Support HS unbinding 3pids

sydent/db/threepid_associations.py

@@ -19,6 +19,10 @@
 from sydent.threepid import ThreepidAssociation, threePidAssocFromDict
 
 import json
+import logging
+
+
+logger = logging.getLogger(__name__)
 
 
 class LocalAssociationStore:
@@ -60,6 +64,34 @@ def getAssociationsAfterId(self, afterId, limit):
 
         return (assocs, maxId)
 
+    def removeAssociation(self, threepid, mxid):
+        cur = self.sydent.db.cursor()
+
+        cur.execute(
+            "SELECT COUNT(*) FROM local_threepid_associations "
+            "WHERE medium = ? AND address = ? AND mxid = ?",
+            (threepid['medium'], threepid['address'], mxid)
+        )
+        row = cur.fetchone()
+        if row[0] > 0:
+            ts = time_msec()
+            cur.execute(
+                "REPLACE INTO local_threepid_associations "
+                "('medium', 'address', 'mxid', 'ts', 'notBefore', 'notAfter') "
+                " values (?, ?, NULL, ?, null, null)",
+                (threepid['medium'], threepid['address'], ts),
+            )
+            logger.info(
+                "Deleting local assoc for %s/%s/%s replaced %d rows",
+                threepid['medium'], threepid['address'], mxid, cur.rowcount,
+            )
+            self.sydent.db.commit()
+        else:
+            logger.info(
+                "No local assoc found for %s/%s/%s",
+                threepid['medium'], threepid['address'], mxid,
+            )
+
 
 class GlobalAssociationStore:
     def __init__(self, sydent):
@@ -164,3 +196,16 @@ def lastIdFromServer(self, server):
             return None
 
         return row[0]
+
+    def removeAssociation(self, medium, address):
+        cur = self.sydent.db.cursor()
+        cur.execute(
+            "DELETE FROM global_threepid_associations WHERE "
+            "medium = ? AND address = ?",
+            (medium, address),
+        )
+        logger.info(
+            "Deleted %d rows from global associations for %s/%s",
+            cur.rowcount, medium, address,
+        )
+        self.sydent.db.commit()

sydent/db/threepid_associations.sql

@@ -14,10 +14,10 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-CREATE TABLE IF NOT EXISTS local_threepid_associations (id integer primary key, medium varchar(16) not null, address varchar(256) not null, mxid varchar(256) not null, ts integer not null, notBefore bigint not null, notAfter bigint not null);
-CREATE UNIQUE INDEX IF NOT EXISTS medium_address on local_threepid_associations(medium, address);
+CREATE TABLE IF NOT EXISTS local_threepid_associations (id integer primary key autoincrement, medium varchar(16) not null, address varchar(256) not null, mxid varchar(256) not null, ts integer, notBefore bigint, notAfter bigint);
+CREATE UNIQUE INDEX IF NOT EXISTS local_threepid_medium_address on local_threepid_associations(medium, address);
 
-CREATE TABLE IF NOT EXISTS global_threepid_associations (id integer primary key, medium varchar(16) not null, address varchar(256) not null, mxid varchar(256) not null, ts integer not null, notBefore bigint not null, notAfter integer not null, originServer varchar(255) not null, originId integer not null, sgAssoc text not null);
-CREATE INDEX IF NOT EXISTS medium_address on global_threepid_associations (medium, address);
-CREATE INDEX IF NOT EXISTS medium_lower_address on global_threepid_associations (medium, lower(address));
-CREATE UNIQUE INDEX IF NOT EXISTS originServer_originId on global_threepid_associations (originServer, originId);
+CREATE TABLE IF NOT EXISTS global_threepid_associations (id integer primary key autoincrement, medium varchar(16) not null, address varchar(256) not null, mxid varchar(256) not null, ts integer not null, notBefore bigint not null, notAfter integer not null, originServer varchar(255) not null, originId integer not null, sgAssoc text not null);
+CREATE INDEX IF NOT EXISTS global_threepid_medium_address on global_threepid_associations (medium, address);
+CREATE INDEX IF NOT EXISTS global_threepid_medium_lower_address on global_threepid_associations (medium, lower(address));
+CREATE UNIQUE INDEX IF NOT EXISTS global_threepid_originServer_originId on global_threepid_associations (originServer, originId);

