test_keyring.py 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605
  1. # -*- coding: utf-8 -*-
  2. # Copyright 2017 New Vector Ltd
  3. #
  4. # Licensed under the Apache License, Version 2.0 (the "License");
  5. # you may not use this file except in compliance with the License.
  6. # You may obtain a copy of the License at
  7. #
  8. # http://www.apache.org/licenses/LICENSE-2.0
  9. #
  10. # Unless required by applicable law or agreed to in writing, software
  11. # distributed under the License is distributed on an "AS IS" BASIS,
  12. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13. # See the License for the specific language governing permissions and
  14. # limitations under the License.
  15. import time
  16. from mock import Mock
  17. import canonicaljson
  18. import signedjson.key
  19. import signedjson.sign
  20. from nacl.signing import SigningKey
  21. from signedjson.key import encode_verify_key_base64, get_verify_key
  22. from twisted.internet import defer
  23. from twisted.internet.defer import Deferred, ensureDeferred
  24. from synapse.api.errors import SynapseError
  25. from synapse.crypto import keyring
  26. from synapse.crypto.keyring import (
  27. PerspectivesKeyFetcher,
  28. ServerKeyFetcher,
  29. StoreKeyFetcher,
  30. )
  31. from synapse.logging.context import (
  32. LoggingContext,
  33. current_context,
  34. make_deferred_yieldable,
  35. )
  36. from synapse.storage.keys import FetchKeyResult
  37. from tests import unittest
  38. from tests.test_utils import make_awaitable
  39. from tests.unittest import logcontext_clean
  40. class MockPerspectiveServer:
  41. def __init__(self):
  42. self.server_name = "mock_server"
  43. self.key = signedjson.key.generate_signing_key(0)
  44. def get_verify_keys(self):
  45. vk = signedjson.key.get_verify_key(self.key)
  46. return {"%s:%s" % (vk.alg, vk.version): encode_verify_key_base64(vk)}
  47. def get_signed_key(self, server_name, verify_key):
  48. key_id = "%s:%s" % (verify_key.alg, verify_key.version)
  49. res = {
  50. "server_name": server_name,
  51. "old_verify_keys": {},
  52. "valid_until_ts": time.time() * 1000 + 3600,
  53. "verify_keys": {key_id: {"key": encode_verify_key_base64(verify_key)}},
  54. }
  55. self.sign_response(res)
  56. return res
  57. def sign_response(self, res):
  58. signedjson.sign.sign_json(res, self.server_name, self.key)
  59. @logcontext_clean
  60. class KeyringTestCase(unittest.HomeserverTestCase):
  61. def check_context(self, val, expected):
  62. self.assertEquals(getattr(current_context(), "request", None), expected)
  63. return val
  64. def test_verify_json_objects_for_server_awaits_previous_requests(self):
  65. mock_fetcher = Mock()
  66. mock_fetcher.get_keys = Mock()
  67. kr = keyring.Keyring(self.hs, key_fetchers=(mock_fetcher,))
  68. # a signed object that we are going to try to validate
  69. key1 = signedjson.key.generate_signing_key(1)
  70. json1 = {}
  71. signedjson.sign.sign_json(json1, "server10", key1)
  72. # start off a first set of lookups. We make the mock fetcher block until this
  73. # deferred completes.
