element-hq / element-hq/dendrite

Default configuration for Dendrite refuses to outbound connect over IPv6

Open
#3,676 2 comments 7 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
965
Forks
101
PR merge metrics
No merged PRs in 30d

Description

https://github.com/element-hq/dendrite/blob/e9cc37ac52ff1611ddf055a95e65869806041038/setup/config/config_federationapi.go#L71-L73

Since the default federation_api.allow_networks ACLs do not include ::/0, IPv6 addresses always get denied in the outbound ACL checks. I suspect this is just a simple mistake, if this was deliberate I would expect to see a comment in there or something explaining the rationale.

We noticed this after moving our Dendrite server to an IPv6 only machine (with NAT64). The symptoms included "failed to fetch keys for some servers" warning logs, which only under debug log level would show a more useful cause: `msg="Outgoing request failed" error="Post \"matrix://delroth.net/_matrix/key/v2/query\": dial tcp [2a01:4f8:13b:f15::1]:8448: [2a01:4f8:13b:f15::1]:8448 is denied" `.

We tested that adding ::/0 to the allow_networks via configuration solved the issue, so adding it to the defaults should work to fix this.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.