1 /* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */
4 import * as chai from 'chai'
5 import { buildDigest } from '@server/helpers/peertube-crypto'
6 import { HttpStatusCode } from '../../../../shared/core-utils/miscs/http-error-codes'
8 buildAbsoluteFixturePath,
10 flushAndRunMultipleServers,
15 } from '../../../../shared/extra-utils'
16 import { makeFollowRequest, makePOSTAPRequest } from '../../../../shared/extra-utils/requests/activitypub'
17 import { activityPubContextify, buildSignedActivity } from '../../../helpers/activitypub'
18 import { HTTP_SIGNATURE } from '../../../initializers/constants'
19 import { buildGlobalHeaders } from '../../../lib/job-queue/handlers/utils/activitypub-http-utils'
21 const expect = chai.expect
23 function setKeysOfServer (onServer: ServerInfo, ofServer: ServerInfo, publicKey: string, privateKey: string) {
24 const url = 'http://localhost:' + ofServer.port + '/accounts/peertube'
27 onServer.sqlCommand.setActorField(url, 'publicKey', publicKey),
28 onServer.sqlCommand.setActorField(url, 'privateKey', privateKey)
32 function setUpdatedAtOfServer (onServer: ServerInfo, ofServer: ServerInfo, updatedAt: string) {
33 const url = 'http://localhost:' + ofServer.port + '/accounts/peertube'
36 onServer.sqlCommand.setActorField(url, 'createdAt', updatedAt),
37 onServer.sqlCommand.setActorField(url, 'updatedAt', updatedAt)
41 function getAnnounceWithoutContext (server: ServerInfo) {
42 const json = require(buildAbsoluteFixturePath('./ap-json/peertube/announce-without-context.json'))
43 const result: typeof json = {}
45 for (const key of Object.keys(json)) {
46 if (Array.isArray(json[key])) {
47 result[key] = json[key].map(v => v.replace(':9002', `:${server.port}`))
49 result[key] = json[key].replace(':9002', `:${server.port}`)
56 describe('Test ActivityPub security', function () {
57 let servers: ServerInfo[]
60 const keys = require(buildAbsoluteFixturePath('./ap-json/peertube/keys.json'))
61 const invalidKeys = require(buildAbsoluteFixturePath('./ap-json/peertube/invalid-keys.json'))
62 const baseHttpSignature = () => ({
63 algorithm: HTTP_SIGNATURE.ALGORITHM,
64 authorizationHeaderName: HTTP_SIGNATURE.HEADER_NAME,
65 keyId: 'acct:peertube@localhost:' + servers[1].port,
67 headers: HTTP_SIGNATURE.HEADERS_TO_SIGN
70 // ---------------------------------------------------------------
72 before(async function () {
75 servers = await flushAndRunMultipleServers(3)
77 url = servers[0].url + '/inbox'
79 await setKeysOfServer(servers[0], servers[1], keys.publicKey, null)
80 await setKeysOfServer(servers[1], servers[1], keys.publicKey, keys.privateKey)
82 const to = { url: 'http://localhost:' + servers[0].port + '/accounts/peertube' }
83 const by = { url: 'http://localhost:' + servers[1].port + '/accounts/peertube', privateKey: keys.privateKey }
84 await makeFollowRequest(to, by)
87 describe('When checking HTTP signature', function () {
89 it('Should fail with an invalid digest', async function () {
90 const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
92 Digest: buildDigest({ hello: 'coucou' })
96 await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
97 expect(true, 'Did not throw').to.be.false
99 expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
103 it('Should fail with an invalid date', async function () {
104 const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
105 const headers = buildGlobalHeaders(body)
106 headers['date'] = 'Wed, 21 Oct 2015 07:28:00 GMT'
109 await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
110 expect(true, 'Did not throw').to.be.false
112 expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
116 it('Should fail with bad keys', async function () {
117 await setKeysOfServer(servers[0], servers[1], invalidKeys.publicKey, invalidKeys.privateKey)
118 await setKeysOfServer(servers[1], servers[1], invalidKeys.publicKey, invalidKeys.privateKey)
120 const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
121 const headers = buildGlobalHeaders(body)
124 await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
125 expect(true, 'Did not throw').to.be.false
127 expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
131 it('Should reject requests without appropriate signed headers', async function () {
132 await setKeysOfServer(servers[0], servers[1], keys.publicKey, keys.privateKey)
133 await setKeysOfServer(servers[1], servers[1], keys.publicKey, keys.privateKey)
135 const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
136 const headers = buildGlobalHeaders(body)
138 const signatureOptions = baseHttpSignature()
139 const badHeadersMatrix = [
140 [ '(request-target)', 'date', 'digest' ],
141 [ 'host', 'date', 'digest' ],
142 [ '(request-target)', 'host', 'digest' ]
145 for (const badHeaders of badHeadersMatrix) {