sydent/db/version.py

@@ -0,0 +1,109 @@
+# -*- coding: utf-8 -*-
+
+# Copyright 2018 New Vector Ltd
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+class VersionStore:
+    def __init__(self, sydent):
+        self.sydent = sydent
+
+    def upgradeSchema(self):
+        curVer = self._getSchemaVersion()
+
+        if curVer < 1:
+            cur = self.sydent.db.cursor()
+
+            # add auto_increment to the primary key of local_threepid_associations to ensure ids are never re-used,
+            # allow the mxid column to be null to represent the deletion of a binding
+            # and remove not null constraints on ts, notBefore and notAfter
+            logger.info("Migrating schema from v0 to v1")
+            cur.execute("DROP INDEX IF EXISTS medium_address")
+            cur.execute("DROP INDEX IF EXISTS local_threepid_medium_address")
+            cur.execute("ALTER TABLE local_threepid_associations RENAME TO old_local_threepid_associations");
+            cur.execute(
+                "CREATE TABLE local_threepid_associations (id integer primary key autoincrement, "
+                "medium varchar(16) not null, "
+                "address varchar(256) not null, "
+                "mxid varchar(256), "
+                "ts integer, "
+                "notBefore bigint, "
+                "notAfter bigint)"
+            )
+            cur.execute(
+                "INSERT INTO local_threepid_associations (medium, address, mxid, ts, notBefore, notAfter) "
+                "SELECT medium, address, mxid, ts, notBefore, notAfter FROM old_local_threepid_associations"
+            )
+            cur.execute(
+                "CREATE UNIQUE INDEX local_threepid_medium_address on local_threepid_associations(medium, address)"
+            )
+            cur.execute("DROP TABLE old_local_threepid_associations")
+
+            # same for global_threepid_associations
+            cur.execute("DROP INDEX IF EXISTS global_threepid_medium_address")
+            cur.execute("DROP INDEX IF EXISTS global_threepid_medium_lower_address")
+            cur.execute("DROP INDEX IF EXISTS global_threepid_originServer_originId")
+            cur.execute("DROP INDEX IF EXISTS medium_lower_address")
+            cur.execute("DROP INDEX IF EXISTS threepid_originServer_originId")
+            cur.execute("ALTER TABLE global_threepid_associations RENAME TO old_global_threepid_associations");
+            cur.execute(
+                "CREATE TABLE IF NOT EXISTS global_threepid_associations "
+                "(id integer primary key autoincrement, "
+                "medium varchar(16) not null, "
+                "address varchar(256) not null, "
+                "mxid varchar(256) not null, "
+                "ts integer not null, "
+                "notBefore bigint not null, "
+                "notAfter integer not null, "
+                "originServer varchar(255) not null, "
+                "originId integer not null, "
+                "sgAssoc text not null)"
+            )
+            cur.execute(
+                "INSERT INTO global_threepid_associations "
+                "(medium, address, mxid, ts, notBefore, notAfter, originServer, originId, sgAssoc) "
+                "SELECT medium, address, mxid, ts, notBefore, notAfter, originServer, originId, sgAssoc "
+                "FROM old_global_threepid_associations"
+            )
+            cur.execute("CREATE INDEX global_threepid_medium_address on global_threepid_associations (medium, address)")
+            cur.execute(
+                "CREATE INDEX global_threepid_medium_lower_address on "
+                "global_threepid_associations (medium, lower(address))"
+            )
+            cur.execute(
+                "CREATE UNIQUE INDEX global_threepid_originServer_originId on "
+                "global_threepid_associations (originServer, originId)"
+            )
+            cur.execute("DROP TABLE old_global_threepid_associations")
+            self.sydent.db.commit()
+            logger.info("v0 -> v1 schema migration complete")
+            self._setSchemaVersion(1)
+
+    def _getSchemaVersion(self):
+        cur = self.sydent.db.cursor()
+        res = cur.execute("PRAGMA user_version");
+        row = cur.fetchone()
+        return row[0]
+
+    def _setSchemaVersion(self, ver):
+        cur = self.sydent.db.cursor()
+        # NB. pragma doesn't support variable substitution so we
+        # do it in python (as a decimal so we don't risk SQL injection)
+        res = cur.execute("PRAGMA user_version = %d" % (ver,));
+

