server/tests/api/activitypub/security.ts

   1 /* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */
   2
   3 import 'mocha'
   4 import * as chai from 'chai'
   5 import { buildDigest } from '@server/helpers/peertube-crypto'
   6 import { HttpStatusCode } from '../../../../shared/core-utils/miscs/http-error-codes'
   7 import {
   8   cleanupTests,
   9   closeAllSequelize,
  10   flushAndRunMultipleServers,
  11   killallServers,
  12   reRunServer,
  13   ServerInfo,
  14   setActorField,
  15   wait
  16 } from '../../../../shared/extra-utils'
  17 import { makeFollowRequest, makePOSTAPRequest } from '../../../../shared/extra-utils/requests/activitypub'
  18 import { activityPubContextify, buildSignedActivity } from '../../../helpers/activitypub'
  19 import { HTTP_SIGNATURE } from '../../../initializers/constants'
  20 import { buildGlobalHeaders } from '../../../lib/job-queue/handlers/utils/activitypub-http-utils'
  21
  22 const expect = chai.expect
  23
  24 function setKeysOfServer (onServer: ServerInfo, ofServer: ServerInfo, publicKey: string, privateKey: string) {
  25   const url = 'http://localhost:' + ofServer.port + '/accounts/peertube'
  26
  27   return Promise.all([
  28     setActorField(onServer.internalServerNumber, url, 'publicKey', publicKey),
  29     setActorField(onServer.internalServerNumber, url, 'privateKey', privateKey)
  30   ])
  31 }
  32
  33 function setUpdatedAtOfServer (onServer: ServerInfo, ofServer: ServerInfo, updatedAt: string) {
  34   const url = 'http://localhost:' + ofServer.port + '/accounts/peertube'
  35
  36   return Promise.all([
  37     setActorField(onServer.internalServerNumber, url, 'createdAt', updatedAt),
  38     setActorField(onServer.internalServerNumber, url, 'updatedAt', updatedAt)
  39   ])
  40 }
  41
  42 function getAnnounceWithoutContext (server: ServerInfo) {
  43   const json = require('./json/peertube/announce-without-context.json')
  44   const result: typeof json = {}
  45
  46   for (const key of Object.keys(json)) {
  47     if (Array.isArray(json[key])) {
  48       result[key] = json[key].map(v => v.replace(':9002', `:${server.port}`))
  49     } else {
  50       result[key] = json[key].replace(':9002', `:${server.port}`)
  51     }
  52   }
  53
  54   return result
  55 }
  56
  57 describe('Test ActivityPub security', function () {
  58   let servers: ServerInfo[]
  59   let url: string
  60
  61   const keys = require('./json/peertube/keys.json')
  62   const invalidKeys = require('./json/peertube/invalid-keys.json')
  63   const baseHttpSignature = () => ({
  64     algorithm: HTTP_SIGNATURE.ALGORITHM,
  65     authorizationHeaderName: HTTP_SIGNATURE.HEADER_NAME,
  66     keyId: 'acct:peertube@localhost:' + servers[1].port,
  67     key: keys.privateKey,
  68     headers: HTTP_SIGNATURE.HEADERS_TO_SIGN
  69   })
  70
  71   // ---------------------------------------------------------------
  72
  73   before(async function () {
  74     this.timeout(60000)
  75
  76     servers = await flushAndRunMultipleServers(3)
  77
  78     url = servers[0].url + '/inbox'
  79
  80     await setKeysOfServer(servers[0], servers[1], keys.publicKey, null)
  81     await setKeysOfServer(servers[1], servers[1], keys.publicKey, keys.privateKey)
  82
  83     const to = { url: 'http://localhost:' + servers[0].port + '/accounts/peertube' }
  84     const by = { url: 'http://localhost:' + servers[1].port + '/accounts/peertube', privateKey: keys.privateKey }
  85     await makeFollowRequest(to, by)
  86   })
  87
  88   describe('When checking HTTP signature', function () {
  89
  90     it('Should fail with an invalid digest', async function () {
  91       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
  92       const headers = {
  93         Digest: buildDigest({ hello: 'coucou' })
  94       }
  95
  96       try {
  97         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
  98         expect(true, 'Did not throw').to.be.false
  99       } catch (err) {
 100         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 101       }
 102     })
 103
 104     it('Should fail with an invalid date', async function () {
 105       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
 106       const headers = buildGlobalHeaders(body)
 107       headers['date'] = 'Wed, 21 Oct 2015 07:28:00 GMT'
 108
 109       try {
 110         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 111         expect(true, 'Did not throw').to.be.false
 112       } catch (err) {
 113         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 114       }
 115     })
 116
 117     it('Should fail with bad keys', async function () {
 118       await setKeysOfServer(servers[0], servers[1], invalidKeys.publicKey, invalidKeys.privateKey)
 119       await setKeysOfServer(servers[1], servers[1], invalidKeys.publicKey, invalidKeys.privateKey)
 120
 121       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
 122       const headers = buildGlobalHeaders(body)
 123
 124       try {
 125         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 126         expect(true, 'Did not throw').to.be.false
 127       } catch (err) {
 128         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 129       }
 130     })
 131
 132     it('Should reject requests without appropriate signed headers', async function () {
 133       await setKeysOfServer(servers[0], servers[1], keys.publicKey, keys.privateKey)
 134       await setKeysOfServer(servers[1], servers[1], keys.publicKey, keys.privateKey)
 135
 136       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
 137       const headers = buildGlobalHeaders(body)
 138
 139       const signatureOptions = baseHttpSignature()
 140       const badHeadersMatrix = [
 141         [ '(request-target)', 'date', 'digest' ],
 142         [ 'host', 'date', 'digest' ],
 143         [ '(request-target)', 'host', 'digest' ]
 144       ]
 145
 146       for (const badHeaders of badHeadersMatrix) {
 147         signatureOptions.headers = badHeaders
 148
 149         try {
