mirror of
https://git.anonymousland.org/anonymousland/synapse-product.git
synced 2024-12-24 05:19:22 -05:00
30fba62108
Replaces the `federation_ip_range_blacklist` configuration setting with an `ip_range_blacklist` setting with wider scope. It now applies to: * Federation * Identity servers * Push notifications * Checking key validitity for third-party invite events The old `federation_ip_range_blacklist` setting is still honored if present, but with reduced scope (it only applies to federation and identity servers).
124 lines
4.9 KiB
Python
124 lines
4.9 KiB
Python
# -*- coding: utf-8 -*-
|
|
# Copyright 2020 The Matrix.org Foundation C.I.C.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
from typing import Optional
|
|
|
|
from netaddr import IPSet
|
|
|
|
from synapse.config._base import Config, ConfigError
|
|
from synapse.config._util import validate_config
|
|
|
|
|
|
class FederationConfig(Config):
|
|
section = "federation"
|
|
|
|
def read_config(self, config, **kwargs):
|
|
# FIXME: federation_domain_whitelist needs sytests
|
|
self.federation_domain_whitelist = None # type: Optional[dict]
|
|
federation_domain_whitelist = config.get("federation_domain_whitelist", None)
|
|
|
|
if federation_domain_whitelist is not None:
|
|
# turn the whitelist into a hash for speed of lookup
|
|
self.federation_domain_whitelist = {}
|
|
|
|
for domain in federation_domain_whitelist:
|
|
self.federation_domain_whitelist[domain] = True
|
|
|
|
ip_range_blacklist = config.get("ip_range_blacklist", [])
|
|
|
|
# Attempt to create an IPSet from the given ranges
|
|
try:
|
|
self.ip_range_blacklist = IPSet(ip_range_blacklist)
|
|
except Exception as e:
|
|
raise ConfigError("Invalid range(s) provided in ip_range_blacklist: %s" % e)
|
|
# Always blacklist 0.0.0.0, ::
|
|
self.ip_range_blacklist.update(["0.0.0.0", "::"])
|
|
|
|
# The federation_ip_range_blacklist is used for backwards-compatibility
|
|
# and only applies to federation and identity servers. If it is not given,
|
|
# default to ip_range_blacklist.
|
|
federation_ip_range_blacklist = config.get(
|
|
"federation_ip_range_blacklist", ip_range_blacklist
|
|
)
|
|
try:
|
|
self.federation_ip_range_blacklist = IPSet(federation_ip_range_blacklist)
|
|
except Exception as e:
|
|
raise ConfigError(
|
|
"Invalid range(s) provided in federation_ip_range_blacklist: %s" % e
|
|
)
|
|
# Always blacklist 0.0.0.0, ::
|
|
self.federation_ip_range_blacklist.update(["0.0.0.0", "::"])
|
|
|
|
federation_metrics_domains = config.get("federation_metrics_domains") or []
|
|
validate_config(
|
|
_METRICS_FOR_DOMAINS_SCHEMA,
|
|
federation_metrics_domains,
|
|
("federation_metrics_domains",),
|
|
)
|
|
self.federation_metrics_domains = set(federation_metrics_domains)
|
|
|
|
def generate_config_section(self, config_dir_path, server_name, **kwargs):
|
|
return """\
|
|
## Federation ##
|
|
|
|
# Restrict federation to the following whitelist of domains.
|
|
# N.B. we recommend also firewalling your federation listener to limit
|
|
# inbound federation traffic as early as possible, rather than relying
|
|
# purely on this application-layer restriction. If not specified, the
|
|
# default is to whitelist everything.
|
|
#
|
|
#federation_domain_whitelist:
|
|
# - lon.example.com
|
|
# - nyc.example.com
|
|
# - syd.example.com
|
|
|
|
# Prevent outgoing requests from being sent to the following blacklisted IP address
|
|
# CIDR ranges. If this option is not specified, or specified with an empty list,
|
|
# no IP range blacklist will be enforced.
|
|
#
|
|
# The blacklist applies to the outbound requests for federation, identity servers,
|
|
# push servers, and for checking key validitity for third-party invite events.
|
|
#
|
|
# (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
|
|
# listed here, since they correspond to unroutable addresses.)
|
|
#
|
|
# This option replaces federation_ip_range_blacklist in Synapse v1.24.0.
|
|
#
|
|
ip_range_blacklist:
|
|
- '127.0.0.0/8'
|
|
- '10.0.0.0/8'
|
|
- '172.16.0.0/12'
|
|
- '192.168.0.0/16'
|
|
- '100.64.0.0/10'
|
|
- '169.254.0.0/16'
|
|
- '::1/128'
|
|
- 'fe80::/64'
|
|
- 'fc00::/7'
|
|
|
|
# Report prometheus metrics on the age of PDUs being sent to and received from
|
|
# the following domains. This can be used to give an idea of "delay" on inbound
|
|
# and outbound federation, though be aware that any delay can be due to problems
|
|
# at either end or with the intermediate network.
|
|
#
|
|
# By default, no domains are monitored in this way.
|
|
#
|
|
#federation_metrics_domains:
|
|
# - matrix.org
|
|
# - example.com
|
|
"""
|
|
|
|
|
|
_METRICS_FOR_DOMAINS_SCHEMA = {"type": "array", "items": {"type": "string"}}
|