summary refs log tree commit diff
path: root/synapse/crypto/event_signing.py
diff options
context:
space:
mode:
authorMark Haines <mark.haines@matrix.org>2014-11-14 16:45:39 +0000
committerMark Haines <mark.haines@matrix.org>2014-11-14 19:11:04 +0000
commitde1ec90133031cf6a043c47adae515ae1690c6d8 (patch)
treeb334a5dcb60556d68a136bc6d1a3b672b35e322c /synapse/crypto/event_signing.py
parentAdd event-stream-service unit tests. (diff)
downloadsynapse-de1ec90133031cf6a043c47adae515ae1690c6d8.tar.xz
Validate signatures on incoming events
Diffstat (limited to 'synapse/crypto/event_signing.py')
-rw-r--r--synapse/crypto/event_signing.py18
1 files changed, 14 insertions, 4 deletions
diff --git a/synapse/crypto/event_signing.py b/synapse/crypto/event_signing.py
index baa93b0ee4..c7e6bec8f5 100644
--- a/synapse/crypto/event_signing.py
+++ b/synapse/crypto/event_signing.py
@@ -19,6 +19,7 @@ from synapse.api.events.utils import prune_event
 from syutil.jsonutil import encode_canonical_json
 from syutil.base64util import encode_base64, decode_base64
 from syutil.crypto.jsonsign import sign_json
+from synapse.api.errors import SynapseError, Codes
 
 import hashlib
 import logging
@@ -29,15 +30,24 @@ logger = logging.getLogger(__name__)
 def check_event_content_hash(event, hash_algorithm=hashlib.sha256):
     """Check whether the hash for this PDU matches the contents"""
     computed_hash = _compute_content_hash(event, hash_algorithm)
+    logging.debug("Expecting hash: %s", encode_base64(computed_hash.digest()))
     if computed_hash.name not in event.hashes:
-        raise Exception("Algorithm %s not in hashes %s" % (
-            computed_hash.name, list(event.hashes)
-        ))
+        raise SynapseError(
+            400,
+            "Algorithm %s not in hashes %s" % (
+                computed_hash.name, list(event.hashes),
+            ),
+            Codes.UNAUTHORIZED,
+        )
     message_hash_base64 = event.hashes[computed_hash.name]
     try:
         message_hash_bytes = decode_base64(message_hash_base64)
     except:
-        raise Exception("Invalid base64: %s" % (message_hash_base64,))
+        raise SynapseError(
+            400,
+            "Invalid base64: %s" % (message_hash_base64,),
+            Codes.UNAUTHORIZED,
+        )
     return message_hash_bytes == computed_hash.digest()