server/tests/api/activitypub/security.ts

   1 /* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */
   2
   3 import 'mocha'
   4 import * as chai from 'chai'
   5 import { buildDigest } from '@server/helpers/peertube-crypto'
   6 import { HttpStatusCode } from '../../../../shared/core-utils/miscs/http-error-codes'
   7 import {
   8   buildAbsoluteFixturePath,
   9   cleanupTests,
  10   closeAllSequelize,
  11   flushAndRunMultipleServers,
  12   killallServers,
  13   reRunServer,
  14   ServerInfo,
  15   setActorField,
  16   wait
  17 } from '../../../../shared/extra-utils'
  18 import { makeFollowRequest, makePOSTAPRequest } from '../../../../shared/extra-utils/requests/activitypub'
  19 import { activityPubContextify, buildSignedActivity } from '../../../helpers/activitypub'
  20 import { HTTP_SIGNATURE } from '../../../initializers/constants'
  21 import { buildGlobalHeaders } from '../../../lib/job-queue/handlers/utils/activitypub-http-utils'
  22
  23 const expect = chai.expect
  24
  25 function setKeysOfServer (onServer: ServerInfo, ofServer: ServerInfo, publicKey: string, privateKey: string) {
  26   const url = 'http://localhost:' + ofServer.port + '/accounts/peertube'
  27
  28   return Promise.all([
  29     setActorField(onServer.internalServerNumber, url, 'publicKey', publicKey),
  30     setActorField(onServer.internalServerNumber, url, 'privateKey', privateKey)
  31   ])
  32 }
  33
  34 function setUpdatedAtOfServer (onServer: ServerInfo, ofServer: ServerInfo, updatedAt: string) {
  35   const url = 'http://localhost:' + ofServer.port + '/accounts/peertube'
  36
  37   return Promise.all([
  38     setActorField(onServer.internalServerNumber, url, 'createdAt', updatedAt),
  39     setActorField(onServer.internalServerNumber, url, 'updatedAt', updatedAt)
  40   ])
  41 }
  42
  43 function getAnnounceWithoutContext (server: ServerInfo) {
  44   const json = require(buildAbsoluteFixturePath('./ap-json/peertube/announce-without-context.json'))
  45   const result: typeof json = {}
  46
  47   for (const key of Object.keys(json)) {
  48     if (Array.isArray(json[key])) {
  49       result[key] = json[key].map(v => v.replace(':9002', `:${server.port}`))
  50     } else {
  51       result[key] = json[key].replace(':9002', `:${server.port}`)
  52     }
  53   }
  54
  55   return result
  56 }
  57
  58 describe('Test ActivityPub security', function () {
  59   let servers: ServerInfo[]
  60   let url: string
  61
  62   const keys = require(buildAbsoluteFixturePath('./ap-json/peertube/keys.json'))
  63   const invalidKeys = require(buildAbsoluteFixturePath('./ap-json/peertube/invalid-keys.json'))
  64   const baseHttpSignature = () => ({
  65     algorithm: HTTP_SIGNATURE.ALGORITHM,
  66     authorizationHeaderName: HTTP_SIGNATURE.HEADER_NAME,
  67     keyId: 'acct:peertube@localhost:' + servers[1].port,
  68     key: keys.privateKey,
  69     headers: HTTP_SIGNATURE.HEADERS_TO_SIGN
  70   })
  71
  72   // ---------------------------------------------------------------
  73
  74   before(async function () {
  75     this.timeout(60000)
  76
  77     servers = await flushAndRunMultipleServers(3)
  78
  79     url = servers[0].url + '/inbox'
  80
  81     await setKeysOfServer(servers[0], servers[1], keys.publicKey, null)
  82     await setKeysOfServer(servers[1], servers[1], keys.publicKey, keys.privateKey)
  83
  84     const to = { url: 'http://localhost:' + servers[0].port + '/accounts/peertube' }
  85     const by = { url: 'http://localhost:' + servers[1].port + '/accounts/peertube', privateKey: keys.privateKey }
  86     await makeFollowRequest(to, by)
  87   })
  88
  89   describe('When checking HTTP signature', function () {
  90
  91     it('Should fail with an invalid digest', async function () {
  92       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
  93       const headers = {
  94         Digest: buildDigest({ hello: 'coucou' })
  95       }
  96
  97       try {
  98         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
  99         expect(true, 'Did not throw').to.be.false
 100       } catch (err) {
 101         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 102       }
 103     })
 104
 105     it('Should fail with an invalid date', async function () {
 106       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
 107       const headers = buildGlobalHeaders(body)
 108       headers['date'] = 'Wed, 21 Oct 2015 07:28:00 GMT'
 109
 110       try {
 111         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 112         expect(true, 'Did not throw').to.be.false
 113       } catch (err) {
 114         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 115       }
 116     })
 117
 118     it('Should fail with bad keys', async function () {
 119       await setKeysOfServer(servers[0], servers[1], invalidKeys.publicKey, invalidKeys.privateKey)
 120       await setKeysOfServer(servers[1], servers[1], invalidKeys.publicKey, invalidKeys.privateKey)
 121
 122       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
 123       const headers = buildGlobalHeaders(body)
 124
 125       try {
 126         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 127         expect(true, 'Did not throw').to.be.false
 128       } catch (err) {
 129         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 130       }
 131     })
 132
 133     it('Should reject requests without appropriate signed headers', async function () {
 134       await setKeysOfServer(servers[0], servers[1], keys.publicKey, keys.privateKey)
 135       await setKeysOfServer(servers[1], servers[1], keys.publicKey, keys.privateKey)
 136
 137       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
 138       const headers = buildGlobalHeaders(body)
 139
 140       const signatureOptions = baseHttpSignature()
 141       const badHeadersMatrix = [
 142         [ '(request-target)', 'date', 'digest' ],
 143         [ 'host', 'date', 'digest' ],
 144         [ '(request-target)', 'host', 'digest' ]
 145       ]
 146
 147       for (const badHeaders of badHeadersMatrix) {
