superseriousbusiness / gotosocial

Fast, fun, small ActivityPub server.
https://docs.gotosocial.org
GNU Affero General Public License v3.0
3.57k stars 300 forks source link

[bug] Cross-instance Reply Failures #1167

Closed sparked435 closed 1 year ago

sparked435 commented 1 year ago

The following (slightly sanitized) example is a disproportionate amount of traffic on my instance:

timestamp="23/11/2022 19:02:53.754" func=federation.(*federator).AuthenticatePostInbox level=TRACE useragent="http.rb/5.1.0 (Mastodon/4.0.2; +https://mastodon.sdf.org/)" url="/users/aaron/inbox" msg="received request to authenticate"

timestamp="23/11/2022 19:02:53.762" func=federation.(*federator).AuthenticateFederatedRequest level=TRACE msg="proceeding with dereference for uncached public key https://mastodon.sdf.org/users/XXXXXXXXX#main-key"

timestamp="23/11/2022 19:02:53.770" func=transport.(*transport).do level=INFO pubKeyID="https://chirp.zadzmo.org/users/aaron/main-key" method="GET" url="https://mastodon.sdf.org/users/XXXXXXXXX#main-key" msg="performing request"

timestamp="23/11/2022 19:02:54.815" func=federation.(*federator).AuthenticateFederatedRequest level=DEBUG msg="error dereferencing public key https://mastodon.sdf.org/users/XXXXXXXXX#main-key: GET request to https://mastodon.sdf.org/users/XXXXXXXXX#main-key failed (410): 410 Gone"

timestamp="23/11/2022 19:02:54.826" func=router.loggingMiddleware.func1 level=INFO latency="1.071514814s" clientIP="205.166.94.38" userAgent="http.rb/5.1.0 (Mastodon/4.0.2; +https://mastodon.sdf.org/)" method="POST" statusCode=401 path="/users/aaron/inbox" msg="Unauthorized: wrote 23B"

Browsing to https://mastodon.sdf.org/users/XXXXXXXXX#main-key does in fact return a '410 Gone' response. From further investigation, this particular transaction was @XXXXXXXXX@mastodon.social (who I am not following) replying to a toot from a user I am following at mastodon.sdf.org.

It looks to me that GotoSocial is experiencing some form of domain confusion in this cross-instance reply case.

tsmethurst commented 1 year ago

Already fixed this on main, will be in a release soon :)