  74. first_lookup_deferred = Deferred()
  75. async def first_lookup_fetch(keys_to_fetch):
  76. self.assertEquals(current_context().request, "context_11")
  77. self.assertEqual(keys_to_fetch, {"server10": {get_key_id(key1): 0}})
  78. await make_deferred_yieldable(first_lookup_deferred)
  79. return {
  80. "server10": {
  81. get_key_id(key1): FetchKeyResult(get_verify_key(key1), 100)
  82. }
  83. }
  84. mock_fetcher.get_keys.side_effect = first_lookup_fetch
  85. async def first_lookup():
  86. with LoggingContext("context_11") as context_11:
  87. context_11.request = "context_11"
  88. res_deferreds = kr.verify_json_objects_for_server(
  89. [("server10", json1, 0, "test10"), ("server11", {}, 0, "test11")]
  90. )
  91. # the unsigned json should be rejected pretty quickly
  92. self.assertTrue(res_deferreds[1].called)
  93. try:
  94. await res_deferreds[1]
  95. self.assertFalse("unsigned json didn't cause a failure")
  96. except SynapseError:
  97. pass
  98. self.assertFalse(res_deferreds[0].called)
  99. res_deferreds[0].addBoth(self.check_context, None)
  100. await make_deferred_yieldable(res_deferreds[0])
  101. d0 = ensureDeferred(first_lookup())
  102. mock_fetcher.get_keys.assert_called_once()
  103. # a second request for a server with outstanding requests
  104. # should block rather than start a second call
  105. async def second_lookup_fetch(keys_to_fetch):
  106. self.assertEquals(current_context().request, "context_12")
  107. return {
  108. "server10": {
  109. get_key_id(key1): FetchKeyResult(get_verify_key(key1), 100)
  110. }
  111. }
  112. mock_fetcher.get_keys.reset_mock()
  113. mock_fetcher.get_keys.side_effect = second_lookup_fetch
  114. second_lookup_state = [0]
  115. async def second_lookup():
  116. with LoggingContext("context_12") as context_12:
  117. context_12.request = "context_12"
  118. res_deferreds_2 = kr.verify_json_objects_for_server(
  119. [("server10", json1, 0, "test")]
  120. )
  121. res_deferreds_2[0].addBoth(self.check_context, None)
  122. second_lookup_state[0] = 1
  123. await make_deferred_yieldable(res_deferreds_2[0])
  124. second_lookup_state[0] = 2
  125. d2 = ensureDeferred(second_lookup())
  126. self.pump()
  127. # the second request should be pending, but the fetcher should not yet have been
  128. # called
  129. self.assertEqual(second_lookup_state[0], 1)
  130. mock_fetcher.get_keys.assert_not_called()
  131. # complete the first request
  132. first_lookup_deferred.callback(None)
  133. # and now both verifications should succeed.
  134. self.get_success(d0)
  135. self.get_success(d2)
  136. def test_verify_json_for_server(self):
  137. kr = keyring.Keyring(self.hs)
  138. key1 = signedjson.key.generate_signing_key(1)
  139. r = self.hs.get_datastore().store_server_verify_keys(
  140. "server9",
  141. time.time() * 1000,
  142. [("server9", get_key_id(key1), FetchKeyResult(get_verify_key(key1), 1000))],
  143. )
  144. self.get_success(r)
  145. json1 = {}
  146. signedjson.sign.sign_json(json1, "server9", key1)
  147. # should fail immediately on an unsigned object
  148. d = _verify_json_for_server(kr, "server9", {}, 0, "test unsigned")
  149. self.get_failure(d, SynapseError)
  150. # should succeed on a signed object
  151. d = _verify_json_for_server(kr, "server9", json1, 500, "test signed")
  152. # self.assertFalse(d.called)
  153. self.get_success(d)
  154. def test_verify_json_for_server_with_null_valid_until_ms(self):
  155. """Tests that we correctly handle key requests for keys we've stored
  156. with a null `ts_valid_until_ms`
  157. """
  158. mock_fetcher = Mock()
  159. mock_fetcher.get_keys = Mock(return_value=make_awaitable({}))
  160. kr = keyring.Keyring(
  161. self.hs, key_fetchers=(StoreKeyFetcher(self.hs), mock_fetcher)
  162. )
  163. key1 = signedjson.key.generate_signing_key(1)
  164. r = self.hs.get_datastore().store_server_verify_keys(
  165. "server9",
  166. time.time() * 1000,
  167. [("server9", get_key_id(key1), FetchKeyResult(get_verify_key(key1), None))],
  168. )
  169. self.get_success(r)
  170. json1 = {}
  171. signedjson.sign.sign_json(json1, "server9", key1)
  172. # should fail immediately on an unsigned object
  173. d = _verify_json_for_server(kr, "server9", {}, 0, "test unsigned")
  174. self.get_failure(d, SynapseError)
  175. # should fail on a signed object with a non-zero minimum_valid_until_ms,
  176. # as it tries to refetch the keys and fails.
