Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

MSC2261: Allow m.room.aliases events to be redacted by room admins #2261

Closed
wants to merge 4 commits into from
Closed

MSC2261: Allow m.room.aliases events to be redacted by room admins #2261

wants to merge 4 commits into from

Conversation

richvdh
Copy link
Member

@richvdh richvdh commented Aug 29, 2019 •
edited by ara4n
Loading

@richvdh richvdh added proposal A matrix spec change proposal proposal-in-review labels Aug 29, 2019
@richvdh richvdh mentioned this pull request Oct 10, 2019
Closed
@pakman
Copy link

pakman commented Oct 11, 2019

See #625 (comment) for an example of why this would be nice to have

@neilisfragile neilisfragile mentioned this pull request Dec 4, 2019
Closed
KitsuneRal
KitsuneRal reviewed Dec 31, 2019
View reviewed changes
proposals/2261-fix-alias-redaction.md
TODO: should the room directory be updated to match the new room state, where
possible? It kinda makes sense when the redaction is used to undo an accidental
addition, but in general it might not be a great plan, particularly if we are
switching to a world in which `m.room.aliases` is very much advisory. Also,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if it's better if room admins could allow aliases in a room to be advertised, instead of the current situation. Basically, what if we provide a means for a room admin to explicitly approve a given alias to m.room.aliases before anybody sees it? This mode itself could be made configurable (e.g., admins may choose whether they want to curate aliases or just let people add them). Sounds like a whole separate MSC though.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This feels pretty sci-fi, tbh. How would the room admin find out about new aliases that it might be appropriate to add to m.room.aliases ?

Copy link
Member

@KitsuneRal KitsuneRal Jan 11, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By a (probably, but not necessarily, the same) room event that's sent to the room but only admins (=people who can send m.room.alias(es)) see it?
(I just realised that to have an "event sign-off" would be cool - but that is sci-fi)

@richvdh richvdh mentioned this pull request Jan 8, 2020
Closed
@turt2live turt2live self-requested a review January 29, 2020 11:18
neilalexander
neilalexander reviewed Feb 4, 2020
View reviewed changes
proposals/2261-fix-alias-redaction.md
This will require a new room version, since changes to the redaction algorithm
also change the way that event hashes (and hence event IDs) are calculated.

TODO: should the room directory be updated to match the new room state, where
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This feels like it makes sense (and I think Dendrite's public rooms component possibly already does this by listening for events from the room server), although it opens the question of whether the public room directory really needs to gratuitously return aliases unless it is obvious that an alias matches the given filter?

@richvdh richvdh mentioned this pull request Mar 4, 2020
Closed
8 tasks
turt2live
turt2live reviewed Mar 5, 2020
View reviewed changes
proposals/2261-fix-alias-redaction.md
Comment on lines +14 to +15
This will require a new room version, since changes to the redaction algorithm
also change the way that event hashes (and hence event IDs) are calculated.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The other alias MSC also requires a room version bump, and removes all meaning from m.room.aliases. Do we instead just use that and drop this MSC?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, possibly.

@richvdh
Copy link
Member Author

richvdh commented Mar 20, 2020

I think this is superceded by #2432.

@richvdh richvdh closed this Mar 20, 2020
@richvdh richvdh added obsolete A proposal which has been overtaken by other proposals and removed proposal-in-review labels Mar 20, 2020
richvdh added a commit to matrix-org/synapse that referenced this pull request Mar 23, 2020
@richvdh
Merge tag 'v1.12.0'
229eb81 
Synapse 1.12.0 (2020-03-23)
===========================

No significant changes since 1.12.0rc1.

Debian packages and Docker images are rebuilt using the latest versions of
dependency libraries, including Twisted 20.3.0. **Please see security advisory
below**.

Security advisory
-----------------

Synapse may be vulnerable to request-smuggling attacks when it is used with a
reverse-proxy. The vulnerabilties are fixed in Twisted 20.3.0, and are
described in
[CVE-2020-10108](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10108)
and
[CVE-2020-10109](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10109).
For a good introduction to this class of request-smuggling attacks, see
https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn.

