tuwunel_api_federation/
send_knock.rs

1use axum::extract::State;
2use futures::{FutureExt, future::try_join};
3use ruma::{
4	OwnedServerName, OwnedUserId,
5	api::federation::membership::{RawStrippedState, create_knock_event},
6	events::{
7		StateEventType,
8		room::member::{MembershipState, RoomMemberEventContent},
9	},
10	serde::JsonObject,
11};
12use tuwunel_core::{Err, Result, at, err, warn};
13use tuwunel_matrix::{event::gen_event_id_canonical_json, pdu::PduEvent, room_version};
14
15use super::utils::require_known_room;
16use crate::Ruma;
17
18/// # `PUT /_matrix/federation/v1/send_knock/{roomId}/{eventId}`
19///
20/// Submits a signed knock event.
21pub(crate) async fn create_knock_event_v1_route(
22	State(services): State<crate::State>,
23	body: Ruma<create_knock_event::v1::Request>,
24) -> Result<create_knock_event::v1::Response> {
25	if let Some(server) = body.room_id.server_name()
26		&& services
27			.config
28			.is_forbidden_remote_server_name(server)
29	{
30		warn!(
31			"Server {} tried knocking room ID {} which has a server name that is globally \
32			 forbidden. Rejecting.",
33			body.origin(),
34			&body.room_id,
35		);
36		return Err!(Request(Forbidden("Server is banned on this homeserver.")));
37	}
38
39	services
40		.sending
41		.notify_peer_alive(body.origin())
42		.await;
43
44	require_known_room(&services, &body.room_id, body.origin()).await?;
45
46	let room_version_id = services
47		.state
48		.get_room_version(&body.room_id)
49		.await?;
50
51	let room_version_rules = room_version::rules(&room_version_id)?;
52
53	if !room_version_rules.authorization.knocking {
54		return Err!(Request(Forbidden("Room version does not support knocking.")));
55	}
56
57	let Ok((event_id, value)) = gen_event_id_canonical_json(&body.pdu, &room_version_id) else {
58		// Event could not be converted to canonical json
59		return Err!(Request(InvalidParam("Could not convert event to canonical json.")));
60	};
61
62	let event_type: StateEventType = serde_json::from_value(
63		value
64			.get("type")
65			.ok_or_else(|| err!(Request(InvalidParam("Event has no event type."))))?
66			.clone()
67			.into(),
68	)
69	.map_err(|e| err!(Request(InvalidParam("Event has invalid event type: {e}"))))?;
70
71	if event_type != StateEventType::RoomMember {
72		return Err!(Request(InvalidParam(
73			"Not allowed to send non-membership state event to knock endpoint.",
74		)));
75	}
76
77	let content: RoomMemberEventContent = serde_json::from_value(
78		value
79			.get("content")
80			.ok_or_else(|| err!(Request(InvalidParam("Membership event has no content"))))?
81			.clone()
82			.into(),
83	)
84	.map_err(|e| err!(Request(InvalidParam("Event has invalid membership content: {e}"))))?;
85
86	if content.membership != MembershipState::Knock {
87		return Err!(Request(InvalidParam(
88			"Not allowed to send a non-knock membership event to knock endpoint."
89		)));
90	}
91
92	// ACL check sender server name
93	let sender: OwnedUserId = serde_json::from_value(
94		value
95			.get("sender")
96			.ok_or_else(|| err!(Request(InvalidParam("Event has no sender user ID."))))?
97			.clone()
98			.into(),
99	)
100	.map_err(|e| err!(Request(BadJson("Event sender is not a valid user ID: {e}"))))?;
101
102	services
103		.event_handler
104		.acl_check(sender.server_name(), &body.room_id)
105		.await?;
106
107	// check if origin server is trying to send for another server
108	if sender.server_name() != body.origin() {
109		return Err!(Request(BadJson("Not allowed to knock on behalf of another server/user.")));
110	}
111
112	let state_key: OwnedUserId = serde_json::from_value(
113		value
114			.get("state_key")
115			.ok_or_else(|| err!(Request(InvalidParam("Event does not have a state_key"))))?
116			.clone()
117			.into(),
118	)
119	.map_err(|e| err!(Request(BadJson("Event does not have a valid state_key: {e}"))))?;
120
121	if state_key != sender {
122		return Err!(Request(InvalidParam("state_key does not match sender user of event.")));
123	}
124
125	let origin: OwnedServerName = serde_json::from_value(
126		value
127			.get("origin")
128			.ok_or_else(|| err!(Request(BadJson("Event does not have an origin server name."))))?
129			.clone()
130			.into(),
131	)
132	.map_err(|e| err!(Request(BadJson("Event has an invalid origin server name: {e}"))))?;
133
134	let mut event: JsonObject = serde_json::from_str(body.pdu.get())
135		.map_err(|e| err!(Request(InvalidParam("Invalid knock event PDU: {e}"))))?;
136
137	event.insert("event_id".to_owned(), "$placeholder".into());
138
139	let pdu: PduEvent = serde_json::from_value(event.into())
140		.map_err(|e| err!(Request(InvalidParam("Invalid knock event PDU: {e}"))))?;
141
142	let mutex_lock = services
143		.event_handler
144		.mutex_federation
145		.lock(&body.room_id)
146		.await;
147
148	let pdu_id = services
149		.event_handler
150		.handle_incoming_pdu(&origin, &body.room_id, &event_id, value.clone(), true)
151		.await?
152		.map(at!(0))
153		.ok_or_else(|| err!(Request(Forbidden("Could not accept as timeline event."))))?;
154
155	drop(mutex_lock);
156
157	let broadcast = services
158		.sending
159		.send_pdu_room(&body.room_id, &pdu_id);
160
161	let knock_room_state = services
162		.state
163		.summary_pdus(&pdu, &value, &room_version_id)
164		.map(Ok);
165
166	let (knock_room_state, ()) = try_join(knock_room_state, broadcast).await?;
167
168	Ok(create_knock_event::v1::Response {
169		knock_room_state: knock_room_state
170			.into_iter()
171			.map(RawStrippedState::Pdu)
172			.collect(),
173	})
174}
tuwunel_api_federation/send_knock.rs

tuwunel_api_federation/
send_knock.rs
