Fix 'ip_range_whitelist' not working for federation servers

changelog.d/10115.bugfix

@@ -0,0 +1,2 @@
+Fix a bug that prevented the 'ip_range_whitelist' configuration to work for federation and identity servers.
+Notice that this change will not be applied, if your configuration still uses 'federation_ip_range_blacklist', to allow backwards-compatibility.

synapse/config/server.py

@@ -410,6 +410,11 @@ def read_config(self, config, **kwargs):
             ["0.0.0.0", "::"],
             config_path=("federation_ip_range_blacklist",),
         )
+        # The federation_ip_range_whitelist is used to provide
+        # backwards-compatibility, if federation_ip_range_blacklist is set.
+        self.federation_ip_range_whitelist = None
+        if "federation_ip_range_blacklist" not in config:
+            self.federation_ip_range_whitelist = self.ip_range_whitelist
 
         # (undocumented) option for torturing the worker-mode replication a bit,
         # for testing. The value defines the number of milliseconds to pause before

synapse/http/matrixfederationclient.py

@@ -322,7 +322,9 @@ def __init__(self, hs, tls_client_options_factory):
         # We need to use a DNS resolver which filters out blacklisted IP
         # addresses, to prevent DNS rebinding.
         self.reactor = BlacklistingReactorWrapper(
-            hs.get_reactor(), None, hs.config.federation_ip_range_blacklist
+            hs.get_reactor(),
+            hs.config.federation_ip_range_whitelist,
+            hs.config.federation_ip_range_blacklist,
         )  # type: ISynapseReactor
 
         user_agent = hs.version_string