Add federation_domain_whitelist option #2820

ara4n · 2018-01-22T11:23:33Z

Gives a way to restrict which domains your HS is allowed to federate with.
Useful mainly for gracefully preventing a private but internet-connected HS from trying to federate outbound to the wider public Matrix network.
For symmetry, we also try to block inbound federation from non-whitelisted domains, but this should also be done at the IP or HTTP level rather than relying purely on Synapse's application-level filtering at this point.

gives a way to restrict which domains your HS is allowed to federate with. useful mainly for gracefully preventing a private but internet-connected HS from trying to federate to the wider public Matrix network

richvdh · 2018-01-22T11:35:55Z

synapse/federation/federation_client.py

@@ -266,6 +266,9 @@ def get_pdu(self, destinations, event_id, outlier=False, timeout=None):
            except NotRetryingDestination as e:
                logger.info(e.message)
                continue
+            except FederationDeniedError as e:
+                logger.debug(e.message)


Is there a reason to log these at debug rather than info? Debug logging is normally disabled, so I'm worried that people will get obscure failure modes due to lack of logging

this was a thinko which i forgot to fully fix - thanks.

richvdh · 2018-01-22T11:42:27Z

synapse/config/server.py

@@ -55,6 +55,15 @@ def read_config(self, config):
            "block_non_admin_invites", False,
        )

+        federation_domain_whitelist = config.get(


It feels very odd that you can whitelist everything by having an empty whitelist. I wonder if it would be better to make an empty whitelist actually mean that nothing is allowed, and have the default be *

good point; fixed.

richvdh · 2018-01-22T11:43:22Z

tests/replication/slave/storage/_base.py

@@ -41,15 +43,17 @@ def setUp(self):
        self.event_id = 0

        server_factory = ReplicationStreamProtocolFactory(self.hs)
-        listener = reactor.listenUNIX("\0xxx", server_factory)
+        # XXX: mktemp is unsafe and should never be used. but we're just a test.
+        path = tempfile.mktemp(prefix="base_slaved_store_test_case_socket")


This looks unrelated. Can you make it a separate PR please

yes, it is unrelated, other than being pulled in to fix the tests whilst doing this PR. given it's trivial, i'd prefer to not burn the time splitting it out at this point.

Keeping unrelated things in separate PRs makes it easier to review them, helps with bisecting, and makes it easier to back things out separately if they turn out to be ill-advised. It being trivial means it's all the easier to separate out.

I've done it for you: c776c52 backs out the changes; #2821 is the new PR.

ara4n · 2018-01-22T14:25:36Z

@erikjohnston (or @richvdh, but i'd have thought rich would rather snowboard) can you PTAL again?

richvdh · 2018-01-22T16:26:38Z

synapse/config/server.py

@@ -222,7 +224,8 @@ def default_config(self, server_name, **kwargs):
        # Restrict federation to the following whitelist of domains.
        # N.B. we recommend also firewalling your federation listener to limit
        # inbound federation traffic as early as possible, rather than relying
-        # purely on this application-layer restriction.
+        # purely on this application-layer restriction.  If not specified, the
+        # default is to whitelist nothing.


s/nothing/everything?

Extracted from #2820

richvdh · 2018-01-22T16:32:30Z

synapse/rest/media/v1/media_repository.py

-                logger.debug(e)
-                raise SynapseError(403, e.message)
+                logger.info(e)
+                raise e


this should probably be raise rather than raise e, unless there is a good reason to throw a new exception annd hence swallow the original stack trace.

Although, looking at it, I don't think you'll ever get here, because FederationDeniedError is a subclass of SynapseError so the clause at line 382 will get taken instead. I think you might as well remove the whole thing

richvdh · 2018-01-22T16:51:04Z

tests/replication/slave/storage/_base.py

@@ -41,15 +43,17 @@ def setUp(self):
        self.event_id = 0

        server_factory = ReplicationStreamProtocolFactory(self.hs)
-        listener = reactor.listenUNIX("\0xxx", server_factory)
+        # XXX: mktemp is unsafe and should never be used. but we're just a test.
+        path = tempfile.mktemp(prefix="base_slaved_store_test_case_socket")


Keeping unrelated things in separate PRs makes it easier to review them, helps with bisecting, and makes it easier to back things out separately if they turn out to be ill-advised. It being trivial means it's all the easier to separate out.

