2022-05-06 11:43:53 +01:00
|
|
|
#
|
2023-11-21 15:29:58 -05:00
|
|
|
# This file is licensed under the Affero General Public License (AGPL) version 3.
|
|
|
|
#
|
2024-01-23 11:26:48 +00:00
|
|
|
# Copyright 2022 The Matrix.org Foundation C.I.C.
|
2023-11-21 15:29:58 -05:00
|
|
|
# Copyright (C) 2023 New Vector, Ltd
|
|
|
|
#
|
|
|
|
# This program is free software: you can redistribute it and/or modify
|
|
|
|
# it under the terms of the GNU Affero General Public License as
|
|
|
|
# published by the Free Software Foundation, either version 3 of the
|
|
|
|
# License, or (at your option) any later version.
|
|
|
|
#
|
|
|
|
# See the GNU Affero General Public License for more details:
|
|
|
|
# <https://www.gnu.org/licenses/agpl-3.0.html>.
|
|
|
|
#
|
|
|
|
# Originally licensed under the Apache License, Version 2.0:
|
|
|
|
# <http://www.apache.org/licenses/LICENSE-2.0>.
|
|
|
|
#
|
|
|
|
# [This file includes modifications made by New Vector Limited]
|
2022-05-06 11:43:53 +01:00
|
|
|
#
|
|
|
|
#
|
|
|
|
from typing import Any, Mapping, Optional
|
|
|
|
from unittest.mock import Mock
|
|
|
|
|
2023-03-22 17:15:34 +00:00
|
|
|
from immutabledict import immutabledict
|
2022-05-06 11:43:53 +01:00
|
|
|
|
|
|
|
from synapse.config import ConfigError
|
2023-07-07 02:45:25 -05:00
|
|
|
from synapse.config.workers import WorkerConfig
|
2022-05-06 11:43:53 +01:00
|
|
|
|
|
|
|
from tests.unittest import TestCase
|
|
|
|
|
2023-03-22 17:15:34 +00:00
|
|
|
_EMPTY_IMMUTABLEDICT: Mapping[str, Any] = immutabledict()
|
2022-05-06 11:43:53 +01:00
|
|
|
|
|
|
|
|
|
|
|
class WorkerDutyConfigTestCase(TestCase):
|
|
|
|
def _make_worker_config(
|
|
|
|
self,
|
|
|
|
worker_app: str,
|
|
|
|
worker_name: Optional[str],
|
2023-03-22 17:15:34 +00:00
|
|
|
extras: Mapping[str, Any] = _EMPTY_IMMUTABLEDICT,
|
2022-05-06 11:43:53 +01:00
|
|
|
) -> WorkerConfig:
|
|
|
|
root_config = Mock()
|
|
|
|
root_config.worker_app = worker_app
|
|
|
|
root_config.worker_name = worker_name
|
|
|
|
worker_config = WorkerConfig(root_config)
|
|
|
|
worker_config_dict = {
|
|
|
|
"worker_name": worker_name,
|
|
|
|
"worker_app": worker_app,
|
|
|
|
**extras,
|
|
|
|
}
|
Add --no-secrets-in-config command line option (#18092)
Adds the `--no-secrets-in-config` command line option that makes Synapse
reject all configurations containing keys with in-line secret values.
Currently this rejects
- `turn_shared_secret`
- `registration_shared_secret`
- `macaroon_secret_key`
- `recaptcha_private_key`
- `recaptcha_public_key`
- `experimental_features.msc3861.client_secret`
- `experimental_features.msc3861.jwk`
- `experimental_features.msc3861.admin_token`
- `form_secret`
- `redis.password`
- `worker_replication_secret`
> [!TIP]
> Hey, you! Yes, you! 😊 If you think this list is missing an item,
please leave a comment below. Thanks :)
This PR complements my other PRs[^1] that add the corresponding `_path`
variants for this class of config options. It enables admins to enforce
a policy of no secrets in configuration files and guards against
accident and malice.
