server/tests/api/activitypub/security.ts

   1 /* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */
   2
   3 import 'mocha'
   4 import * as chai from 'chai'
   5 import { buildDigest } from '@server/helpers/peertube-crypto'
   6 import { HttpStatusCode } from '../../../../shared/core-utils/miscs/http-error-codes'
   7 import {
   8   buildAbsoluteFixturePath,
   9   cleanupTests,
  10   flushAndRunMultipleServers,
  11   killallServers,
  12   reRunServer,
  13   ServerInfo,
  14   wait
  15 } from '../../../../shared/extra-utils'
  16 import { makeFollowRequest, makePOSTAPRequest } from '../../../../shared/extra-utils/requests/activitypub'
  17 import { activityPubContextify, buildSignedActivity } from '../../../helpers/activitypub'
  18 import { HTTP_SIGNATURE } from '../../../initializers/constants'
  19 import { buildGlobalHeaders } from '../../../lib/job-queue/handlers/utils/activitypub-http-utils'
  20
  21 const expect = chai.expect
  22
  23 function setKeysOfServer (onServer: ServerInfo, ofServer: ServerInfo, publicKey: string, privateKey: string) {
  24   const url = 'http://localhost:' + ofServer.port + '/accounts/peertube'
  25
  26   return Promise.all([
  27     onServer.sql.setActorField(url, 'publicKey', publicKey),
  28     onServer.sql.setActorField(url, 'privateKey', privateKey)
  29   ])
  30 }
  31
  32 function setUpdatedAtOfServer (onServer: ServerInfo, ofServer: ServerInfo, updatedAt: string) {
  33   const url = 'http://localhost:' + ofServer.port + '/accounts/peertube'
  34
  35   return Promise.all([
  36     onServer.sql.setActorField(url, 'createdAt', updatedAt),
  37     onServer.sql.setActorField(url, 'updatedAt', updatedAt)
  38   ])
  39 }
  40
  41 function getAnnounceWithoutContext (server: ServerInfo) {
  42   const json = require(buildAbsoluteFixturePath('./ap-json/peertube/announce-without-context.json'))
  43   const result: typeof json = {}
  44
  45   for (const key of Object.keys(json)) {
  46     if (Array.isArray(json[key])) {
  47       result[key] = json[key].map(v => v.replace(':9002', `:${server.port}`))
  48     } else {
  49       result[key] = json[key].replace(':9002', `:${server.port}`)
  50     }
  51   }
  52
  53   return result
  54 }
  55
  56 describe('Test ActivityPub security', function () {
  57   let servers: ServerInfo[]
  58   let url: string
  59
  60   const keys = require(buildAbsoluteFixturePath('./ap-json/peertube/keys.json'))
  61   const invalidKeys = require(buildAbsoluteFixturePath('./ap-json/peertube/invalid-keys.json'))
  62   const baseHttpSignature = () => ({
  63     algorithm: HTTP_SIGNATURE.ALGORITHM,
  64     authorizationHeaderName: HTTP_SIGNATURE.HEADER_NAME,
  65     keyId: 'acct:peertube@localhost:' + servers[1].port,
  66     key: keys.privateKey,
  67     headers: HTTP_SIGNATURE.HEADERS_TO_SIGN
  68   })
  69
  70   // ---------------------------------------------------------------
  71
  72   before(async function () {
  73     this.timeout(60000)
  74
  75     servers = await flushAndRunMultipleServers(3)
  76
  77     url = servers[0].url + '/inbox'
  78
  79     await setKeysOfServer(servers[0], servers[1], keys.publicKey, null)
  80     await setKeysOfServer(servers[1], servers[1], keys.publicKey, keys.privateKey)
  81
  82     const to = { url: 'http://localhost:' + servers[0].port + '/accounts/peertube' }
  83     const by = { url: 'http://localhost:' + servers[1].port + '/accounts/peertube', privateKey: keys.privateKey }
  84     await makeFollowRequest(to, by)
  85   })
  86
  87   describe('When checking HTTP signature', function () {
  88
  89     it('Should fail with an invalid digest', async function () {
  90       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
  91       const headers = {
  92         Digest: buildDigest({ hello: 'coucou' })
  93       }
  94
  95       try {
  96         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
  97         expect(true, 'Did not throw').to.be.false
  98       } catch (err) {
  99         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 100       }
 101     })
 102
 103     it('Should fail with an invalid date', async function () {
 104       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
 105       const headers = buildGlobalHeaders(body)
 106       headers['date'] = 'Wed, 21 Oct 2015 07:28:00 GMT'
 107
 108       try {
 109         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 110         expect(true, 'Did not throw').to.be.false
 111       } catch (err) {
 112         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 113       }
 114     })
 115
 116     it('Should fail with bad keys', async function () {
 117       await setKeysOfServer(servers[0], servers[1], invalidKeys.publicKey, invalidKeys.privateKey)
 118       await setKeysOfServer(servers[1], servers[1], invalidKeys.publicKey, invalidKeys.privateKey)
 119
 120       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
 121       const headers = buildGlobalHeaders(body)
 122
 123       try {
 124         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 125         expect(true, 'Did not throw').to.be.false
 126       } catch (err) {
 127         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 128       }
 129     })
 130
 131     it('Should reject requests without appropriate signed headers', async function () {
 132       await setKeysOfServer(servers[0], servers[1], keys.publicKey, keys.privateKey)
 133       await setKeysOfServer(servers[1], servers[1], keys.publicKey, keys.privateKey)
 134
 135       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
 136       const headers = buildGlobalHeaders(body)
 137
 138       const signatureOptions = baseHttpSignature()
 139       const badHeadersMatrix = [
 140         [ '(request-target)', 'date', 'digest' ],
 141         [ 'host', 'date', 'digest' ],
 142         [ '(request-target)', 'host', 'digest' ]
 143       ]
 144
 145       for (const badHeaders of badHeadersMatrix) {
 146         signatureOptions.headers = badHeaders
 147
