epsilon-phase/Plume
1
0
Fork 0
forked from Plume/Plume
Code Issues Pull requests Releases Wiki Activity

Implement JSON-ld signature verification

Browse source 
Implement JSON-ld signature verification
Move signature verification functions to the proper file
This commit is contained in:
Trinity Pointard 2018-10-06 10:06:06 +02:00
parent 62c94ed463
commit 3466e55548
4 changed files with 95 additions and 73 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

66
plume-common/src/activity_pub/mod.rs
View file

@ -1,10 +1,8 @@
use activitypub::{Activity, Actor, Object, Link};
use array_tool::vec::Uniq;
use base64;
use reqwest::Client;
use rocket::{
Outcome,
http::{Status,HeaderMap},
Outcome, http::Status,
response::{Response, Responder},
request::{FromRequest, Request}
};
@ -120,68 +118,6 @@ pub fn broadcast<S: sign::Signer, A: Activity, T: inbox::WithInbox + Actor>(send
}
}
#[derive(Debug)]
pub enum SignatureValidity {
Invalid,
ValidNoDigest,
Valid,
Absent,
}
impl SignatureValidity {
pub fn is_secure(&self) -> bool {
match self {
SignatureValidity::Valid => true,
_ => false,
}
}
}
pub fn verify_http_headers<S: sign::Signer+::std::fmt::Debug>(sender: &S, all_headers: HeaderMap, data: String) -> SignatureValidity{
if let Some(sig_header) = all_headers.get_one("Signature") {
let mut _key_id = None;
let mut _algorithm = None;
let mut headers = None;
let mut signature = None;
for part in sig_header.split(',') {
match part {
part if part.starts_with("keyId=") => _key_id = Some(&part[7..part.len()-1]),
part if part.starts_with("algorithm=") => _algorithm = Some(&part[11..part.len()-1]),
part if part.starts_with("headers=") => headers = Some(&part[9..part.len()-1]),
part if part.starts_with("signature=") => signature = Some(&part[11..part.len()-1]),
_ => {},
}
}
if signature.is_some() && headers.is_some() {
let headers = headers.unwrap().split_whitespace().collect::<Vec<_>>();
let signature = signature.unwrap();
let h = headers.iter()
.map(|header| (header,all_headers.get_one(header)))
.map(|(header, value)| format!("{}: {}", header.to_lowercase(), value.unwrap_or("")))
.collect::<Vec<_>>().join("\n");
if sender.verify(h, base64::decode(signature).unwrap_or(Vec::new())) {
if headers.contains(&"digest") {
let digest = all_headers.get_one("digest").unwrap_or("");
let digest = request::Digest::from_header(digest);
if digest.map(|d| d.verify(data)).unwrap_or(false) {
SignatureValidity::Valid
} else {
SignatureValidity::Invalid
}
} else {
SignatureValidity::ValidNoDigest
}
} else {
SignatureValidity::Invalid
}
} else {
SignatureValidity::Invalid
}
} else {
SignatureValidity::Absent
}
}
#[derive(Clone, Serialize, Deserialize)]
pub struct Id(String);

