, "server1")
  269. self.assertEqual(key_ids, [get_key_id(key1)])
  270. self.assertEqual(minimum_valid_until_ts, 1500)
  271. return {get_key_id(key1): FetchKeyResult(get_verify_key(key1), 1200)}
  272. mock_fetcher = Mock()
  273. mock_fetcher.get_keys = Mock(side_effect=get_keys)
  274. kr = keyring.Keyring(self.hs, key_fetchers=(mock_fetcher,))
  275. json1: JsonDict = {}
  276. signedjson.sign.sign_json(json1, "server1", key1)
  277. # the first request should succeed; the second should fail because the key
  278. # has expired
  279. results = kr.verify_json_objects_for_server(
  280. [
  281. (
  282. "server1",
  283. json1,
  284. 500,
  285. ),
  286. ("server1", json1, 1500),
  287. ]
  288. )
  289. self.assertEqual(len(results), 2)
  290. self.get_success(results[0])
  291. e = self.get_failure(results[1], SynapseError).value
  292. self.assertEqual(e.errcode, "M_UNAUTHORIZED")
  293. self.assertEqual(e.code, 401)
  294. # there should have been a single call to the fetcher
  295. mock_fetcher.get_keys.assert_called_once()
  296. def test_verify_json_falls_back_to_other_fetchers(self) -> None:
  297. """If the first fetcher cannot provide a recent enough key, we fall back"""
  298. key1 = signedjson.key.generate_signing_key("1")
  299. async def get_keys1(
  300. server_name: str, key_ids: List[str], minimum_valid_until_ts: int
  301. ) -> Dict[str, FetchKeyResult]:
  302. self.assertEqual(server_name, "server1")
  303. self.assertEqual(key_ids, [get_key_id(key1)])
  304. self.assertEqual(minimum_valid_until_ts, 1500)
  305. return {get_key_id(key1): FetchKeyResult(get_verify_key(key1), 800)}
  306. async def get_keys2(
  307. server_name: str, key_ids: List[str], minimum_valid_until_ts: int
  308. ) -> Dict[str, FetchKeyResult]:
  309. self.assertEqual(server_name, "server1")
  310. self.assertEqual(key_ids, [get_key_id(key1)])
  311. self.assertEqual(minimum_valid_until_ts, 1500)
  312. return {get_key_id(key1): FetchKeyResult(get_verify_key(key1), 1200)}
  313. mock_fetcher1 = Mock()
  314. mock_fetcher1.get_keys = Mock(side_effect=get_keys1)
  315. mock_fetcher2 = Mock()
  316. mock_fetcher2.get_keys = Mock(side_effect=get_keys2)
  317. kr = keyring.Keyring(self.hs, key_fetchers=(mock_fetcher1, mock_fetcher2))
  318. json1: JsonDict = {}
  319. signedjson.sign.sign_json(json1, "server1", key1)
  320. results = kr.verify_json_objects_for_server(
  321. [
  322. (
  323. "server1",
  324. json1,
  325. 1200,
  326. ),
  327. (
  328. "server1",
  329. json1,
  330. 1500,
  331. ),
  332. ]
  333. )
  334. self.assertEqual(len(results), 2)
  335. self.get_success(results[0])
  336. e = self.get_failure(results[1], SynapseError).value
  337. self.assertEqual(e.errcode, "M_UNAUTHORIZED")
  338. self.assertEqual(e.code, 401)
  339. # there should have been a single call to each fetcher
  340. mock_fetcher1.get_keys.assert_called_once()
  341. mock_fetcher2.get_keys.assert_called_once()
  342. @logcontext_clean
  343. class ServerKeyFetcherTestCase(unittest.HomeserverTestCase):
  344. def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
  345. self.http_client = Mock()
  346. hs = self.setup_test_homeserver(federation_http_client=self.http_client)
  347. return hs
  348. def test_get_keys_from_server(self) -> None:
  349. # arbitrarily advance the clock a bit
  350. self.reactor.advance(100)
  351. SERVER_NAME = "server2"
  352. fetcher = ServerKeyFetcher(self.hs)
  353. testkey = signedjson.key.generate_signing_key("ver1")
