Soft-failures make federated bans racy and frustrate redaction

[matrixbot]

This issue has been migrated from #9329.

---

I've come across this issue twice in two days:

• A user joins over federation and spams messages into the room
• Mjolnir bans the user and redacts their messages
• Users from other homeservers report that an unredacted message remains, but my homeserver doesn't have it

I think the issue is:

• Synapse soft-fails a message from the banned user that other homeservers have accepted
• ⇒ Redaction of this message is now impossible

A sample is below. Mjolnir's FirstMessageIsImageProtection banned and redacted the user after they sent three images, but their fourth image is soft-failed, making redaction impossible.

archlinux.org rejected the message:

[root@matrix ~]# journalctl --since='3 hours ago' | grep "\$WM5mW7VqMvW19ceHPt1r-jrLCPJE8pGCVXfVZKQ47io"
Feb 04 14:04:17 matrix.archlinux.org synapse[56716]: synapse.handlers.federation: [PUT-159337-$WM5mW7VqMvW19ceHPt1r-jrLCPJE8pGCVXfVZKQ47io] handling received PDU: <FrozenEventV3 event_id='$WM5mW7VqMvW19ceHPt1r-jrLCPJE8pGCVXfVZKQ47io', type='m.room.message', state_key=None>
Feb 04 14:04:17 matrix.archlinux.org synapse[56716]: synapse.state: [PUT-159337-$WM5mW7VqMvW19ceHPt1r-jrLCPJE8pGCVXfVZKQ47io] Resolving state for !SEgsRQLScqPxYtucHl:archlinux.org with groups [2601779, 2601782]
Feb 04 14:04:18 matrix.archlinux.org synapse[56716]: synapse.handlers.federation: [PUT-159337-$WM5mW7VqMvW19ceHPt1r-jrLCPJE8pGCVXfVZKQ47io] Soft-failing <FrozenEventV3 event_id='$WM5mW7VqMvW19ceHPt1r-jrLCPJE8pGCVXfVZKQ47io', type='m.room.message', state_key=None> because 403: User [bad-user] not in room !SEgsRQLScqPxYtucHl:archlinux.org (<FrozenEventV3 event_id='$SdIQbg5dST1Yly1f-_G8qERVvbOUPeO5P2lHt3Fe3vI', type='m.room.member', state_key='[bad-user]'>)
Feb 04 14:04:18 matrix.archlinux.org synapse[56716]: synapse.http.client: [PUT-159337-$WM5mW7VqMvW19ceHPt1r-jrLCPJE8pGCVXfVZKQ47io] Received response to POST http://127.0.0.1:9093/_synapse/replication/fed_send_events/cxkgfQOzda: 200

aria-net.org accepted the message:

:~$ grep "\$WM5mW7VqMvW19ceHPt1r-jrLCPJE8pGCVXfVZKQ47io" /var/log/syslog
Feb  4 14:04:17 akademeia matrix-synapse-worker_federation_reader_1[189517]: 2021-02-04 14:04:17,116 - synapse.handlers.federation - 189 - INFO - PUT-19046-$WM5mW7VqMvW19ceHPt1r-jrLCPJE8pGCVXfVZKQ47io - handling received PDU: <FrozenEventV3 event_id='$WM5mW7VqMvW19ceHPt1r-jrLCPJE8pGCVXfVZKQ47io', type='m.room.message', state_key=None>
Feb  4 14:04:17 akademeia matrix-synapse-worker_federation_reader_1[189517]: 2021-02-04 14:04:17,822 - synapse.http.client - 425 - INFO - PUT-19046-$WM5mW7VqMvW19ceHPt1r-jrLCPJE8pGCVXfVZKQ47io - Received response to POST http://127.0.0.1:8101/_synapse/replication/fed_send_events/cItXxahwLx: 200

Version information

• Homeserver: matrix.archlinux.org
• Version: {"server_version":"1.26.0","python_version":"3.9.1"}
• Install method: pip
• Platform: Arch Linux

[Gnuxie]

For some additional context, the reason why this is a problem for Mjolnir is because as a room administrator, NOT necessarily a homeserver administrator (but it is also a problem for server admins), mjolnir can't see the soft failed events. A solution that would work would be allowing a client to access soft failed events from both/sync and /messages. It will be ok for these events to be given in a redacted form, provided it is very & immediately obvious to a client whether these events have an associated m.redaction event or not. So that Mjolnir can then see and issue redactions that will be seen by other servers. This should ideally not be a Synapse administrator API, since public Matrix homeservers will have room admins who are not admins of the homeserver.

[Gnuxie]

A very unideal work around for those following along is to have a room admin on the same homeserver as the spammer, who will be able to see all of the spammer's events normally and then be able to issue redactions for them. This only really works because the majority of spam comes from accounts registered with matrix.org, so they don't usually need an admin account with every participating server in the room.

[MadLittleMods]

A solution that would work would be allowing a client to access soft failed events from both/sync and /messages.

For homeserver administrators, this is now possible via #18238