element-hq / element-hq/synapse

Not whitelisting federation with matrix.org causes errors when fetching keys

Open
#4,856 0 comments 0 reactions 0 assignees View on GitHub
A-Federation A-Invite T-Defect
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 6h
Merged PRs (30d)
46

Description

This issue has been migrated from [#4856](https://github.com/matrix-org/synapse/issues/4856).

---

### Description

I've got 2 servers with federation enabled. Each server only whitelists the other in `federation_domain_whitelist`. I'm only expecting them to federate with one another.

When I make a room and invite a user from the other server (inviting by matrix id), Synapse would first try retrieving some signature keys using perspectives (via matrix.org).

Since federation with matrix.org is not enabled, this would fail with the following error:

```
2019-03-14 07:56:27,716 - synapse.crypto.keyring - 385 - ERROR - POST-118 - Unable to get key from 'matrix.org': FederationDeniedError 403: Federation denied with matrix.org.
Traceback (most recent call last):
File "/usr/local/lib/python3.6/site-packages/twisted/internet/defer.py", line 1418, in _inlineCallbacks
result = g.send(result)
File "/usr/local/lib/python3.6/site-packages/synapse/storage/_base.py", line 460, in runWithConnection
defer.returnValue(result)
File "/usr/local/lib/python3.6/site-packages/twisted/internet/defer.py", line 1362, in returnValue
raise _DefGen_Return(val)
twisted.internet.defer._DefGen_Return: None
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/local/lib/python3.6/site-packages/twisted/internet/defer.py", line 1418, in _inlineCallbacks
result = g.send(result)
File "/usr/local/lib/python3.6/site-packages/synapse/storage/_base.py", line 418, in runInteraction
defer.returnValue(result)
File "/usr/local/lib/python3.6/site-packages/twisted/internet/defer.py", line 1362, in returnValue
raise _DefGen_Return(val)
twisted.internet.defer._DefGen_Return: None
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/local/lib/python3.6/site-packages/twisted/internet/defer.py", line 1418, in _inlineCallbacks
result = g.send(result)
StopIteration
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/local/lib/python3.6/site-packages/twisted/internet/defer.py", line 1418, in _inlineCallbacks
result = g.send(result)
File "/usr/local/lib/python3.6/site-packages/synapse/storage/keys.py", line 124, in get_server_verify_keys
defer.returnValue(keys)
File "/usr/local/lib/python3.6/site-packages/twisted/internet/defer.py", line 1362, in returnValue
raise _DefGen_Return(val)
twisted.internet.defer._DefGen_Return: {}
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/local/lib/python3.6/site-packages/twisted/internet/defer.py", line 1418, in _inlineCallbacks
result = g.send(result)
File "/usr/local/lib/python3.6/site-packages/synapse/crypto/keyring.py", line 366, in get_keys_from_store
defer.returnValue(dict(res))
File "/usr/local/lib/python3.6/site-packages/twisted/internet/defer.py", line 1362, in returnValue
raise _DefGen_Return(val)
twisted.internet.defer._DefGen_Return: {'OWN_DOMAIN_HERE': {}}
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/local/lib/python3.6/site-packages/synapse/crypto/keyring.py", line 374, in get_key
server_name_and_key_ids, perspective_name, perspective_keys
synapse.api.errors.FederationDeniedError: 403: Federation denied with matrix.org.
```

From what I've seen, this comes from `synapse/crypto/keyring.py`, which tries getting keys using the following methods (in order):

- local store
- perspectives (matrix.org)
- directly from the server

A failure during this "perspectives" method of fetching keys doesn't seem to cause a fatal failure, as it just falls back to the 3rd method (directly from the server).

Still, it generates useless errors in the log.

Maybe this will go away by itself when Synapse hits v1.0 and the perspectives approach is eliminated?

Maybe the correct way to fix it now is to **not instruct Synapse to use perspectives**.
This likely breaks federation with old servers, but if one is building a private federation, it's likely okay to do it.

### Version information

- **Version**: 0.99.2

- **Install method**: Docker

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.