X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=src%2FUtil%2FHTTPSignature.php;h=07ff5e805d9b3293c921786d7ac195ac6ea02ff5;hb=e447375cddb847edbc9d4486be3938674ae66b8c;hp=f6a5fe1fe4f869c142a1683bc522eb43e031ae7d;hpb=11310f4cf0eb66206ba758e178a892345028bf15;p=friendica.git

diff --git a/src/Util/HTTPSignature.php b/src/Util/HTTPSignature.php
index f6a5fe1fe4..07ff5e805d 100644
--- a/src/Util/HTTPSignature.php
+++ b/src/Util/HTTPSignature.php
@@ -7,8 +7,10 @@ namespace Friendica\Util;
 
 use Friendica\BaseObject;
 use Friendica\Core\Config;
+use Friendica\Core\Logger;
 use Friendica\Database\DBA;
 use Friendica\Model\User;
+use Friendica\Model\APContact;
 use Friendica\Protocol\ActivityPub;
 
 /**
@@ -16,12 +18,22 @@ use Friendica\Protocol\ActivityPub;
  *
  * Ported from Hubzilla: https://framagit.org/hubzilla/core/blob/master/Zotlabs/Web/HTTPSig.php
  *
+ * Other parts of the code for HTTP signing are taken from the Osada project.
+ * https://framagit.org/macgirvin/osada
+ *
  * @see https://tools.ietf.org/html/draft-cavage-http-signatures-07
  */
 
 class HTTPSignature
 {
 	// See draft-cavage-http-signatures-08
+	/**
+	 * @brief Verifies a magic request
+	 *
+	 * @param $key
+	 *
+	 * @return array with verification data
+	 */
 	public static function verifyMagic($key)
 	{
 		$headers   = null;
@@ -48,7 +60,7 @@ class HTTPSignature
 		$sig_block = self::parseSigheader($headers['authorization']);
 
 		if (!$sig_block) {
-			logger('no signature provided.');
+			Logger::log('no signature provided.');
 			return $result;
 		}
 
@@ -78,7 +90,7 @@ class HTTPSignature
 			$key = $key($sig_block['keyId']);
 		}
 
-		logger('Got keyID ' . $sig_block['keyId']);
+		Logger::log('Got keyID ' . $sig_block['keyId'], Logger::DEBUG);
 
 		if (!$key) {
 			return $result;
@@ -86,7 +98,7 @@ class HTTPSignature
 
 		$x = Crypto::rsaVerify($signed_data, $sig_block['signature'], $key, $algorithm);
 
-		logger('verified: ' . $x, LOGGER_DEBUG);
+		Logger::log('verified: ' . $x, Logger::DEBUG);
 
 		if (!$x) {
 			return $result;
@@ -192,6 +204,8 @@ class HTTPSignature
 
 		if (preg_match('/algorithm="(.*?)"/ism', $header, $matches)) {
 			$ret['algorithm'] = $matches[1];
+		} else {
+			$ret['algorithm'] = 'rsa-sha256';
 		}
 
 		if (preg_match('/headers="(.*?)"/ism', $header, $matches)) {
@@ -254,10 +268,19 @@ class HTTPSignature
 		return '';
 	}
 
-	/**
+	/*
 	 * Functions for ActivityPub
 	 */
 
+	/**
+	 * @brief Transmit given data to a target for a user
+	 *
+	 * @param array $data Data that is about to be send
+	 * @param string $target The URL of the inbox
+	 * @param integer $uid User id of the sender
+	 *
+	 * @return boolean Was the transmission successful?
+	 */
 	public static function transmit($data, $target, $uid)
 	{
 		$owner = User::getOwnerDataById($uid);
@@ -266,7 +289,7 @@ class HTTPSignature
 			return;
 		}
 
-		$content = json_encode($data);
+		$content = json_encode($data, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
 
 		// Header data that is about to be signed.
 		$host = parse_url($target, PHP_URL_HOST);
@@ -284,13 +307,71 @@ class HTTPSignature
 
 		$headers[] = 'Content-Type: application/activity+json';
 
-		Network::post($target, $content, $headers);
-		$return_code = BaseObject::getApp()->get_curl_code();
+		$postResult = Network::post($target, $content, $headers);
+		$return_code = $postResult->getReturnCode();
 
