From 2221a13a4da2a417a8b8dcc09350f884cdb10197 Mon Sep 17 00:00:00 2001
From: Mark Haines <mark.haines@matrix.org>
Date: Mon, 3 Nov 2014 15:58:00 +0000
Subject: [PATCH 1/3] script for checking signatures on signed json

---
 scripts/check_signature.py | 70 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 scripts/check_signature.py

diff --git a/scripts/check_signature.py b/scripts/check_signature.py
new file mode 100644
index 0000000000..6309c32cc1
--- /dev/null
+++ b/scripts/check_signature.py
@@ -0,0 +1,70 @@
+
+from synapse.crypto.event_signing import verify_signed_event_pdu
+from syutil.crypto.jsonsign import verify_signed_json
+from syutil.crypto.signing_key import (
+    decode_verify_key_bytes, write_signing_keys
+)
+from syutil.base64util import decode_base64
+
+import urllib2
+import json
+import sys
+import dns.resolver
+import pprint
+import argparse
+import logging
+
+def get_targets(server_name):
+    try:
+        answers = dns.resolver.query("_matrix._tcp." + server_name, "SRV")
+        for srv in answers:
+            yield (srv.target, srv.port)
+    except dns.resolver.NXDOMAIN:
+        yield (server_name, 8480)
+
+def get_server_keys(server_name, target, port):
+    url = "https://%s:%i/_matrix/key/v1" % (target, port)
+    keys = json.load(urllib2.urlopen(url))
+    verify_keys = {}
+    for key_id, key_base64 in keys["verify_keys"].items():
+        verify_key = decode_verify_key_bytes(key_id, decode_base64(key_base64))
+        verify_signed_json(keys, server_name, verify_key)
+        verify_keys[key_id] = verify_key
+    return verify_keys
+
+def main():
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument("signature_name")
+    parser.add_argument("input_json", nargs="?", type=argparse.FileType('r'),
+                        default=sys.stdin)
+
+    args = parser.parse_args()
+    logging.basicConfig()
+
+    server_name = args.signature_name
+    keys = {}
+    for target, port in get_targets(server_name):
+        try:
+            keys = get_server_keys(server_name, target, port)
+            print "Using keys from https://%s:%s/_matrix/key/v1" % (target, port)
+            write_signing_keys(sys.stdout, keys.values())
+            break
+        except:
+            logging.exception("Error talking to %s:%s", target, port)
+
+    json_to_check = json.load(args.input_json)
+    print "Checking JSON:"
+    for key_id in json_to_check["signatures"][args.signature_name]:
+        try:
+            key = keys[key_id]
+            verify_signed_json(json_to_check, args.signature_name, key)
+            print "PASS %s" % (key_id,)
+        except:
+            logging.exception("Check for key %s failed" % (key_id,))
+            print "FAIL %s" % (key_id,)
+
+
+if __name__ == '__main__':
+    main()
+

From fe6832fae85d56b0b4cdc906a73a2c64a26de15d Mon Sep 17 00:00:00 2001
From: Mark Haines <mark.haines@matrix.org>
Date: Mon, 3 Nov 2014 16:08:22 +0000
Subject: [PATCH 2/3] handle server names with embeded ports

---
 scripts/check_signature.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/check_signature.py b/scripts/check_signature.py
index 6309c32cc1..e7964e7e71 100644
--- a/scripts/check_signature.py
+++ b/scripts/check_signature.py
@@ -15,6 +15,10 @@ import argparse
 import logging
 
 def get_targets(server_name):
+    if ":" in server_name:
+        target, port = server_name.split(":")
+        yield (target, int(port))
+        return
     try:
         answers = dns.resolver.query("_matrix._tcp." + server_name, "SRV")
         for srv in answers:

From af83bf6712629bd9121d1b28b18dda936f0c28f2 Mon Sep 17 00:00:00 2001
From: Mark Haines <mark.haines@matrix.org>
Date: Mon, 3 Nov 2014 16:35:24 +0000
Subject: [PATCH 3/3] Script for checking event hashes

---
 scripts/check_event_hash.py | 43 +++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 scripts/check_event_hash.py

diff --git a/scripts/check_event_hash.py b/scripts/check_event_hash.py
new file mode 100644
index 0000000000..9fa4452ee6
--- /dev/null
+++ b/scripts/check_event_hash.py
@@ -0,0 +1,43 @@
+from synapse.crypto.event_signing import *
+from syutil.base64util import encode_base64
+
+import argparse
+import hashlib
+import sys
+import json
+
+class dictobj(dict):
+    def __init__(self, *args, **kargs):
+        dict.__init__(self, *args, **kargs)
+        self.__dict__ = self
+
+    def get_dict(self):
+        return dict(self)
+
+
+def main():
+    parser = parser = argparse.ArgumentParser()
+    parser.add_argument("input_json", nargs="?", type=argparse.FileType('r'),
+                        default=sys.stdin)
+    args = parser.parse_args()
+    logging.basicConfig()
+
+    event_json = dictobj(json.load(args.input_json))
+
+    algorithms = {
+        "sha256": hashlib.sha256,
+    }
+
+    for alg_name in event_json.hashes:
+        if check_event_pdu_content_hash(event_json, algorithms[alg_name]):
+            print "PASS content hash %s" % (alg_name,)
+        else:
+            print "FAIL content hash %s" % (alg_name,)
+
+    for algorithm in algorithms.values():
+        name, h_bytes = compute_pdu_event_reference_hash(event_json, algorithm)
+        print "Reference hash %s: %s" % (name, encode_base64(bytes))
+
+if __name__=="__main__":
+    main()
+