Because I consider the flag `--no-secrets-in-config` to be
security-relevant, I did not add a corresponding `--secrets-in-config`
flag; this way, if Synapse command line options are appended at various
places, there is no way to weaken the once-set setting with a succeeding
flag.
[^1]: [#17690](https://github.com/element-hq/synapse/pull/17690),
[#17717](https://github.com/element-hq/synapse/pull/17717),
[#17983](https://github.com/element-hq/synapse/pull/17983),
[#17984](https://github.com/element-hq/synapse/pull/17984),
[#18004](https://github.com/element-hq/synapse/pull/18004),
[#18090](https://github.com/element-hq/synapse/pull/18090)
### Pull Request Checklist
<!-- Please read
https://element-hq.github.io/synapse/latest/development/contributing_guide.html
before submitting your pull request -->
* [x] Pull request is based on the develop branch
* [x] Pull request includes a [changelog
file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog).
The entry should:
- Be a short description of your change which makes sense to users.
"Fixed a bug that prevented receiving messages from other servers."
instead of "Moved X method from `EventStore` to `EventWorkerStore`.".
- Use markdown where necessary, mostly for `code blocks`.
- End with either a period (.) or an exclamation mark (!).
- Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by
@github_username." or "Contributed by [Your Name]." to the end of the
entry.
* [x] [Code
style](https://element-hq.github.io/synapse/latest/code_style.html) is
correct
(run the
[linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))
2025-02-25 17:26:01 +01:00
|
|
|
worker_config.read_config(worker_config_dict, allow_secrets_in_config=True)
|
2022-05-06 11:43:53 +01:00
|
|
|
return worker_config
|
|
|
|
|
|
|
|
def test_old_configs_master(self) -> None:
|
|
|
|
"""
|
|
|
|
Tests old (legacy) config options. This is for the master's config.
|
|
|
|
"""
|
|
|
|
main_process_config = self._make_worker_config(
|
|
|
|
worker_app="synapse.app.homeserver", worker_name=None
|
|
|
|
)
|
|
|
|
|
|
|
|
self.assertTrue(
|
|
|
|
main_process_config._should_this_worker_perform_duty(
|
|
|
|
{},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
self.assertTrue(
|
|
|
|
main_process_config._should_this_worker_perform_duty(
|
|
|
|
{
|
|
|
|
"notify_appservices": True,
|
|
|
|
},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
self.assertFalse(
|
|
|
|
main_process_config._should_this_worker_perform_duty(
|
|
|
|
{
|
|
|
|
"notify_appservices": False,
|
|
|
|
},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
def test_old_configs_appservice_worker(self) -> None:
|
|
|
|
"""
|
|
|
|
Tests old (legacy) config options. This is for the worker's config.
|
|
|
|
"""
|
|
|
|
appservice_worker_config = self._make_worker_config(
|
|
|
|
worker_app="synapse.app.appservice",
|
|
|
|
worker_name="worker1",
|
|
|
|
extras={
|
|
|
|
# Set notify_appservices to false for the initialiser's config,
|
|
|
|
# so that it doesn't raise an exception here.
|
|
|
|
# (This is not read by `_should_this_worker_perform_duty`.)
|
|
|
|
"notify_appservices": False,
|
2023-05-26 14:28:55 +00:00
|
|
|
"instance_map": {"main": {"host": "127.0.0.1", "port": 0}},
|
2022-05-06 11:43:53 +01:00
|
|
|
},
|
|
|
|
)
|
|
|
|
|
|
|
|
with self.assertRaises(ConfigError):
|
|
|
|
# This raises because you need to set notify_appservices: False
|
|
|
|
# before using the synapse.app.appservice worker type
|
|
|
|
self.assertFalse(
|
|
|
|
appservice_worker_config._should_this_worker_perform_duty(
|
|
|
|
{},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
with self.assertRaises(ConfigError):
|
|
|
|
# This also raises because you need to set notify_appservices: False
|
|
|
|
# before using the synapse.app.appservice worker type
|
|
|
|
appservice_worker_config._should_this_worker_perform_duty(
|
|
|
|
{
|
|
|
|
"notify_appservices": True,
|
|
|
|
},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
|
|
|
|
self.assertTrue(
|
|
|
|
appservice_worker_config._should_this_worker_perform_duty(
|
|
|
|
{
|
|
|
|
"notify_appservices": False,
|
|
|
|
},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
def test_transitional_configs_master(self) -> None:
|
|
|
|
"""
|
|
|
|
Tests transitional (legacy + new) config options. This is for the master's config.
