mirror of
https://github.com/element-hq/synapse.git
synced 2026-11-05 19:48:19 +00:00
Kegan DougalandClaude Fable 5.1
5161187a50
Rust: `RoomVersion.msc4430_member_keys` and `MSC4430V12`
("org.matrix.msc4430.12" = `MSC4242V12` + the flag); redaction of
`m.room.member` keeps `content.domain` and drops `content.localpart` in such
rooms, so the reference hash, the event ID and the member key signature cover
the claimed domain but not the claimed localpart;
`membership_field::{DOMAIN,LOCALPART}`; `org.matrix.msc4430` in `/versions`;
`.pyi` updated. The version is defined but *not* registered in
`KNOWN_ROOM_VERSIONS`, not even when the flag is on.
Python: `MemberKey` in `synapse.types` next to the other identifier types, with
the grammar `^@[A-Za-z0-9_-]{43}$` (anything with a `:` is a user ID),
`is_member_key` (syntactic, regex only, for hot paths) and
`MemberKey.from_string` (strict: rejects non-canonical base64, so each public
key has exactly one member key string). `MemberKeys` constants
(`SIGNATURE_ENTITY = "sender"`, key ID `ed25519:1`) and
`EventContentFields.MSC4430_{LOCALPART,DOMAIN}`. `supports_msc4430_member_keys`
is a `TypeIs[MSC4430Event]` modelled on `supports_msc4242_state_dag`;
`MSC4430Event` subclasses `MSC4242Event`, since every member key room is a state
DAG room, so one predicate narrows to both.
Signing: `add_hashes_and_signatures_from_signers(room_version, event_dict,
signers, *, server_name)` hashes once and then applies `(entity, key)` signers
in order; `compute_member_key_room_signature(room_version, event_dict, signer,
*, server_name)` adds one signature to an already hashed event (the authoriser's
signature on `/send_join`, our co-signature on an inbound `/invite`) without
rehashing a PDU we have not checked. The three signer kinds are: the sender's
member key under `sender`; our own server name co-signing linkage information;
the authorising member key of a restricted join under the member key string
itself. Together these are the one choke point for signing in member key rooms,
and they refuse with `MemberKeySigningRefusedError` (500) any signer the MSC
does not allow: a `sender` signature by a key other than the one `sender` names,
a key ID other than `ed25519:1`, a server co-signature under any name but ours
or on anything but an `m.room.member` whose `content.domain` is us, or an
authorising signature on anything but a join that names that key in
`join_authorised_via_users_server`. A bug in choosing signers therefore cannot
make us sign as a key we do not hold or vouch for linkage information that is
not ours. An empty signer list hashes only (`/make_join` templates).
Loudness: `get_domain_from_id` and `get_localpart_from_id` raise
`MemberKeyHasNoDomainError` (a `SynapseError`, 500: it is a server bug) when
given a member key, on the no-colon branch only, so user IDs and aliases are
untouched. Because the HTTP layer logs every `SynapseError` at INFO without a
traceback, and the error may be caught before it gets there, both MSC4430 errors
log themselves at ERROR with the stack of the raise site: the point of them is
to name the unadapted code path. `hs.is_mine_id` is left alone: it is called on
raw client strings (state keys, sliding-sync `required_state`,
`/users/{id}/report`, module API) and on remote-controlled room content
(`/upgrade` moving a canonical alias), where "False if malformed" is relied upon
and a member-key-shaped string in a legacy room is just malformed.
`hs.is_mine_identity(room_id, identity)` is the sanctioned question for room
identities; it answers for user IDs and raises `MemberKeyHasNoDomainError` for
member keys. The Prometheus counter
`synapse_msc4430_unsupported_path_total{server_name,path}` and
`record_unsupported_path(server_name, path)` (counts always, warns once per path
per process) are for branches that deliberately skip member keys.
The identity module is `synapse/handlers/member_keys.py` (`MemberKeyHandler`,
`hs.get_member_key_handler()`). The `MemberKey` type and `is_member_key` live in
`synapse.types` because `get_domain_from_id` needs them and the module cannot
import handlers.
Config: `msc4430_enabled` implies `msc4428_enabled`; the Complement image sets
it.
None of this is reachable: no identity in any existing room can satisfy
`is_member_key`, and the room version cannot be used. Not gated, by design: the
`is_member_key`-guarded raises in `get_domain_from_id`/`get_localpart_from_id`,
which only fire for member-key-shaped strings and turn a 400 "Invalid ID" into a
500. The one remote-reachable path that was a clean 400 before,
`/make_join|leave|knock/{roomId}/{userId}` with a member-key-shaped path
parameter (the handlers compare `get_domain_from_id(user_id)` with the origin),
now validates the parameter as a user ID at the servlet (400 `M_INVALID_PARAM`),
so a malformed request cannot make the Synapse federation client fail over
across every resident on a 5xx. A PDU whose sender is member-key-shaped in a
legacy room already fails at `_check_sigs_on_pdu` and is logged at ERROR with a
traceback on `/send`; only the status code changes.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
172 lines
3.8 KiB
Django/Jinja
172 lines
3.8 KiB
Django/Jinja
{#
|
|
This file extends the default 'shared' configuration file (from the 'synapse-workers'
|
|
docker image) with Complement-specific tweak.
|
|
|
|
The base configuration is moved out of the default path to `shared-orig.yaml.j2`
|
|
in the Complement Dockerfile and below we include that original file.