  354. testverifykey = signedjson.key.get_verify_key(testkey)
  355. testverifykey_id = "ed25519:ver1"
  356. VALID_UNTIL_TS = 200 * 1000
  357. # valid response
  358. response = {
  359. "server_name": SERVER_NAME,
  360. "old_verify_keys": {},
  361. "valid_until_ts": VALID_UNTIL_TS,
  362. "verify_keys": {
  363. testverifykey_id: {
  364. "key": signedjson.key.encode_verify_key_base64(testverifykey)
  365. }
  366. },
  367. }
  368. signedjson.sign.sign_json(response, SERVER_NAME, testkey)
  369. async def get_json(destination: str, path: str, **kwargs: Any) -> JsonDict:
  370. self.assertEqual(destination, SERVER_NAME)
  371. self.assertEqual(path, "/_matrix/key/v2/server")
  372. return response
  373. self.http_client.get_json.side_effect = get_json
  374. keys = self.get_success(fetcher.get_keys(SERVER_NAME, ["key1"], 0))
  375. k = keys[testverifykey_id]
  376. self.assertEqual(k.valid_until_ts, VALID_UNTIL_TS)
  377. self.assertEqual(k.verify_key, testverifykey)
  378. self.assertEqual(k.verify_key.alg, "ed25519")
  379. self.assertEqual(k.verify_key.version, "ver1")
  380. # check that the perspectives store is correctly updated
  381. lookup_triplet = (SERVER_NAME, testverifykey_id, None)
  382. key_json = self.get_success(
  383. self.hs.get_datastores().main.get_server_keys_json_for_remote(
  384. [lookup_triplet]
  385. )
  386. )
  387. res_keys = key_json[lookup_triplet]
  388. self.assertEqual(len(res_keys), 1)
  389. res = res_keys[0]
  390. self.assertEqual(res["key_id"], testverifykey_id)
  391. self.assertEqual(res["from_server"], SERVER_NAME)
  392. self.assertEqual(res["ts_added_ms"], self.reactor.seconds() * 1000)
  393. self.assertEqual(res["ts_valid_until_ms"], VALID_UNTIL_TS)
  394. # we expect it to be encoded as canonical json *before* it hits the db
  395. self.assertEqual(
  396. bytes(res["key_json"]), canonicaljson.encode_canonical_json(response)
  397. )
  398. # change the server name: the result should be ignored
  399. response["server_name"] = "OTHER_SERVER"
  400. keys = self.get_success(fetcher.get_keys(SERVER_NAME, ["key1"], 0))
  401. self.assertEqual(keys, {})
  402. class PerspectivesKeyFetcherTestCase(unittest.HomeserverTestCase):
  403. def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
  404. self.mock_perspective_server = MockPerspectiveServer()
  405. self.http_client = Mock()
  406. config = self.default_config()
  407. config["trusted_key_servers"] = [
  408. {
  409. "server_name": self.mock_perspective_server.server_name,
  410. "verify_keys": self.mock_perspective_server.get_verify_keys(),
  411. }
  412. ]
  413. return self.setup_test_homeserver(
  414. federation_http_client=self.http_client, config=config
  415. )
  416. def build_perspectives_response(
  417. self,
  418. server_name: str,
  419. signing_key: SigningKey,
  420. valid_until_ts: int,
  421. ) -> dict:
  422. """
  423. Build a valid perspectives server response to a request for the given key
  424. """
  425. verify_key = signedjson.key.get_verify_key(signing_key)
  426. verifykey_id = "%s:%s" % (verify_key.alg, verify_key.version)
  427. response = {
  428. "server_name": server_name,
  429. "old_verify_keys": {},
  430. "valid_until_ts": valid_until_ts,
  431. "verify_keys": {
  432. verifykey_id: {
  433. "key": signedjson.key.encode_verify_key_base64(verify_key)
  434. }
  435. },
  436. }
  437. # the response must be signed by both the origin server and the perspectives
  438. # server.