I've done it for you: c776c52 backs out the changes; #2821 is the new PR.

ara4n · 2018-01-22T17:43:49Z

ok. have pushed remaining PR fixes.

richvdh

lgtm. Please squash before/during merging so that we don't have all the bad commits confusing things for future bisecting

andrewgdunn · 2018-03-28T21:39:40Z

It'd be really nice to have some logging for the 403 (deny) so that homeserver operators can add inbound addresses that are constantly retrying.

krombel · 2018-03-29T00:06:28Z

@storrgie That should be possible when you have your server logs set to INFO.
Just grep the logs for "Federation denied with "

ShellCode33 · 2018-03-30T19:20:51Z

Is there a way to wildcard name servers in order to disable the federation entirely ?

turt2live · 2018-03-30T19:52:59Z

There doesn't appear to be wildcard support, but setting it to an empty array looks to be a way to disable it. As per the sample configuration, it's probably best to firewall it though (both inbound and outbound).

krombel · 2018-04-03T10:40:42Z

AFAIK when the federation whitelist is unset all federation is allowed.
So you might set the whitelist to your server_name and/or disable the federation listeners (so the server does not listen for federation requests entirely.

In short: Add

federation_domain_whitelist:
- <yourServerName>

to your config and remove your federation listener do disable all federation

//EDIT: Extended with more explicit HowTo

flumpt · 2019-01-11T13:02:07Z

Is there a way to wildcard name servers in order to disable the federation entirely ?

I would love to be able to use a wildcard to build a closed matrix subnet. Is there any way to do it without every server knowing all other participating servers?

ara4n added 2 commits January 20, 2018 17:23

make replication tests pass on OSX

3f79378

add federation_domain_whitelist

4b090cb

gives a way to restrict which domains your HS is allowed to federate with. useful mainly for gracefully preventing a private but internet-connected HS from trying to federate to the wider public Matrix network

ara4n assigned richvdh and erikjohnston Jan 22, 2018

richvdh suggested changes Jan 22, 2018

View reviewed changes

ara4n added 2 commits January 22, 2018 14:54

incorporate PR feedback

313a489

fix tests

b424c16

richvdh reviewed Jan 22, 2018

View reviewed changes

Back out unrelated changes

c776c52

richvdh added a commit that referenced this pull request Jan 22, 2018

Matthew's fixes to the unit tests

5c431f4

Extracted from #2820

richvdh mentioned this pull request Jan 22, 2018

Matthew's fixes to the unit tests #2821

Merged

richvdh reviewed Jan 22, 2018

View reviewed changes

richvdh assigned ara4n and unassigned richvdh and erikjohnston Jan 22, 2018

ara4n added 2 commits January 22, 2018 18:43

fix thinko

fa80b49

remove unreachable except block

3869981

richvdh approved these changes Jan 22, 2018

View reviewed changes

ara4n merged commit ab9f844 into develop Jan 22, 2018

Half-Shot mentioned this pull request Mar 2, 2018

Ability to 100% disable all federation for a synapse #2619

Closed

turt2live mentioned this pull request May 2, 2018

Ability to completely blacklist a domain/server from federating #3173

Closed

richvdh mentioned this pull request Aug 24, 2018

Allow federation_domain_whitelist to be emtpy list #3754

Merged

hawkowl deleted the matthew/limit-federation branch September 20, 2018 13:59

ataraxus mentioned this pull request Mar 21, 2019

Don't federate my data #4907

Closed

neilisfragile mentioned this pull request Nov 22, 2019

Correct way to completely disable federation ? #6395

Closed

lunainvictum mentioned this pull request Jan 12, 2021

Question about Synapse Server completly isolated #9094

Closed

SPiRiT369 mentioned this pull request Jan 23, 2024

I how to close federation element-hq/synapse#16754

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add federation_domain_whitelist option #2820

Add federation_domain_whitelist option #2820

ara4n commented Jan 22, 2018

richvdh Jan 22, 2018

ara4n Jan 22, 2018

richvdh Jan 22, 2018

ara4n Jan 22, 2018

richvdh Jan 22, 2018

ara4n Jan 22, 2018

richvdh Jan 22, 2018

ara4n commented Jan 22, 2018

richvdh Jan 22, 2018

richvdh Jan 22, 2018

richvdh Jan 22, 2018

ara4n commented Jan 22, 2018

richvdh left a comment

andrewgdunn commented Mar 28, 2018

krombel commented Mar 29, 2018

ShellCode33 commented Mar 30, 2018

turt2live commented Mar 30, 2018

krombel commented Apr 3, 2018 •

edited

Loading

flumpt commented Jan 11, 2019 •

edited

Loading

Add federation_domain_whitelist option #2820

Add federation_domain_whitelist option #2820

Conversation

ara4n commented Jan 22, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ara4n commented Jan 22, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ara4n commented Jan 22, 2018

richvdh left a comment

Choose a reason for hiding this comment

andrewgdunn commented Mar 28, 2018

krombel commented Mar 29, 2018

ShellCode33 commented Mar 30, 2018

turt2live commented Mar 30, 2018

krombel commented Apr 3, 2018 • edited Loading

flumpt commented Jan 11, 2019 • edited Loading

krombel commented Apr 3, 2018 •

edited

Loading

flumpt commented Jan 11, 2019 •

edited

Loading