Skip to content
This repository was archived by the owner on Apr 26, 2024. It is now read-only.

Force TLS certificate verification in registration script.#16530

Merged
clokep merged 2 commits intomatrix-org:developfrom
dkasak:dkasak/verify-tls-in-registration-script
Oct 23, 2023
Merged

Force TLS certificate verification in registration script.#16530
clokep merged 2 commits intomatrix-org:developfrom
dkasak:dkasak/verify-tls-in-registration-script

Conversation

@dkasak
Copy link
Member

@dkasak dkasak commented Oct 20, 2023 •
edited
Loading

Rationale: If using the script remotely, there's no particularly convincing reason to disable certificate verification, as this makes the connection interceptible. If on the other hand, the script is used locally (the most common use case), you can simply target the HTTP listener and avoid TLS altogether.

Pull Request Checklist

  • Pull request is based on the develop branch
  • Pull request includes a changelog file. The entry should:
    • Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
    • Use markdown where necessary, mostly for code blocks.
    • End with either a period (.) or an exclamation mark (!).
    • Start with a capital letter.
    • Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry.
  • Pull request includes a sign off
  • Code style is correct
    (run the linters)

@dkasak
Force TLS certificate verification in registration script.
21929b8 
Rationale: If using the script remotely, there's no particularly
convincing reason to disable certificate verification, as this makes the
connection interceptible. If on the other hand, the script is used
locally (the most common use case), you can simply target the HTTP
listener and avoid TLS altogether.

Signed-off-by: Denis Kasak <dkasak@termina.org.uk>
@dkasak dkasak requested a review from a team as a code owner October 20, 2023 14:46
clokep
clokep reviewed Oct 20, 2023
View reviewed changes
synapse/_scripts/register_new_matrix_user.py
Copy link
Member

@clokep clokep Oct 20, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like the common case of running this locally ensures you don't use TLS, see:

synapse/synapse/_scripts/register_new_matrix_user.py

Lines 298 to 299 in e9069c9

if listener.get("type") != "http" or listener.get("tls", False):
continue

synapse/synapse/_scripts/register_new_matrix_user.py

Lines 308 to 309 in e9069c9

# TODO: consider bind_addresses
return f"http://localhost:{listener['port']}"

@clokep clokep requested a review from a team October 20, 2023 16:16
DMRobertson
DMRobertson approved these changes Oct 23, 2023
View reviewed changes
Copy link
Contributor

@DMRobertson DMRobertson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems reasonable to me!

@clokep clokep merged commit 3a0aa6f into matrix-org:develop Oct 23, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

2 more reviewers

@clokep clokep clokep left review comments

@DMRobertson DMRobertson DMRobertson approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@dkasak @clokep @DMRobertson