dandri/synapse
1
0
Fork 0
mirror of https://github.com/element-hq/synapse.git synced 2026-08-28 21:18:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use the federation blacklist for requests to untrusted Identity Servers (#6000)

Browse Source 
Uses a SimpleHttpClient instance equipped with the federation_ip_range_blacklist list for requests to identity servers provided by user input. Does not use a blacklist when contacting identity servers specified by account_threepid_delegates. The homeserver trusts the latter and we don't want to prevent homeserver admins from specifying delegates that are on internal IP addresses.

Fixes #5935
This commit is contained in:
Andrew Morgan
2019-09-23 20:23:20 +01:00
committed by Richard van der Hoff
parent 1ea3ed7620
commit e08ea43463
5 changed files with 28 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sample_config.yaml
+3
View File
@@ -110,6 +110,9 @@ pid_file: DATADIR/homeserver.pid
# blacklist IP address CIDR ranges. If this option is not specified, or
# specified with an empty list, no ip range blacklist will be enforced.
#
# As of Synapse v1.4.0 this option also affects any outbound requests to identity
# servers provided by user input.
#
# (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly
# listed here, since they correspond to unroutable addresses.)
#