|
|
|
|
"""
|
|
|
|
|
|
|
|
main_process_config = self._make_worker_config(
|
2023-05-26 14:28:55 +00:00
|
|
|
worker_app="synapse.app.homeserver",
|
|
|
|
worker_name=None,
|
|
|
|
extras={"instance_map": {"main": {"host": "127.0.0.1", "port": 0}}},
|
2022-05-06 11:43:53 +01:00
|
|
|
)
|
|
|
|
|
|
|
|
self.assertTrue(
|
|
|
|
main_process_config._should_this_worker_perform_duty(
|
|
|
|
{
|
|
|
|
"notify_appservices": True,
|
|
|
|
"notify_appservices_from_worker": "master",
|
|
|
|
},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
self.assertFalse(
|
|
|
|
main_process_config._should_this_worker_perform_duty(
|
|
|
|
{
|
|
|
|
"notify_appservices": False,
|
|
|
|
"notify_appservices_from_worker": "worker1",
|
|
|
|
},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
with self.assertRaises(ConfigError):
|
|
|
|
# Contradictory because we say the master should notify appservices,
|
|
|
|
# then we say worker1 is the designated worker to do that!
|
|
|
|
main_process_config._should_this_worker_perform_duty(
|
|
|
|
{
|
|
|
|
"notify_appservices": True,
|
|
|
|
"notify_appservices_from_worker": "worker1",
|
|
|
|
},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
|
|
|
|
with self.assertRaises(ConfigError):
|
|
|
|
# Contradictory because we say the master shouldn't notify appservices,
|
|
|
|
# then we say master is the designated worker to do that!
|
|
|
|
main_process_config._should_this_worker_perform_duty(
|
|
|
|
{
|
|
|
|
"notify_appservices": False,
|
|
|
|
"notify_appservices_from_worker": "master",
|
|
|
|
},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
|
|
|
|
def test_transitional_configs_appservice_worker(self) -> None:
|
|
|
|
"""
|
|
|
|
Tests transitional (legacy + new) config options. This is for the worker's config.
|
|
|
|
"""
|
|
|
|
appservice_worker_config = self._make_worker_config(
|
|
|
|
worker_app="synapse.app.appservice",
|
|
|
|
worker_name="worker1",
|
|
|
|
extras={
|
|
|
|
# Set notify_appservices to false for the initialiser's config,
|
|
|
|
# so that it doesn't raise an exception here.
|
|
|
|
# (This is not read by `_should_this_worker_perform_duty`.)
|
|
|
|
"notify_appservices": False,
|
2023-05-26 14:28:55 +00:00
|
|
|
"instance_map": {"main": {"host": "127.0.0.1", "port": 0}},
|
2022-05-06 11:43:53 +01:00
|
|
|
},
|
|
|
|
)
|
|
|
|
|
|
|
|
self.assertTrue(
|
|
|
|
appservice_worker_config._should_this_worker_perform_duty(
|
|
|
|
{
|
|
|
|
"notify_appservices": False,
|
|
|
|
"notify_appservices_from_worker": "worker1",
|
|
|
|
},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
with self.assertRaises(ConfigError):
|
|
|
|
# This raises because this worker is the appservice app type, yet
|
|
|
|
# another worker is the designated worker!
|
|
|
|
appservice_worker_config._should_this_worker_perform_duty(
|
|
|
|
{
|
|
|
|
"notify_appservices": False,
|
|
|
|
"notify_appservices_from_worker": "worker2",
|
|
|
|
},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
|
|
|
|
def test_new_configs_master(self) -> None:
|
|
|
|
"""
|
|
|
|
Tests new config options. This is for the master's config.