We are not aware of these vulnerabilities being exploited in the wild, and
do not believe that they are exploitable with current versions of any reverse
proxies. Nevertheless, we recommend that all Synapse administrators ensure that
they have the latest versions of the Twisted library to ensure that their
installation remains secure.

* Administrators using the [`matrix.org` Docker
  image](https://hub.docker.com/r/matrixdotorg/synapse/) or the [Debian/Ubuntu
  packages from
  `matrix.org`](https://github.com/matrix-org/synapse/blob/master/INSTALL.md#matrixorg-packages)
  should ensure that they have version 1.12.0 installed: these images include
  Twisted 20.3.0.
* Administrators who have [installed Synapse from
  source](https://github.com/matrix-org/synapse/blob/master/INSTALL.md#installing-from-source)
  should upgrade Twisted within their virtualenv by running:
  ```sh
  <path_to_virtualenv>/bin/pip install 'Twisted>=20.3.0'
  ```
* Administrators who have installed Synapse from distribution packages should
  consult the information from their distributions.

The `matrix.org` Synapse instance was not vulnerable to these vulnerabilities.

Advance notice of change to the default `git` branch for Synapse
----------------------------------------------------------------

Currently, the default `git` branch for Synapse is `master`, which tracks the
latest release.

After the release of Synapse 1.13.0, we intend to change this default to
`develop`, which is the development tip. This is more consistent with common
practice and modern `git` usage.

Although we try to keep `develop` in a stable state, there may be occasions
where regressions creep in. Developers and distributors who have scripts which
run builds using the default branch of `Synapse` should therefore consider
pinning their scripts to `master`.

Synapse 1.12.0rc1 (2020-03-19)
==============================

Features
--------

- Changes related to room alias management ([MSC2432](matrix-org/matrix-spec-proposals#2432)):
  - Publishing/removing a room from the room directory now requires the user to have a power level capable of modifying the canonical alias, instead of the room aliases. ([\#6965](#6965))
  - Validate the `alt_aliases` property of canonical alias events. ([\#6971](#6971))
  - Users with a power level sufficient to modify the canonical alias of a room can now delete room aliases. ([\#6986](#6986))
  - Implement updated authorization rules and redaction rules for aliases events, from [MSC2261](matrix-org/matrix-spec-proposals#2261) and [MSC2432](matrix-org/matrix-spec-proposals#2432). ([\#7037](#7037))
  - Stop sending m.room.aliases events during room creation and upgrade. ([\#6941](#6941))
  - Synapse no longer uses room alias events to calculate room names for push notifications. ([\#6966](#6966))
  - The room list endpoint no longer returns a list of aliases. ([\#6970](#6970))
  - Remove special handling of aliases events from [MSC2260](matrix-org/matrix-spec-proposals#2260) added in v1.10.0rc1. ([\#7034](#7034))
- Expose the `synctl`, `hash_password` and `generate_config` commands in the snapcraft package. Contributed by @devec0. ([\#6315](#6315))
- Check that server_name is correctly set before running database updates. ([\#6982](#6982))
- Break down monthly active users by `appservice_id` and emit via Prometheus. ([\#7030](#7030))
- Render a configurable and comprehensible error page if something goes wrong during the SAML2 authentication process. ([\#7058](#7058), [\#7067](#7067))
- Add an optional parameter to control whether other sessions are logged out when a user's password is modified. ([\#7085](#7085))
- Add prometheus metrics for the number of active pushers. ([\#7103](#7103), [\#7106](#7106))
- Improve performance when making HTTPS requests to sygnal, sydent, etc, by sharing the SSL context object between connections. ([\#7094](#7094))

