Friendica/friendica-github
1
0
Fork 0
mirror of https://github.com/friendica/friendica synced 2024-11-10 09:02:53 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #10189 from annando/signature-message

Browse source 
Improved logging for invalid HTTP signatures
This commit is contained in:
Tobias Diekershoff 2021-05-01 14:40:24 +02:00 committed by GitHub
commit 60f0af3daa
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 16 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/Protocol/ActivityPub/Receiver.php
View file

@ -111,9 +111,12 @@ class Receiver
}
$http_signer = HTTPSignature::getSigner($body, $header);
if (empty($http_signer)) {
if ($http_signer === false) {
Logger::warning('Invalid HTTP signature, message will be discarded.');
return;
} elseif (empty($http_signer)) {
Logger::info('Signer is a tombstone. The message will be discarded, the signer account is deleted.');
return;
} else {
Logger::info('Valid HTTP signature', ['signer' => $http_signer]);
}

13
src/Util/HTTPSignature.php
View file

@ -473,12 +473,14 @@ class HTTPSignature
public static function getSigner($content, $http_headers)
{
if (empty($http_headers['HTTP_SIGNATURE'])) {
Logger::info('No HTTP_SIGNATURE header');
return false;
}
if (!empty($content)) {
$object = json_decode($content, true);
if (empty($object)) {
Logger::info('No object');
return false;
}
@ -507,6 +509,7 @@ class HTTPSignature
$sig_block = self::parseSigHeader($http_headers['HTTP_SIGNATURE']);
if (empty($sig_block) || empty($sig_block['headers']) || empty($sig_block['keyId'])) {
Logger::info('No headers or keyId');
return false;
}
@ -519,6 +522,7 @@ class HTTPSignature
$signed_data = rtrim($signed_data, "\n");
if (empty($signed_data)) {
Logger::info('Signed data is empty');
return false;
}
@ -541,11 +545,13 @@ class HTTPSignature
}
if (empty($algorithm)) {
Logger::info('No alagorithm');
return false;
}
$key = self::fetchKey($sig_block['keyId'], $actor);
if (empty($key)) {
Logger::info('Empty key');
return false;
}
@ -554,14 +560,16 @@ class HTTPSignature
// We now delete everything that we possibly knew from this actor
Contact::deleteContactByUrl($key['url']);
return false;
return null;
}
if (empty($key['pubkey'])) {
Logger::info('Empty pubkey');
return false;
}
if (!Crypto::rsaVerify($signed_data, $sig_block['signature'], $key['pubkey'], $algorithm)) {
Logger::info('Verification failed');
return false;
}
@ -580,6 +588,7 @@ class HTTPSignature
/// @todo add all hashes from the rfc
if (!empty($hashalg) && base64_encode(hash($hashalg, $content, true)) != $digest[1]) {
Logger::info('Digest does not match');
return false;
}
@ -599,6 +608,7 @@ class HTTPSignature
// Check the content-length when it is part of the signed data
if (in_array('content-length', $sig_block['headers'])) {
if (strlen($content) != $headers['content-length']) {
Logger::info('Content length does not match');
return false;
}
}
@ -606,6 +616,7 @@ class HTTPSignature
// Ensure that the authentication had been done with some content
// Without this check someone could authenticate with fakeable data
if (!$hasGoodSignedContent) {
Logger::info('No good signed content');
return false;
}