X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=include%2Fsalmon.php;h=49384efea76d80009e6036a48669d625bc896ee6;hb=0b4a6f8eaca0d1396e7e944cd4735a573bd1d111;hp=bd2d620a815132b4087c3d1e52d73a323180cc3f;hpb=5edee3c4d1f84c07c1c54775072601188075a542;p=friendica.git diff --git a/include/salmon.php b/include/salmon.php index bd2d620a81..49384efea7 100644 --- a/include/salmon.php +++ b/include/salmon.php @@ -19,80 +19,59 @@ function salmon_key($pubkey) { function base64url_encode($s) { - return strtr(base64_encode($s),'+/','-_'); + $s = strtr(base64_encode($s),'+/','-_'); +/* + * // placeholder for un-padded base64url_encode + * // per latest salmon rev + * + * $s = str_replace('=','',$s); + * + */ + return $s; } function base64url_decode($s) { + +/* + * // Placeholder for new rev of salmon which strips base64 padding. + * // PHP base64_decode handles the un-padded input without requiring this step + * // Uncomment if you find you need it. + * + * $l = strlen($s); + * if(! strpos($s,'=')) { + * $m = $l % 4; + * if($m == 2) + * $s .= '=='; + * if($m == 3) + * $s .= '='; + * } + * + */ + return base64_decode(strtr($s,'-_','+/')); } function get_salmon_key($uri,$keyhash) { $ret = array(); - $debugging = get_config('system','debugging'); - if($debugging) - file_put_contents('salmon.out', "\n" . 'Fetch key' . "\n", FILE_APPEND); - - if(strstr($uri,'@')) { - $arr = webfinger($uri); - if($debugging) - file_put_contents('salmon.out', "\n" . 'Fetch key from webfinger' . "\n", FILE_APPEND); - } - else { - $html = fetch_url($uri); - $a = get_app(); - $h = $a->get_curl_headers(); - if($debugging) - file_put_contents('salmon.out', "\n" . 'Fetch key via HTML header: ' . $h . "\n", FILE_APPEND); - - $l = explode("\n",$h); - if(count($l)) { - foreach($l as $line) { - - if($debugging) - file_put_contents('salmon.out', "\n" . $line . "\n", FILE_APPEND); - if((stristr($line,'link:')) && preg_match('/<([^>].*)>.*rel\=[\'\"]lrdd[\'\"]/',$line,$matches)) { - $link = $matches[1]; - if($debugging) - file_put_contents('salmon.out', "\n" . 'Fetch key via Link from header: ' . $link . "\n", FILE_APPEND); - break; - } - } - } - } - - if(! isset($link)) { - require_once('library/HTML5/Parser.php'); - $dom = HTML5_Parser::parse($html); - - if(! $dom) - return ''; - - $items = $dom->getElementsByTagName('link'); - - foreach($items as $item) { - $x = $item->getAttribute('rel'); - if($x == "lrdd") { - $link = $item->getAttribute('href'); - if($debugging) - file_put_contents('salmon.out', "\n" . 'Fetch key via HTML body' . $link . "\n", FILE_APPEND); - break; - } - } - } - - if(! isset($link)) - return ''; + logger('Fetching salmon key'); - $arr = fetch_xrd_links($link); + $arr = lrdd($uri); - if($arr) { + if(is_array($arr)) { foreach($arr as $a) { if($a['@attributes']['rel'] === 'magic-public-key') { $ret[] = $a['@attributes']['href']; } } } + else { + return ''; + } + + // We have found at least one key URL + // If it's inline, parse it - otherwise get the key + if(count($ret)) { for($x = 0; $x < count($ret); $x ++) { if(substr($ret[$x],0,5) === 'data:') { @@ -105,10 +84,18 @@ function get_salmon_key($uri,$keyhash) { $ret[$x] = fetch_url($ret[$x]); } } - if($debugging) - file_put_contents('salmon.out', "\n" . 'Key located: ' . print_r($ret,true) . "\n", FILE_APPEND); + + + logger('Key located: ' . print_r($ret,true)); if(count($ret) == 1) { + + // We only found one one key so we don't care if the hash matches. + // If it's the wrong key we'll find out soon enough because + // message verification will fail. This also covers some older + // software which don't supply a keyhash. As long as they only + // have one key we'll be right. + return $ret[0]; } else { @@ -124,4 +111,104 @@ function get_salmon_key($uri,$keyhash) { - \ No newline at end of file +function slapper($owner,$url,$slap) { + + logger('slapper called. Data: ' . $slap); + + // does contact have a salmon endpoint? + + if(! strlen($url)) + return; + + // add all namespaces to item + +$namespaces = <<< EOT + +EOT; + + $slap = str_replace('',$namespaces,$slap); + + // create a magic envelope + + $data = base64url_encode($slap); + $data_type = 'application/atom+xml'; + $encoding = 'base64url'; + $algorithm = 'RSA-SHA256'; + $keyhash = base64url_encode(hash('sha256',salmon_key($owner['spubkey']))); + + // Setup RSA stuff to PKCS#1 sign the data + + set_include_path(get_include_path() . PATH_SEPARATOR . 'phpsec'); + + require_once('phpsec/Crypt/RSA.php'); + + $rsa = new CRYPT_RSA(); + $rsa->signatureMode = CRYPT_RSA_SIGNATURE_PKCS1; + $rsa->setHash('sha256'); + $rsa->loadKey($owner['sprvkey']); + + // precomputed base64url encoding of data_type, encoding, algorithm concatenated with periods + + $precomputed = '.YXBwbGljYXRpb24vYXRvbSt4bWw=.YmFzZTY0dXJs.UlNBLVNIQTI1Ng=='; + + $signature = base64url_encode($rsa->sign($data . $precomputed)); + + $signature2 = base64url_encode($rsa->sign($data)); + + $salmon_tpl = load_view_file('view/magicsig.tpl'); + $salmon = replace_macros($salmon_tpl,array( + '$data' => $data, + '$encoding' => $encoding, + '$algorithm' => $algorithm, + '$keyhash' => $keyhash, + '$signature' => $signature + )); + + // slap them + post_url($url,$salmon, array( + 'Content-type: application/magic-envelope+xml', + 'Content-length: ' . strlen($salmon) + )); + + $a = get_app(); + $return_code = $a->get_curl_code(); + + // check for success, e.g. 2xx + + if($return_code > 299) { + + logger('slapper: compliant salmon failed. Falling back to status.net hack'); + + // Entirely likely that their salmon implementation is + // non-compliant. Let's try once more, this time only signing + // the data, without the precomputed blob + + $salmon = replace_macros($salmon_tpl,array( + '$data' => $data, + '$encoding' => $encoding, + '$algorithm' => $algorithm, + '$keyhash' => $keyhash, + '$signature' => $signature2 + )); + + // slap them + post_url($url,$salmon, array( + 'Content-type: application/magic-envelope+xml', + 'Content-length: ' . strlen($salmon) + )); + $return_code = $a->get_curl_code(); + + } + logger('slapper returned ' . $return_code); + if(! $return_code) + return(-1); + return ((($return_code >= 200) && ($return_code < 300)) ? 0 : 1); +} +