continuwuation/continuwuity
continuwuation/continuwuity
12
41
Fork 41
Code Issues 93 Pull requests 19 Releases 24 Packages 3 Activity Actions 3

WIP: feat: Enhance invite security checks & do away with stripped state #1239

Closed
nex wants to merge 4 commits from nex/fix/fed-invite-compliance into main
pull from: nex/fix/fed-invite-compliance
merge into: continuwuation:main
Conversation 3 Commits 4 Files changed 12 +558 -193
nex commented 2025-12-23 19:54:04 +00:00
Owner
Copy link

This PR follows up the fixes for https://github.com/continuwuity/continuwuity/security/advisories/GHSA-22fw-4jq7-g8r8 pushed as part of 0.5.0 with some additional checks, and also makes those checks more idiomatic and easier to understand. Primarily a style update on that front. Additional checks were inspired by https://github.com/matrix-org/matrix-spec/pull/2284.

This PR also does away with stripped state - as stated in our dev room, I've failed to find a reason for its existence for months, and we now know that the server receives full events over federation for invites anyway, so I see no reason to keep it around. Inherently this also fixes #1098.

This PR follows up the fixes for https://github.com/continuwuity/continuwuity/security/advisories/GHSA-22fw-4jq7-g8r8 pushed as part of 0.5.0 with some additional checks, and also makes those checks more idiomatic and easier to understand. Primarily a style update on that front. Additional checks were inspired by https://github.com/matrix-org/matrix-spec/pull/2284. This PR *also* does away with stripped state - as stated in our dev room, I've failed to find a reason for its existence for months, and we now know that the server receives full events over federation for invites anyway, so I see no reason to keep it around. Inherently this also fixes #1098.
feat: Enhance invite security checks & do away with stripped state
All checks were successful
Update flake hashes / update-flake-hashes (pull_request) Successful in 32s
Details
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m3s
Details
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 2m37s
Details
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 20m11s
Details
04980b3ee7
nex requested review from Owners 2025-12-23 19:55:33 +00:00
feat: Allow using legacy, less secure validation
Some checks failed
Update flake hashes / update-flake-hashes (pull_request) Successful in 34s
Details
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m19s
Details
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 3m0s
Details
Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled
Details
81ff8f1bd3
fix: Don't treat every create event as unstripped
Some checks failed
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m22s
Details
Update flake hashes / update-flake-hashes (pull_request) Successful in 22s
Details
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 2m10s
Details
Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled
Details
f6ad1787a0
fix: Partially pervert botched previous commit
Some checks failed
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m28s
Details
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m16s
Details
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 3m41s
Details
Checks / Prek / Clippy and Cargo Tests (pull_request) Failing after 24m0s
Details
49ce6b4072
nex commented 2025-12-24 03:52:51 +00:00
Author
Owner
Copy link