-		logger('Transmit to ' . $target . ' returned ' . $return_code);
+		Logger::log('Transmit to ' . $target . ' returned ' . $return_code, Logger::DEBUG);
+
+		return ($return_code >= 200) && ($return_code <= 299);
 	}
 
-	public static function verifyAP($content, $http_headers)
+	/**
+	 * @brief Fetches JSON data for a user
+	 *
+	 * @param string $request request url
+	 * @param integer $uid User id of the requester
+	 *
+	 * @return array JSON array
+	 */
+	public static function fetch($request, $uid)
+	{
+		$owner = User::getOwnerDataById($uid);
+
+		if (!$owner) {
+			return;
+		}
+
+		// Header data that is about to be signed.
+		$host = parse_url($request, PHP_URL_HOST);
+		$path = parse_url($request, PHP_URL_PATH);
+
+		$headers = ['Host: ' . $host];
+
+		$signed_data = "(request-target): get " . $path . "\nhost: " . $host;
+
+		$signature = base64_encode(Crypto::rsaSign($signed_data, $owner['uprvkey'], 'sha256'));
+
+		$headers[] = 'Signature: keyId="' . $owner['url'] . '#main-key' . '",algorithm="rsa-sha256",headers="(request-target) host",signature="' . $signature . '"';
+
+		$headers[] = 'Accept: application/activity+json, application/ld+json';
+
+		$curlResult = Network::curl($request, false, $redirects, ['header' => $headers]);
+		$return_code = $curlResult->getReturnCode();
+
+		Logger::log('Fetched for user ' . $uid . ' from ' . $request . ' returned ' . $return_code, Logger::DEBUG);
+
+		if (!$curlResult->isSuccess() || empty($curlResult->getBody())) {
+			return false;
+		}
+
+		$content = json_decode($curlResult->getBody(), true);
+
+		if (empty($content) || !is_array($content)) {
+			return false;
+		}
+
+		return $content;
+	}
+
+	/**
+	 * @brief Gets a signer from a given HTTP request
+	 *
+	 * @param $content
+	 * @param $http_headers
+	 *
+	 * @return signer string
+	 */
+	public static function getSigner($content, $http_headers)
 	{
 		$object = json_decode($content, true);
 
@@ -355,7 +436,7 @@ class HTTPSignature
 			return false;
 		}
 
-		if (!Crypto::rsaVerify($signed_data, $sig_block['signature'], $key, $algorithm)) {
+		if (!Crypto::rsaVerify($signed_data, $sig_block['signature'], $key['pubkey'], $algorithm)) {
 			return false;
 		}
 
@@ -376,6 +457,8 @@ class HTTPSignature
 			}
 		}
 
+		/// @todo Check if the signed date field is in an acceptable range
+
 		// Check the content-length when it is part of the signed data
 		if (in_array('content-length', $sig_block['headers'])) {
 			if (strlen($content) != $headers['content-length']) {
@@ -383,21 +466,30 @@ class HTTPSignature
 			}
 		}
 
-		return true;
-
+		return $key['url'];
 	}
 
+	/**
+	 * @brief fetches a key for a given id and actor
+	 *
+	 * @param $id
+	 * @param $actor
+	 *
+	 * @return array with actor url and public key
+	 */
 	private static function fetchKey($id, $actor)
 	{
 		$url = (strpos($id, '#') ? substr($id, 0, strpos($id, '#')) : $id);
 
-		$profile = ActivityPub::fetchprofile($url);
+		$profile = APContact::getByURL($url);
 		if (!empty($profile)) {
-			return $profile['pubkey'];
+			Logger::log('Taking key from id ' . $id, Logger::DEBUG);
+			return ['url' => $url, 'pubkey' => $profile['pubkey']];
 		} elseif ($url != $actor) {
-			$profile = ActivityPub::fetchprofile($actor);
+			$profile = APContact::getByURL($actor);
 			if (!empty($profile)) {
-				return $profile['pubkey'];
+				Logger::log('Taking key from actor ' . $actor, Logger::DEBUG);
+				return ['url' => $actor, 'pubkey' => $profile['pubkey']];
 			}
 		}