  439. signedjson.sign.sign_json(response, server_name, signing_key)
  440. self.mock_perspective_server.sign_response(response)
  441. return response
  442. def expect_outgoing_key_query(
  443. self, expected_server_name: str, expected_key_id: str, response: dict
  444. ) -> None:
  445. """
  446. Tell the mock http client to expect a perspectives-server key query
  447. """
  448. async def post_json(
  449. destination: str, path: str, data: JsonDict, **kwargs: Any
  450. ) -> JsonDict:
  451. self.assertEqual(destination, self.mock_perspective_server.server_name)
  452. self.assertEqual(path, "/_matrix/key/v2/query")
  453. # check that the request is for the expected key
  454. q = data["server_keys"]
  455. self.assertEqual(list(q[expected_server_name].keys()), [expected_key_id])
  456. return {"server_keys": [response]}
  457. self.http_client.post_json.side_effect = post_json
  458. def test_get_keys_from_perspectives(self) -> None:
  459. # arbitrarily advance the clock a bit
  460. self.reactor.advance(100)
  461. fetcher = PerspectivesKeyFetcher(self.hs)
  462. SERVER_NAME = "server2"
  463. testkey = signedjson.key.generate_signing_key("ver1")
  464. testverifykey = signedjson.key.get_verify_key(testkey)
  465. testverifykey_id = "ed25519:ver1"
  466. VALID_UNTIL_TS = 200 * 1000
  467. response = self.build_perspectives_response(
  468. SERVER_NAME,
  469. testkey,
  470. VALID_UNTIL_TS,
  471. )
  472. self.expect_outgoing_key_query(SERVER_NAME, "key1", response)
  473. keys = self.get_success(fetcher.get_keys(SERVER_NAME, ["key1"], 0))
  474. self.assertIn(testverifykey_id, keys)
  475. k = keys[testverifykey_id]
  476. self.assertEqual(k.valid_until_ts, VALID_UNTIL_TS)
  477. self.assertEqual(k.verify_key, testverifykey)
  478. self.assertEqual(k.verify_key.alg, "ed25519")
  479. self.assertEqual(k.verify_key.version, "ver1")
  480. # check that the perspectives store is correctly updated
  481. lookup_triplet = (SERVER_NAME, testverifykey_id, None)
  482. key_json = self.get_success(
  483. self.hs.get_datastores().main.get_server_keys_json_for_remote(
  484. [lookup_triplet]
  485. )
  486. )
  487. res_keys = key_json[lookup_triplet]
  488. self.assertEqual(len(res_keys), 1)
  489. res = res_keys[0]
  490. self.assertEqual(res["key_id"], testverifykey_id)
  491. self.assertEqual(res["from_server"], self.mock_perspective_server.server_name)
  492. self.assertEqual(res["ts_added_ms"], self.reactor.seconds() * 1000)
  493. self.assertEqual(res["ts_valid_until_ms"], VALID_UNTIL_TS)
  494. self.assertEqual(
  495. bytes(res["key_json"]), canonicaljson.encode_canonical_json(response)
  496. )
  497. def test_get_multiple_keys_from_perspectives(self) -> None:
  498. """Check that we can correctly request multiple keys for the same server"""
  499. fetcher = PerspectivesKeyFetcher(self.hs)
  500. SERVER_NAME = "server2"
  501. testkey1 = signedjson.key.generate_signing_key("ver1")
  502. testverifykey1 = signedjson.key.get_verify_key(testkey1)
  503. testverifykey1_id = "ed25519:ver1"
  504. testkey2 = signedjson.key.generate_signing_key("ver2")
  505. testverifykey2 = signedjson.key.get_verify_key(testkey2)
  506. testverifykey2_id = "ed25519:ver2"
  507. VALID_UNTIL_TS = 200 * 1000
  508. response1 = self.build_perspectives_response(
  509. SERVER_NAME,
  510. testkey1,
  511. VALID_UNTIL_TS,
  512. )
  513. response2 = self.build_perspectives_response(
  514. SERVER_NAME,
  515. testkey2,
  516. VALID_UNTIL_TS,
  517. )
  518. async def post_json(
  519. destination: str, path: str, data: JsonDict, **kwargs: str
  520. ) -> JsonDict:
  521. self.assertEqual(destination, self.mock_perspective_server.server_name)
  522. self.assertEqual(path, "/_matrix/key/v2/query")
  523. # check that the request is for the expected keys
  524. q = data["server_keys"]
  525. self.assertEqual(
  526. list(q[SERVER_NAME].keys()), [testverifykey1_id, testverifykey2_id]
  527. )
  528. return {"server_keys": [response1, response2]}
  529. self.http_client.post_json.side_effect = post_json
  530. # fire off two separate requests; they should get merged together into a
  531. # single HTTP hit.
  532. request1_d = defer.ensureDeferred(
  533. fetcher.get_keys(SERVER_NAME, [testverifykey1_id], 0)
  534. )
  535. request2_d = defer.ensureDeferred(
  536. fetcher.get_keys(SERVER_NAME, [testverifykey2_id], 0)
  537. )
  538. keys1 = self.get_success(request1_d)
  539. self.assertIn(testverifykey1_id, keys1)
  540. k = keys1[testverifykey1_id]
  541. self.assertEqual(k.valid_until_ts, VALID_UNTIL_TS)
  542. self.assertEqual(k.verify_key, testverifykey1)
  543. self.assertEqual(k.verify_key.alg, "ed25519")
  544. self.assertEqual(k.verify_key.version, "ver1")
  545. keys2 = self.get_success(request2_d)
  546. self.assertIn(testverifykey2_id, keys2)
  547. k = keys2[testverifykey2_id]
  548. self.assertEqual(k.valid_until_ts, VALID_UNTIL_TS)
  549. self.assertEqual(k.verify_key, testverifykey2)
  550. self.assertEqual(k.verify_key.alg, "ed25519")
  551. self.assertEqual(k.verify_key.version, "ver2")
  552. # finally, ensure that only one request was sent
  553. self.assertEqual(self.http_client.post_json.call_count, 1)
  554. def test_get_perspectives_own_key(self) -> None:
  555. """Check that we can get the perspectives server's own keys
  556. This is slightly complicated by the fact that the perspectives server may
  557. use different keys for signing notary responses.
