Merge pull request #6447 from annando/peertube

[friendica.git] / src / Util / HTTPSignature.php

diff --git a/src/Util/HTTPSignature.php b/src/Util/HTTPSignature.php
index 503cbff0ade45b0af04c35d039380f28ff267cbc..2b9e396241755f5ba07ee83116a1c569f0f0774d 100644 (file)
--- a/src/Util/HTTPSignature.php
+++ b/src/Util/HTTPSignature.php
@@ -7,10 +7,12 @@ namespace Friendica\Util;
 
 use Friendica\BaseObject;
 use Friendica\Core\Config;
+use Friendica\Core\Logger;
 use Friendica\Database\DBA;
 use Friendica\Model\User;
 use Friendica\Model\APContact;
 use Friendica\Protocol\ActivityPub;
+use Friendica\Util\DateTimeFormat;
 
 /**
  * @brief Implements HTTP Signatures per draft-cavage-http-signatures-07.
@@ -59,7 +61,7 @@ class HTTPSignature
                $sig_block = self::parseSigheader($headers['authorization']);
 
                if (!$sig_block) {
-                       logger('no signature provided.');
+                       Logger::log('no signature provided.');
                        return $result;
                }
 
@@ -89,7 +91,7 @@ class HTTPSignature
                        $key = $key($sig_block['keyId']);
                }
 
-               logger('Got keyID ' . $sig_block['keyId']);
+               Logger::log('Got keyID ' . $sig_block['keyId'], Logger::DEBUG);
 
                if (!$key) {
                        return $result;
@@ -97,7 +99,7 @@ class HTTPSignature
 
                $x = Crypto::rsaVerify($signed_data, $sig_block['signature'], $key, $algorithm);
 
-               logger('verified: ' . $x, LOGGER_DEBUG);
+               Logger::log('verified: ' . $x, Logger::DEBUG);
 
                if (!$x) {
                        return $result;
@@ -203,6 +205,8 @@ class HTTPSignature
 
                if (preg_match('/algorithm="(.*?)"/ism', $header, $matches)) {
                        $ret['algorithm'] = $matches[1];
+               } else {
+                       $ret['algorithm'] = 'rsa-sha256';
                }
 
                if (preg_match('/headers="(.*?)"/ism', $header, $matches)) {
@@ -272,9 +276,11 @@ class HTTPSignature
        /**
         * @brief Transmit given data to a target for a user
         *
-        * @param $data
-        * @param $target
-        * @param $uid
+        * @param array $data Data that is about to be send
+        * @param string $target The URL of the inbox
+        * @param integer $uid User id of the sender
+        *
+        * @return boolean Was the transmission successful?
         */
        public static function transmit($data, $target, $uid)
        {
@@ -291,20 +297,72 @@ class HTTPSignature
                $path = parse_url($target, PHP_URL_PATH);
                $digest = 'SHA-256=' . base64_encode(hash('sha256', $content, true));
                $content_length = strlen($content);
+               $date = DateTimeFormat::utcNow(DateTimeFormat::HTTP);
 
-               $headers = ['Content-Length: ' . $content_length, 'Digest: ' . $digest, 'Host: ' . $host];
+               $headers = ['Date: ' . $date, 'Content-Length: ' . $content_length, 'Digest: ' . $digest, 'Host: ' . $host];
 
-               $signed_data = "(request-target): post " . $path . "\ncontent-length: " . $content_length . "\ndigest: " . $digest . "\nhost: " . $host;
+               $signed_data = "(request-target): post " . $path . "\ndate: ". $date . "\ncontent-length: " . $content_length . "\ndigest: " . $digest . "\nhost: " . $host;
 
                $signature = base64_encode(Crypto::rsaSign($signed_data, $owner['uprvkey'], 'sha256'));
 
-               $headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) content-length digest host",signature="' . $signature . '"';
+               $headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) date content-length digest host",signature="' . $signature . '"';
 
                $headers[] = 'Content-Type: application/activity+json';
 
                $postResult = Network::post($target, $content, $headers);
+               $return_code = $postResult->getReturnCode();
+
+               Logger::log('Transmit to ' . $target . ' returned ' . $return_code, Logger::DEBUG);
 
-               logger('Transmit to ' . $target . ' returned ' . $postResult->getReturnCode());
+               return ($return_code >= 200) && ($return_code <= 299);
+       }
+
+       /**
+        * @brief Fetches JSON data for a user
+        *
+        * @param string $request request url
+        * @param integer $uid User id of the requester
+        *
+        * @return array JSON array
+        */
+       public static function fetch($request, $uid)
+       {
+               $owner = User::getOwnerDataById($uid);
+
+               if (!$owner) {
+                       return;
+               }
+
+               // Header data that is about to be signed.
+               $host = parse_url($request, PHP_URL_HOST);
+               $path = parse_url($request, PHP_URL_PATH);
+
+               $headers = ['Host: ' . $host];
+
+               $signed_data = "(request-target): get " . $path . "\nhost: " . $host;
+
+               $signature = base64_encode(Crypto::rsaSign($signed_data, $owner['uprvkey'], 'sha256'));
+
+               $headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) host",signature="' . $signature . '"';
+
+               $headers[] = 'Accept: application/activity+json, application/ld+json';
+
+               $curlResult = Network::curl($request, false, $redirects, ['header' => $headers]);
+               $return_code = $curlResult->getReturnCode();
+
+               Logger::log('Fetched for user ' . $uid . ' from ' . $request . ' returned ' . $return_code, Logger::DEBUG);
+
+               if (!$curlResult->isSuccess() || empty($curlResult->getBody())) {
+                       return false;
+               }
+
+               $content = json_decode($curlResult->getBody(), true);
+
+               if (empty($content) || !is_array($content)) {
+                       return false;
+               }
+
+               return $content;
        }
 
        /**
@@ -401,6 +459,8 @@ class HTTPSignature
                        }
                }
 
+               /// @todo Check if the signed date field is in an acceptable range
+
                // Check the content-length when it is part of the signed data
                if (in_array('content-length', $sig_block['headers'])) {
                        if (strlen($content) != $headers['content-length']) {
@@ -425,12 +485,12 @@ class HTTPSignature
 
                $profile = APContact::getByURL($url);
                if (!empty($profile)) {
-                       logger('Taking key from id ' . $id, LOGGER_DEBUG);
+                       Logger::log('Taking key from id ' . $id, Logger::DEBUG);
                        return ['url' => $url, 'pubkey' => $profile['pubkey']];
                } elseif ($url != $actor) {
                        $profile = APContact::getByURL($actor);
                        if (!empty($profile)) {
-                               logger('Taking key from actor ' . $actor, LOGGER_DEBUG);
+                               Logger::log('Taking key from actor ' . $actor, Logger::DEBUG);
                                return ['url' => $actor, 'pubkey' => $profile['pubkey']];
                        }
                }