Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Rename blacklist/whitelist internally #15620

Merged
merged 9 commits into from
May 19, 2023
Prev Previous commit
Next Next commit
Update more bits of tests & fix tests.
  • Loading branch information
clokep committed May 18, 2023
commit 9b03478bd337587b453daf4613e9da68b55bb832
2 changes: 1 addition & 1 deletion synapse/handlers/federation.py
Original file line number Diff line number Diff line change
Expand Up @@ -148,7 +148,7 @@ def __init__(self, hs: "HomeServer"):
self._event_auth_handler = hs.get_event_auth_handler()
self._server_notices_mxid = hs.config.servernotices.server_notices_mxid
self.config = hs.config
self.http_client = hs.get_proxied_blocklisting_http_client()
self.http_client = hs.get_proxied_blocklisted_http_client()
self._replication = hs.get_replication_data_handler()
self._federation_event_handler = hs.get_federation_event_handler()
self._device_handler = hs.get_device_handler()
Expand Down
2 changes: 1 addition & 1 deletion synapse/handlers/sso.py
Original file line number Diff line number Diff line change
Expand Up @@ -204,7 +204,7 @@ def __init__(self, hs: "HomeServer"):
self._media_repo = (
hs.get_media_repository() if hs.config.media.can_load_media_repo else None
)
self._http_client = hs.get_proxied_blocklisting_http_client()
self._http_client = hs.get_proxied_blocklisted_http_client()

# The following template is shown after a successful user interactive
# authentication session. It tells the user they can close the window.
Expand Down
2 changes: 1 addition & 1 deletion synapse/push/httppusher.py
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ def __init__(self, hs: "HomeServer", pusher_config: PusherConfig):
)

self.url = url
self.http_client = hs.get_proxied_blocklisting_http_client()
self.http_client = hs.get_proxied_blocklisted_http_client()
self.data_minus_url = {}
self.data_minus_url.update(self.data)
del self.data_minus_url["url"]
Expand Down
2 changes: 1 addition & 1 deletion synapse/server.py
Original file line number Diff line number Diff line change
Expand Up @@ -453,7 +453,7 @@ def get_proxied_http_client(self) -> SimpleHttpClient:
return SimpleHttpClient(self, use_proxy=True)

@cache_in_self
def get_proxied_blocklisting_http_client(self) -> SimpleHttpClient:
def get_proxied_blocklisted_http_client(self) -> SimpleHttpClient:
"""
An HTTP client that uses configured HTTP(S) proxies and blocks IPs
based on the configured IP ranges.
Expand Down
2 changes: 1 addition & 1 deletion tests/federation/test_federation_server.py
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ def test_bad_request(self, query_content: bytes) -> None:


class ServerACLsTestCase(unittest.TestCase):
def test_blacklisted_server(self) -> None:
def test_blocked_server(self) -> None:
e = _create_acl_event({"allow": ["*"], "deny": ["evil.com"]})
logging.info("ACL event: %s", e.content)

Expand Down
2 changes: 1 addition & 1 deletion tests/handlers/test_sso.py
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ def make_homeserver(self, reactor: MemoryReactor, clock: Clock) -> HomeServer:
self.http_client.get_file.side_effect = mock_get_file
self.http_client.user_agent = b"Synapse Test"
hs = self.setup_test_homeserver(
proxied_blacklisted_http_client=self.http_client
proxied_blocklisted_http_client=self.http_client
)
return hs

Expand Down
14 changes: 7 additions & 7 deletions tests/http/test_matrixfederationclient.py
Original file line number Diff line number Diff line change
Expand Up @@ -231,10 +231,10 @@ def test_client_connect_no_response(self) -> None:
self.assertIsInstance(f.value, RequestSendFailed)
self.assertIsInstance(f.value.inner_exception, ResponseNeverReceived)

def test_client_ip_range_blacklist(self) -> None:
"""Ensure that Synapse does not try to connect to blacklisted IPs"""
def test_client_ip_range_blocklist(self) -> None:
"""Ensure that Synapse does not try to connect to blocked IPs"""

# Set up the ip_range blacklist
# Set up the ip_range blocklist
self.hs.config.server.federation_ip_range_blocklist = IPSet(
["127.0.0.0/8", "fe80::/64"]
)
Expand All @@ -243,7 +243,7 @@ def test_client_ip_range_blacklist(self) -> None:
self.reactor.lookups["fine"] = "10.20.30.40"
cl = MatrixFederationHttpClient(self.hs, None)