146 signatureOptions.headers = badHeaders
149 await makePOSTAPRequest(url, body, signatureOptions, headers)
150 expect(true, 'Did not throw').to.be.false
152 expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
157 it('Should succeed with a valid HTTP signature', async function () {
158 const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
159 const headers = buildGlobalHeaders(body)
161 const { statusCode } = await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
162 expect(statusCode).to.equal(HttpStatusCode.NO_CONTENT_204)
165 it('Should refresh the actor keys', async function () {
168 // Update keys of server 2 to invalid keys
169 // Server 1 should refresh the actor and fail
170 await setKeysOfServer(servers[1], servers[1], invalidKeys.publicKey, invalidKeys.privateKey)
171 await setUpdatedAtOfServer(servers[0], servers[1], '2015-07-17 22:00:00+00')
173 // Invalid peertube actor cache
174 await killallServers([ servers[1] ])
175 await reRunServer(servers[1])
177 const body = activityPubContextify(getAnnounceWithoutContext(servers[1]))
178 const headers = buildGlobalHeaders(body)
181 await makePOSTAPRequest(url, body, baseHttpSignature(), headers)
182 expect(true, 'Did not throw').to.be.false
185 expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
190 describe('When checking Linked Data Signature', function () {
191 before(async function () {
194 await setKeysOfServer(servers[0], servers[1], keys.publicKey, keys.privateKey)
195 await setKeysOfServer(servers[1], servers[1], keys.publicKey, keys.privateKey)
196 await setKeysOfServer(servers[2], servers[2], keys.publicKey, keys.privateKey)
198 const to = { url: 'http://localhost:' + servers[0].port + '/accounts/peertube' }
199 const by = { url: 'http://localhost:' + servers[2].port + '/accounts/peertube', privateKey: keys.privateKey }
200 await makeFollowRequest(to, by)
203 it('Should fail with bad keys', async function () {
206 await setKeysOfServer(servers[0], servers[2], invalidKeys.publicKey, invalidKeys.privateKey)
207 await setKeysOfServer(servers[2], servers[2], invalidKeys.publicKey, invalidKeys.privateKey)
209 const body = getAnnounceWithoutContext(servers[1])
210 body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
212 const signer: any = { privateKey: invalidKeys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
213 const signedBody = await buildSignedActivity(signer, body)
215 const headers = buildGlobalHeaders(signedBody)
218 await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
219 expect(true, 'Did not throw').to.be.false
221 expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
225 it('Should fail with an altered body', async function () {
228 await setKeysOfServer(servers[0], servers[2], keys.publicKey, keys.privateKey)
229 await setKeysOfServer(servers[0], servers[2], keys.publicKey, keys.privateKey)
231 const body = getAnnounceWithoutContext(servers[1])
232 body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
234 const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
235 const signedBody = await buildSignedActivity(signer, body)
237 signedBody.actor = 'http://localhost:' + servers[2].port + '/account/peertube'
239 const headers = buildGlobalHeaders(signedBody)
242 await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
243 expect(true, 'Did not throw').to.be.false
245 expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
249 it('Should succeed with a valid signature', async function () {
252 const body = getAnnounceWithoutContext(servers[1])
253 body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
255 const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
256 const signedBody = await buildSignedActivity(signer, body)
258 const headers = buildGlobalHeaders(signedBody)
260 const { statusCode } = await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
261 expect(statusCode).to.equal(HttpStatusCode.NO_CONTENT_204)
264 it('Should refresh the actor keys', async function () {
267 // Wait refresh invalidation
270 // Update keys of server 3 to invalid keys
271 // Server 1 should refresh the actor and fail
272 await setKeysOfServer(servers[2], servers[2], invalidKeys.publicKey, invalidKeys.privateKey)
274 const body = getAnnounceWithoutContext(servers[1])
275 body.actor = 'http://localhost:' + servers[2].port + '/accounts/peertube'
277 const signer: any = { privateKey: keys.privateKey, url: 'http://localhost:' + servers[2].port + '/accounts/peertube' }
278 const signedBody = await buildSignedActivity(signer, body)
280 const headers = buildGlobalHeaders(signedBody)
283 await makePOSTAPRequest(url, signedBody, baseHttpSignature(), headers)
284 expect(true, 'Did not throw').to.be.false
286 expect(err.statusCode).to.equal(HttpStatusCode.FORBIDDEN_403)
291 after(async function () {
294 await cleanupTests(servers)