 148         signatureOptions.headers = badHeaders
 149
 150         try {
 151           await makePOSTAPRequest(url, body, signatureOptions, headers)
 152           expect(true, 'Did not throw').to.be.false
 153         } catch (err) {
 154           expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 155         }
 156       }
 157     })
 158
 159     it('Should succeed with a valid HTTP signature', async function () {
 160       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
 161       const headers = buildGlobalHeaders(body)
 162
 163       const { statusCode } = await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 164       expect(statusCode).to.equal(HttpStatusCode.NO_CONTENT_204)
 165     })
 166
 167     it('Should refresh the actor keys', async function () {
 168       this.timeout(20000)
 169
 170       // Update keys of server 2 to invalid keys
 171       // Server 1 should refresh the actor and fail
 172       await setKeysOfServer(servers[1], servers[1], invalidKeys.publicKey, invalidKeys.privateKey)
 173       await setUpdatedAtOfServer(servers[0], servers[1], '2015-07-17 22:00:00+00')
 174
 175       // Invalid peertube actor cache
 176       killallServers([ servers[1] ])
 177       await reRunServer(servers[1])
 178
 179       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
 180       const headers = buildGlobalHeaders(body)
 181
 182       try {
 183         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 184         expect(true, 'Did not throw').to.be.false
 185       } catch (err) {
 186         console.error(err)
 187         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 188       }
 189     })
 190   })
 191
 192   describe('When checking Linked Data Signature', function () {
 193     before(async function () {
 194       this.timeout(10000)
 195
 196       await setKeysOfServer(servers[0], servers[1], keys.publicKey, keys.privateKey)
 197       await setKeysOfServer(servers[1], servers[1], keys.publicKey, keys.privateKey)
 198       await setKeysOfServer(servers[2], servers[2], keys.publicKey, keys.privateKey)
 199
 200       const to = { url: 'http://localhost:' + servers[0].port + '/accounts/peertube' }
 201       const by = { url: 'http://localhost:' + servers[2].port + '/accounts/peertube', privateKey: keys.privateKey }
 202       await makeFollowRequest(to, by)
 203     })
 204
 205     it('Should fail with bad keys', async function () {
 206       this.timeout(10000)
 207
 208       await setKeysOfServer(servers[0], servers[2], invalidKeys.publicKey, invalidKeys.privateKey)
 209       await setKeysOfServer(servers[2], servers[2], invalidKeys.publicKey, invalidKeys.privateKey)
 210
 211       const body = getAnnounceWithoutContext(servers[1])
 212       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 213
 214       const signer: any = { privateKey: invalidKeys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 215       const signedBody = await buildSignedActivity(signer, body)
 216
 217       const headers = buildGlobalHeaders(signedBody)
 218
 219       try {
 220         await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 221         expect(true, 'Did not throw').to.be.false
 222       } catch (err) {
 223         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 224       }
 225     })
 226
 227     it('Should fail with an altered body', async function () {
 228       this.timeout(10000)
 229
 230       await setKeysOfServer(servers[0], servers[2], keys.publicKey, keys.privateKey)
 231       await setKeysOfServer(servers[0], servers[2], keys.publicKey, keys.privateKey)
 232
 233       const body = getAnnounceWithoutContext(servers[1])
 234       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 235
 236       const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 237       const signedBody = await buildSignedActivity(signer, body)
 238
 239       signedBody.actor = 'http://localhost:' + servers[2].port + '/account/peertube'
 240
 241       const headers = buildGlobalHeaders(signedBody)
 242
 243       try {
 244         await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 245         expect(true, 'Did not throw').to.be.false
 246       } catch (err) {
 247         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 248       }
 249     })
 250
 251     it('Should succeed with a valid signature', async function () {
 252       this.timeout(10000)
 253
 254       const body = getAnnounceWithoutContext(servers[1])
 255       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 256
 257       const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 258       const signedBody = await buildSignedActivity(signer, body)
 259
 260       const headers = buildGlobalHeaders(signedBody)
 261
 262       const { statusCode } = await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 263       expect(statusCode).to.equal(HttpStatusCode.NO_CONTENT_204)
 264     })
 265
 266     it('Should refresh the actor keys', async function () {
 267       this.timeout(20000)
 268
 269       // Wait refresh invalidation
 270       await wait(10000)
 271
 272       // Update keys of server 3 to invalid keys
 273       // Server 1 should refresh the actor and fail
 274       await setKeysOfServer(servers[2], servers[2], invalidKeys.publicKey, invalidKeys.privateKey)
 275
 276       const body = getAnnounceWithoutContext(servers[1])
 277       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 278
 279       const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 280       const signedBody = await buildSignedActivity(signer, body)
 281
 282       const headers = buildGlobalHeaders(signedBody)
 283
 284       try {
 285         await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 286         expect(true, 'Did not throw').to.be.false
 287       } catch (err) {
 288         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 289       }
 290     })
 291   })
 292
 293   after(async function () {
 294     this.timeout(10000)
 295
 296     await cleanupTests(servers)
 297
 298     await closeAllSequelize(servers)
 299   })
 300 })