# Try making a GET request to a blacklisted IPv4 address
# Try making a GET request to a blocked IPv4 address
# ------------------------------------------------------
# Make the request
d = defer.ensureDeferred(cl.get_json("internal:8008", "foo/bar", timeout=10000))
Expand All @@ -261,7 +261,7 @@ def test_client_ip_range_blacklist(self) -> None:
self.assertIsInstance(f.value, RequestSendFailed)
self.assertIsInstance(f.value.inner_exception, DNSLookupError)

# Try making a POST request to a blacklisted IPv6 address
# Try making a POST request to a blocked IPv6 address
# -------------------------------------------------------
# Make the request
d = defer.ensureDeferred(
Expand All @@ -278,11 +278,11 @@ def test_client_ip_range_blacklist(self) -> None:
clients = self.reactor.tcpClients
self.assertEqual(len(clients), 0)

# Check that it was due to a blacklisted DNS lookup
# Check that it was due to a blocked DNS lookup
f = self.failureResultOf(d, RequestSendFailed)
self.assertIsInstance(f.value.inner_exception, DNSLookupError)

# Try making a GET request to a non-blacklisted IPv4 address
# Try making a GET request to an allowed IPv4 address
# ----------------------------------------------------------
# Make the request
d = defer.ensureDeferred(cl.post_json("fine:8008", "foo/bar", timeout=10000))
Expand Down
2 changes: 1 addition & 1 deletion tests/push/test_http.py
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ def post_json_get_json(url: str, body: JsonDict) -> Deferred:

m.post_json_get_json = post_json_get_json

hs = self.setup_test_homeserver(proxied_blacklisted_http_client=m)
hs = self.setup_test_homeserver(proxied_blocklisted_http_client=m)

return hs

Expand Down
6 changes: 3 additions & 3 deletions tests/replication/test_pusher_shard.py
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ def test_send_push_single_worker(self) -> None:
self.make_worker_hs(
"synapse.app.generic_worker",
{"worker_name": "pusher1", "pusher_instances": ["pusher1"]},
proxied_blacklisted_http_client=http_client_mock,
proxied_blocklisted_http_client=http_client_mock,
)

event_id = self._create_pusher_and_send_msg("user")
Expand Down Expand Up @@ -126,7 +126,7 @@ def test_send_push_multiple_workers(self) -> None:
"worker_name": "pusher1",
"pusher_instances": ["pusher1", "pusher2"],
},
proxied_blacklisted_http_client=http_client_mock1,
proxied_blocklisted_http_client=http_client_mock1,
)

http_client_mock2 = Mock(spec_set=["post_json_get_json"])
Expand All @@ -140,7 +140,7 @@ def test_send_push_multiple_workers(self) -> None:
"worker_name": "pusher2",
"pusher_instances": ["pusher1", "pusher2"],
},
proxied_blacklisted_http_client=http_client_mock2,
proxied_blocklisted_http_client=http_client_mock2,
)

# We choose a user name that we know should go to pusher1.
Expand Down
48 changes: 21 additions & 27 deletions tests/rest/media/test_url_preview.py
Original file line number Diff line number Diff line change
Expand Up @@ -418,9 +418,9 @@ def test_ipaddr(self) -> None:
channel.json_body, {"og:title": "~matrix~", "og:description": "hi"}
)

def test_blacklisted_ip_specific(self) -> None:
def test_blocked_ip_specific(self) -> None:
"""
Blacklisted IP addresses, found via DNS, are not spidered.
Blocked IP addresses, found via DNS, are not spidered.
"""
self.lookups["example.com"] = [(IPv4Address, "192.168.1.1")]

Expand All @@ -439,9 +439,9 @@ def test_blacklisted_ip_specific(self) -> None:
},
)

def test_blacklisted_ip_range(self) -> None:
def test_blocked_ip_range(self) -> None:
"""
Blacklisted IP ranges, IPs found over DNS, are not spidered.
Blocked IP ranges, IPs found over DNS, are not spidered.
"""
self.lookups["example.com"] = [(IPv4Address, "1.1.1.2")]

