Federation allow list #673

Closed

Jade wants to merge 4 commits from JadedBlueEyes/federation-allow-list into main

Jade commented

2025-01-18 17:08:32 +00:00

Owner

This adds an allowed_remote_server_names. When empty, all remote servers are allowed. When set, servers not in the list are treated the same as forbidden_remote_server_names.

This additionally makes these options apply to remote media fetching and remote room directory fetching.

Not sure if ignoring messages from servers not in the allow-list is the best behaviour - it may result in some unexpected behaviour in cases like #672, where users are in a room with a non-allowed user via an allowed user. Perhaps this should be a separate option?

Unfortunately, the example config won't regenerate for me.
Tested and appears to work well (matrix-limited-federation.pissing.dev, only allows pissing.dev)

A useful enhancement for this and related options may be glob matching, or reading from a policy room. Out of scope for this, though.

This adds an `allowed_remote_server_names`. When empty, all remote servers are allowed. When set, servers not in the list are treated the same as `forbidden_remote_server_names`. This additionally makes these options apply to remote media fetching and remote room directory fetching. Not sure if ignoring messages from servers not in the allow-list is the best behaviour - it may result in some unexpected behaviour in cases like #672, where users are in a room with a non-allowed user via an allowed user. Perhaps this should be a separate option? Unfortunately, the example config won't regenerate for me. Tested and appears to work well (`matrix-limited-federation.pissing.dev`, only allows `pissing.dev`) A useful enhancement for this and related options may be glob matching, or reading from a policy room. Out of scope for this, though.

Jade commented

2025-01-29 19:51:44 +00:00

Author

Owner

Rebased on the latest main, but I haven't tested config live reload with this as it's not a feature I use