Send SNI indication to support vhosts over federation (SYN-620)

[matrixbot]

TwoOne problems:

• Federation doesn't send an SNI indication (because twisted), so for vhosted servers we tend to end up on the default.
• We send the server_name in the Host header, rather than what the SRV tells us to use. (We think the current behaviour is correct, as per Federation uses incorrect Host: header when SRV record is present #2525).

(Imported from https://matrix.org/jira/browse/SYN-620)

[matrixbot]

Jira watchers: @ara4n @richvdh

[matrixbot]

Links exported from Jira:

is duplicated by SYN-233

[matrixbot]

doublemalt (re)submitted a PR to try to get twisted to implement SNI in the http client: twisted/twisted#281.

-- @richvdh

[richvdh]

Looks like this is worth another look; the twisted PR has been closed with a link to an API

[4b69]

Install docs should probably be made more clear to account for this issue:

For example, you might want to run your server at synapse.example.com, but have your Matrix user-ids look like @user:example.com

Is not possible with reverse-proxying. The readme states:

Synapse does not currently support SNI on the federation protocol (bug #1491), which means that using name-based virtual hosting is unreliable.

But in actuality it's not unreliable, it's impossible.

[richvdh]

But in actuality it's not unreliable, it's impossible.

It's possible if the reverse-proxy is configured to forward to synapse by 'default', when there is no SNI header.

[simonszu]

Is this SNI bug still open after two years?

[neilisfragile]

For work conducted by the core team it comes down to a question of priority - right now that means dealing with the massive growth on matrix.org, hence the bias towards performance in the common case.

With that in mind, community contributions much appreciated :)