Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add federation whitelist for servers #3498

Open
wants to merge 8 commits into
base: main
Choose a base branch
from
Open

Conversation

enaix
Copy link

@enaix enaix commented Jan 16, 2025

Description

This PR introduces a mechanism to exclude all servers from federation except given ones. Similar functionality is implemented in Synapse using federation_domain_whitelist. This functionality has been requested by users: #3487 (comment)

Configuration

In federation:

  • enable_whitelist: enable or disable whitelist
  • whitelisted_servers: the list of server names to whitelist

Changes

  • Added new table with the list of whitelisted servers
  • Added necessary APIs for accessing this server property
  • The whitelist check is performed in federationapi/internal/federationclient.go

Pull Request Checklist

Sign-off: private

@enaix enaix requested a review from a team as a code owner January 16, 2025 17:50
@CLAassistant
Copy link

CLAassistant commented Jan 16, 2025

CLA assistant check
All committers have signed the CLA.

@S7evinK
Copy link
Contributor

S7evinK commented Jan 16, 2025

Just a few quick notes:

  • I'd prefer if we could use AllowList or similar instead of WhiteList
  • No need for an Enable option, if we can just check len(allowedServers) > 0
  • Do we actually need a database table, isn't the list static?

@enaix
Copy link
Author

enaix commented Jan 17, 2025

  • I wanted to match the naming of synapse config options to avoid confusion, but sure
  • Sure
  • Yeah, it makes sense, since we can use a hashmap and drastically reduce cpu cycles

I wanted to ask if it's enough to add allowlist checks in federationclient.go

@enaix
Copy link
Author

enaix commented Jan 17, 2025

I wanted to ask if it's enough to add allowlist checks in federationclient.go

It seems that it's not enough.. clientapi/routing is performing various requests like public rooms fetch. Should we add whitelist checks to clientapi/routing/routing.go?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants