diff --git a/synapse/crypto/context_factory.py b/synapse/crypto/context_factory.py
index 2bc5cc3807..3a16f5ef58 100644
--- a/synapse/crypto/context_factory.py
+++ b/synapse/crypto/context_factory.py
@@ -26,6 +26,7 @@ from twisted.internet.abstract import isIPAddress, isIPv6Address
from twisted.internet.interfaces import IOpenSSLClientConnectionCreator
from twisted.internet.ssl import CertificateOptions, ContextFactory, platformTrust
from twisted.python.failure import Failure
+from twisted.web.iweb import IPolicyForHTTPS
logger = logging.getLogger(__name__)
@@ -59,6 +60,7 @@ class ServerContextFactory(ContextFactory):
return self._context
+@implementer(IPolicyForHTTPS)
class ClientTLSOptionsFactory(object):
"""Factory for Twisted SSLClientConnectionCreators that are used to make connections
to remote servers for federation.
@@ -119,6 +121,12 @@ class ClientTLSOptionsFactory(object):
f = Failure()
tls_protocol.failVerification(f)
+ def creatorForNetloc(self, hostname, port):
+ """Implements the IPolicyForHTTPS interace so that this can be passed
+ directly to agents.
+ """
+ return self.get_options(hostname)
+
@implementer(IOpenSSLClientConnectionCreator)
class SSLClientConnectionCreator(object):
diff --git a/synapse/http/federation/matrix_federation_agent.py b/synapse/http/federation/matrix_federation_agent.py
index b4cbe97b41..e0c075e382 100644
--- a/synapse/http/federation/matrix_federation_agent.py
+++ b/synapse/http/federation/matrix_federation_agent.py
@@ -64,10 +64,6 @@ class MatrixFederationAgent(object):
tls_client_options_factory (ClientTLSOptionsFactory|None):
factory to use for fetching client tls options, or none to disable TLS.
- _well_known_tls_policy (IPolicyForHTTPS|None):
- TLS policy to use for fetching .well-known files. None to use a default
- (browser-like) implementation.
-
_srv_resolver (SrvResolver|None):
SRVResolver impl to use for looking up SRV records. None to use a default
implementation.
@@ -96,13 +92,12 @@ class MatrixFederationAgent(object):
self._pool.maxPersistentPerHost = 5
self._pool.cachedConnectionTimeout = 2 * 60
- agent_args = {}
- if _well_known_tls_policy is not None:
- # the param is called 'contextFactory', but actually passing a
- # contextfactory is deprecated, and it expects an IPolicyForHTTPS.
- agent_args['contextFactory'] = _well_known_tls_policy
_well_known_agent = RedirectAgent(
- Agent(self._reactor, pool=self._pool, **agent_args),
+ Agent(
+ self._reactor,
+ pool=self._pool,
+ contextFactory=tls_client_options_factory,
+ )
)
self._well_known_agent = _well_known_agent
|
