Federation outbound proxy

synapse/config/federation.py

@@ -13,11 +13,23 @@
 # limitations under the License.
 from typing import Any, Optional
 
+import attr
+
 from synapse.config._base import Config
 from synapse.config._util import validate_config
 from synapse.types import JsonDict
 
 
+@attr.s(frozen=True, auto_attribs=True)
+class FederationProxy:
+    """A proxy server for outbound federation traffic, for URIs with a
+    `matrix-federation://` scheme.
+    """
+
+    host: str
+    port: int
+
+
 class FederationConfig(Config):
     section = "federation"
 
@@ -49,5 +61,12 @@ def read_config(self, config: JsonDict, **kwargs: Any) -> None:
             "allow_device_name_lookup_over_federation", False
         )
 
+        self.federation_proxy = None
+        federation_proxy = config.get("federation_proxy")
+        if federation_proxy:
+            host = federation_proxy["host"]
+            port = int(federation_proxy["port"])
+            self.federation_proxy = FederationProxy(host, port)
+
 
 _METRICS_FOR_DOMAINS_SCHEMA = {"type": "array", "items": {"type": "string"}}

synapse/http/federation/matrix_federation_agent.py

@@ -174,7 +174,7 @@ def request(
         # the host header with the delegated server name.
         delegated_server = None
         if (
-            parsed_uri.scheme == b"matrix"
+            parsed_uri.scheme == b"matrix-federation"
             and not _is_ip_literal(parsed_uri.hostname)
             and not parsed_uri.port
         ):
@@ -379,7 +379,7 @@ async def _resolve_server(self) -> List[Server]:
         connect to.
         """
 
-        if self._parsed_uri.scheme != b"matrix":
+        if self._parsed_uri.scheme != b"matrix-federation":
             return [Server(host=self._parsed_uri.host, port=self._parsed_uri.port)]
 
         # Note: We don't do well-known lookup as that needs to have happened

synapse/http/matrixfederationclient.py

@@ -50,7 +50,7 @@
 from twisted.internet.task import Cooperator
 from twisted.web.client import ResponseFailed
 from twisted.web.http_headers import Headers
-from twisted.web.iweb import IBodyProducer, IResponse
+from twisted.web.iweb import IAgent, IBodyProducer, IResponse
 
 import synapse.metrics
 import synapse.util.retryutils
@@ -175,7 +175,14 @@ def __attrs_post_init__(self) -> None:
 
         # The object is frozen so we can pre-compute this.
         uri = urllib.parse.urlunparse(
-            (b"matrix", destination_bytes, path_bytes, None, query_bytes, b"")
+            (
+                b"matrix-federation",
+                destination_bytes,
+                path_bytes,
+                None,
+                query_bytes,
+                b"",
+            )
         )
         object.__setattr__(self, "uri", uri)
 
@@ -389,9 +396,21 @@ def __init__(
         if hs.config.server.user_agent_suffix:
             user_agent = "%s %s" % (user_agent, hs.config.server.user_agent_suffix)
 
-        federation_agent = ProxyAgent(
-            self.reactor, self.reactor, tls_client_options_factory
-        )
+        if hs.config.federation.federation_proxy:
+            federation_agent: IAgent = ProxyAgent(
+                self.reactor,
+                self.reactor,
+                tls_client_options_factory,
+                federation_proxy=hs.config.federation.federation_proxy,
+            )
+        else:
+            federation_agent = MatrixFederationAgent(
+                self.reactor,
+                tls_client_options_factory,
+                user_agent.encode("ascii"),
+                hs.config.server.federation_ip_range_whitelist,
+                hs.config.server.federation_ip_range_blacklist,
+            )
 
         # Use a BlacklistingAgentWrapper to prevent circumventing the IP
         # blacklist via IP literals in server names

synapse/http/proxyagent.py

@@ -36,6 +36,7 @@
 from twisted.web.http_headers import Headers
 from twisted.web.iweb import IAgent, IBodyProducer, IPolicyForHTTPS, IResponse
 
+from synapse.config.federation import FederationProxy
 from synapse.http import redact_uri
 from synapse.http.connectproxyclient import HTTPConnectProxyEndpoint, ProxyCredentials
 
@@ -89,6 +90,7 @@ def __init__(
         bindAddress: Optional[bytes] = None,
         pool: Optional[HTTPConnectionPool] = None,
         use_proxy: bool = False,
+        federation_proxy: Optional[FederationProxy] = None,
     ):
         contextFactory = contextFactory or BrowserLikePolicyForHTTPS()
 
@@ -126,6 +128,7 @@ def __init__(
 
         self._policy_for_https = contextFactory
         self._reactor = reactor
+        self._federation_proxy = federation_proxy
 
     def request(
         self,
@@ -214,8 +217,12 @@ def request(
                 parsed_uri.port,
                 self.https_proxy_creds,
             )
-        elif parsed_uri.scheme == b"matrix":
-            endpoint = HostnameEndpoint(self.proxy_reactor, "127.0.0.1", 3000)
+        elif parsed_uri.scheme == b"matrix-federation" and self._federation_proxy:
+            endpoint = HostnameEndpoint(
+                self.proxy_reactor,
+                self._federation_proxy.host,
+                self._federation_proxy.port,
+            )
             request_path = uri
         else:
             # not using a proxy
@@ -236,7 +243,7 @@ def request(
             endpoint = wrapClientTLS(tls_connection_creator, endpoint)
         elif parsed_uri.scheme == b"http":
             pass
-        elif parsed_uri.scheme == b"matrix":
+        elif parsed_uri.scheme == b"matrix-federation" and self._federation_proxy:
             pass
         else:
             return defer.fail(