tuwunel_api/server/
send_knock.rs

1use axum::extract::State;
2use futures::{FutureExt, future::try_join};
3use ruma::{
4	OwnedServerName, OwnedUserId,
5	api::federation::membership::{RawStrippedState, create_knock_event},
6	events::{
7		StateEventType,
8		room::member::{MembershipState, RoomMemberEventContent},
9	},
10	serde::JsonObject,
11};
12use tuwunel_core::{
13	Err, Result, at, err,
14	matrix::{event::gen_event_id_canonical_json, pdu::PduEvent, room_version},
15	warn,
16};
17
18use super::utils::require_known_room;
19use crate::Ruma;
20
21/// # `PUT /_matrix/federation/v1/send_knock/{roomId}/{eventId}`
22///
23/// Submits a signed knock event.
24pub(crate) async fn create_knock_event_v1_route(
25	State(services): State<crate::State>,
26	body: Ruma<create_knock_event::v1::Request>,
27) -> Result<create_knock_event::v1::Response> {
28	if let Some(server) = body.room_id.server_name()
29		&& services
30			.config
31			.is_forbidden_remote_server_name(server)
32	{
33		warn!(
34			"Server {} tried knocking room ID {} which has a server name that is globally \
35			 forbidden. Rejecting.",
36			body.origin(),
37			&body.room_id,
38		);
39		return Err!(Request(Forbidden("Server is banned on this homeserver.")));
40	}
41
42	services
43		.sending
44		.notify_peer_alive(body.origin())
45		.await;
46
47	require_known_room(&services, &body.room_id, body.origin()).await?;
48
49	let room_version_id = services
50		.state
51		.get_room_version(&body.room_id)
52		.await?;
53
54	let room_version_rules = room_version::rules(&room_version_id)?;
55
56	if !room_version_rules.authorization.knocking {
57		return Err!(Request(Forbidden("Room version does not support knocking.")));
58	}
59
60	let Ok((event_id, value)) = gen_event_id_canonical_json(&body.pdu, &room_version_id) else {
61		// Event could not be converted to canonical json
62		return Err!(Request(InvalidParam("Could not convert event to canonical json.")));
63	};
64
65	let event_type: StateEventType = serde_json::from_value(
66		value
67			.get("type")
68			.ok_or_else(|| err!(Request(InvalidParam("Event has no event type."))))?
69			.clone()
70			.into(),
71	)
72	.map_err(|e| err!(Request(InvalidParam("Event has invalid event type: {e}"))))?;
73
74	if event_type != StateEventType::RoomMember {
75		return Err!(Request(InvalidParam(
76			"Not allowed to send non-membership state event to knock endpoint.",
77		)));
78	}
79
80	let content: RoomMemberEventContent = serde_json::from_value(
81		value
82			.get("content")
83			.ok_or_else(|| err!(Request(InvalidParam("Membership event has no content"))))?
84			.clone()
85			.into(),
86	)
87	.map_err(|e| err!(Request(InvalidParam("Event has invalid membership content: {e}"))))?;
88
89	if content.membership != MembershipState::Knock {
90		return Err!(Request(InvalidParam(
91			"Not allowed to send a non-knock membership event to knock endpoint."
92		)));
93	}
94
95	// ACL check sender server name
96	let sender: OwnedUserId = serde_json::from_value(
97		value
98			.get("sender")
99			.ok_or_else(|| err!(Request(InvalidParam("Event has no sender user ID."))))?
100			.clone()
101			.into(),
102	)
103	.map_err(|e| err!(Request(BadJson("Event sender is not a valid user ID: {e}"))))?;
104
105	services
106		.event_handler
107		.acl_check(sender.server_name(), &body.room_id)
108		.await?;
109
110	// check if origin server is trying to send for another server
111	if sender.server_name() != body.origin() {
112		return Err!(Request(BadJson("Not allowed to knock on behalf of another server/user.")));
113	}
114
115	let state_key: OwnedUserId = serde_json::from_value(
116		value
117			.get("state_key")
118			.ok_or_else(|| err!(Request(InvalidParam("Event does not have a state_key"))))?
119			.clone()
120			.into(),
121	)
122	.map_err(|e| err!(Request(BadJson("Event does not have a valid state_key: {e}"))))?;
123
124	if state_key != sender {
125		return Err!(Request(InvalidParam("state_key does not match sender user of event.")));
126	}
127
128	let origin: OwnedServerName = serde_json::from_value(
129		value
130			.get("origin")
131			.ok_or_else(|| err!(Request(BadJson("Event does not have an origin server name."))))?
132			.clone()
133			.into(),
134	)
135	.map_err(|e| err!(Request(BadJson("Event has an invalid origin server name: {e}"))))?;
136
137	let mut event: JsonObject = serde_json::from_str(body.pdu.get())
138		.map_err(|e| err!(Request(InvalidParam("Invalid knock event PDU: {e}"))))?;
139
140	event.insert("event_id".to_owned(), "$placeholder".into());
141
142	let pdu: PduEvent = serde_json::from_value(event.into())
143		.map_err(|e| err!(Request(InvalidParam("Invalid knock event PDU: {e}"))))?;
144
145	let mutex_lock = services
146		.event_handler
147		.mutex_federation
148		.lock(&body.room_id)
149		.await;
150
151	let pdu_id = services
152		.event_handler
153		.handle_incoming_pdu(&origin, &body.room_id, &event_id, value.clone(), true)
154		.await?
155		.map(at!(0))
156		.ok_or_else(|| err!(Request(InvalidParam("Could not accept as timeline event."))))?;
157
158	drop(mutex_lock);
159
160	let broadcast = services
161		.sending
162		.send_pdu_room(&body.room_id, &pdu_id);
163
164	let knock_room_state = services
165		.state
166		.summary_pdus(&pdu, &value, &room_version_id)
167		.map(Ok);
168
169	let (knock_room_state, ()) = try_join(knock_room_state, broadcast).await?;
170
171	Ok(create_knock_event::v1::Response {
172		knock_room_state: knock_room_state
173			.into_iter()
174			.map(RawStrippedState::Pdu)
175			.collect(),
176	})
177}
tuwunel_api/server/send_knock.rs

tuwunel_api/server/
send_knock.rs
