server/tests/api/activitypub/security.ts

   1 /* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */
   2
   3 import { expect } from 'chai'
   4 import { buildDigest } from '@server/helpers/peertube-crypto'
   5 import { HTTP_SIGNATURE } from '@server/initializers/constants'
   6 import { activityPubContextify } from '@server/lib/activitypub/context'
   7 import { buildGlobalHeaders, signAndContextify } from '@server/lib/activitypub/send'
   8 import { makeFollowRequest, makePOSTAPRequest } from '@server/tests/shared'
   9 import { buildAbsoluteFixturePath, wait } from '@shared/core-utils'
  10 import { HttpStatusCode } from '@shared/models'
  11 import { cleanupTests, createMultipleServers, killallServers, PeerTubeServer } from '@shared/server-commands'
  12
  13 function setKeysOfServer (onServer: PeerTubeServer, ofServer: PeerTubeServer, publicKey: string, privateKey: string) {
  14   const url = 'http://localhost:' + ofServer.port + '/accounts/peertube'
  15
  16   return Promise.all([
  17     onServer.sql.setActorField(url, 'publicKey', publicKey),
  18     onServer.sql.setActorField(url, 'privateKey', privateKey)
  19   ])
  20 }
  21
  22 function setUpdatedAtOfServer (onServer: PeerTubeServer, ofServer: PeerTubeServer, updatedAt: string) {
  23   const url = 'http://localhost:' + ofServer.port + '/accounts/peertube'
  24
  25   return Promise.all([
  26     onServer.sql.setActorField(url, 'createdAt', updatedAt),
  27     onServer.sql.setActorField(url, 'updatedAt', updatedAt)
  28   ])
  29 }
  30
  31 function getAnnounceWithoutContext (server: PeerTubeServer) {
  32   const json = require(buildAbsoluteFixturePath('./ap-json/peertube/announce-without-context.json'))
  33   const result: typeof json = {}
  34
  35   for (const key of Object.keys(json)) {
  36     if (Array.isArray(json[key])) {
  37       result[key] = json[key].map(v => v.replace(':9002', `:${server.port}`))
  38     } else {
  39       result[key] = json[key].replace(':9002', `:${server.port}`)
  40     }
  41   }
  42
  43   return result
  44 }
  45
  46 describe('Test ActivityPub security', function () {
  47   let servers: PeerTubeServer[]
  48   let url: string
  49
  50   const keys = require(buildAbsoluteFixturePath('./ap-json/peertube/keys.json'))
  51   const invalidKeys = require(buildAbsoluteFixturePath('./ap-json/peertube/invalid-keys.json'))
  52   const baseHttpSignature = () => ({
  53     algorithm: HTTP_SIGNATURE.ALGORITHM,
  54     authorizationHeaderName: HTTP_SIGNATURE.HEADER_NAME,
  55     keyId: 'acct:peertube@localhost:' + servers[1].port,
  56     key: keys.privateKey,
  57     headers: HTTP_SIGNATURE.HEADERS_TO_SIGN
  58   })
  59
  60   // ---------------------------------------------------------------
  61
  62   before(async function () {
  63     this.timeout(60000)
  64
  65     servers = await createMultipleServers(3)
  66
  67     url = servers[0].url + '/inbox'
  68
  69     await setKeysOfServer(servers[0], servers[1], keys.publicKey, null)
  70     await setKeysOfServer(servers[1], servers[1], keys.publicKey, keys.privateKey)
  71
  72     const to = { url: 'http://localhost:' + servers[0].port + '/accounts/peertube' }
  73     const by = { url: 'http://localhost:' + servers[1].port + '/accounts/peertube', privateKey: keys.privateKey }
  74     await makeFollowRequest(to, by)
  75   })
  76
  77   describe('When checking HTTP signature', function () {
  78
  79     it('Should fail with an invalid digest', async function () {
  80       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]), 'Announce')
  81       const headers = {
  82         Digest: buildDigest({ hello: 'coucou' })
  83       }
  84
  85       try {
  86         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
  87         expect(true, 'Did not throw').to.be.false
  88       } catch (err) {
  89         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
  90       }
  91     })
  92
  93     it('Should fail with an invalid date', async function () {
  94       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]), 'Announce')
  95       const headers = buildGlobalHeaders(body)
  96       headers['date'] = 'Wed, 21 Oct 2015 07:28:00 GMT'
  97
  98       try {
  99         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 100         expect(true, 'Did not throw').to.be.false
 101       } catch (err) {
 102         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 103       }
 104     })
 105
 106     it('Should fail with bad keys', async function () {
 107       await setKeysOfServer(servers[0], servers[1], invalidKeys.publicKey, invalidKeys.privateKey)
 108       await setKeysOfServer(servers[1], servers[1], invalidKeys.publicKey, invalidKeys.privateKey)
 109
 110       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]), 'Announce')
 111       const headers = buildGlobalHeaders(body)
 112
 113       try {
 114         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 115         expect(true, 'Did not throw').to.be.false
 116       } catch (err) {
 117         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 118       }
 119     })
 120
 121     it('Should reject requests without appropriate signed headers', async function () {
 122       await setKeysOfServer(servers[0], servers[1], keys.publicKey, keys.privateKey)
 123       await setKeysOfServer(servers[1], servers[1], keys.publicKey, keys.privateKey)
 124
 125       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]), 'Announce')
 126       const headers = buildGlobalHeaders(body)
 127
 128       const signatureOptions = baseHttpSignature()
 129       const badHeadersMatrix = [
 130         [ '(request-target)', 'date', 'digest' ],
 131         [ 'host', 'date', 'digest' ],
 132         [ '(request-target)', 'host', 'digest' ]
 133       ]
 134
 135       for (const badHeaders of badHeadersMatrix) {
 136         signatureOptions.headers = badHeaders
 137
 138         try {
 139           await makePOSTAPRequest(url, body, signatureOptions, headers)
 140           expect(true, 'Did not throw').to.be.false
 141         } catch (err) {
 142           expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 143         }
 144       }
 145     })
 146
 147     it('Should succeed with a valid HTTP signature draft 11 (without date but with (created))', async function () {
