matrix-construct / construct

This is The Construct

This — is The Construct

FEDERATED MESSAGING SERVER

🚚 GET CONSTRUCT

• git clone https://github.com/matrix-construct/construct

  

• 📦 DISTRIBUTION PACKAGES

• 🐋 DOCKER IMAGES

🗒️ INSTRUCTIONS

1. 🏗️ BUILD to compile Construct from source.

2. 🪛 SETUP to run Construct for the first time.

3. ⚡ TUNING to optimize Construct for your deployment.

• 🙋 TROUBLESHOOTING guide for solutions to possible problems.

• ❓ FREQUENTLY ASKED QUESTIONS for answers to the most common perplexities.

🛑 Operating a Construct server which is open to public user registration is unsafe. Local users may be able to exceed resource limitations and deny service to other users.

👷‍♀️ DEVELOPERS

📚 DOCUMENTATION

Generate doxygen using doxygen ./Doxyfile the target directory is doc/html. Browse to doc/html/index.html.

🛣️ DEPLOYMENT ROADMAP

• Personal: Dozens of users. Few default restrictions; higher log output.
• Company: Hundreds of users. Moderate default restrictions.
• Public: Thousands of users. Untrusting configuration defaults.

construct's Issues

Link-Time-Optimized build segfault during static initialization

An optimized build with -flto crashes during execution. This does not occur in any other optimized build without -flto.

relevant portion of stacktrace:

(#0 ... #10 template jumble in /deps/boost/include/boost/spirit/home/karma/*)

#11 ircd::json::printer::operator()<boost::spirit::karma::rule<char*, ircd::string_view, boost::spirit::unused_type, boost::spirit::unused_type, boost::spirit::unused_type> const&, ircd::string_view const&>(ircd::buffer::mutable_buffer&, boost::spirit::karma::rule<char*, ircd::string_view, boost::spirit::unused_type, boost::spirit::unused_type, boost::spirit::unused_type> const&, ircd::string_view const&) const [clone .isra.1773] [clone .lto_priv.3466] (out=..., g=..., a#0=...) at json.cc:356
#12 0x00007ffff7b25b56 in ircd::json::serialized (v=...) at json.cc:2706
#13 0x00007ffff7b2634a in ircd::json::value::value (this=this@entry=0x7fffffffdd50, other=...) at json.cc:2985
#14 0x00007ffff7ab9973 in __base_ctor  (__y=..., __x=..., this=0x7fffffffdd50) at /usr/include/c++/6/bits/stl_pair.h:311
#15 ircd::json::member::member<char const (&) [30]>(ircd::string_view const&, char const (&) [30]) [clone .lto_priv.2021] (this=0x7fffffffdd50, key=..., v=...) at json/member.h:69
#16 0x00007ffff7ab96ae in __static_initialization_and_destruction_0 (__initialize_p=1, __priority=65535) at ircd.cc:26
#17 _GLOBAL__sub_I_ircd.cc.lto_priv.1875 () at ircd.cc:405
#18 0x00007ffff7adb82e in global constructors keyed to 65535_0_info.o.568086 () from /home/jason/charybdis/lib/libircd.so.3
#19 0x00007ffff7de76ba in call_init (l=<optimized out>, argc=argc@entry=3, argv=argv@entry=0x7fffffffde58, env=env@entry=0x7fffffffde78) at dl-init.c:72
#20 0x00007ffff7de77cb in call_init (env=0x7fffffffde78, argv=0x7fffffffde58, argc=3, l=<optimized out>) at dl-init.c:30
#21 _dl_init (main_map=0x7ffff7ffe168, argc=3, argv=0x7fffffffde58, env=0x7fffffffde78) at dl-init.c:120
#22 0x00007ffff7dd7c6a in _dl_start_user () from /lib64/ld-linux-x86-64.so.2
#23 0x0000000000000003 in ?? ()
#24 0x00007fffffffe221 in ?? ()
#25 0x00007fffffffe245 in ?? ()
#26 0x00007fffffffe24e in ?? ()
#27 0x0000000000000000 in ?? ()

Link-Time-Optimization is not enabled by default due to [at least] this issue. To enable it manually configure with --enable-lto.