  177. d = _verify_json_for_server(
  178. kr, "server9", json1, 500, "test signed non-zero min"
  179. )
  180. self.get_failure(d, SynapseError)
  181. # We expect the keyring tried to refetch the key once.
  182. mock_fetcher.get_keys.assert_called_once_with(
  183. {"server9": {get_key_id(key1): 500}}
  184. )
  185. # should succeed on a signed object with a 0 minimum_valid_until_ms
  186. d = _verify_json_for_server(
  187. kr, "server9", json1, 0, "test signed with zero min"
  188. )
  189. self.get_success(d)
  190. def test_verify_json_dedupes_key_requests(self):
  191. """Two requests for the same key should be deduped."""
  192. key1 = signedjson.key.generate_signing_key(1)
  193. async def get_keys(keys_to_fetch):
  194. # there should only be one request object (with the max validity)
  195. self.assertEqual(keys_to_fetch, {"server1": {get_key_id(key1): 1500}})
  196. return {
  197. "server1": {
  198. get_key_id(key1): FetchKeyResult(get_verify_key(key1), 1200)
  199. }
  200. }
  201. mock_fetcher = Mock()
  202. mock_fetcher.get_keys = Mock(side_effect=get_keys)
  203. kr = keyring.Keyring(self.hs, key_fetchers=(mock_fetcher,))
  204. json1 = {}
  205. signedjson.sign.sign_json(json1, "server1", key1)
  206. # the first request should succeed; the second should fail because the key
  207. # has expired
  208. results = kr.verify_json_objects_for_server(
  209. [("server1", json1, 500, "test1"), ("server1", json1, 1500, "test2")]
  210. )
  211. self.assertEqual(len(results), 2)
  212. self.get_success(results[0])
  213. e = self.get_failure(results[1], SynapseError).value
  214. self.assertEqual(e.errcode, "M_UNAUTHORIZED")
  215. self.assertEqual(e.code, 401)
  216. # there should have been a single call to the fetcher
  217. mock_fetcher.get_keys.assert_called_once()
  218. def test_verify_json_falls_back_to_other_fetchers(self):
  219. """If the first fetcher cannot provide a recent enough key, we fall back"""
  220. key1 = signedjson.key.generate_signing_key(1)
  221. async def get_keys1(keys_to_fetch):
  222. self.assertEqual(keys_to_fetch, {"server1": {get_key_id(key1): 1500}})
  223. return {
  224. "server1": {get_key_id(key1): FetchKeyResult(get_verify_key(key1), 800)}
  225. }
  226. async def get_keys2(keys_to_fetch):
  227. self.assertEqual(keys_to_fetch, {"server1": {get_key_id(key1): 1500}})
  228. return {
  229. "server1": {
  230. get_key_id(key1): FetchKeyResult(get_verify_key(key1), 1200)
  231. }
  232. }
  233. mock_fetcher1 = Mock()
  234. mock_fetcher1.get_keys = Mock(side_effect=get_keys1)
  235. mock_fetcher2 = Mock()
  236. mock_fetcher2.get_keys = Mock(side_effect=get_keys2)
  237. kr = keyring.Keyring(self.hs, key_fetchers=(mock_fetcher1, mock_fetcher2))
  238. json1 = {}
  239. signedjson.sign.sign_json(json1, "server1", key1)
  240. results = kr.verify_json_objects_for_server(
  241. [("server1", json1, 1200, "test1"), ("server1", json1, 1500, "test2")]
  242. )
  243. self.assertEqual(len(results), 2)
  244. self.get_success(results[0])
  245. e = self.get_failure(results[1], SynapseError).value
  246. self.assertEqual(e.errcode, "M_UNAUTHORIZED")
  247. self.assertEqual(e.code, 401)
  248. # there should have been a single call to each fetcher
  249. mock_fetcher1.get_keys.assert_called_once()
  250. mock_fetcher2.get_keys.assert_called_once()
  251. @logcontext_clean
  252. class ServerKeyFetcherTestCase(unittest.HomeserverTestCase):
  253. def make_homeserver(self, reactor, clock):
  254. self.http_client = Mock()
  255. hs = self.setup_test_homeserver(federation_http_client=self.http_client)
  256. return hs
  257. def test_get_keys_from_server(self):