84
plume-common/src/activity_pub/sign.rs
View file

@ -6,6 +6,8 @@ use openssl::{
rsa::Rsa,
sha::sha256
};
use super::request;
use rocket::http::HeaderMap;
use serde_json;
/// Returns (public key, private key)
@ -26,6 +28,7 @@ pub trait Signer {
pub trait Signable {
fn sign<T>(&mut self, creator: &T) -> &mut Self where T: Signer;
fn verify<T>(self, creator: &T) -> bool where T: Signer;
fn hash(data: String) -> String {
let bytes = data.into_bytes();
@ -55,4 +58,85 @@ impl Signable for serde_json::Value {
self["signature"] = options;
self
}
fn verify<T: Signer>(mut self, creator: &T) -> bool {
let signature_obj = if let Some(sig) = self.as_object_mut().and_then(|o| o.remove("signature")) {
sig
} else {
//signature not present
return false
};
let signature = if let Ok(sig) = base64::decode(&signature_obj["signatureValue"].as_str().unwrap_or("")) {
sig
} else {
return false
};
let creation_date = &signature_obj["created"];
let options_hash = Self::hash(json!({
"@context": "https://w3id.org/identity/v1",
"created": creation_date
}).to_string());
let document_hash = Self::hash(self.to_string());
let to_be_signed = options_hash + &document_hash;
creator.verify(to_be_signed, signature)
}
}
#[derive(Debug,Copy,Clone,PartialEq)]
pub enum SignatureValidity {
Invalid,
ValidNoDigest,
Valid,
Absent,
}
impl SignatureValidity {
pub fn is_secure(&self) -> bool {
self==&SignatureValidity::Valid
}
}
pub fn verify_http_headers<S: Signer+::std::fmt::Debug>(sender: &S, all_headers: HeaderMap, data: String) -> SignatureValidity{
if let Some(sig_header) = all_headers.get_one("Signature") {
let mut _key_id = None;
let mut _algorithm = None;
let mut headers = None;
let mut signature = None;
for part in sig_header.split(',') {
match part {
part if part.starts_with("keyId=") => _key_id = Some(&part[7..part.len()-1]),
part if part.starts_with("algorithm=") => _algorithm = Some(&part[11..part.len()-1]),
part if part.starts_with("headers=") => headers = Some(&part[9..part.len()-1]),
part if part.starts_with("signature=") => signature = Some(&part[11..part.len()-1]),
_ => {},
}
}
if signature.is_some() && headers.is_some() {
let headers = headers.unwrap().split_whitespace().collect::<Vec<_>>();
let signature = signature.unwrap();
let h = headers.iter()
.map(|header| (header,all_headers.get_one(header)))
.map(|(header, value)| format!("{}: {}", header.to_lowercase(), value.unwrap_or("")))
.collect::<Vec<_>>().join("\n");
if sender.verify(h, base64::decode(signature).unwrap_or(Vec::new())) {
if headers.contains(&"digest") {
let digest = all_headers.get_one("digest").unwrap_or("");
let digest = request::Digest::from_header(digest);
if digest.map(|d| d.verify(data)).unwrap_or(false) {
SignatureValidity::Valid
} else {
SignatureValidity::Invalid
}
} else {
SignatureValidity::ValidNoDigest
}
} else {
SignatureValidity::Invalid
}
} else {
SignatureValidity::Invalid
}
} else {
SignatureValidity::Absent
}
}

9
src/routes/instance.rs
View file

@ -4,7 +4,8 @@ use rocket_contrib::{Json, Template};
use serde_json;
use validator::{Validate};
use plume_common::activity_pub::verify_http_headers;
use plume_common::activity_pub::sign::{Signable,
verify_http_headers};
use plume_models::{
admin::Admin,
comments::Comment,
@ -198,9 +199,9 @@ fn shared_inbox(conn: DbConn, data: String, headers: Headers) -> String {
let actor_id = activity["actor"].as_str()
.unwrap_or_else(|| activity["actor"]["id"].as_str().expect("No actor ID for incoming activity, blocks by panicking"));
let sig = verify_http_headers(&User::from_url(&conn, actor_id.to_owned()).unwrap(), headers.0, data).is_secure();
if !sig {
// TODO check for valid json-ld signature
let actor = User::from_url(&conn, actor_id.to_owned()).unwrap();
if !verify_http_headers(&actor, headers.0, data).is_secure() &&
!act.clone().verify(&actor) {
return "invalid signature".to_owned();
}

9
src/routes/user.rs
View file

@ -16,7 +16,8 @@ use workerpool::thunk::*;
use plume_common::activity_pub::{
ActivityStream, broadcast, Id, IntoId, ApRequest,
verify_http_headers, inbox::{FromActivity, Notify, Deletable}
inbox::{FromActivity, Notify, Deletable},
sign::{Signable, verify_http_headers}
};
use plume_common::utils;
use plume_models::{
@ -304,9 +305,9 @@ fn inbox(name: String, conn: DbConn, data: String, headers: Headers) -> String {
let actor_id = activity["actor"].as_str()
.unwrap_or_else(|| activity["actor"]["id"].as_str().expect("User: No actor ID for incoming activity, blocks by panicking"));
let sig = verify_http_headers(&User::from_url(&conn, actor_id.to_owned()).unwrap(), headers.0, data).is_secure();
if !sig {
// TODO check for json-ld signature
let actor = User::from_url(&conn, actor_id.to_owned()).unwrap();
if !verify_http_headers(&actor, headers.0, data).is_secure() &&
!act.clone().verify(&actor) {
return "invalid signature".to_owned();
}