 148         try {
 149           await makePOSTAPRequest(url, body, signatureOptions, headers)
 150           expect(true, 'Did not throw').to.be.false
 151         } catch (err) {
 152           expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 153         }
 154       }
 155     })
 156
 157     it('Should succeed with a valid HTTP signature', async function () {
 158       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
 159       const headers = buildGlobalHeaders(body)
 160
 161       const { statusCode } = await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 162       expect(statusCode).to.equal(HttpStatusCode.NO_CONTENT_204)
 163     })
 164
 165     it('Should refresh the actor keys', async function () {
 166       this.timeout(20000)
 167
 168       // Update keys of server 2 to invalid keys
 169       // Server 1 should refresh the actor and fail
 170       await setKeysOfServer(servers[1], servers[1], invalidKeys.publicKey, invalidKeys.privateKey)
 171       await setUpdatedAtOfServer(servers[0], servers[1], '2015-07-17 22:00:00+00')
 172
 173       // Invalid peertube actor cache
 174       await killallServers([ servers[1] ])
 175       await reRunServer(servers[1])
 176
 177       const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
 178       const headers = buildGlobalHeaders(body)
 179
 180       try {
 181         await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
 182         expect(true, 'Did not throw').to.be.false
 183       } catch (err) {
 184         console.error(err)
 185         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 186       }
 187     })
 188   })
 189
 190   describe('When checking Linked Data Signature', function () {
 191     before(async function () {
 192       this.timeout(10000)
 193
 194       await setKeysOfServer(servers[0], servers[1], keys.publicKey, keys.privateKey)
 195       await setKeysOfServer(servers[1], servers[1], keys.publicKey, keys.privateKey)
 196       await setKeysOfServer(servers[2], servers[2], keys.publicKey, keys.privateKey)
 197
 198       const to = { url: 'http://localhost:' + servers[0].port + '/accounts/peertube' }
 199       const by = { url: 'http://localhost:' + servers[2].port + '/accounts/peertube', privateKey: keys.privateKey }
 200       await makeFollowRequest(to, by)
 201     })
 202
 203     it('Should fail with bad keys', async function () {
 204       this.timeout(10000)
 205
 206       await setKeysOfServer(servers[0], servers[2], invalidKeys.publicKey, invalidKeys.privateKey)
 207       await setKeysOfServer(servers[2], servers[2], invalidKeys.publicKey, invalidKeys.privateKey)
 208
 209       const body = getAnnounceWithoutContext(servers[1])
 210       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 211
 212       const signer: any = { privateKey: invalidKeys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 213       const signedBody = await buildSignedActivity(signer, body)
 214
 215       const headers = buildGlobalHeaders(signedBody)
 216
 217       try {
 218         await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 219         expect(true, 'Did not throw').to.be.false
 220       } catch (err) {
 221         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 222       }
 223     })
 224
 225     it('Should fail with an altered body', async function () {
 226       this.timeout(10000)
 227
 228       await setKeysOfServer(servers[0], servers[2], keys.publicKey, keys.privateKey)
 229       await setKeysOfServer(servers[0], servers[2], keys.publicKey, keys.privateKey)
 230
 231       const body = getAnnounceWithoutContext(servers[1])
 232       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 233
 234       const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 235       const signedBody = await buildSignedActivity(signer, body)
 236
 237       signedBody.actor = 'http://localhost:' + servers[2].port + '/account/peertube'
 238
 239       const headers = buildGlobalHeaders(signedBody)
 240
 241       try {
 242         await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 243         expect(true, 'Did not throw').to.be.false
 244       } catch (err) {
 245         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 246       }
 247     })
 248
 249     it('Should succeed with a valid signature', async function () {
 250       this.timeout(10000)
 251
 252       const body = getAnnounceWithoutContext(servers[1])
 253       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 254
 255       const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 256       const signedBody = await buildSignedActivity(signer, body)
 257
 258       const headers = buildGlobalHeaders(signedBody)
 259
 260       const { statusCode } = await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 261       expect(statusCode).to.equal(HttpStatusCode.NO_CONTENT_204)
 262     })
 263
 264     it('Should refresh the actor keys', async function () {
 265       this.timeout(20000)
 266
 267       // Wait refresh invalidation
 268       await wait(10000)
 269
 270       // Update keys of server 3 to invalid keys
 271       // Server 1 should refresh the actor and fail
 272       await setKeysOfServer(servers[2], servers[2], invalidKeys.publicKey, invalidKeys.privateKey)
 273
 274       const body = getAnnounceWithoutContext(servers[1])
 275       body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
 276
 277       const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
 278       const signedBody = await buildSignedActivity(signer, body)
 279
 280       const headers = buildGlobalHeaders(signedBody)
 281
 282       try {
 283         await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
 284         expect(true, 'Did not throw').to.be.false
 285       } catch (err) {
 286         expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
 287       }
 288     })
 289   })
 290
 291   after(async function () {
 292     this.timeout(10000)
 293
 294     await cleanupTests(servers)
 295   })
 296 })