rejected event used as an auth event #9595
Comments
|
this room is continuing to cause severe problems on my server. I'm going to leave it to try to make federation work again. |
|
(Doing |
|
The main problem here is that Really, we need to get rid of the whole premise of The two methods are also very confused about whether the auth events they are working with are those according to the
|
reivilibre
added
T-Defect
We should make sure that events that refer to rejected events in their auth_events are themselves rejected. See matrix-org/synapse#9595.
We should make sure that events that refer to rejected events in their auth_events are themselves rejected. See matrix-org/synapse#9595.
|
So I think we now have PRs that should stop this happening again in the future. The next question is whether we can do anything about existing brokenness in peoples' databases. |
I actually had a heated discussion about this in #matrix-spec yesterday, the consensus (and logical decision) is to - when re-validating - throw away the entire history of a room from that point on. Here is a link to the discussion, but the talk about this requirement and me wrestling with it and trying to find an alternative is a bit further up and down from that point. Thank you for clarifying that the issue has been fixed, though. |
Currently, when we receive an event whose auth_events differ from those we expect, we state-resolve between the two state sets, and check that the event passes auth based on the resolved state. This means that it's possible for us to accept events which don't pass auth at their declared auth_events (or where the auth events themselves were rejected), leading to problems down the line like #10083. This change means we will: * ignore any events where we cannot find the auth events * reject any events whose auth events were rejected * reject any events which do not pass auth at their declared auth_events. Together with a whole raft of previous work, this is a partial fix to #9595. Fixes #6643. Based on #11009.
This is the final piece of the jigsaw for #9595. As with other changes before this one (eg #10771), we need to make sure that we auth the auth events in the right order, and actually check that their predecessors haven't been rejected. To do this I've reused the existing code we use when persisting outliers elsewhere. I've removed the code for attempting to fetch missing auth_events - the events should have been present in the send_join response, so the likely reason they are missing is that we couldn't verify them, so requesting them again is unlikely to help. Instead, we simply drop any state which relies on those auth events, as we do at a backwards-extremity. See also matrix-org/complement#216 for a test for this.
|
I guess so. The problem is that we're still going to see this on an ongoing basis until we clear out existing problematic data. |
|
Is this related to a batch of rooms I can't join that I saved the join links to that when pressed all give "Auth events could not be found"? Can someone help me clear the database entries in my postgres db so I can join these rooms? I can join other rooms but once I've "poisoned" a room with a join link then I can't enter that room even if I manually find it through the room browser. Here are the join links (beware they will probably break the rooms for you too) https://matrix.to/#/!EoRhMvNpnWxCMTMPeP:libera.chat?via=geese.party&via=libera.chat&via=matrix.org https://matrix.to/#/!YLTeaulxSDauOOxBoR:matrix.org?via=geese.party&via=gitter.im&via=matrix.org https://matrix.to/#/!GryYovOTNVgikENmcX:libera.chat?via=geese.party&via=libera.chat&via=matrix.org |
Do we have a way to fix the database ? I have several channel with this issue. @richvdh UPDATE: I did upgrade the room. People can join the new room. However the previous room still is not accesible from |
@parisni What do you mean “upgrade room”? could you tell how to do that? i have same issue and i just want can join new room. |
Upgrade a roomThis will make the current room read-only, and create a new room see Simply type this as a message (you will be asked to invite every participant) : Run an api request : curl -H 'Authorization: Bearer <token-access>' -H "Content-Type: application/json" -X POST https://matrix.interhop.org/_matrix/client/r0/rooms/<room-id-url-encoded>/upgrade -d '{"new_version": "6"}'
|
in my database,
$h+BUjV0LuuSRmFh5ZFeSVZkP+oo6v7bhyJ+1wYjpLb4(a regular membership event) uses$NncVOvrPzkKl0u1Q8FIJ7Pz1kZH1iF2lwWj6pZ6+Kkg(a membership event which was rejected due to missing auth events) as an auth event. This seems wrong:$h+BUjV0LuuSRmFh5ZFeSVZkP+oo6v7bhyJ+1wYjpLb4should have been rejected too.Logs from the arrival of that event:
The text was updated successfully, but these errors were encountered: