Add Monolog

[friendica.git] / src / Util / HTTPSignature.php

diff --git a/src/Util/HTTPSignature.php b/src/Util/HTTPSignature.php
index 956d6ff3728d36b4d55a8b8abe4f81c406f636ce..b54f50051235e56621462196b36cc51e372c5936 100644 (file)
--- a/src/Util/HTTPSignature.php
+++ b/src/Util/HTTPSignature.php
@@ -12,6 +12,7 @@ use Friendica\Database\DBA;
 use Friendica\Model\User;
 use Friendica\Model\APContact;
 use Friendica\Protocol\ActivityPub;
+use Friendica\Util\DateTimeFormat;
 
 /**
  * @brief Implements HTTP Signatures per draft-cavage-http-signatures-07.
@@ -204,6 +205,8 @@ class HTTPSignature
 
                if (preg_match('/algorithm="(.*?)"/ism', $header, $matches)) {
                        $ret['algorithm'] = $matches[1];
+               } else {
+                       $ret['algorithm'] = 'rsa-sha256';
                }
 
                if (preg_match('/headers="(.*?)"/ism', $header, $matches)) {
@@ -214,7 +217,7 @@ class HTTPSignature
                        $ret['signature'] = base64_decode(preg_replace('/\s+/', '', $matches[1]));
                }
 
-               if (($ret['signature']) && ($ret['algorithm']) && (!$ret['headers'])) {
+               if (!empty($ret['signature']) && !empty($ret['algorithm']) && empty($ret['headers'])) {
                        $ret['headers'] = ['date'];
                }
 
@@ -294,14 +297,15 @@ class HTTPSignature
                $path = parse_url($target, PHP_URL_PATH);
                $digest = 'SHA-256=' . base64_encode(hash('sha256', $content, true));
                $content_length = strlen($content);
+               $date = DateTimeFormat::utcNow(DateTimeFormat::HTTP);
 
-               $headers = ['Content-Length: ' . $content_length, 'Digest: ' . $digest, 'Host: ' . $host];
+               $headers = ['Date: ' . $date, 'Content-Length: ' . $content_length, 'Digest: ' . $digest, 'Host: ' . $host];
 
-               $signed_data = "(request-target): post " . $path . "\ncontent-length: " . $content_length . "\ndigest: " . $digest . "\nhost: " . $host;
+               $signed_data = "(request-target): post " . $path . "\ndate: ". $date . "\ncontent-length: " . $content_length . "\ndigest: " . $digest . "\nhost: " . $host;
 
                $signature = base64_encode(Crypto::rsaSign($signed_data, $owner['uprvkey'], 'sha256'));
 
-               $headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) content-length digest host",signature="' . $signature . '"';
+               $headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) date content-length digest host",signature="' . $signature . '"';
 
                $headers[] = 'Content-Type: application/activity+json';
 
@@ -332,14 +336,15 @@ class HTTPSignature
                // Header data that is about to be signed.
                $host = parse_url($request, PHP_URL_HOST);
                $path = parse_url($request, PHP_URL_PATH);
+               $date = DateTimeFormat::utcNow(DateTimeFormat::HTTP);
 
-               $headers = ['Host: ' . $host];
+               $headers = ['Date: ' . $date, 'Host: ' . $host];
 
-               $signed_data = "(request-target): get " . $path . "\nhost: " . $host;
+               $signed_data = "(request-target): get " . $path . "\ndate: ". $date . "\nhost: " . $host;
 
                $signature = base64_encode(Crypto::rsaSign($signed_data, $owner['uprvkey'], 'sha256'));
 
-               $headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) host",signature="' . $signature . '"';
+               $headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) date host",signature="' . $signature . '"';
 
                $headers[] = 'Accept: application/activity+json, application/ld+json';
 
@@ -371,13 +376,20 @@ class HTTPSignature
         */
        public static function getSigner($content, $http_headers)
        {
-               $object = json_decode($content, true);
-
-               if (empty($object)) {
+               if (empty($http_headers['HTTP_SIGNATURE'])) {
                        return false;
                }
 
-               $actor = JsonLD::fetchElement($object, 'actor', 'id');
+               if (!empty($content)) {
+                       $object = json_decode($content, true);
+                       if (empty($object)) {
+                               return false;
+                       }
+
+                       $actor = JsonLD::fetchElement($object, 'actor', 'id');
+               } else {
+                       $actor = '';
+               }
 
                $headers = [];
                $headers['(request-target)'] = strtolower($http_headers['REQUEST_METHOD']) . ' ' . $http_headers['REQUEST_URI'];
@@ -455,7 +467,14 @@ class HTTPSignature
                        }
                }
 
-               /// @todo Check if the signed date field is in an acceptable range
+               //  Check if the signed date field is in an acceptable range
+               if (in_array('date', $sig_block['headers'])) {
+                       $diff = abs(strtotime($headers['date']) - time());
+                       if ($diff > 300) {
+                               Logger::log("Header date '" . $headers['date'] . "' is with " . $diff . " seconds out of the 300 second frame. The signature is invalid.");
+                               return false;
+                       }
+               }
 
                // Check the content-length when it is part of the signed data
                if (in_array('content-length', $sig_block['headers'])) {