|
|
#}
|
|
|
|
## Server ##
|
|
public_baseurl: http://127.0.0.1:8008/
|
|
report_stats: False
|
|
trusted_key_servers: []
|
|
enable_registration: true
|
|
enable_registration_without_verification: true
|
|
bcrypt_rounds: 4
|
|
url_preview_enabled: true
|
|
url_preview_ip_range_blacklist: []
|
|
# MSC4429 and MSC4262 Profile updates down sync
|
|
include_profile_updates_in_sync: true
|
|
|
|
## Registration ##
|
|
|
|
# Needed by Complement to register admin users
|
|
# DO NOT USE in a production configuration! This should be a random secret.
|
|
registration_shared_secret: complement
|
|
|
|
## Federation ##
|
|
|
|
# trust certs signed by Complement's CA
|
|
federation_custom_ca_list:
|
|
- /complement/ca/ca.crt
|
|
|
|
# unblacklist RFC1918 addresses
|
|
federation_ip_range_blacklist: []
|
|
|
|
# Disable server rate-limiting
|
|
rc_federation:
|
|
window_size: 1000
|
|
sleep_limit: 10
|
|
sleep_delay: 500
|
|
reject_limit: 99999
|
|
concurrent: 3
|
|
|
|
rc_message:
|
|
per_second: 9999
|
|
burst_count: 9999
|
|
|
|
rc_registration:
|
|
per_second: 9999
|
|
burst_count: 9999
|
|
|
|
rc_login:
|
|
address:
|
|
per_second: 9999
|
|
burst_count: 9999
|
|
account:
|
|
per_second: 9999
|
|
burst_count: 9999
|
|
failed_attempts:
|
|
per_second: 9999
|
|
burst_count: 9999
|
|
|
|
rc_admin_redaction:
|
|
per_second: 9999
|
|
burst_count: 9999
|
|
|
|
rc_joins:
|
|
local:
|
|
per_second: 9999
|
|
burst_count: 9999
|
|
remote:
|
|
per_second: 9999
|
|
burst_count: 9999
|
|
|
|
rc_joins_per_room:
|
|
per_second: 9999
|
|
burst_count: 9999
|
|
|
|
rc_3pid_validation:
|
|
per_second: 1000
|
|
burst_count: 1000
|
|
|
|
rc_invites:
|
|
per_room:
|
|
per_second: 1000
|
|
burst_count: 1000
|
|
per_user:
|
|
per_second: 1000
|
|
burst_count: 1000
|
|
per_issuer:
|
|
per_second: 1000
|
|
burst_count: 1000
|
|
|
|
rc_presence:
|
|
per_user:
|
|
per_second: 9999
|
|
burst_count: 9999
|
|
|
|
rc_delayed_event_mgmt:
|
|
per_second: 9999
|
|
burst_count: 9999
|
|
|
|
rc_room_creation:
|
|
per_second: 9999
|
|
burst_count: 9999
|
|
|
|
rc_user_directory:
|
|
per_second: 9999
|
|
burst_count: 9999
|
|
|
|
federation_rr_transactions_per_room_per_second: 9999
|
|
|
|
allow_device_name_lookup_over_federation: true
|
|
|
|
## Experimental Features ##
|
|
|
|
experimental_features:
|
|
# Enable support for polls
|
|
msc3381_polls_enabled: true
|
|
# Enable deleting device-specific notification settings stored in account data
|
|
msc3890_enabled: true
|
|
# Enable removing account data support
|
|
msc3391_enabled: true
|
|
# Filtering /messages by relation type.
|
|
msc3874_enabled: true
|
|
# no UIA for x-signing upload for the first time
|
|
msc3967_enabled: true
|
|
# Send to-device messages to application services
|
|
msc2409_to_device_messages_enabled: true
|
|
# Allow application services to masquerade devices
|
|
msc3202_device_masquerading: true
|
|
# Sending device list changes, one-time key counts and fallback key usage to application services
|
|
msc3202_transaction_extensions: true
|
|
# Proxy OTK claim requests to exclusive ASes
|
|
msc3983_appservice_otk_claims: true
|
|
# Proxy key queries to exclusive ASes
|
|
msc3984_appservice_key_query: true
|
|
# Invite filtering
|
|
msc4155_enabled: true
|
|
# Thread Subscriptions
|
|
msc4306_enabled: true
|
|
# Sticky Events
|
|
msc4354_enabled: true
|
|
# `/sync` `state_after`
|
|
msc4222_enabled: true
|
|
# State DAGs
|
|
msc4242_enabled: true
|
|
msc4428_enabled: true
|
|
msc4430_enabled: true
|
|
|
|
server_notices:
|
|
system_mxid_localpart: _server
|
|
system_mxid_display_name: "Server Alert"
|
|
system_mxid_avatar_url: ""
|
|
room_name: "Server Alert"
|
|
|
|
# Enable delayed events (msc4140)
|
|
max_event_delay_duration: 24h
|
|
|
|
|
|
# Disable sync cache so that initial `/sync` requests are up-to-date.
|
|
caches:
|
|
sync_response_cache_duration: 0
|
|
|
|
|
|
# Complement assumes that it can publish to the room list by default.
|
|
room_list_publication_rules:
|
|
- action: allow
|
|
|
|
|
|
{% include "shared-orig.yaml.j2" %}
|