diff options
| author | Patrick Cloke <clokep@users.noreply.github.com> | 2020-12-02 11:09:24 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-12-02 11:09:24 -0500 |
| commit | 30fba6210834a4ecd91badf0c8f3eb278b72e746 (patch) | |
| tree | 3396057c52cf6372d4bec0d32fe08f767f6f5d31 /docs | |
| parent | Correctly handle unpersisted events when calculating auth chain difference. (... (diff) | |
| download | synapse-30fba6210834a4ecd91badf0c8f3eb278b72e746.tar.xz | |
Apply an IP range blacklist to push and key revocation requests. (#8821)
Replaces the `federation_ip_range_blacklist` configuration setting with an `ip_range_blacklist` setting with wider scope. It now applies to: * Federation * Identity servers * Push notifications * Checking key validitity for third-party invite events The old `federation_ip_range_blacklist` setting is still honored if present, but with reduced scope (it only applies to federation and identity servers).
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/sample_config.yaml | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/docs/sample_config.yaml b/docs/sample_config.yaml index 394eb9a3ff..6dbccf5932 100644 --- a/docs/sample_config.yaml +++ b/docs/sample_config.yaml @@ -642,17 +642,19 @@ acme: # - nyc.example.com # - syd.example.com -# Prevent federation requests from being sent to the following -# blacklist IP address CIDR ranges. If this option is not specified, or -# specified with an empty list, no ip range blacklist will be enforced. +# Prevent outgoing requests from being sent to the following blacklisted IP address +# CIDR ranges. If this option is not specified, or specified with an empty list, +# no IP range blacklist will be enforced. # -# As of Synapse v1.4.0 this option also affects any outbound requests to identity -# servers provided by user input. +# The blacklist applies to the outbound requests for federation, identity servers, +# push servers, and for checking key validitity for third-party invite events. # # (0.0.0.0 and :: are always blacklisted, whether or not they are explicitly # listed here, since they correspond to unroutable addresses.) # -federation_ip_range_blacklist: +# This option replaces federation_ip_range_blacklist in Synapse v1.24.0. +# +ip_range_blacklist: - '127.0.0.0/8' - '10.0.0.0/8' - '172.16.0.0/12' |