|
|
|
|
"""
|
|
|
|
main_process_config = self._make_worker_config(
|
2023-05-26 14:28:55 +00:00
|
|
|
worker_app="synapse.app.homeserver",
|
|
|
|
worker_name=None,
|
|
|
|
extras={"instance_map": {"main": {"host": "127.0.0.1", "port": 0}}},
|
2022-05-06 11:43:53 +01:00
|
|
|
)
|
|
|
|
|
|
|
|
self.assertTrue(
|
|
|
|
main_process_config._should_this_worker_perform_duty(
|
|
|
|
{"notify_appservices_from_worker": None},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
self.assertFalse(
|
|
|
|
main_process_config._should_this_worker_perform_duty(
|
|
|
|
{"notify_appservices_from_worker": "worker1"},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
def test_new_configs_appservice_worker(self) -> None:
|
|
|
|
"""
|
|
|
|
Tests new config options. This is for the worker's config.
|
|
|
|
"""
|
|
|
|
appservice_worker_config = self._make_worker_config(
|
2023-05-26 14:28:55 +00:00
|
|
|
worker_app="synapse.app.generic_worker",
|
|
|
|
worker_name="worker1",
|
|
|
|
extras={"instance_map": {"main": {"host": "127.0.0.1", "port": 0}}},
|
2022-05-06 11:43:53 +01:00
|
|
|
)
|
|
|
|
|
|
|
|
self.assertTrue(
|
|
|
|
appservice_worker_config._should_this_worker_perform_duty(
|
|
|
|
{
|
|
|
|
"notify_appservices_from_worker": "worker1",
|
|
|
|
},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
self.assertFalse(
|
|
|
|
appservice_worker_config._should_this_worker_perform_duty(
|
|
|
|
{
|
|
|
|
"notify_appservices_from_worker": "worker2",
|
|
|
|
},
|
|
|
|
"notify_appservices",
|
|
|
|
"synapse.app.appservice",
|
|
|
|
"notify_appservices_from_worker",
|
|
|
|
)
|
|
|
|
)
|
2022-05-10 11:08:45 +01:00
|
|
|
|
|
|
|
def test_worker_duty_configs(self) -> None:
|
|
|
|
"""
|
|
|
|
Additional tests for the worker duties
|
|
|
|
"""
|
|
|
|
|
|
|
|
worker1_config = self._make_worker_config(
|
|
|
|
worker_app="synapse.app.generic_worker",
|
|
|
|
worker_name="worker1",
|
|
|
|
extras={
|
|
|
|
"notify_appservices_from_worker": "worker2",
|
|
|
|
"update_user_directory_from_worker": "worker1",
|
2023-05-26 14:28:55 +00:00
|
|
|
"instance_map": {"main": {"host": "127.0.0.1", "port": 0}},
|
2022-05-10 11:08:45 +01:00
|
|
|
},
|
|
|
|
)
|
|
|
|
self.assertFalse(worker1_config.should_notify_appservices)
|
|
|
|
self.assertTrue(worker1_config.should_update_user_directory)
|
|
|
|
|
|
|
|
worker2_config = self._make_worker_config(
|
|
|
|
worker_app="synapse.app.generic_worker",
|
|
|
|
worker_name="worker2",
|
|
|
|
extras={
|
|
|
|
"notify_appservices_from_worker": "worker2",
|
|
|
|
"update_user_directory_from_worker": "worker1",
|
2023-05-26 14:28:55 +00:00
|
|
|
"instance_map": {"main": {"host": "127.0.0.1", "port": 0}},
|
2022-05-10 11:08:45 +01:00
|
|
|
},
|
|
|
|
)
|
|
|
|
self.assertTrue(worker2_config.should_notify_appservices)
|
|
|
|
self.assertFalse(worker2_config.should_update_user_directory)
|