Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Ability to blacklist ip ranges for federation traffic #5043

Merged
merged 30 commits into from
May 13, 2019
Merged

Ability to blacklist ip ranges for federation traffic #5043

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
30 commits
Select commit Hold shift + click to select a range
1b8532b
tests fail
anoadragon453 Apr 10, 2019
4501489
tests pass
anoadragon453 Apr 10, 2019
0200c86
lint
anoadragon453 Apr 10, 2019
9f1f03f
lint and changelog
anoadragon453 Apr 10, 2019
6631485
actually add changelog
anoadragon453 Apr 10, 2019
25c99dc
sample config
anoadragon453 Apr 10, 2019
9795344
Don't raise an exception if coming from federation
anoadragon453 Apr 10, 2019
1b3989b
lint
anoadragon453 Apr 10, 2019
0e2f8ca
Add some notes
anoadragon453 Apr 10, 2019
6479cd5
Use an empty list as default
anoadragon453 Apr 30, 2019
3f4f931
Merge branch 'develop' into anoa/blacklist_ip_ranges
anoadragon453 Apr 30, 2019
968ddca
Testing
anoadragon453 May 2, 2019
e1feb45
We can't throw exceptions in an IResolutionReceiver
richvdh May 2, 2019
152d7a8
Remove different behaviour for fed vs. nonfed
anoadragon453 May 2, 2019
6592691
Import at the top
anoadragon453 May 2, 2019
517794e
isort locally didn't have a problem >:(
anoadragon453 May 3, 2019
15d1802
lint
anoadragon453 May 3, 2019
131b9c0
yield deferred
anoadragon453 May 3, 2019
13f430c
Same behavior for no result and result blacklisted
anoadragon453 May 3, 2019
e2bc9af
lint
anoadragon453 May 3, 2019
ec67848
Remove yield
anoadragon453 May 3, 2019
43ffe47
Enable federation blacklisting by default
anoadragon453 May 8, 2019
aee810a
Fix tests and various small review issues
anoadragon453 May 8, 2019
a30a778
Update tests
anoadragon453 May 8, 2019
ede582f
lint
anoadragon453 May 8, 2019
4ba420f
always blacklist 0.0.0.0, ::
anoadragon453 May 10, 2019
358777d
lower pump value
anoadragon453 May 10, 2019
7f15dd7
lint
anoadragon453 May 10, 2019
6b29f7e
regen config
anoadragon453 May 10, 2019
e0715d0
Merge branch 'develop' into anoa/blacklist_ip_ranges
anoadragon453 May 10, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docs/sample_config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,9 @@ pid_file: DATADIR/homeserver.pid
# blacklist IP address CIDR ranges. If this option is not specified, or
# specified with an empty list, no ip range blacklist will be enforced.
#
# (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
# listed here, since they correspond to unroutable addresses.)
#
federation_ip_range_blacklist:
- '127.0.0.0/8'
- '10.0.0.0/8'
Expand Down
6 changes: 6 additions & 0 deletions synapse/config/server.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,6 +148,9 @@ def read_config(self, config):
self.federation_ip_range_blacklist = IPSet(
self.federation_ip_range_blacklist
)

# Always blacklist 0.0.0.0, ::
self.federation_ip_range_blacklist.update(["0.0.0.0", "::"])
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this could really have done with being outside the try/catch, but nm

except Exception as e:
raise ConfigError(
"Invalid range(s) provided in "
Expand Down Expand Up @@ -407,6 +410,9 @@ def default_config(self, server_name, data_dir_path, **kwargs):
# blacklist IP address CIDR ranges. If this option is not specified, or
# specified with an empty list, no ip range blacklist will be enforced.
#
# (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
# listed here, since they correspond to unroutable addresses.)
#
federation_ip_range_blacklist:
- '127.0.0.0/8'
- '10.0.0.0/8'
Expand Down
6 changes: 3 additions & 3 deletions tests/http/test_fedclient.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,7 +232,7 @@ def test_client_ip_range_blacklist(self):
# Nothing happened yet
self.assertNoResult(d)

self.pump(120)
self.pump(1)

# Check that it was unable to resolve the address
clients = self.reactor.tcpClients
Expand All @@ -251,7 +251,7 @@ def test_client_ip_range_blacklist(self):
self.assertNoResult(d)

# Move the reactor forwards
self.pump(120)
self.pump(1)

# Check that it was unable to resolve the address
clients = self.reactor.tcpClients
Expand All @@ -270,7 +270,7 @@ def test_client_ip_range_blacklist(self):
self.assertNoResult(d)

# Move the reactor forwards
self.pump(120)
self.pump(1)

# Check that it was able to resolve the address
clients = self.reactor.tcpClients
Expand Down