Implement search.

Join rooms on other servers from clients

Implement conf/room for client 13.5 VoIP turnServer response

make fail

I just try to compile on debian testing.
I follow the readme but maybe i miss something.

First i have to remove the CXX=g++-6 on CXX=g++-6 ./configure --prefix=$PWD/build.

configure.log
make.log

It is not understood why this assumption does not always hold in ircd::server::link::discard_read()

construct/ircd/server.cc

Line 1787 in e33c486

// Shouldn't ever be hit because the read() within discard() throws

Implement io_uring for supporting kernels.

Without RWF_NOWAIT (since Linux 4.14) the call to io_submit(2) in ircd/fs_aio.cc is liable to block the entire daemon under certain conditions. A non-blocking use of this call allows the daemon to continue making progress in other contexts during that time.

This server does not support Forward Secrecy with the reference browsers. Grade capped to B.

Forward secrecy (sometimes also called perfect forward secrecy) is a protocol feature that enables secure conversations that are not dependent on the server’s private key. With cipher suites that do not provide forward secrecy, someone who can recover a server’s private key can decrypt all earlier recorded encrypted conversations. You need to support and prefer ECDHE suites in order to enable forward secrecy with modern web browsers. To support a wider range of clients, you should also use DHE suites as fallback after ECDHE. Avoid the RSA key exchange unless absolutely necessary. My proposed default configuration in Section 2.3 contains only suites that provide forward secrecy.

https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#25-use-forward-secrecy

EDU's are being missed on linear syncs.

This is because the events sent to /sync for linear-sync (page reload & heavy traffic) and longpoll-sync are not real events with sequence numbers. If the longpoll-sync misses the event, linear-sync will not be able to find it. Polylog-sync (initial and overnight page load) does not have this problem because it extracts EDU's from real events. Linear-sync has to match on the same real events as polylog-sync to extract EDU data.

Investigate missing endpoint on errors

1552276764.926827    ERROR resource   client     57 :socket:71 local[45.231.133.188:443] remote[177.118.166.198:61815] client:68 req:17:17 HTTP 404 `' Not Found in 1.61ms; text/html; charset=utf-8 content-length:0

Happens when switching tabs on riot iOS (even though it's not doing the initial sync, for another reason).

`db files events` blows up with too many small files which don't auto-compact

Room alias caching wrt refreshing and removing must be implemented.

Currently when the remote changes an alias we have no automated mechanism to update the cache in the !alias room, or even do that manually.

Crash when setting up invalid configuration string for DNS servers

In the console, writing

conf set ircd.net.dns.resolver.servers 127.0.0.11,1.1.1.1,8.8.8.8

will cause a crash and it will prevent me from restarting the server.

The valid configuration would have included ; instead of , to separate the DNS servers.

Figure out why we compile included RocksDB with -frtti

If -frtti can be eliminated from our included compilation we are a step closer to using packaged rocksdb libraries from systems rather than our --with-included-rocksdb.

Accepting/declining room invites from remote servers doesn't work

If your remote server happens to be synapse, the invite will get stuck forever.

ggc-min-expand=1 must be applied when compiling json.cc

This reduces the memory consumption (at the cost of speed) which will allow compiling on low-memory systems. This has to be applied only for json.cc via ircd/Makefile.am, somehow.

Safari does not transfer Authentication bearer tokens through a 308 redirect.

These redirects cannot be used for authenticated client endpoints with that user-agent.

Save all transaction_id to user's user room to include with events forever.

Implement client 13.26 reporting content

Implement rate limiting w/ 429 response; add configuration to resource::method::opts

Many resource handlers are missing the RATE_LIMITED flag as per the spec.

Resolving this issue involves going through the handlers in the modules/ tree alongside the matrix client and server specification to flag methods required to be rate-limited. Currently some are, but many are not.

