clean up the salmon consumer bits

diff --git a/include/salmon.php b/include/salmon.php
index bd2d620a815132b4087c3d1e52d73a323180cc3f..52810426f69e3d8724eb90f9f2e0d5a5d590a296 100644 (file)
--- a/include/salmon.php
+++ b/include/salmon.php
@@ -43,48 +43,48 @@ function get_salmon_key($uri,$keyhash) {
                $a = get_app();
                $h = $a->get_curl_headers();
                if($debugging)
-                       file_put_contents('salmon.out', "\n" . 'Fetch key via HTML header: ' . $h . "\n", FILE_APPEND);
+                       file_put_contents('salmon.out', "\n" . 'Fetch key via HTTP header: ' . $h . "\n", FILE_APPEND);
 
                $l = explode("\n",$h);
                if(count($l)) {
-                       foreach($l as $line) {
-                               
-                               if($debugging)
-                                       file_put_contents('salmon.out', "\n" . $line . "\n", FILE_APPEND);
+                       foreach($l as $line) {                          
                                if((stristr($line,'link:')) && preg_match('/<([^>].*)>.*rel\=[\'\"]lrdd[\'\"]/',$line,$matches)) {
                                        $link = $matches[1];
                                        if($debugging)
-                                               file_put_contents('salmon.out', "\n" . 'Fetch key via Link from header: ' . $link . "\n", FILE_APPEND);
+                                               file_put_contents('salmon.out', "\n" . 'Fetch key via HTML Link: ' . $link . "\n", FILE_APPEND);
                                        break;
                                }
                        }
                }
-       }
 
-       if(! isset($link)) {
-               require_once('library/HTML5/Parser.php');
-               $dom = HTML5_Parser::parse($html);
+               if(! isset($link)) {
 
-               if(! $dom)
-                       return '';
+                       // parse the page of the supplied URL looking for rel links
+
+                       require_once('library/HTML5/Parser.php');
+                       $dom = HTML5_Parser::parse($html);
 
-               $items = $dom->getElementsByTagName('link');
+                       if(! $dom)
+                               return '';
 
-               foreach($items as $item) {
-                       $x = $item->getAttribute('rel');
-                       if($x == "lrdd") {
-                               $link = $item->getAttribute('href');
-                               if($debugging)
-                                       file_put_contents('salmon.out', "\n" . 'Fetch key via HTML body' . $link . "\n", FILE_APPEND);
-                               break;
+                       $items = $dom->getElementsByTagName('link');
+
+                       foreach($items as $item) {
+                               $x = $item->getAttribute('rel');
+                               if($x == "lrdd") {
+                                       $link = $item->getAttribute('href');
+                                       if($debugging)
+                                               file_put_contents('salmon.out', "\n" . 'Fetch key via HTML body' . $link . "\n", FILE_APPEND);
+                                       break;
+                               }
                        }
                }
-       }
 
-       if(! isset($link))
-               return '';
+               if(! isset($link))
+                       return '';
 
-       $arr = fetch_xrd_links($link);
+               $arr = fetch_xrd_links($link);
+       }
 
        if($arr) {
                foreach($arr as $a) {
@@ -93,6 +93,13 @@ function get_salmon_key($uri,$keyhash) {
                        }
                }
        }
+       else {
+               return '';
+       }
+
+       // We have found at least one key URL
+       // If it's inline, parse it - otherwise get the key
+
        if(count($ret)) {
                for($x = 0; $x < count($ret); $x ++) {
                        if(substr($ret[$x],0,5) === 'data:') {
@@ -105,10 +112,18 @@ function get_salmon_key($uri,$keyhash) {
                                $ret[$x] = fetch_url($ret[$x]);
                }
        }
+
        if($debugging)
                file_put_contents('salmon.out', "\n" . 'Key located: ' . print_r($ret,true) . "\n", FILE_APPEND);
 
        if(count($ret) == 1) {
+
+               // We only found one one key so we don't care if the hash matches.
+               // If it's the wrong key we'll find out soon enough because 
+               // message verification will fail. This also covers some older 
+               // software which don't supply a keyhash. As long as they only
+               // have one key we'll be right. 
+
                return $ret[0];
        }
        else {

diff --git a/mod/salmon.php b/mod/salmon.php
index 7ae29aafe2b00d3358b8aad5ed4d27a4c63e4919..30e87f243fd436779c1d165add5cfdf66014685b 100644 (file)
--- a/mod/salmon.php
+++ b/mod/salmon.php
@@ -1,7 +1,7 @@
 <?php
 
