Security update: Synapse 0.32.0

2018-07-06 — Releases, Security — Neil Johnson

Folks, Synapse 0.32.0 is an important security update: please upgrade as soon as you can.

The release focuses on security; fixing several federation bugs and adding new features for countering abuse. Notably it includes the ability to blacklist & whitelist servers allowed to send events to a room on a per-room basis via the new m.room.server_acl state event: see MSC1383 for details. This also closes out https://github.com/matrix-org/matrix-doc/issues/709 - one of our oldest feature requests from users who wish to be able to limit the servers allowed to participate in a given room.

It's important to understand that server ACLs only work if all the servers participating in the room honour them. In future this will be handled better (as part of ongoing work in making it easier to incrementally version and upgrade the federation protocol). This means that for the ACLs to work, any servers which don't yet implement ACLs (e.g. older Synapses) have to be ACL'd from the room for the access control to work.

Therefore please upgrade as soon as possible to avoid this problem.

This ongoing flurry of security work is in general all part of moving towards the long-awaited stable release of the Server-Server API. In parallel we've been working on the other main outstanding point: State Resets (i.e. scenarios where you get unexpected results when resolving conflicts between different servers' copies of a room). There will be a few more major changes and upgrades on the horizon as we fix these, but then we'll finally be able to cut an r0 release of the Server-Server API and Matrix will be one massive step closer to being out of beta!

As always, you can get the new update from https://github.com/matrix-org/synapse/releases/tag/v0.32.1 or any of the sources mentioned at https://github.com/matrix-org/synapse.

Changes in synapse v0.32.0 (2018-07-06)

No changes since 0.32.0rc1

Synapse 0.32.0rc1 (2018-07-05)

Features

Add blacklist & whitelist of servers allowed to send events to a room via m.room.server_acl event. (merge)
Cache factor override system for specific caches (#3334)
Add metrics to track appservice transactions (#3344)
Try to log more helpful info when a sig verification fails (#3372)
Synapse now uses the best performing JSON encoder/decoder according to your runtime (simplejson on CPython, stdlib json on PyPy). (#3462)
Add optional ip_range_whitelist param to AS registration files to lock AS IP access (#3465)
Reject invalid server names in federation requests (#3480)
Reject invalid server names in homeserver.yaml (#3483)

Bugfixes

Strip access_token from outgoing requests (#3327)
Redact AS tokens in logs (#3349)
Fix federation backfill from SQLite servers (#3355)
Fix event-purge-by-ts admin API (#3363)
Fix event filtering in get_missing_events handler (#3371)
Synapse is now stricter regarding accepting events which it cannot retrieve the prev_events for. (#3456)
Fix bug where synapse would explode when receiving unicode in HTTP User-Agent header (#3470)
Invalidate cache on correct thread to avoid race (#3473)