feat: Optionally require S2S auth for the server /version endpoint

Adds a new setting that defaults to 'False' for root level yaml
configuration

`require_auth_for_server_version`: boolean

Author: jason-famedly

synapse/config/server.py

@@ -409,6 +409,12 @@ def read_config(self, config: JsonDict, **kwargs: Any) -> None:
             "require_auth_for_profile_requests", False
         )
 
+        # Whether to require federation(server) authentication for the server /version
+        # endpoint.
+        self.require_auth_for_server_version = config.get(
+            "require_auth_for_server_version", False
+        )
+
         # Whether to require sharing a room with a user to retrieve their
         # profile data
         self.limit_profile_requests_to_users_who_share_rooms = config.get(

synapse/federation/transport/server/federation.py

@@ -678,6 +678,18 @@ class FederationVersionServlet(BaseFederationServlet):
 
     REQUIRE_AUTH = False
 
+    def __init__(
+        self,
+        hs: "HomeServer",
+        authenticator: Authenticator,
+        ratelimiter: FederationRateLimiter,
+        server_name: str,
+    ):
+        # Enable auth on the /version endpoint if enabled. Not sure how many
+        # ramifications this will end up having.
+        self.REQUIRE_AUTH = hs.config.server.require_auth_for_server_version
+        super().__init__(hs, authenticator, ratelimiter, server_name)
+
     async def on_GET(
         self,
         origin: Optional[str],

tests/federation/transport/server/test_federation.py

@@ -0,0 +1,23 @@
+from synapse.types import JsonDict
+
+from tests import unittest
+
+
+class TestAuthenticatedFederationVersionEndpoint(unittest.FederatingHomeserverTestCase):
+    def default_config(self) -> JsonDict:
+        config = super().default_config()
+        config.update({"require_auth_for_server_version": True})
+        return config
+
+    def test_endpoint(self) -> None:
+        # Un-authed requests to endpoints that require them return a 401
+        channel = self.make_request(
+            "GET", "/_matrix/federation/v1/version", shorthand=False
+        )
+        assert channel.code == 401, channel
+
+        # Authing the request works as expected
+        channel = self.make_signed_federation_request(
+            "GET", "/_matrix/federation/v1/version"
+        )
+        assert channel.code == 200, channel