 
-// TODO: pass keyhash to key discovery
+// TODO: 
 // add relevant contacts so they can use this
 
 // There is a lot of debug stuff in here because this is quite a
@@ -68,24 +68,30 @@ function salmon_post(&$a) {
 
 
        $signature = base64url_decode($base->sig);
+
        if($debugging)
                file_put_contents('salmon.out', "\n" . 'Encoded Signature: ' . $base->sig . "\n" , FILE_APPEND);
 
-       // unpack our data element.
+       // unpack the  data
 
-       // strip whitespace
+       // strip whitespace so our data element will return to one big base64 blob
        $data = str_replace(array(" ","\t","\r","\n"),array("","","",""),$base->data);
+
+       // stash away some other stuff for later
+
        $type = $base->data[0]->attributes()->type[0];
+       $keyhash = $base->sig[0]->attributes()->keyhash[0];
        $encoding = $base->encoding;
        $alg = $base->alg;
 
-       $signed_data = $data;
-       // . '.' . base64url_encode($type) . '.' . base64url_encode($encoding) . '.' . base64url_encode($alg);
-       // decode it
-       $data = base64url_decode($data);
+       // If we're talking to status.net or one of their ilk, they aren't following the magic envelope spec
+       // and only signed the data element. We'll be nice and let them validate anyway. 
 
-       if($debugging)
-               file_put_contents('salmon.out', "\n" . 'Signed data:>>>' . $signed_data . "<<<\n" , FILE_APPEND);
+       $stnet_signed_data = $data;
+       $signed_data = $data  . '.' . base64url_encode($type) . '.' . base64url_encode($encoding) . '.' . base64url_encode($alg);
+
+       // decode the data
+       $data = base64url_decode($data);
 
        // Remove the xml declaration
        $data = preg_replace('/\<\?xml[^\?].*\?\>/','',$data);
@@ -128,7 +134,7 @@ function salmon_post(&$a) {
                salmon_return(500);
        }
 
-       // Once we have the author URI, go to the web and find their public key
+       // Once we have the author URI, go to the web and try to find their public key
 
        if($debugging) {
                file_put_contents('salmon.out', "\n" . 'Fetching key for ' . $author_link . "\n", FILE_APPEND);
@@ -152,6 +158,7 @@ function salmon_post(&$a) {
 
        $m = base64url_decode($key_info[1]);
        $e = base64url_decode($key_info[2]);
+
        if($debugging)
                file_put_contents('salmon.out',"\n" . print_r($key_info,true) . "\n", FILE_APPEND);
 
@@ -164,9 +171,14 @@ function salmon_post(&$a) {
     $rsa->exponent = new Math_BigInteger($e, 256);
 
        // We should have everything we need now. Let's see if it verifies.
+       // If it fails with the proper data format, try again using just the data
+       // (e.g. status.net)
 
     $verify = $rsa->verify($signed_data,$signature);
 
+       if(! $verify)
+           $verify = $rsa->verify($stnet_signed_data,$signature);
+
        if(! $verify) {
                if($debugging)
                        file_put_contents('salmon.out',"\n" . 'Message did not verify. Discarding.' . "\n", FILE_APPEND);
@@ -193,9 +205,11 @@ function salmon_post(&$a) {
                salmon_return(500);
        }       
 
-
        require_once('include/items.php');
 
+       // Placeholder for hub discovery. We shouldn't find any hubs
+       // since we supplied the fake feed header - and it doesn't have any.
+
        $hub = '';
 
        consume_feed($feedxml,$importer,$r[0],$hub);