server/middlewares/activitypub.ts

   1 import { NextFunction, Request, Response } from 'express'
   2 import { getAPId } from '@server/helpers/activitypub'
   3 import { isActorDeleteActivityValid } from '@server/helpers/custom-validators/activitypub/actor'
   4 import { ActivityDelete, ActivityPubSignature, HttpStatusCode } from '@shared/models'
   5 import { logger } from '../helpers/logger'
   6 import { isHTTPSignatureVerified, isJsonLDSignatureVerified, parseHTTPSignature } from '../helpers/peertube-crypto'
   7 import { ACCEPT_HEADERS, ACTIVITY_PUB, HTTP_SIGNATURE } from '../initializers/constants'
   8 import { getOrCreateAPActor, loadActorUrlOrGetFromWebfinger } from '../lib/activitypub/actors'
   9
  10 async function checkSignature (req: Request, res: Response, next: NextFunction) {
  11   try {
  12     const httpSignatureChecked = await checkHttpSignature(req, res)
  13     if (httpSignatureChecked !== true) return
  14
  15     const actor = res.locals.signature.actor
  16
  17     // Forwarded activity
  18     const bodyActor = req.body.actor
  19     const bodyActorId = getAPId(bodyActor)
  20     if (bodyActorId && bodyActorId !== actor.url) {
  21       const jsonLDSignatureChecked = await checkJsonLDSignature(req, res)
  22       if (jsonLDSignatureChecked !== true) return
  23     }
  24
  25     return next()
  26   } catch (err) {
  27     const activity: ActivityDelete = req.body
  28     if (isActorDeleteActivityValid(activity) && activity.object === activity.actor) {
  29       logger.debug('Handling signature error on actor delete activity', { err })
  30       return res.status(HttpStatusCode.NO_CONTENT_204).end()
  31     }
  32
  33     logger.warn('Error in ActivityPub signature checker.', { err })
  34     return res.fail({
  35       status: HttpStatusCode.FORBIDDEN_403,
  36       message: 'ActivityPub signature could not be checked'
  37     })
  38   }
  39 }
  40
  41 function executeIfActivityPub (req: Request, res: Response, next: NextFunction) {
  42   const accepted = req.accepts(ACCEPT_HEADERS)
  43   if (accepted === false || ACTIVITY_PUB.POTENTIAL_ACCEPT_HEADERS.includes(accepted) === false) {
  44     // Bypass this route
  45     return next('route')
  46   }
  47
  48   logger.debug('ActivityPub request for %s.', req.url)
  49
  50   return next()
  51 }
  52
  53 // ---------------------------------------------------------------------------
  54
  55 export {
  56   checkSignature,
  57   executeIfActivityPub,
  58   checkHttpSignature
  59 }
  60
  61 // ---------------------------------------------------------------------------
  62
  63 async function checkHttpSignature (req: Request, res: Response) {
  64   // FIXME: compatibility with http-signature < v1.3
  65   const sig = req.headers[HTTP_SIGNATURE.HEADER_NAME] as string
  66   if (sig && sig.startsWith('Signature ') === true) req.headers[HTTP_SIGNATURE.HEADER_NAME] = sig.replace(/^Signature /, '')
  67
  68   let parsed: any
  69
  70   try {
  71     parsed = parseHTTPSignature(req, HTTP_SIGNATURE.CLOCK_SKEW_SECONDS)
  72   } catch (err) {
  73     logger.warn('Invalid signature because of exception in signature parser', { reqBody: req.body, err })
  74
  75     res.fail({
  76       status: HttpStatusCode.FORBIDDEN_403,
  77       message: err.message
  78     })
  79     return false
  80   }
  81
  82   const keyId = parsed.keyId
  83   if (!keyId) {
  84     res.fail({
  85       status: HttpStatusCode.FORBIDDEN_403,
  86       message: 'Invalid key ID',
  87       data: {
  88         keyId
  89       }
  90     })
  91     return false
  92   }
  93
  94   logger.debug('Checking HTTP signature of actor %s...', keyId)
  95
  96   let [ actorUrl ] = keyId.split('#')
  97   if (actorUrl.startsWith('acct:')) {
  98     actorUrl = await loadActorUrlOrGetFromWebfinger(actorUrl.replace(/^acct:/, ''))
  99   }
 100
 101   const actor = await getOrCreateAPActor(actorUrl)
 102
 103   const verified = isHTTPSignatureVerified(parsed, actor)
 104   if (verified !== true) {
 105     logger.warn('Signature from %s is invalid', actorUrl, { parsed })
 106
 107     res.fail({
 108       status: HttpStatusCode.FORBIDDEN_403,
 109       message: 'Invalid signature',
 110       data: {
 111         actorUrl
 112       }
 113     })
 114     return false
 115   }
 116
 117   res.locals.signature = { actor }
 118   return true
 119 }
 120
 121 async function checkJsonLDSignature (req: Request, res: Response) {
 122   const signatureObject: ActivityPubSignature = req.body.signature
 123
 124   if (!signatureObject || !signatureObject.creator) {
 125     res.fail({
 126       status: HttpStatusCode.FORBIDDEN_403,
 127       message: 'Object and creator signature do not match'
 128     })
 129     return false
 130   }
 131
 132   const [ creator ] = signatureObject.creator.split('#')
 133
 134   logger.debug('Checking JsonLD signature of actor %s...', creator)
 135
 136   const actor = await getOrCreateAPActor(creator)
 137   const verified = await isJsonLDSignatureVerified(actor, req.body)
 138
 139   if (verified !== true) {
 140     logger.warn('Signature not verified.', req.body)
 141
 142     res.fail({
 143       status: HttpStatusCode.FORBIDDEN_403,
 144       message: 'Signature could not be verified'
 145     })
 146     return false
 147   }
 148
 149   res.locals.signature = { actor }
 150   return true
 151 }