this is busted

this is busted
nex commented 2025-12-24 04:13:49 +00:00
Author
Owner
Copy link

TODO

2025-12-24T04:13:04.529254Z DEBUG router{method=PUT path=/_matrix/federation/v2/invite/:room_id}:invite{client=80.3.155.46 room_id="!KjVas1Hl4buUCgHfOp:nexy7574.co.uk"}: conduwuit_api::server::invite: Received invite request from !KjVas1Hl4buUCgHfOp:nexy7574.co.uk: "nexy7574.co.uk"
2025-12-24T04:13:04.534633Z TRACE router{method=PUT path=/_matrix/federation/v2/invite/:room_id}:invite{client=80.3.155.46 room_id="!KjVas1Hl4buUCgHfOp:nexy7574.co.uk"}: conduwuit_api::server::invite: Hashing & signing invite event event={"auth_events": Array([String("$RemjzoiyzNGPmHwol9UpWzs-hj-9JenqXcMar9_6LNg"), String("$udI03SeicdodCFpjeMqMdBYUPUkgiQKiq54r3ZqhTy8"), String("$ewkkvTq7IE3pPWcVJOJDuRedsapXt1nn3F5jQabJ_fo"), String("$Bu0HV_YQA3DdVzeGWvTJdwy1Bb6b4ldbNkxReFHXQsA")]), "content": Object({"avatar_url": String("mxc://timedout.uk/sji8UYnFzYtfeu8TSPD0TuMDv4J891VX"), "is_direct": Bool(false), "membership": String("invite")}), "depth": 7, "hashes": Object({"sha256": String("oPJMnZUg6N06wEAvXWi6gKBmC//XqpHj4aX7unnCrDo")}), "origin": String("nexy7574.co.uk"), "origin_server_ts": 1766549584394, "prev_events": Array([String("$iu3C5NI11BpC5AaP_9S-fkvdfH3-Pmn5-cbUaKgasPA")]), "room_id": String("!KjVas1Hl4buUCgHfOp:nexy7574.co.uk"), "sender": String("@nex:nexy7574.co.uk"), "signatures": Object({"nexy7574.co.uk": Object({"ed25519:efn3fIVR": String("kg6VKD9PDsF7JPfJSA2Ql0ad1uzaOVmWV55XLUpZzkL2UsXzBPhYke1sOQwwwp68ic3r1oQSiHQhBbjJElQ+Bg")})}), "state_key": String("@nex:timedout.uk"), "type": String("m.room.member")}
2025-12-24T04:13:04.540108Z DEBUG router{method=PUT path=/_matrix/federation/v2/invite/:room_id}:invite{client=80.3.155.46 room_id="!KjVas1Hl4buUCgHfOp:nexy7574.co.uk"}: conduwuit_api::server::invite: Checking invite event validity
2025-12-24T04:13:04.548937Z DEBUG router{method=PUT path=/_matrix/federation/v2/invite/:room_id}:invite{client=80.3.155.46 room_id="!KjVas1Hl4buUCgHfOp:nexy7574.co.uk"}: conduwuit_api::server::invite: Checking invite state validity
2025-12-24T04:13:04.550986Z TRACE router{method=PUT path=/_matrix/federation/v2/invite/:room_id}:invite{client=80.3.155.46 room_id="!KjVas1Hl4buUCgHfOp:nexy7574.co.uk"}: conduwuit_api::server::invite: Processing invite state event: RawValue({"content":{"room_version":"11"},"event_id":"$udI03SeicdodCFpjeMqMdBYUPUkgiQKiq54r3ZqhTy8","origin_server_ts":1766520149739,"room_id":"!KjVas1Hl4buUCgHfOp:nexy7574.co.uk","sender":"@nex:nexy7574.co.uk","state_key":"","type":"m.room.create","unsigned":{}})
2025-12-24T04:13:04.555561Z  WARN router{method=PUT path=/_matrix/federation/v2/invite/:room_id}:invite{client=80.3.155.46 room_id="!KjVas1Hl4buUCgHfOp:nexy7574.co.uk"}: conduwuit_api::server::invite: Invite state validity check failed: M_INVALID_PARAM: Signature failed verification on event $nvWbJ-TEuuDZ4HuQSxgLyLFBTaK0l5KjS4XrHwVR2Rc: JSON error: JSON object must contain the field "hashes"
TODO ``` 2025-12-24T04:13:04.529254Z DEBUG router{method=PUT path=/_matrix/federation/v2/invite/:room_id}:invite{client=80.3.155.46 room_id="!KjVas1Hl4buUCgHfOp:nexy7574.co.uk"}: conduwuit_api::server::invite: Received invite request from !KjVas1Hl4buUCgHfOp:nexy7574.co.uk: "nexy7574.co.uk" 2025-12-24T04:13:04.534633Z TRACE router{method=PUT path=/_matrix/federation/v2/invite/:room_id}:invite{client=80.3.155.46 room_id="!KjVas1Hl4buUCgHfOp:nexy7574.co.uk"}: conduwuit_api::server::invite: Hashing & signing invite event event={"auth_events": Array([String("$RemjzoiyzNGPmHwol9UpWzs-hj-9JenqXcMar9_6LNg"), String("$udI03SeicdodCFpjeMqMdBYUPUkgiQKiq54r3ZqhTy8"), String("$ewkkvTq7IE3pPWcVJOJDuRedsapXt1nn3F5jQabJ_fo"), String("$Bu0HV_YQA3DdVzeGWvTJdwy1Bb6b4ldbNkxReFHXQsA")]), "content": Object({"avatar_url": String("mxc://timedout.uk/sji8UYnFzYtfeu8TSPD0TuMDv4J891VX"), "is_direct": Bool(false), "membership": String("invite")}), "depth": 7, "hashes": Object({"sha256": String("oPJMnZUg6N06wEAvXWi6gKBmC//XqpHj4aX7unnCrDo")}), "origin": String("nexy7574.co.uk"), "origin_server_ts": 1766549584394, "prev_events": Array([String("$iu3C5NI11BpC5AaP_9S-fkvdfH3-Pmn5-cbUaKgasPA")]), "room_id": String("!KjVas1Hl4buUCgHfOp:nexy7574.co.uk"), "sender": String("@nex:nexy7574.co.uk"), "signatures": Object({"nexy7574.co.uk": Object({"ed25519:efn3fIVR": String("kg6VKD9PDsF7JPfJSA2Ql0ad1uzaOVmWV55XLUpZzkL2UsXzBPhYke1sOQwwwp68ic3r1oQSiHQhBbjJElQ+Bg")})}), "state_key": String("@nex:timedout.uk"), "type": String("m.room.member")} 2025-12-24T04:13:04.540108Z DEBUG router{method=PUT path=/_matrix/federation/v2/invite/:room_id}:invite{client=80.3.155.46 room_id="!KjVas1Hl4buUCgHfOp:nexy7574.co.uk"}: conduwuit_api::server::invite: Checking invite event validity 2025-12-24T04:13:04.548937Z DEBUG router{method=PUT path=/_matrix/federation/v2/invite/:room_id}:invite{client=80.3.155.46 room_id="!KjVas1Hl4buUCgHfOp:nexy7574.co.uk"}: conduwuit_api::server::invite: Checking invite state validity 2025-12-24T04:13:04.550986Z TRACE router{method=PUT path=/_matrix/federation/v2/invite/:room_id}:invite{client=80.3.155.46 room_id="!KjVas1Hl4buUCgHfOp:nexy7574.co.uk"}: conduwuit_api::server::invite: Processing invite state event: RawValue({"content":{"room_version":"11"},"event_id":"$udI03SeicdodCFpjeMqMdBYUPUkgiQKiq54r3ZqhTy8","origin_server_ts":1766520149739,"room_id":"!KjVas1Hl4buUCgHfOp:nexy7574.co.uk","sender":"@nex:nexy7574.co.uk","state_key":"","type":"m.room.create","unsigned":{}}) 2025-12-24T04:13:04.555561Z WARN router{method=PUT path=/_matrix/federation/v2/invite/:room_id}:invite{client=80.3.155.46 room_id="!KjVas1Hl4buUCgHfOp:nexy7574.co.uk"}: conduwuit_api::server::invite: Invite state validity check failed: M_INVALID_PARAM: Signature failed verification on event $nvWbJ-TEuuDZ4HuQSxgLyLFBTaK0l5KjS4XrHwVR2Rc: JSON error: JSON object must contain the field "hashes" ```
nex changed title from feat: Enhance invite security checks & do away with stripped state to WIP: feat: Enhance invite security checks & do away with stripped state 2025-12-24 04:13:56 +00:00
nex self-assigned this 2025-12-24 04:13:58 +00:00
nex commented 2026-01-16 13:09:25 +00:00
Author
Owner
Copy link

