element-hq / element-hq/dendrite

federation transactions failing signature authentication with synapse

Open
#3,158 2 comments 0 reactions 0 assignees View on GitHub
bug upstream S-Major T-Defect
Dominant language
Go
Stars
965
Forks
101
PR merge metrics
No merged PRs in 30d

Description

*This issue was originally created by [**@ashkitten**](https://github.com/ashkitten) at .*

### Background information

- **Dendrite version or git SHA**: 0.13.1
- **SQLite3 or Postgres?**: postgres
- **Running in Docker?**: no
- **`go version`**: 1.20.5
- **Client used (if applicable)**:

### Description

- **What** is the problem: my dendrite server always receives HTTP 401 responses from my synapse server when sending a federation transaction.
- **Who** is affected: my dendrite server (nyrina.link) and my synapse server (kity.wtf)
- **How** is this bug manifesting: kity.wtf keeps spitting out messages like this in logs:
```
Jul 25 21:47:05 steve synapse[2031445]: synapse.federation.transport.server._base: [PUT-5553614] authenticate_request failed: 401: Invalid signature for server [nyrina.link](http://nyrina.link/) with key ed25519:oHl6VZ: Unable to verify signature for [nyrina.link](http://nyrina.link/): Signature was forged or corrupt
Jul 25 21:47:05 steve synapse[2031445]: synapse.http.server: [PUT-5553614] SynapseError: 401 - Invalid signature for server [nyrina.link](http://nyrina.link/) with key ed25519:oHl6VZ: Unable to verify signature for [nyrina.link](http://nyrina.link/): Signature was forged or corrupt
```
meanwhile nyrina.link only has this in (debug level) logs:
```
Jul 26 03:15:12 xenia dendrite[230252]: time="2023-07-26T03:15:12.583817125Z" level=debug msg="Sending transaction \"1690338729600-1\" containing 50 PDUs, 100 EDUs" server_name=[kity.wtf](http://kity.wtf/)
Jul 26 03:15:12 xenia dendrite[230252]: time="2023-07-26T03:15:12.748215964Z" level=debug msg="Transaction failed with HTTP401"
```
- **When** did this first appear: 2023-07-10, maybe. this is the earliest timestamp i can find in the json event contents of HTTP requests intercepted by wireshark on the loopback interface (post tls termination) of kity.wtf. at the time, i was running dendrite 0.12.0 and upgraded on 2023-07-15 after noticing the issue.

### Steps to reproduce

- be me
- 🤷🏻‍♀️

i can send wireshark captures over matrix if it would help, or any other debugging steps.

Contributor guide

Open the contributing guide

Research direction

Start by examining Dendrite's federation transaction handling for PUT requests to `/_matrix/federation/v1/send/...` and compare its signing and verification data with the Synapse logs showing HTTP 401 responses. Use the reported versions and captured request data to reproduce the signature failure; done means federation transactions authenticate successfully against Synapse without forged-or-corrupt signature errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.