element-hq / element-hq/synapse
tlsv1 alert protocol version (Synapse can't make TLS 1.3 requests, FreeBSD)
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
### Description
Hi,
some admins who (like me) run their own homeservers told me their servers won't get room updates directly from my server, it takes another server to accept them, and relay them to their homeservers.
### Steps to reproduce
- send a message in room
- get feedback from some users that my messages lag, that they don't get updates directly from my homeserver, it needs for some other server to accept them, then relay them to their homeserver
- check log and observe abovementioned INFO message
### Homeserver
mimar.rs
### Synapse Version
1.104.0
### Installation Method
Other (please mention below)
### Database
PostgreSQL
### Workers
Single process
### Platform
FreeBSD jail (14.0 x64) running on FreeBSD host (14.0 x64).
### Configuration
I added `federation_client_minimum_tls_version: "1.2"` but the problem remains.
### Relevant log output
```shell
(real domain changed to example.org)
2024-04-04 10:33:42,479 - synapse.http.matrixfederationclient - 799 - INFO - federation_transaction_transmission_loop-4667- {PUT-O-4699} [example.org] Request failed: PUT matrix-federation://example.org/_matrix/federation/v1/send/1712218846484: RequestTransmissionFailed:[Error([('SSL routines', '', 'tlsv1 alert protocol version')])]
```
### Anything else that would be useful to know?
Same situation happens with current FreeBSD port/package (1.98.0). I created my custom port and upgraded to 1.104.0 (will send patches to FreeBSD after a few days of running it if no problems appear), but the problem remains.
Contributor guide
Research direction
Start with the federation_transaction_transmission_loop log entry in synapse.http.matrixfederationclient and investigate the TLS alert when sending federation requests from FreeBSD. Compare the configured federation_client_minimum_tls_version with the observed negotiation and reproduce the failure; done means Synapse can make the affected TLS requests and federation updates arrive directly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100