This PR will be superseded

This PR will be superseded
nex closed this pull request 2026-01-16 13:09:39 +00:00
Some checks failed
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m28s
Details
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m16s
Details
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 3m41s
Required
Details
Checks / Prek / Clippy and Cargo Tests (pull_request) Failing after 24m0s
Required
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
continuwuation/Owners
Labels
Clear labels   
Blocked

This pull request or issue is currently blocked from being merged/closed

  
Bug

Something isn't working as intended

  
Cherry-picking

Commits picked from other conduit projects

  
Database

This requires or includes changes to the database

  
Dependencies

Something dependency related

  
Dependencies/Renovate

Automatic dependency upgrades by Renovate

  
Difficulty
Easy
Low difficulty to implement - touches few parts of the codebase, low complexity

  
Difficulty
Hard
High difficulty to implement - touches many parts of the codebase, high complexity

  
Difficulty
Medium
Medium difficulty to implement - touches more parts of the codebase, higher complexity

  
Documentation

Improvements or additions to documentation

  
Enhancement

New feature or request

  
Good first issue

Good for newcomers

  
Help wanted

Additional eyes and keyboards are required for this one

  
Inherited

Issues that have been inhereted from the project pre-fork

  
Matrix/Administration

Features pertaining to homeserver administration

  
Matrix/Appservices

Features pertaining to the appservice API

  
Matrix/Auth

Features pertaining to authentication

  
Matrix/Client

Features pertaining to client-to-server interactions

  
Matrix/Core

Issues relating to core matrix functionality, such as state resolution and PDU formats

  
Matrix/Federation

Features pertaining to server-to-server interactions

  
Matrix/Hydra

Issues related to room version 12 and related changes (temporary label)

  
Matrix/MSC

Features pertaining to unstable matrix features

  
Matrix/Media

Features pertaining to media interactions

  
Meta

Related to housekeeping, maintenance, or other repo-meta.

  
Meta/CI

Issues related to CI changes

  
Meta/Packaging

Packaging

  
Priority
Blocking
This issue is blocking the next release

  
Priority
High
This issue is very important

  
Priority
Low
This issue is of a rather low priority

  
Security

This item is related to general security

  
Status
Confirmed
This issue has enough information and is confirmed

  
Status
Duplicate
This issue or pull request already exists

  
Status
Invalid
This issue doesn't seem right

  
Status
Needs Investigation
This issue needs further investigation

  
Support

Questions or support requests

  
To-Merge

   
Wont fix

This will not be worked on

  
old/ci/cd

Ci/CD

Archived

  
old/rust

Pull requests that update Rust code

Archived

No labels
Blocked
Bug
Cherry-picking
Database
Dependencies
Dependencies/Renovate
Difficulty
Easy
Difficulty
Hard
Difficulty
Medium
Documentation
Enhancement
Good first issue
Help wanted
Inherited
Matrix/Administration
Matrix/Appservices
Matrix/Auth
Matrix/Client
Matrix/Core
Matrix/Federation
Matrix/Hydra
Matrix/MSC
Matrix/Media
Meta
Meta/CI
Meta/Packaging
Priority
Blocking
Priority
High
Priority
Low
Security
Status
Confirmed
Status
Duplicate
Status
Invalid
Status
Needs Investigation
Support
To-Merge
Wont fix
old/ci/cd
old/rust
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
nex
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
continuwuation/continuwuity!1239
No description provided.