element-hq / element-hq/dendrite
federation transactions failing signature authentication with synapse
- Dominant language
- Go
- Stars
- 965
- Forks
- 101
- PR merge metrics
- No merged PRs in 30d
Description
*This issue was originally created by [**@ashkitten**](https://github.com/ashkitten) at .*
### Background information
- **Dendrite version or git SHA**: 0.13.1
- **SQLite3 or Postgres?**: postgres
- **Running in Docker?**: no
- **`go version`**: 1.20.5
- **Client used (if applicable)**:
### Description
- **What** is the problem: my dendrite server always receives HTTP 401 responses from my synapse server when sending a federation transaction.
- **Who** is affected: my dendrite server (nyrina.link) and my synapse server (kity.wtf)
- **How** is this bug manifesting: kity.wtf keeps spitting out messages like this in logs:
```
Jul 25 21:47:05 steve synapse[2031445]: synapse.federation.transport.server._base: [PUT-5553614] authenticate_request failed: 401: Invalid signature for server [nyrina.link](http://nyrina.link/) with key ed25519:oHl6VZ: Unable to verify signature for [nyrina.link](http://nyrina.link/): Signature was forged or corrupt
Jul 25 21:47:05 steve synapse[2031445]: synapse.http.server: [PUT-5553614] SynapseError: 401 - Invalid signature for server [nyrina.link](http://nyrina.link/) with key ed25519:oHl6VZ: Unable to verify signature for [nyrina.link](http://nyrina.link/): Signature was forged or corrupt
```
meanwhile nyrina.link only has this in (debug level) logs:
```
Jul 26 03:15:12 xenia dendrite[230252]: time="2023-07-26T03:15:12.583817125Z" level=debug msg="Sending transaction \"1690338729600-1\" containing 50 PDUs, 100 EDUs" server_name=[kity.wtf](http://kity.wtf/)
Jul 26 03:15:12 xenia dendrite[230252]: time="2023-07-26T03:15:12.748215964Z" level=debug msg="Transaction failed with HTTP401"
```
- **When** did this first appear: 2023-07-10, maybe. this is the earliest timestamp i can find in the json event contents of HTTP requests intercepted by wireshark on the loopback interface (post tls termination) of kity.wtf. at the time, i was running dendrite 0.12.0 and upgraded on 2023-07-15 after noticing the issue.
### Steps to reproduce
- be me
- 🤷🏻♀️
i can send wireshark captures over matrix if it would help, or any other debugging steps.
Contributor guide
Research direction
Start by examining Dendrite's federation transaction handling for PUT requests to `/_matrix/federation/v1/send/...` and compare its signing and verification data with the Synapse logs showing HTTP 401 responses. Use the reported versions and captured request data to reproduce the signature failure; done means federation transactions authenticate successfully against Synapse without forged-or-corrupt signature errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100