sydent/http/httpclient.py

@@ -18,9 +18,13 @@
 import logging
 
 from StringIO import StringIO
-from twisted.internet import defer, reactor
-from twisted.web.client import FileBodyProducer, Agent
+from twisted.internet import defer, reactor, ssl
+from twisted.internet._sslverify import _OpenSSLECCurve, _defaultCurveName, ClientTLSOptions
+from twisted.web.client import FileBodyProducer, Agent, readBody
 from twisted.web.http_headers import Headers
+from twisted.web.iweb import IPolicyForHTTPS
+from zope.interface import implementer
+from OpenSSL import SSL
 
 logger = logging.getLogger(__name__)
 
@@ -29,15 +33,33 @@ class SimpleHttpClient(object):
     A simple, no-frills HTTP client based on the class of the same name
     from synapse
     """
-    def __init__(self, sydent):
+    def __init__(self, sydent, context_factory=None):
         self.sydent = sydent
-        # The default context factory in Twisted 14.0.0 (which we require) is
-        # BrowserLikePolicyForHTTPS which will do regular cert validation
-        # 'like a browser'
-        self.agent = Agent(
-            reactor,
-            connectTimeout=15,
+        if context_factory is None:
+            # The default context factory in Twisted 14.0.0 (which we require) is
+            # BrowserLikePolicyForHTTPS which will do regular cert validation
+            # 'like a browser'
+            self.agent = Agent(
+                reactor,
+                connectTimeout=15,
+            )
+        else:
+            self.agent = Agent(
+                reactor,
+                connectTimeout=15,
+                contextFactory=context_factory
+            )
+
+    @defer.inlineCallbacks
+    def get_json(self, uri):
+        logger.debug("HTTP GET %s", uri)
+
+        response = yield self.agent.request(
+            "GET",
+            uri.encode("ascii"),
         )
+        body = yield readBody(response)
+        defer.returnValue(json.loads(body))
 
     @defer.inlineCallbacks
     def post_json_get_nothing(self, uri, post_json, opts):
@@ -57,3 +79,21 @@ def post_json_get_nothing(self, uri, post_json, opts):
         )
         defer.returnValue(response)
 
+@implementer(IPolicyForHTTPS)
+class FederationPolicyForHTTPS(object):
+    def creatorForNetloc(self, hostname, port):
+        context = SSL.Context(SSL.SSLv23_METHOD)
+        try:
+            _ecCurve = _OpenSSLECCurve(_defaultCurveName)
+            _ecCurve.addECKeyToContext(context)
+        except Exception:
+            logger.exception("Failed to enable elliptic curve for TLS")
+        context.set_options(SSL.OP_NO_SSLv2 | SSL.OP_NO_SSLv3)
+
+        context.set_cipher_list("!ADH:HIGH+kEDH:!AECDH:HIGH+kEECDH")
+        return ClientTLSOptions(hostname, context)
+
+
+class FederationHttpClient(SimpleHttpClient):
+    def __init__(self, sydent):
+        super(FederationHttpClient, self).__init__(sydent, FederationPolicyForHTTPS())

sydent/http/httpserver.py

@@ -1,6 +1,7 @@
 # -*- coding: utf-8 -*-
 
 # Copyright 2014 OpenMarket Ltd
+# Copyright 2018 New Vector Ltd
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -48,6 +49,7 @@ def __init__(self, sydent):
 
