Client IP-based channel bans as per IRC. (SYN-62)

[matrixbot]

It could be nice (but not vital) to say "please do not let any clients connect to this room from this IP mask". We'd obviously have to trust all participating HSes to uphold this, which makes it fairly useless - although if we don't trust a given HS, we should think about kicking it out of the gang somehow anyway.

(Imported from https://matrix.org/jira/browse/SYN-62)

(Reported by @ara4n)

[matrixbot]

Jira watchers: @ara4n

[matrixbot]

Links exported from Jira:

is blocked by SPEC-82

[richvdh]

This kinda got implemented by server_acls, though via server names rather than IP masks.

[ara4n]

well, not really - i opened this explicitly for the ability to specify a blacklist of client IPs, to stop known malicious IP addresses from being able to connect to a room (assuming all servers are wellbehaved), as is required to ban clients from botnet IPs or known bad netmasks.

[jevolk]

It would be best to be compatible with the IRC ban expressions which use CIDR masks and globular matching, for both hostnames and IP's.

[richvdh]

well, not really - i opened this explicitly for the ability to specify a blacklist of client IPs, to stop known malicious IP addresses from being able to connect to a room (assuming all servers are wellbehaved), as is required to ban clients from botnet IPs or known bad netmasks.

Hum. Why did we descope IP addresses from server_acls, then?

[richvdh]

Hum. Why did we descope IP addresses from server_acls, then?

Sorry, I was failing to parse the word 'client'. This issue is about banning clients rather than servers.

[e-lisa]

Hi, our server is under constant attack. I have commented on related issues to try to get some movement on this very basic functionality. I have overlooked this ticket because it is 6 years old... But I was told this is the "master ticket" for this issue.

Related functionality:
#7731

[e-lisa]

well, not really - i opened this explicitly for the ability to specify a blacklist of client IPs, to stop known malicious IP addresses from being able to connect to a room (assuming all servers are wellbehaved), as is required to ban clients from botnet IPs or known bad netmasks.

Additionally, there should be an option for a server-wide ban. To DISCONNECT a user from the server, and prevent reconnection.

Banning a user from a room when they are abusing an entire server is not a fix. This is even more important homeserver is not federated.

It is deeply troubling that Synapse lacks this basic functionality to prevent abusive users from maintaining a persistence presence on a server.

[e-lisa]

@ara4n @erikjohnston This seems to be getting a lot of attention recently.

Are their plans on on a path to get this merged?

Are merge/pull requests welcome?