Matrix-Mirrors/anonymousland-synapse
1
0
Fork 0
mirror of https://git.anonymousland.org/anonymousland/synapse.git synced 2025-05-03 16:04:50 -04:00
Code Issues Projects Releases Packages Wiki Activity

Use the federation blacklist for requests to untrusted Identity Servers (#6000)

Browse source 
Uses a SimpleHttpClient instance equipped with the federation_ip_range_blacklist list for requests to identity servers provided by user input. Does not use a blacklist when contacting identity servers specified by account_threepid_delegates. The homeserver trusts the latter and we don't want to prevent homeserver admins from specifying delegates that are on internal IP addresses.

Fixes #5935
This commit is contained in:
Andrew Morgan 2019-09-23 21:23:20 +02:00 • committed by Richard van der Hoff
parent 1ea3ed7620
commit e08ea43463
5 changed files with 28 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
synapse/config/server.py
View file

@ -545,6 +545,9 @@ class ServerConfig(Config):
# blacklist IP address CIDR ranges. If this option is not specified, or
# specified with an empty list, no ip range blacklist will be enforced.
#
# As of Synapse v1.4.0 this option also affects any outbound requests to identity
# servers provided by user input.
#
# (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
# listed here, since they correspond to unroutable addresses.)
#