summary refs log tree commit diff
diff options
context:
space:
mode:
authorErik Johnston <erik@matrix.org>2019-01-29 16:26:40 +0000
committerErik Johnston <erik@matrix.org>2019-01-29 16:57:00 +0000
commit8e3d34e3c58374ab32f3aaace916ddcb4b1a150c (patch)
treee0c635a667424392b45a0672ea6b28e7a9474a36
parentUse snder and not event ID domain to check if ours (diff)
downloadsynapse-8e3d34e3c58374ab32f3aaace916ddcb4b1a150c.tar.xz
Use event origin for filtering incoming events
We only process events sent to us from a server if the event ID matches
the server, to help guard against federation storms. We replace this
with a check against the event origin.
Diffstat (limited to '')
-rw-r--r--synapse/federation/federation_server.py11
1 files changed, 7 insertions, 4 deletions
diff --git a/synapse/federation/federation_server.py b/synapse/federation/federation_server.py
index 6681614232..5c3784c560 100644
--- a/synapse/federation/federation_server.py
+++ b/synapse/federation/federation_server.py
@@ -25,7 +25,7 @@ from twisted.internet import defer
 from twisted.internet.abstract import isIPAddress
 from twisted.python import failure
 
-from synapse.api.constants import EventTypes
+from synapse.api.constants import EventTypes, Membership
 from synapse.api.errors import (
     AuthError,
     FederationError,
@@ -620,16 +620,19 @@ class FederationServer(FederationBase):
         """
         # check that it's actually being sent from a valid destination to
         # workaround bug #1753 in 0.18.5 and 0.18.6
-        if origin != get_domain_from_id(pdu.event_id):
+        if origin != get_domain_from_id(pdu.sender):
             # We continue to accept join events from any server; this is
             # necessary for the federation join dance to work correctly.
             # (When we join over federation, the "helper" server is
             # responsible for sending out the join event, rather than the
-            # origin. See bug #1893).
+            # origin. See bug #1893. This is also true for some third party
+            # invites).
             if not (
                 pdu.type == 'm.room.member' and
                 pdu.content and
-                pdu.content.get("membership", None) == 'join'
+                pdu.content.get("membership", None) in (
+                    Membership.JOIN, Membership.INVITE,
+                )
             ):
                 logger.info(
                     "Discarding PDU %s from invalid origin %s",