Example of a method with the flag:

resource::method
method
{
    resource, "GET", handler,
    {
        method.REQUIRES_AUTH |
        method.RATE_LIMITED
    }
};

./configure non-fatal error when compiling openssl/tls1.h during RB_CHK_SYSHEADER

The header openssl/tls1.h does not seem able to be compiled on its own, so ./configure considers it not to exist. Everything still compiles and works normally.

Either this is simply removed or a way to make this check pass is figured out.

m::state btree needs the node-removal side implemented.

After doing so, the conf item ircd.m.room.state.disable_history should be defaulted to false, and all current users must change this conf item to false and run the command room state rebuild history *. Otherwise the "state of a room at an event" will not be available as specified.

The "webhook module" unnecessarily escapes quotes in github issue titles.

Add Prometheus /metrics endpoint

Implement client 9.5.1 / 9.5.2 directory list

I don't see the module for it here, but I swear I thought... looks simple enough though.

Figure out what 13.22 CAS login is and wait for somebody to need it implemented

Include prev_content in state events

Otherwise clients will show displayname/avatar changes as joins

HTTP 404 `/_matrix/client/r0/sync' Not Found :{"errcode":"M_NOT_FOUND","error":"Since parameter is too far in the future..."}

1552713906.495079    ERROR resource   client     79 :socket:4377 local[45.231.133.188:443] remote[177.76.6.60:65466] client:3415 req:24:24 HTTP 404 `/_matrix/client/r0/sync' Not Found in 908.00us; text/html; charset=utf-8 content-length:79 wrote:157                                                                    
1552713913.439890    ERROR   client   client     62 :socket:4377 local[45.231.133.188:443] remote[177.76.6.60:65466] client:3415 req:27:27 HTTP 404 `/_matrix/client/r0/sync?filter=&timeout=0&since=388445' Not Found :{"errcode":"M_NOT_FOUND","error":"Since parameter is too far in the future..."}                      
1552713913.440228    ERROR resource   client     62 :socket:4377 local[45.231.133.188:443] remote[177.76.6.60:65466] client:3415 req:27:27 HTTP 404 `/_matrix/client/r0/sync' Not Found in 1.10ms; text/html; charset=utf-8 content-length:79 wrote:155                                                                      
1552713918.461716    ERROR   client   client     70 :socket:4377 local[45.231.133.188:443] remote[177.76.6.60:65466] client:3415 req:29:29 HTTP 404 `/_matrix/client/r0/sync?filter=&timeout=0&since=388445' Not Found :{"errcode":"M_NOT_FOUND","error":"Since parameter is too far in the future..."}                      
1552713918.464746    ERROR resource   client     70 :socket:4377 local[45.231.133.188:443] remote[177.76.6.60:65466] client:3415 req:29:29 HTTP 404 `/_matrix/client/r0/sync' Not Found in 3.61ms; text/html; charset=utf-8 content-length:79 wrote:155                                                                      

"No shared cipher" prevents iOS clients from working

1551743733.910715    ERROR  listener        *      0 :'matrix-443' @ [0.0.0.0]:44343: socket:2346 local[redacted:443] remote[redacted:49921] in handshake(): no shared cipher

Implement client 13.24.3 Ignoring users (server behavior)

Add IPv6 Support

Properly implement keys/upload to fix "Error uploading one-time keys"

Allow listener configurations to specify TLS versions and cipher lists

Implement client 13.29 Server ACL's

With conf items for which non-modifying endpoints to allow through the ACL. Because information wants to be free and I hope we're not fascists.

DNS caching needs to be moved out of RAM to a server's server room.

Support version 3 rooms and event_id grammar

modules/webhook: Implement additional github issue label handlers.

No way for admin to join their !control room / access denied error at console.

Update m/README.md with the core flow process; how hooks and eval work...

Room tags

Sync issues prevent clients from having a coherent history

Everything related to third-party identifiers must be implemented.

Construct is not aware of riot's "locally timed out" events

SRV priority and weighting not respected.

Support thumbnail creation for media.

No library for thumbnailing has yet been decided upon. Currently the thumbnail endpoint is a passthru to /download.

Support .well-known for server name resolution.

AS support

Add a toggle to disable insecure ciphers

Implement 13.23.3 is_direct (server behavior) on /createRoom