X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=plugins%2FOStatus%2Flib%2Fmagicenvelope.php;h=a057da515bdd84529361d29d063f71a9a3f0c7a1;hb=f9ddb0e20919b1b22b1a78463ffb227a009c5614;hp=cd5efc0359054d594b2a88d488f5b2ebc3b57684;hpb=78805d113acb71642756d8b6b77f519c5f7df56d;p=quix0rs-gnu-social.git diff --git a/plugins/OStatus/lib/magicenvelope.php b/plugins/OStatus/lib/magicenvelope.php index cd5efc0359..a057da515b 100644 --- a/plugins/OStatus/lib/magicenvelope.php +++ b/plugins/OStatus/lib/magicenvelope.php @@ -32,6 +32,8 @@ class MagicEnvelope const NS = 'http://salmon-protocol.org/ns/magic-env'; + protected $actor = null; // Profile of user who has signed the envelope + protected $data = null; // When stored here it is _always_ base64url encoded protected $data_type = null; protected $encoding = null; @@ -48,14 +50,23 @@ class MagicEnvelope * @fixme may give fatal errors if some elements are missing or invalid XML * @fixme calling DOMDocument::loadXML statically triggers warnings in strict mode */ - public function __construct($xml=null) { + public function __construct($xml=null, Profile $actor=null) { if (!empty($xml)) { - $dom = DOMDocument::loadXML($xml); - if (!$dom instanceof DOMDocument) { + $dom = new DOMDocument(); + if (!$dom->loadXML($xml)) { throw new ServerException('Tried to load malformed XML as DOM'); } elseif (!$this->fromDom($dom)) { throw new ServerException('Could not load MagicEnvelope from DOM'); } + } elseif ($actor instanceof Profile) { + // So far we only allow setting with _either_ $xml _or_ $actor as that's + // all our circumstances require. But it may be confusing for new developers. + // The idea is that feeding XML must be followed by interpretation and then + // running $magic_env->verify($profile), just as in SalmonAction->prepare(...) + // and supplying an $actor (which right now has to be a User) will require + // defining the $data, $data_type etc. attributes manually afterwards before + // signing the envelope.. + $this->setActor($actor); } } @@ -67,15 +78,21 @@ class MagicEnvelope * @param boolean $discovery Network discovery if no local cache? */ public function getKeyPair(Profile $profile, $discovery=false) { - $magicsig = Magicsig::getKV('user_id', $profile->id); + if (!$profile->isLocal()) common_debug('Getting magic-public-key for non-local profile id=='.$profile->getID()); + $magicsig = Magicsig::getKV('user_id', $profile->getID()); if ($discovery && !$magicsig instanceof Magicsig) { + if (!$profile->isLocal()) common_debug('magic-public-key not found, will do discovery for profile id=='.$profile->getID()); // Throws exception on failure, but does not try to _load_ the keypair string. $keypair = $this->discoverKeyPair($profile); $magicsig = new Magicsig(); - $magicsig->user_id = $profile->id; + $magicsig->user_id = $profile->getID(); $magicsig->importKeys($keypair); + // save the public key for this profile in our database. + // TODO: If the profile generates a new key remotely, we must be able to replace + // this (of course after callback-verification). + $magicsig->insert(); } elseif (!$magicsig instanceof Magicsig) { // No discovery request, so we'll give up. throw new ServerException(sprintf('No public key found for profile (id==%d)', $profile->id)); } @@ -98,28 +115,41 @@ class MagicEnvelope { $signer_uri = $profile->getUri(); if (empty($signer_uri)) { - throw new ServerException(sprintf('Profile missing URI (id==%d)', $profile->id)); + throw new ServerException(sprintf('Profile missing URI (id==%d)', $profile->getID())); } $disco = new Discovery(); // Throws exception on lookup problems - $xrd = $disco->lookup($signer_uri); + try { + $xrd = $disco->lookup($signer_uri); + } catch (Exception $e) { + // Diaspora seems to require us to request the acct: uri + $xrd = $disco->lookup($profile->getAcctUri()); + } - $link = $xrd->get(Magicsig::PUBLICKEYREL); - if (is_null($link)) { - // TRANS: Exception. - throw new Exception(_m('Unable to locate signer public key.')); + common_debug('Will try to find magic-public-key from XRD of profile id=='.$profile->getID()); + $pubkey = null; + if (Event::handle('MagicsigPublicKeyFromXRD', array($xrd, &$pubkey))) { + $link = $xrd->get(Magicsig::PUBLICKEYREL); + if (is_null($link)) { + // TRANS: Exception. + throw new Exception(_m('Unable to locate signer public key.')); + } + $pubkey = $link->href; + } + if (empty($pubkey)) { + throw new ServerException('Empty Magicsig public key. A bug?'); } // We have a public key element, let's hope it has proper key data. $keypair = false; - $parts = explode(',', $link->href); + $parts = explode(',', $pubkey); if (count($parts) == 2) { $keypair = $parts[1]; } else { // Backwards compatibility check for separator bug in 0.9.0 - $parts = explode(';', $link->href); + $parts = explode(';', $pubkey); if (count($parts) == 2) { $keypair = $parts[1]; } @@ -153,21 +183,36 @@ class MagicEnvelope * @param $text * @param $mimetype * @param Magicsig $magicsig Magicsig with private key available. + * * @return MagicEnvelope object with all properties set + * + * @throws Exception of various kinds on signing failure */ - public static function signMessage($text, $mimetype, Magicsig $magicsig) + public function signMessage($text, $mimetype) { - $magic_env = new MagicEnvelope(); + if (!$this->actor instanceof Profile) { + throw new ServerException('No profile to sign message with is set.'); + } elseif (!$this->actor->isLocal()) { + throw new ServerException('Cannot sign magic envelopes with remote users since we have no private key.'); + } + + // Find already stored key + $magicsig = Magicsig::getKV('user_id', $this->actor->getID()); + if (!$magicsig instanceof Magicsig) { + // and if it doesn't exist, it is time to create one! + $magicsig = Magicsig::generate($this->actor->getUser()); + } + assert($magicsig instanceof Magicsig); + assert($magicsig->privateKey instanceof Crypt_RSA); // Prepare text and metadata for signing - $magic_env->data = Magicsig::base64_url_encode($text); - $magic_env->data_type = $mimetype; - $magic_env->encoding = self::ENCODING; - $magic_env->alg = $magicsig->getName(); - // Get the actual signature - $magic_env->sig = $magicsig->sign($magic_env->signingText()); + $this->data = Magicsig::base64_url_encode($text); + $this->data_type = $mimetype; + $this->encoding = self::ENCODING; + $this->alg = $magicsig->getName(); - return $magic_env; + // Get the actual signature + $this->sig = $magicsig->sign($this->signingText()); } /** @@ -175,19 +220,22 @@ class MagicEnvelope * * @return string representation of XML document */ - public function toXML() { + public function toXML(Profile $target=null, $flavour=null) { $xs = new XMLStringer(); - $xs->startXML(); - $xs->elementStart('me:env', array('xmlns:me' => self::NS)); - $xs->element('me:data', array('type' => $this->data_type), $this->data); - $xs->element('me:encoding', null, $this->encoding); - $xs->element('me:alg', null, $this->alg); - $xs->element('me:sig', null, $this->sig); - $xs->elementEnd('me:env'); - - $string = $xs->getString(); - common_debug('MagicEnvelope XML: ' . $string); - return $string; + $xs->startXML(); // header, to point out it's not HTML or anything... + if (Event::handle('StartMagicEnvelopeToXML', array($this, $xs, $flavour, $target))) { + // fall back to our default, normal Magic Envelope XML. + // the $xs element _may_ have had elements added, or could get in the end event + $xs->elementStart('me:env', array('xmlns:me' => self::NS)); + $xs->element('me:data', array('type' => $this->data_type), $this->data); + $xs->element('me:encoding', null, $this->encoding); + $xs->element('me:alg', null, $this->alg); + $xs->element('me:sig', null, $this->getSignature()); + $xs->elementEnd('me:env'); + + Event::handle('EndMagicEnvelopeToXML', array($this, $xs, $flavour, $target)); + } + return $xs->getString(); } /* @@ -220,7 +268,7 @@ class MagicEnvelope $prov->appendChild($enc); $alg = $dom->createElementNS(self::NS, 'me:alg', $this->alg); $prov->appendChild($alg); - $sig = $dom->createElementNS(self::NS, 'me:sig', $this->sig); + $sig = $dom->createElementNS(self::NS, 'me:sig', $this->getSignature()); $prov->appendChild($sig); $dom->documentElement->appendChild($prov); @@ -231,6 +279,34 @@ class MagicEnvelope return $dom; } + public function getSignature() + { + if (empty($this->sig)) { + throw new ServerException('You must first call signMessage before getSignature'); + } + return $this->sig; + } + + public function getSignatureAlgorithm() + { + return $this->alg; + } + + public function getData() + { + return $this->data; + } + + public function getDataType() + { + return $this->data_type; + } + + public function getEncoding() + { + return $this->encoding; + } + /** * Find the author URI referenced in the payload Atom entry. * @@ -264,23 +340,28 @@ class MagicEnvelope public function verify(Profile $profile) { if ($this->alg != 'RSA-SHA256') { - common_log(LOG_DEBUG, "Salmon error: bad algorithm"); + common_debug("Salmon error: bad algorithm"); return false; } if ($this->encoding != self::ENCODING) { - common_log(LOG_DEBUG, "Salmon error: bad encoding"); + common_debug("Salmon error: bad encoding"); return false; } try { $magicsig = $this->getKeyPair($profile, true); // Do discovery too if necessary } catch (Exception $e) { - common_log(LOG_DEBUG, "Salmon error: ".$e->getMessage()); + common_debug("Salmon error: ".$e->getMessage()); return false; } - return $magicsig->verify($this->signingText(), $this->sig); + if (!$magicsig->verify($this->signingText(), $this->getSignature())) { + // TRANS: Client error when incoming salmon slap signature does not verify cryptographically. + throw new ClientException(_m('Salmon signature verification failed.')); + } + $this->setActor($profile); + return true; } /** @@ -313,6 +394,22 @@ class MagicEnvelope return true; } + public function setActor(Profile $actor) + { + if ($this->actor instanceof Profile) { + throw new ServerException('Cannot set a new actor profile for MagicEnvelope object.'); + } + $this->actor = $actor; + } + + public function getActor() + { + if (!$this->actor instanceof Profile) { + throw new ServerException('No actor set for this magic envelope.'); + } + return $this->actor; + } + /** * Encode the given string as a signed MagicEnvelope XML document, * using the keypair for the given local user profile. We can of @@ -324,30 +421,16 @@ class MagicEnvelope * on some systems. * * @param string $text XML fragment to sign, assumed to be Atom - * @param Profile $actor Profile of a local user to use as signer + * @param User $user User who cryptographically signs $text * - * @return string XML string representation of magic envelope + * @return MagicEnvelope object complete with signature * * @throws Exception on bad profile input or key generation problems - * @fixme if signing fails, this seems to return the original text without warning. Is there a reason for this? */ - public static function signForProfile($text, Profile $actor) + public static function signAsUser($text, User $user) { - // We only generate keys for our local users of course, so let - // getUser throw an exception if the profile is not local. - $user = $actor->getUser(); - - // Find already stored key - $magicsig = Magicsig::getKV('user_id', $user->id); - if (!$magicsig instanceof Magicsig) { - // No keypair yet, let's generate one. - $magicsig = new Magicsig(); - $magicsig->generate($user->id); - } - - $magic_env = self::signMessage($text, 'application/atom+xml', $magicsig); - - assert($magic_env instanceof MagicEnvelope); + $magic_env = new MagicEnvelope(null, $user->getProfile()); + $magic_env->signMessage($text, 'application/atom+xml'); return $magic_env; }