  258. # arbitrarily advance the clock a bit
  259. self.reactor.advance(100)
  260. SERVER_NAME = "server2"
  261. fetcher = ServerKeyFetcher(self.hs)
  262. testkey = signedjson.key.generate_signing_key("ver1")
  263. testverifykey = signedjson.key.get_verify_key(testkey)
  264. testverifykey_id = "ed25519:ver1"
  265. VALID_UNTIL_TS = 200 * 1000
  266. # valid response
  267. response = {
  268. "server_name": SERVER_NAME,
  269. "old_verify_keys": {},
  270. "valid_until_ts": VALID_UNTIL_TS,
  271. "verify_keys": {
  272. testverifykey_id: {
  273. "key": signedjson.key.encode_verify_key_base64(testverifykey)
  274. }
  275. },
  276. }
  277. signedjson.sign.sign_json(response, SERVER_NAME, testkey)
  278. async def get_json(destination, path, **kwargs):
  279. self.assertEqual(destination, SERVER_NAME)
  280. self.assertEqual(path, "/_matrix/key/v2/server/key1")
  281. return response
  282. self.http_client.get_json.side_effect = get_json
  283. keys_to_fetch = {SERVER_NAME: {"key1": 0}}
  284. keys = self.get_success(fetcher.get_keys(keys_to_fetch))
  285. k = keys[SERVER_NAME][testverifykey_id]
  286. self.assertEqual(k.valid_until_ts, VALID_UNTIL_TS)
  287. self.assertEqual(k.verify_key, testverifykey)
  288. self.assertEqual(k.verify_key.alg, "ed25519")
  289. self.assertEqual(k.verify_key.version, "ver1")
  290. # check that the perspectives store is correctly updated
  291. lookup_triplet = (SERVER_NAME, testverifykey_id, None)
  292. key_json = self.get_success(
  293. self.hs.get_datastore().get_server_keys_json([lookup_triplet])
  294. )
  295. res = key_json[lookup_triplet]
  296. self.assertEqual(len(res), 1)
  297. res = res[0]
  298. self.assertEqual(res["key_id"], testverifykey_id)
  299. self.assertEqual(res["from_server"], SERVER_NAME)
  300. self.assertEqual(res["ts_added_ms"], self.reactor.seconds() * 1000)
  301. self.assertEqual(res["ts_valid_until_ms"], VALID_UNTIL_TS)
  302. # we expect it to be encoded as canonical json *before* it hits the db
  303. self.assertEqual(
  304. bytes(res["key_json"]), canonicaljson.encode_canonical_json(response)
  305. )
  306. # change the server name: the result should be ignored
  307. response["server_name"] = "OTHER_SERVER"
  308. keys = self.get_success(fetcher.get_keys(keys_to_fetch))
  309. self.assertEqual(keys, {})
  310. class PerspectivesKeyFetcherTestCase(unittest.HomeserverTestCase):
  311. def make_homeserver(self, reactor, clock):
  312. self.mock_perspective_server = MockPerspectiveServer()
  313. self.http_client = Mock()
  314. config = self.default_config()
  315. config["trusted_key_servers"] = [
  316. {
  317. "server_name": self.mock_perspective_server.server_name,
  318. "verify_keys": self.mock_perspective_server.get_verify_keys(),
  319. }
  320. ]
  321. return self.setup_test_homeserver(
  322. federation_http_client=self.http_client, config=config
  323. )
  324. def build_perspectives_response(
  325. self, server_name: str, signing_key: SigningKey, valid_until_ts: int,
  326. ) -> dict:
  327. """
  328. Build a valid perspectives server response to a request for the given key
  329. """
  330. verify_key = signedjson.key.get_verify_key(signing_key)
  331. verifykey_id = "%s:%s" % (verify_key.alg, verify_key.version)
  332. response = {
  333. "server_name": server_name,
  334. "old_verify_keys": {},
  335. "valid_until_ts": valid_until_ts,
  336. "verify_keys": {
  337. verifykey_id: {
  338. "key": signedjson.key.encode_verify_key_base64(verify_key)
  339. }
  340. },
  341. }
  342. # the response must be signed by both the origin server and the perspectives
  343. # server.
