search

element-hq / riot-android

A glossy Matrix collaboration client for Android
Apache License 2.0
1.4k stars 394 forks source link

Many HTTP 404 requests on android and iOS apps (we keep getting blocked) #3072

Open ghost opened 5 years ago

ghost commented 5 years ago

There are following 404 requests logged after opening the android/ios app of Riot.im in our access.log...

Android: "GET /_matrix/client/r0/room_keys/version HTTP/1.1" 404 78 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Riot/1.0.5 Chrome/69.0.3497.128 Electron/4.0.8 Safari/537.36"

iOS: "GET /_matrix/client/unstable/room_keys/version HTTP/1.1" 404 78 "-" "Riot/0.8.3 (iPhone; iOS 12.1.4; Scale/2.00)"

We use fail2ban to block IPs with multiple failing requests (4xx, 5xx), and now we get blocked ourselves again and again after a short time using the app. This behaviour must be relatively new, because there are no such log entries in the access.log of the 2019/03/13.

bmarty commented 5 years ago

/room_keys/version are new APIs, so I assume the homeserver you are using is not up to date.

I assume it will be fixed once your homeserver is updated.

I've thought of this pb before (see first item unchecked in https://github.com/vector-im/riot-android/issues/2920). But it has been decided to skip this pb.

That said, I notice that iOS client uses /unstable and Android uses /r0. I will check with @manuroe who is right (my guess is iOS)

murat-aksoy commented 5 years ago

Hi bmarty, by saying homeserver you mean synapse server? I installed the latest tagged version and still getting 404. Any idea?

bmarty commented 5 years ago

Yes, synapse. @erikjohnston any idea on these 404?

manuroe commented 5 years ago

That said, I notice that iOS client uses /unstable and Android uses /r0. I will check with @manuroe who is right (my guess is iOS)

Riot-web uses r0 too for that endpoint. There is a mix of /unstable and /r0 in e2e endpoints. I guess we will get all aligned once Matrix 1.0 is out.

eMPee584 commented 4 years ago

After digging a bit into this, this 404 is generated here, https://github.com/matrix-org/synapse/blame/master/synapse/handlers/e2e_room_keys.py#L82 handling this https://github.com/matrix-org/matrix-doc/blame/master/proposals/1219-storing-megolm-keys-serverside.md#L69 So it seems 404 is official part of the API and we shall ignore 404 error messages on such endpoints.