Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Use federation blacklist for requests to identity servers #5935

Closed
anoadragon453 opened this issue Aug 30, 2019 · 7 comments
Closed

Use federation blacklist for requests to identity servers #5935

anoadragon453 opened this issue Aug 30, 2019 · 7 comments
Assignees
@anoadragon453
Labels
z-privacy-sprint (Deprecated Label)

Comments

@anoadragon453
Copy link
Member

Now that we're getting rid of the concept of trusted identity servers, we need to make sure that people can't try and poke at internal addresses when sending identity server-related requests.

The plan is to reuse the federation blacklist for these requests which by default blocks internal CIDR ranges.
@anoadragon453 anoadragon453 self-assigned this Aug 30, 2019
@anoadragon453
Copy link
Member Author

@richvdh @erikjohnston Should matrixfederationclient be used for these requests so we get blacklisting for free? Or does that muddy the definition of the client?

@richvdh
Copy link
Member

richvdh commented Sep 2, 2019

Previously, using the MatrixFederationClient would have meant that you'd get .well-known and SRV routing, which you don't want for an IS. But now I'm not so sure. @erikjohnston do your recent changes to the agent mean that https urls skip the federation routing?

@erikjohnston
Copy link
Member

do your recent changes to the agent mean that https urls skip the federation routing?

That should be the case, though I haven't tested it.

@richvdh
Copy link
Member

richvdh commented Sep 2, 2019

I guess another question: do we want the options relating to TLS certs to also apply to connections to the IS? (I think we probably do?)

@anoadragon453
Copy link
Member Author

anoadragon453 commented Sep 5, 2019 •
edited
Loading

Would the federation_domain_whitelist config option affect this?

@anoadragon453 anoadragon453 mentioned this issue Sep 6, 2019
Merged
richvdh pushed a commit that referenced this issue Sep 23, 2019
@anoadragon453 @richvdh
Use the federation blacklist for requests to untrusted Identity Serve…
e08ea43 
…rs (#6000)

Uses a SimpleHttpClient instance equipped with the federation_ip_range_blacklist list for requests to identity servers provided by user input. Does not use a blacklist when contacting identity servers specified by account_threepid_delegates. The homeserver trusts the latter and we don't want to prevent homeserver admins from specifying delegates that are on internal IP addresses.

Fixes #5935
@richvdh
Copy link
Member

richvdh commented Sep 23, 2019

fixed by #6000

@richvdh richvdh closed this as completed Sep 23, 2019
@richvdh
Copy link
Member

richvdh commented Sep 23, 2019

(which did nothing to address the tls certs stuff: you'll have to use a real cert on your ID server)

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@anoadragon453 anoadragon453

Labels
z-privacy-sprint (Deprecated Label)
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@anoadragon453 @richvdh @erikjohnston