  344. signedjson.sign.sign_json(response, server_name, signing_key)
  345. self.mock_perspective_server.sign_response(response)
  346. return response
  347. def expect_outgoing_key_query(
  348. self, expected_server_name: str, expected_key_id: str, response: dict
  349. ) -> None:
  350. """
  351. Tell the mock http client to expect a perspectives-server key query
  352. """
  353. async def post_json(destination, path, data, **kwargs):
  354. self.assertEqual(destination, self.mock_perspective_server.server_name)
  355. self.assertEqual(path, "/_matrix/key/v2/query")
  356. # check that the request is for the expected key
  357. q = data["server_keys"]
  358. self.assertEqual(list(q[expected_server_name].keys()), [expected_key_id])
  359. return {"server_keys": [response]}
  360. self.http_client.post_json.side_effect = post_json
  361. def test_get_keys_from_perspectives(self):
  362. # arbitrarily advance the clock a bit
  363. self.reactor.advance(100)
  364. fetcher = PerspectivesKeyFetcher(self.hs)
  365. SERVER_NAME = "server2"
  366. testkey = signedjson.key.generate_signing_key("ver1")
  367. testverifykey = signedjson.key.get_verify_key(testkey)
  368. testverifykey_id = "ed25519:ver1"
  369. VALID_UNTIL_TS = 200 * 1000
  370. response = self.build_perspectives_response(
  371. SERVER_NAME, testkey, VALID_UNTIL_TS,
  372. )
  373. self.expect_outgoing_key_query(SERVER_NAME, "key1", response)
  374. keys_to_fetch = {SERVER_NAME: {"key1": 0}}
  375. keys = self.get_success(fetcher.get_keys(keys_to_fetch))
  376. self.assertIn(SERVER_NAME, keys)
  377. k = keys[SERVER_NAME][testverifykey_id]
  378. self.assertEqual(k.valid_until_ts, VALID_UNTIL_TS)
  379. self.assertEqual(k.verify_key, testverifykey)
  380. self.assertEqual(k.verify_key.alg, "ed25519")
  381. self.assertEqual(k.verify_key.version, "ver1")
  382. # check that the perspectives store is correctly updated
  383. lookup_triplet = (SERVER_NAME, testverifykey_id, None)
  384. key_json = self.get_success(
  385. self.hs.get_datastore().get_server_keys_json([lookup_triplet])
  386. )
  387. res = key_json[lookup_triplet]
  388. self.assertEqual(len(res), 1)
  389. res = res[0]
  390. self.assertEqual(res["key_id"], testverifykey_id)
  391. self.assertEqual(res["from_server"], self.mock_perspective_server.server_name)
  392. self.assertEqual(res["ts_added_ms"], self.reactor.seconds() * 1000)
  393. self.assertEqual(res["ts_valid_until_ms"], VALID_UNTIL_TS)
  394. self.assertEqual(
  395. bytes(res["key_json"]), canonicaljson.encode_canonical_json(response)
  396. )
  397. def test_get_perspectives_own_key(self):
  398. """Check that we can get the perspectives server's own keys
  399. This is slightly complicated by the fact that the perspectives server may
  400. use different keys for signing notary responses.
