-import * as crypto from 'crypto'
-import { join } from 'path'
-
-import {
- SIGNATURE_ALGORITHM,
- SIGNATURE_ENCODING,
- PRIVATE_CERT_NAME,
- CONFIG,
- BCRYPT_SALT_SIZE,
- PUBLIC_CERT_NAME
-} from '../initializers'
-import {
- readFilePromise,
- bcryptComparePromise,
- bcryptGenSaltPromise,
- bcryptHashPromise,
- accessPromise,
- opensslExecPromise
-} from './core-utils'
+import { Request } from 'express'
+import { BCRYPT_SALT_SIZE, HTTP_SIGNATURE, PRIVATE_RSA_KEY_SIZE } from '../initializers'
+import { ActorModel } from '../models/activitypub/actor'
+import { bcryptComparePromise, bcryptGenSaltPromise, bcryptHashPromise, createPrivateKey, getPublicKey, sha256 } from './core-utils'
+import { jsig, jsonld } from './custom-jsonld-signature'
import { logger } from './logger'
+import { cloneDeep } from 'lodash'
+import { createVerify } from 'crypto'
+import { buildDigest } from '../lib/job-queue/handlers/utils/activitypub-http-utils'
-function checkSignature (publicKey: string, data: string, hexSignature: string) {
- const verify = crypto.createVerify(SIGNATURE_ALGORITHM)
-
- let dataString
- if (typeof data === 'string') {
- dataString = data
- } else {
- try {
- dataString = JSON.stringify(data)
- } catch (err) {
- logger.error('Cannot check signature.', err)
- return false
- }
- }
-
- verify.update(dataString, 'utf8')
+const httpSignature = require('http-signature')
- const isValid = verify.verify(publicKey, hexSignature, SIGNATURE_ENCODING)
- return isValid
-}
-
-async function sign (data: string|Object) {
- const sign = crypto.createSign(SIGNATURE_ALGORITHM)
-
- let dataString: string
- if (typeof data === 'string') {
- dataString = data
- } else {
- try {
- dataString = JSON.stringify(data)
- } catch (err) {
- logger.error('Cannot sign data.', err)
- return ''
- }
- }
+async function createPrivateAndPublicKeys () {
+ logger.info('Generating a RSA key...')
- sign.update(dataString, 'utf8')
+ const { key } = await createPrivateKey(PRIVATE_RSA_KEY_SIZE)
+ const { publicKey } = await getPublicKey(key)
- const myKey = await getMyPrivateCert()
- return sign.sign(myKey, SIGNATURE_ENCODING)
+ return { privateKey: key, publicKey }
}
+// User password checks
+
function comparePassword (plainPassword: string, hashPassword: string) {
return bcryptComparePromise(plainPassword, hashPassword)
}
-async function createCertsIfNotExist () {
- const exist = await certsExist()
- if (exist === true) {
- return
- }
-
- return await createCerts()
-}
-
async function cryptPassword (password: string) {
const salt = await bcryptGenSaltPromise(BCRYPT_SALT_SIZE)
- return await bcryptHashPromise(password, salt)
+ return bcryptHashPromise(password, salt)
}
-function getMyPrivateCert () {
- const certPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME)
- return readFilePromise(certPath, 'utf8')
-}
+// HTTP Signature
-function getMyPublicCert () {
- const certPath = join(CONFIG.STORAGE.CERT_DIR, PUBLIC_CERT_NAME)
- return readFilePromise(certPath, 'utf8')
+function isHTTPSignatureDigestValid (rawBody: Buffer, req: Request): boolean {
+ if (req.headers[HTTP_SIGNATURE.HEADER_NAME] && req.headers['digest']) {
+ return buildDigest(rawBody.toString()) === req.headers['digest']
+ }
+
+ return true
}
-// ---------------------------------------------------------------------------
+function isHTTPSignatureVerified (httpSignatureParsed: any, actor: ActorModel): boolean {
+ return httpSignature.verifySignature(httpSignatureParsed, actor.publicKey) === true
+}
-export {
- checkSignature,
- comparePassword,
- createCertsIfNotExist,
- cryptPassword,
- getMyPrivateCert,
- getMyPublicCert,
- sign
+function parseHTTPSignature (req: Request, clockSkew?: number) {
