mirror of
https://github.com/element-hq/synapse.git
synced 2026-11-05 17:37:55 +00:00
Erik JohnstonandClaude Opus 5.5
7f34eefa26
The parts of the outbound federation agent that decide where to connect and what to trust, each a port of the Python it replaces, with Rust unit tests. Nothing uses them yet. - `resolve`: `_matrix-fed._tcp`, then `_matrix._tcp`, then port 8448, as `MatrixHostnameEndpoint._resolve_server`. SRV records are ordered as `_sort_server_list` (RFC 2782), cached while every record is live, and the stale answer is used when a refetch fails. A lone `.` target means the service is unavailable. SRV lookups go through hickory, and A/AAAA through the system resolver, as Twisted uses getaddrinfo. Parts derive from matrix-hyper-federation-client (Apache-2.0). - `well_known`: `WellKnownResolver`, with Python's cache periods, jitter, grace period, had-valid memory, size cap and retries, behind a `WellKnownFetcher` trait so the state machine is tested without HTTP. Two additions: each fetch attempt has a timeout (`client_timeout`), and concurrent lookups for one server name share a fetch. An `m.server` that is not a valid URI authority now counts as an invalid response. - `policy`: the IP range lists, refusing a name if any of its addresses is blocked (the DNS rebinding defence), and the `https_proxy` settings with Python's `no_proxy` matching. - `tls`: `FederationPolicyForHTTPS` on rustls: platform roots or the custom CA list, verification off (still sending SNI), the per-host verification whitelist. rustls has no TLS 1.0 or 1.1, so a minimum below 1.2 means 1.2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R5b7Ruy4cgt27Mjq6Ptxbb