  558. """
  559. # arbitrarily advance the clock a bit
  560. self.reactor.advance(100)
  561. fetcher = PerspectivesKeyFetcher(self.hs)
  562. SERVER_NAME = self.mock_perspective_server.server_name
  563. testkey = signedjson.key.generate_signing_key("ver1")
  564. testverifykey = signedjson.key.get_verify_key(testkey)
  565. testverifykey_id = "ed25519:ver1"
  566. VALID_UNTIL_TS = 200 * 1000
  567. response = self.build_perspectives_response(
  568. SERVER_NAME, testkey, VALID_UNTIL_TS
  569. )
  570. self.expect_outgoing_key_query(SERVER_NAME, "key1", response)
  571. keys = self.get_success(fetcher.get_keys(SERVER_NAME, ["key1"], 0))
  572. self.assertIn(testverifykey_id, keys)
  573. k = keys[testverifykey_id]
  574. self.assertEqual(k.valid_until_ts, VALID_UNTIL_TS)
  575. self.assertEqual(k.verify_key, testverifykey)
  576. self.assertEqual(k.verify_key.alg, "ed25519")
  577. self.assertEqual(k.verify_key.version, "ver1")
  578. # check that the perspectives store is correctly updated
  579. lookup_triplet = (SERVER_NAME, testverifykey_id, None)
  580. key_json = self.get_success(
  581. self.hs.get_datastores().main.get_server_keys_json_for_remote(
  582. [lookup_triplet]
  583. )
  584. )
  585. res_keys = key_json[lookup_triplet]
  586. self.assertEqual(len(res_keys), 1)
  587. res = res_keys[0]
  588. self.assertEqual(res["key_id"], testverifykey_id)
  589. self.assertEqual(res["from_server"], self.mock_perspective_server.server_name)
  590. self.assertEqual(res["ts_added_ms"], self.reactor.seconds() * 1000)
  591. self.assertEqual(res["ts_valid_until_ms"], VALID_UNTIL_TS)
  592. self.assertEqual(
  593. bytes(res["key_json"]), canonicaljson.encode_canonical_json(response)
  594. )
  595. def test_invalid_perspectives_responses(self) -> None:
  596. """Check that invalid responses from the perspectives server are rejected"""
  597. # arbitrarily advance the clock a bit
  598. self.reactor.advance(100)
  599. SERVER_NAME = "server2"
  600. testkey = signedjson.key.generate_signing_key("ver1")
  601. testverifykey = signedjson.key.get_verify_key(testkey)
  602. testverifykey_id = "ed25519:ver1"
  603. VALID_UNTIL_TS = 200 * 1000
  604. def build_response() -> dict:
  605. return self.build_perspectives_response(
  606. SERVER_NAME, testkey, VALID_UNTIL_TS
  607. )
  608. def get_key_from_perspectives(response: JsonDict) -> Dict[str, FetchKeyResult]:
  609. fetcher = PerspectivesKeyFetcher(self.hs)
  610. self.expect_outgoing_key_query(SERVER_NAME, "key1", response)
  611. return self.get_success(fetcher.get_keys(SERVER_NAME, ["key1"], 0))
  612. # start with a valid response so we can check we are testing the right thing
  613. response = build_response()
  614. keys = get_key_from_perspectives(response)
  615. k = keys[testverifykey_id]
  616. self.assertEqual(k.verify_key, testverifykey)
  617. # remove the perspectives server's signature
  618. response = build_response()
  619. del response["signatures"][self.mock_perspective_server.server_name]
  620. keys = get_key_from_perspectives(response)
  621. self.assertEqual(keys, {}, "Expected empty dict with missing persp server sig")
  622. # remove the origin server's signature
  623. response = build_response()
  624. del response["signatures"][SERVER_NAME]
  625. keys = get_key_from_perspectives(response)
  626. self.assertEqual(keys, {}, "Expected empty dict with missing origin server sig")
  627. def get_key_id(key: SigningKey) -> str:
  628. """Get the matrix ID tag for a given SigningKey or VerifyKey"""
  629. return "%s:%s" % (key.alg, key.version)