 150           await makePOSTAPRequest(url, body, signatureOptions, headers)
 151           expect(true, 'Did not throw').to.be.false
 152         } catch (err) {
 153           expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 154         }
 155       }
 156     })
 157
 158     it('Should succeed with a valid HTTP signature', async function () {
 159       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
 160       const headers = buildGlobalHeaders(body)
 161
 162       const { statusCode } = await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 163       expect(statusCode).to.equal(HttpStatusCode.NO_CONTENT_204)
 164     })
 165
 166     it('Should refresh the actor keys', async function () {
 167       this.timeout(20000)
 168
 169       // Update keys of server 2 to invalid keys
 170       // Server 1 should refresh the actor and fail
 171       await setKeysOfServer(servers[1], servers[1], invalidKeys.publicKey, invalidKeys.privateKey)
 172       await setUpdatedAtOfServer(servers[0], servers[1], '2015-07-17 22:00:00+00')
 173
 174       // Invalid peertube actor cache
 175       killallServers([ servers[1] ])
 176       await reRunServer(servers[1])
 177
 178       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
 179       const headers = buildGlobalHeaders(body)
 180
 181       try {
 182         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 183         expect(true, 'Did not throw').to.be.false
 184       } catch (err) {
 185         console.error(err)
 186         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 187       }
 188     })
 189   })
 190
 191   describe('When checking Linked Data Signature', function () {
 192     before(async function () {
 193       this.timeout(10000)
 194
 195       await setKeysOfServer(servers[0], servers[1], keys.publicKey, keys.privateKey)
 196       await setKeysOfServer(servers[1], servers[1], keys.publicKey, keys.privateKey)
 197       await setKeysOfServer(servers[2], servers[2], keys.publicKey, keys.privateKey)
 198
 199       const to = { url: 'http://localhost:' + servers[0].port + '/accounts/peertube' }
 200       const by = { url: 'http://localhost:' + servers[2].port + '/accounts/peertube', privateKey: keys.privateKey }
 201       await makeFollowRequest(to, by)
 202     })
 203
 204     it('Should fail with bad keys', async function () {
 205       this.timeout(10000)
 206
 207       await setKeysOfServer(servers[0], servers[2], invalidKeys.publicKey, invalidKeys.privateKey)
 208       await setKeysOfServer(servers[2], servers[2], invalidKeys.publicKey, invalidKeys.privateKey)
 209
 210       const body = getAnnounceWithoutContext(servers[1])
 211       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 212
 213       const signer: any = { privateKey: invalidKeys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 214       const signedBody = await buildSignedActivity(signer, body)
 215
 216       const headers = buildGlobalHeaders(signedBody)
 217
 218       try {
 219         await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 220         expect(true, 'Did not throw').to.be.false
 221       } catch (err) {
 222         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 223       }
 224     })
 225
 226     it('Should fail with an altered body', async function () {
 227       this.timeout(10000)
 228
 229       await setKeysOfServer(servers[0], servers[2], keys.publicKey, keys.privateKey)
 230       await setKeysOfServer(servers[0], servers[2], keys.publicKey, keys.privateKey)
 231
 232       const body = getAnnounceWithoutContext(servers[1])
 233       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 234
 235       const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 236       const signedBody = await buildSignedActivity(signer, body)
 237
 238       signedBody.actor = 'http://localhost:' + servers[2].port + '/account/peertube'
 239
 240       const headers = buildGlobalHeaders(signedBody)
 241
 242       try {
 243         await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 244         expect(true, 'Did not throw').to.be.false
 245       } catch (err) {
 246         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 247       }
 248     })
 249
 250     it('Should succeed with a valid signature', async function () {
 251       this.timeout(10000)
 252
 253       const body = getAnnounceWithoutContext(servers[1])
 254       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 255
 256       const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 257       const signedBody = await buildSignedActivity(signer, body)
 258
 259       const headers = buildGlobalHeaders(signedBody)
 260
 261       const { statusCode } = await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 262       expect(statusCode).to.equal(HttpStatusCode.NO_CONTENT_204)
 263     })
 264
 265     it('Should refresh the actor keys', async function () {
 266       this.timeout(20000)
 267
 268       // Wait refresh invalidation
 269       await wait(10000)
 270
 271       // Update keys of server 3 to invalid keys
 272       // Server 1 should refresh the actor and fail
 273       await setKeysOfServer(servers[2], servers[2], invalidKeys.publicKey, invalidKeys.privateKey)
 274
 275       const body = getAnnounceWithoutContext(servers[1])
 276       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 277
 278       const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 279       const signedBody = await buildSignedActivity(signer, body)
 280
 281       const headers = buildGlobalHeaders(signedBody)
 282
 283       try {
 284         await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 285         expect(true, 'Did not throw').to.be.false
 286       } catch (err) {
 287         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 288       }
 289     })
 290   })
 291
 292   after(async function () {
 293     this.timeout(10000)
 294
 295     await cleanupTests(servers)
 296
 297     await closeAllSequelize(servers)
 298   })
 299 })