  401. """
  402. # arbitrarily advance the clock a bit
  403. self.reactor.advance(100)
  404. fetcher = PerspectivesKeyFetcher(self.hs)
  405. SERVER_NAME = self.mock_perspective_server.server_name
  406. testkey = signedjson.key.generate_signing_key("ver1")
  407. testverifykey = signedjson.key.get_verify_key(testkey)
  408. testverifykey_id = "ed25519:ver1"
  409. VALID_UNTIL_TS = 200 * 1000
  410. response = self.build_perspectives_response(
  411. SERVER_NAME, testkey, VALID_UNTIL_TS
  412. )
  413. self.expect_outgoing_key_query(SERVER_NAME, "key1", response)
  414. keys_to_fetch = {SERVER_NAME: {"key1": 0}}
  415. keys = self.get_success(fetcher.get_keys(keys_to_fetch))
  416. self.assertIn(SERVER_NAME, keys)
  417. k = keys[SERVER_NAME][testverifykey_id]
  418. self.assertEqual(k.valid_until_ts, VALID_UNTIL_TS)
  419. self.assertEqual(k.verify_key, testverifykey)
  420. self.assertEqual(k.verify_key.alg, "ed25519")
  421. self.assertEqual(k.verify_key.version, "ver1")
  422. # check that the perspectives store is correctly updated
  423. lookup_triplet = (SERVER_NAME, testverifykey_id, None)
  424. key_json = self.get_success(
  425. self.hs.get_datastore().get_server_keys_json([lookup_triplet])
  426. )
  427. res = key_json[lookup_triplet]
  428. self.assertEqual(len(res), 1)
  429. res = res[0]
  430. self.assertEqual(res["key_id"], testverifykey_id)
  431. self.assertEqual(res["from_server"], self.mock_perspective_server.server_name)
  432. self.assertEqual(res["ts_added_ms"], self.reactor.seconds() * 1000)
  433. self.assertEqual(res["ts_valid_until_ms"], VALID_UNTIL_TS)
  434. self.assertEqual(
  435. bytes(res["key_json"]), canonicaljson.encode_canonical_json(response)
  436. )
  437. def test_invalid_perspectives_responses(self):
  438. """Check that invalid responses from the perspectives server are rejected"""
  439. # arbitrarily advance the clock a bit
  440. self.reactor.advance(100)
  441. SERVER_NAME = "server2"
  442. testkey = signedjson.key.generate_signing_key("ver1")
  443. testverifykey = signedjson.key.get_verify_key(testkey)
  444. testverifykey_id = "ed25519:ver1"
  445. VALID_UNTIL_TS = 200 * 1000
  446. def build_response():
  447. return self.build_perspectives_response(
  448. SERVER_NAME, testkey, VALID_UNTIL_TS
  449. )
  450. def get_key_from_perspectives(response):
  451. fetcher = PerspectivesKeyFetcher(self.hs)
  452. keys_to_fetch = {SERVER_NAME: {"key1": 0}}
  453. self.expect_outgoing_key_query(SERVER_NAME, "key1", response)
  454. return self.get_success(fetcher.get_keys(keys_to_fetch))
  455. # start with a valid response so we can check we are testing the right thing
  456. response = build_response()
  457. keys = get_key_from_perspectives(response)
  458. k = keys[SERVER_NAME][testverifykey_id]
  459. self.assertEqual(k.verify_key, testverifykey)
  460. # remove the perspectives server's signature
  461. response = build_response()
  462. del response["signatures"][self.mock_perspective_server.server_name]
  463. keys = get_key_from_perspectives(response)
  464. self.assertEqual(keys, {}, "Expected empty dict with missing persp server sig")
  465. # remove the origin server's signature
  466. response = build_response()
  467. del response["signatures"][SERVER_NAME]
  468. keys = get_key_from_perspectives(response)
  469. self.assertEqual(keys, {}, "Expected empty dict with missing origin server sig")
  470. def get_key_id(key):
  471. """Get the matrix ID tag for a given SigningKey or VerifyKey"""
  472. return "%s:%s" % (key.alg, key.version)
  473. @defer.inlineCallbacks
  474. def run_in_context(f, *args, **kwargs):
  475. with LoggingContext("testctx") as ctx:
  476. # we set the "request" prop to make it easier to follow what's going on in the
  477. # logs.
  478. ctx.request = "testctx"
  479. rv = yield f(*args, **kwargs)
  480. return rv
  481. def _verify_json_for_server(kr, *args):
  482. """thin wrapper around verify_json_for_server which makes sure it is wrapped
  483. with the patched defer.inlineCallbacks.
  484. """
  485. @defer.inlineCallbacks
  486. def v():
  487. rv1 = yield kr.verify_json_for_server(*args)
  488. return rv1
  489. return run_in_context(v)