Expand All @@ -458,9 +458,9 @@ def test_blacklisted_ip_range(self) -> None:
},
)

def test_blacklisted_ip_specific_direct(self) -> None:
def test_blocked_ip_specific_direct(self) -> None:
"""
Blacklisted IP addresses, accessed directly, are not spidered.
Blocked IP addresses, accessed directly, are not spidered.
"""
channel = self.make_request(
"GET", "preview_url?url=http://192.168.1.1", shorthand=False
Expand All @@ -470,16 +470,13 @@ def test_blacklisted_ip_specific_direct(self) -> None:
self.assertEqual(len(self.reactor.tcpClients), 0)
self.assertEqual(
channel.json_body,
{
"errcode": "M_UNKNOWN",
"error": "IP address blocked by IP blacklist entry",
},
{"errcode": "M_UNKNOWN", "error": "IP address blocked"},
)
self.assertEqual(channel.code, 403)

def test_blacklisted_ip_range_direct(self) -> None:
def test_blocked_ip_range_direct(self) -> None:
"""
Blacklisted IP ranges, accessed directly, are not spidered.
Blocked IP ranges, accessed directly, are not spidered.
"""
channel = self.make_request(
"GET", "preview_url?url=http://1.1.1.2", shorthand=False
Expand All @@ -488,15 +485,12 @@ def test_blacklisted_ip_range_direct(self) -> None:
self.assertEqual(channel.code, 403)
self.assertEqual(
channel.json_body,
{
"errcode": "M_UNKNOWN",
"error": "IP address blocked by IP blacklist entry",
},
{"errcode": "M_UNKNOWN", "error": "IP address blocked"},
)

def test_blacklisted_ip_range_whitelisted_ip(self) -> None:
def test_blocked_ip_range_whitelisted_ip(self) -> None:
"""
Blacklisted but then subsequently whitelisted IP addresses can be
Blocked but then subsequently whitelisted IP addresses can be
spidered.
"""
self.lookups["example.com"] = [(IPv4Address, "1.1.1.1")]
Expand Down Expand Up @@ -527,10 +521,10 @@ def test_blacklisted_ip_range_whitelisted_ip(self) -> None:
channel.json_body, {"og:title": "~matrix~", "og:description": "hi"}
)

def test_blacklisted_ip_with_external_ip(self) -> None:
def test_blocked_ip_with_external_ip(self) -> None:
"""
If a hostname resolves a blacklisted IP, even if there's a
non-blacklisted one, it will be rejected.
If a hostname resolves a blocked IP, even if there's a non-blocked one,
it will be rejected.
"""
# Hardcode the URL resolving to the IP we want.
self.lookups["example.com"] = [
Expand All @@ -550,9 +544,9 @@ def test_blacklisted_ip_with_external_ip(self) -> None:
},
)

def test_blacklisted_ipv6_specific(self) -> None:
def test_blocked_ipv6_specific(self) -> None:
"""
Blacklisted IP addresses, found via DNS, are not spidered.
Blocked IP addresses, found via DNS, are not spidered.
"""
self.lookups["example.com"] = [
(IPv6Address, "3fff:ffff:ffff:ffff:ffff:ffff:ffff:ffff")
Expand All @@ -573,9 +567,9 @@ def test_blacklisted_ipv6_specific(self) -> None:
},
)

def test_blacklisted_ipv6_range(self) -> None:
def test_blocked_ipv6_range(self) -> None:
"""
Blacklisted IP ranges, IPs found over DNS, are not spidered.
Blocked IP ranges, IPs found over DNS, are not spidered.
"""
self.lookups["example.com"] = [(IPv6Address, "2001:800::1")]

Expand Down Expand Up @@ -1359,7 +1353,7 @@ def test_cache_expiry(self) -> None:

@unittest.override_config({"url_preview_url_blacklist": [{"port": "*"}]})
def test_blocked_port(self) -> None:
"""Tests that blacklisting URLs with a port makes previewing such URLs
"""Tests that blocking URLs with a port makes previewing such URLs
fail with a 403 error and doesn't impact other previews.
"""
self.lookups["matrix.org"] = [(IPv4Address, "10.1.2.3")]
Expand Down Expand Up @@ -1401,7 +1395,7 @@ def test_blocked_port(self) -> None:
{"url_preview_url_blacklist": [{"netloc": "example.com"}]}
)
def test_blocked_url(self) -> None:
"""Tests that blacklisting URLs with a host makes previewing such URLs
"""Tests that blocking URLs with a host makes previewing such URLs
fail with a 403 error.
"""
self.lookups["example.com"] = [(IPv4Address, "10.1.2.3")]
Expand Down