 148       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]), 'Announce')
 149       const headers = buildGlobalHeaders(body)
 150
 151       const signatureOptions = baseHttpSignature()
 152       signatureOptions.headers = [ '(request-target)', '(created)', 'host', 'digest' ]
 153
 154       const { statusCode } = await makePOSTAPRequest(url, body, signatureOptions, headers)
 155       expect(statusCode).to.equal(HttpStatusCode.NO_CONTENT_204)
 156     })
 157
 158     it('Should succeed with a valid HTTP signature', async function () {
 159       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]), 'Announce')
 160       const headers = buildGlobalHeaders(body)
 161
 162       const { statusCode } = await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 163       expect(statusCode).to.equal(HttpStatusCode.NO_CONTENT_204)
 164     })
 165
 166     it('Should refresh the actor keys', async function () {
 167       this.timeout(20000)
 168
 169       // Update keys of server 2 to invalid keys
 170       // Server 1 should refresh the actor and fail
 171       await setKeysOfServer(servers[1], servers[1], invalidKeys.publicKey, invalidKeys.privateKey)
 172       await setUpdatedAtOfServer(servers[0], servers[1], '2015-07-17 22:00:00+00')
 173
 174       // Invalid peertube actor cache
 175       await killallServers([ servers[1] ])
 176       await servers[1].run()
 177
 178       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]), 'Announce')
 179       const headers = buildGlobalHeaders(body)
 180
 181       try {
 182         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 183         expect(true, 'Did not throw').to.be.false
 184       } catch (err) {
 185         console.error(err)
 186         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 187       }
 188     })
 189   })
 190
 191   describe('When checking Linked Data Signature', function () {
 192     before(async function () {
 193       this.timeout(10000)
 194
 195       await setKeysOfServer(servers[0], servers[1], keys.publicKey, keys.privateKey)
 196       await setKeysOfServer(servers[1], servers[1], keys.publicKey, keys.privateKey)
 197       await setKeysOfServer(servers[2], servers[2], keys.publicKey, keys.privateKey)
 198
 199       const to = { url: 'http://localhost:' + servers[0].port + '/accounts/peertube' }
 200       const by = { url: 'http://localhost:' + servers[2].port + '/accounts/peertube', privateKey: keys.privateKey }
 201       await makeFollowRequest(to, by)
 202     })
 203
 204     it('Should fail with bad keys', async function () {
 205       this.timeout(10000)
 206
 207       await setKeysOfServer(servers[0], servers[2], invalidKeys.publicKey, invalidKeys.privateKey)
 208       await setKeysOfServer(servers[2], servers[2], invalidKeys.publicKey, invalidKeys.privateKey)
 209
 210       const body = getAnnounceWithoutContext(servers[1])
 211       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 212
 213       const signer: any = { privateKey: invalidKeys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 214       const signedBody = await signAndContextify(signer, body, 'Announce')
 215
 216       const headers = buildGlobalHeaders(signedBody)
 217
 218       try {
 219         await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 220         expect(true, 'Did not throw').to.be.false
 221       } catch (err) {
 222         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 223       }
 224     })
 225
 226     it('Should fail with an altered body', async function () {
 227       this.timeout(10000)
 228
 229       await setKeysOfServer(servers[0], servers[2], keys.publicKey, keys.privateKey)
 230       await setKeysOfServer(servers[0], servers[2], keys.publicKey, keys.privateKey)
 231
 232       const body = getAnnounceWithoutContext(servers[1])
 233       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 234
 235       const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 236       const signedBody = await signAndContextify(signer, body, 'Announce')
 237
 238       signedBody.actor = 'http://localhost:' + servers[2].port + '/account/peertube'
 239
 240       const headers = buildGlobalHeaders(signedBody)
 241
 242       try {
 243         await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 244         expect(true, 'Did not throw').to.be.false
 245       } catch (err) {
 246         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 247       }
 248     })
 249
 250     it('Should succeed with a valid signature', async function () {
 251       this.timeout(10000)
 252
 253       const body = getAnnounceWithoutContext(servers[1])
 254       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 255
 256       const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 257       const signedBody = await signAndContextify(signer, body, 'Announce')
 258
 259       const headers = buildGlobalHeaders(signedBody)
 260
 261       const { statusCode } = await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 262       expect(statusCode).to.equal(HttpStatusCode.NO_CONTENT_204)
 263     })
 264
 265     it('Should refresh the actor keys', async function () {
 266       this.timeout(20000)
 267
 268       // Wait refresh invalidation
 269       await wait(10000)
 270
 271       // Update keys of server 3 to invalid keys
 272       // Server 1 should refresh the actor and fail
 273       await setKeysOfServer(servers[2], servers[2], invalidKeys.publicKey, invalidKeys.privateKey)
 274
 275       const body = getAnnounceWithoutContext(servers[1])
 276       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 277
 278       const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 279       const signedBody = await signAndContextify(signer, body, 'Announce')
 280
 281       const headers = buildGlobalHeaders(signedBody)
 282
 283       try {
 284         await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 285         expect(true, 'Did not throw').to.be.false
 286       } catch (err) {
 287         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 288       }
 289     })
 290   })
 291
 292   after(async function () {
 293     this.timeout(10000)
 294
 295     await cleanupTests(servers)
 296   })
 297 })