Bugfixes
--------

- When a user's profile is updated via the admin API, also generate a displayname/avatar update for that user in each room. ([\#6572](#6572))
- Fix a couple of bugs in email configuration handling. ([\#6962](#6962))
- Fix an issue affecting worker-based deployments where replication would stop working, necessitating a full restart, after joining a large room. ([\#6967](#6967))
- Fix `duplicate key` error which was logged when rejoining a room over federation. ([\#6968](#6968))
- Prevent user from setting 'deactivated' to anything other than a bool on the v2 PUT /users Admin API. ([\#6990](#6990))
- Fix py35-old CI by using native tox package. ([\#7018](#7018))
- Fix a bug causing `org.matrix.dummy_event` to be included in responses from `/sync`. ([\#7035](#7035))
- Fix a bug that renders UTF-8 text files incorrectly when loaded from media. Contributed by @TheStranjer. ([\#7044](#7044))
- Fix a bug that would cause Synapse to respond with an error about event visibility if a client tried to request the state of a room at a given token. ([\#7066](#7066))
- Repair a data-corruption issue which was introduced in Synapse 1.10, and fixed in Synapse 1.11, and which could cause `/sync` to return with 404 errors about missing events and unknown rooms. ([\#7070](#7070))
- Fix a bug causing account validity renewal emails to be sent even if the feature is turned off in some cases. ([\#7074](#7074))

Improved Documentation
----------------------

- Updated CentOS8 install instructions. Contributed by Richard Kellner. ([\#6925](#6925))
- Fix `POSTGRES_INITDB_ARGS` in the `contrib/docker/docker-compose.yml` example docker-compose configuration. ([\#6984](#6984))
- Change date in [INSTALL.md](./INSTALL.md#tls-certificates) for last date of getting TLS certificates to November 2019. ([\#7015](#7015))
- Document that the fallback auth endpoints must be routed to the same worker node as the register endpoints. ([\#7048](#7048))

Deprecations and Removals
-------------------------

- Remove the unused query_auth federation endpoint per [MSC2451](matrix-org/matrix-spec-proposals#2451). ([\#7026](#7026))

Internal Changes
----------------

- Add type hints to `logging/context.py`. ([\#6309](#6309))
- Add some clarifications to `README.md` in the database schema directory. ([\#6615](#6615))
- Refactoring work in preparation for changing the event redaction algorithm. ([\#6874](#6874), [\#6875](#6875), [\#6983](#6983), [\#7003](#7003))
- Improve performance of v2 state resolution for large rooms. ([\#6952](#6952), [\#7095](#7095))
- Reduce time spent doing GC, by freezing objects on startup. ([\#6953](#6953))
- Minor perfermance fixes to `get_auth_chain_ids`. ([\#6954](#6954))
- Don't record remote cross-signing keys in the `devices` table. ([\#6956](#6956))
- Use flake8-comprehensions to enforce good hygiene of list/set/dict comprehensions. ([\#6957](#6957))
- Merge worker apps together. ([\#6964](#6964), [\#7002](#7002), [\#7055](#7055), [\#7104](#7104))
- Remove redundant `store_room` call from `FederationHandler._process_received_pdu`. ([\#6979](#6979))
- Update warning for incorrect database collation/ctype to include link to documentation. ([\#6985](#6985))
- Add some type annotations to the database storage classes. ([\#6987](#6987))
- Port `synapse.handlers.presence` to async/await. ([\#6991](#6991), [\#7019](#7019))
- Add some type annotations to the federation base & client classes. ([\#6995](#6995))
- Port `synapse.rest.keys` to async/await. ([\#7020](#7020))
- Add a type check to `is_verified` when processing room keys. ([\#7045](#7045))
- Add type annotations and comments to the auth handler. ([\#7063](#7063))
@turt2live turt2live added the kind:core MSC which is critical to the protocol's success label Apr 20, 2020
@cvincent cvincent mentioned this pull request Jun 29, 2020
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@neilalexander neilalexander neilalexander left review comments

@turt2live turt2live turt2live left review comments

@KitsuneRal KitsuneRal KitsuneRal left review comments

Assignees
No one assigned
Labels
kind:core MSC which is critical to the protocol's success obsolete A proposal which has been overtaken by other proposals proposal A matrix spec change proposal
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@richvdh @pakman @neilalexander @turt2live @KitsuneRal