+ return httpSignature.parse(req, { authorizationHeaderName: HTTP_SIGNATURE.HEADER_NAME, clockSkew })
}
-// ---------------------------------------------------------------------------
+// JSONLD
-async function certsExist () {
- const certPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME)
+async function isJsonLDSignatureVerified (fromActor: ActorModel, signedDocument: any): Promise<boolean> {
+ if (signedDocument.signature.type === 'RsaSignature2017') {
+ // Mastodon algorithm
+ const res = await isJsonLDRSA2017Verified(fromActor, signedDocument)
+ // Success? If no, try with our library
+ if (res === true) return true
+ }
- // If there is an error the certificates do not exist
- try {
- await accessPromise(certPath)
+ const publicKeyObject = {
+ '@context': jsig.SECURITY_CONTEXT_URL,
+ id: fromActor.url,
+ type: 'CryptographicKey',
+ owner: fromActor.url,
+ publicKeyPem: fromActor.publicKey
+ }
- return true
- } catch {
- return false
+ const publicKeyOwnerObject = {
+ '@context': jsig.SECURITY_CONTEXT_URL,
+ id: fromActor.url,
+ publicKey: [ publicKeyObject ]
}
-}
-async function createCerts () {
- const exist = await certsExist()
- if (exist === true) {
- const errorMessage = 'Certs already exist.'
- logger.warning(errorMessage)
- throw new Error(errorMessage)
+ const options = {
+ publicKey: publicKeyObject,
+ publicKeyOwner: publicKeyOwnerObject
}
- logger.info('Generating a RSA key...')
+ return jsig.promises
+ .verify(signedDocument, options)
+ .then((result: { verified: boolean }) => result.verified)
+ .catch(err => {
+ logger.error('Cannot check signature.', { err })
+ return false
+ })
+}
- const privateCertPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME)
- const genRsaOptions = {
- 'out': privateCertPath,
- '2048': false
+// Backward compatibility with "other" implementations
+async function isJsonLDRSA2017Verified (fromActor: ActorModel, signedDocument: any) {
+ function hash (obj: any): Promise<any> {
+ return jsonld.promises
+ .normalize(obj, {
+ algorithm: 'URDNA2015',
+ format: 'application/n-quads'
+ })
+ .then(res => sha256(res))
}
- await opensslExecPromise('genrsa', genRsaOptions)
- logger.info('RSA key generated.')
- logger.info('Managing public key...')
+ const signatureCopy = cloneDeep(signedDocument.signature)
+ Object.assign(signatureCopy, {
+ '@context': [
+ 'https://w3id.org/security/v1',
+ { RsaSignature2017: 'https://w3id.org/security#RsaSignature2017' }
+ ]
+ })
+ delete signatureCopy.type
+ delete signatureCopy.id
+ delete signatureCopy.signatureValue
+
+ const docWithoutSignature = cloneDeep(signedDocument)
+ delete docWithoutSignature.signature
+
+ const [ documentHash, optionsHash ] = await Promise.all([
+ hash(docWithoutSignature),
+ hash(signatureCopy)
+ ])
+
+ const toVerify = optionsHash + documentHash
+
+ const verify = createVerify('RSA-SHA256')
+ verify.update(toVerify, 'utf8')
- const publicCertPath = join(CONFIG.STORAGE.CERT_DIR, 'peertube.pub')
- const rsaOptions = {
- 'in': privateCertPath,
- 'pubout': true,
- 'out': publicCertPath
+ return verify.verify(fromActor.publicKey, signedDocument.signature.signatureValue, 'base64')
+}
+
+function signJsonLDObject (byActor: ActorModel, data: any) {
+ const options = {
+ privateKeyPem: byActor.privateKey,
+ creator: byActor.url,
+ algorithm: 'RsaSignature2017'
}
- await opensslExecPromise('rsa', rsaOptions)
+ return jsig.promises.sign(data, options)
+}
+
+// ---------------------------------------------------------------------------
+
+export {
+ isHTTPSignatureDigestValid,
+ parseHTTPSignature,
+ isHTTPSignatureVerified,
+ isJsonLDSignatureVerified,
+ comparePassword,
+ createPrivateAndPublicKeys,
+ cryptPassword,
+ signJsonLDObject
}
projects / github / Chocobozzz / PeerTube.git / blobdiff