         threepid = Resource()
         bind = self.sydent.servlets.threepidBind
+        unbind = self.sydent.servlets.threepidUnbind
 
         pubkey = Resource()
         ephemeralPubkey = Resource()
@@ -74,6 +76,7 @@ def __init__(self, sydent):
 
         v1.putChild('3pid', threepid)
         threepid.putChild('bind', bind)
+        threepid.putChild('unbind', unbind)
         threepid.putChild('getValidated3pid', getValidated3pid)
 
         email.putChild('requestToken', emailReqCode)

sydent/http/servlets/replication.py

@@ -79,7 +79,11 @@ def render_POST(self, request):
 
                 assocObj = threePidAssocFromDict(sgAssoc)
 
-                globalAssocsStore.addAssociation(assocObj, json.dumps(sgAssoc), peer.servername, originId, commit=False)
+                if assocObj.mxid is not None:
+                    globalAssocsStore.addAssociation(assocObj, json.dumps(sgAssoc), peer.servername, originId, commit=False)
+                else:
+                    logger.info("Incoming deletion: removing associations for %s / %s", assocObj.medium, assocObj.address)
+                    globalAssocsStore.removeAssociation(assocObj.medium, assocObj.address)
                 logger.info("Stored association origin ID %s from %s", originId, peer.servername)
             except:
                 failedIds.append(originId)

sydent/http/servlets/threepidunbindservlet.py

@@ -0,0 +1,83 @@
+# -*- coding: utf-8 -*-
+
+# Copyright 2014 OpenMarket Ltd
+# Copyright 2018 New Vector Ltd
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import json
+
+from twisted.web.resource import Resource
+from twisted.web import server
+from twisted.internet import defer
+
+from sydent.http.servlets import get_args, jsonwrap
+from sydent.hs_federation.verifier import NoAuthenticationError
+from signedjson.sign import SignatureVerifyException
+
+class ThreePidUnbindServlet(Resource):
+    def __init__(self, sydent):
+        self.sydent = sydent
+
+    def render_POST(self, request):
+        self._async_render_POST(request)
+        return server.NOT_DONE_YET
+
+    @defer.inlineCallbacks
+    def _async_render_POST(self, request):
+        try:
+            body = json.load(request.content)
+        except ValueError:
+            request.setResponseCode(400)
+            request.write(json.dumps({'errcode': 'M_BAD_JSON', 'error': 'Malformed JSON'}))
+            request.finish()
+            return
+
+        missing = [k for k in ("threepid", "mxid") if k not in body]
+        if len(missing) > 0:
+            request.setResponseCode(400)
+            msg = "Missing parameters: "+(",".join(missing))
+            request.write(json.dumps({'errcode': 'M_MISSING_PARAMS', 'error': msg}))
+            request.finish()
+            return
+
+        threepid = body['threepid']
+        mxid = body['mxid']
+
+        if 'medium' not in threepid or 'address' not in threepid:
+            request.setResponseCode(400)
+            request.write(json.dumps({'errcode': 'M_MISSING_PARAMS', 'error': 'Threepid lacks medium / address'}))
+            request.finish()
+            return
+
+        try:
+            origin_server_name = yield self.sydent.sig_verifier.authenticate_request(request, body)
+        except SignatureVerifyException as ex:
+            request.setResponseCode(401)
+            request.write(json.dumps({'errcode': 'M_FORBIDDEN', 'error': ex.message}))
+            request.finish()
+            return
+        except NoAuthenticationError as ex:
+            request.setResponseCode(401)
+            request.write(json.dumps({'errcode': 'M_FORBIDDEN', 'error': ex.message}))
+            request.finish()
+            return
+
+        if not mxid.endswith(':' + origin_server_name):
+            request.setResponseCode(403)
+            request.write(json.dumps({'errcode': 'M_FORBIDDEN', 'error': 'Origin server name does not match mxid'}))
+            request.finish()
+
+        res = self.sydent.threepidBinder.removeBinding(threepid, mxid)
+        request.write(json.dumps({}))
+        request.finish()