-import crypto = require('crypto')
-import bcrypt = require('bcrypt')
-import fs = require('fs')
-import openssl = require('openssl-wrapper')
-import { join } from 'path'
-
-import {
- SIGNATURE_ALGORITHM,
- SIGNATURE_ENCODING,
- PRIVATE_CERT_NAME,
- CONFIG,
- BCRYPT_SALT_SIZE,
- PUBLIC_CERT_NAME
-} from '../initializers'
+import { compare, genSalt, hash } from 'bcrypt'
+import { createSign, createVerify } from 'crypto'
+import { Request } from 'express'
+import { cloneDeep } from 'lodash'
+import { sha256 } from '@shared/extra-utils'
+import { BCRYPT_SALT_SIZE, HTTP_SIGNATURE, PRIVATE_RSA_KEY_SIZE } from '../initializers/constants'
+import { MActor } from '../types/models'
+import { createPrivateKey, getPublicKey, promisify1, promisify2 } from './core-utils'
+import { jsonld } from './custom-jsonld-signature'
import { logger } from './logger'
-function checkSignature (publicKey, data, hexSignature) {
- const verify = crypto.createVerify(SIGNATURE_ALGORITHM)
-
- let dataString
- if (typeof data === 'string') {
- dataString = data
- } else {
- try {
- dataString = JSON.stringify(data)
- } catch (err) {
- logger.error('Cannot check signature.', { error: err })
- return false
- }
- }
+const bcryptComparePromise = promisify2<any, string, boolean>(compare)
+const bcryptGenSaltPromise = promisify1<number, string>(genSalt)
+const bcryptHashPromise = promisify2<any, string | number, string>(hash)
+
+const httpSignature = require('@peertube/http-signature')
- verify.update(dataString, 'utf8')
+async function createPrivateAndPublicKeys () {
+ logger.info('Generating a RSA key...')
- const isValid = verify.verify(publicKey, hexSignature, SIGNATURE_ENCODING)
- return isValid
+ const { key } = await createPrivateKey(PRIVATE_RSA_KEY_SIZE)
+ const { publicKey } = await getPublicKey(key)
+
+ return { privateKey: key, publicKey }
}
-function sign (data) {
- const sign = crypto.createSign(SIGNATURE_ALGORITHM)
-
- let dataString
- if (typeof data === 'string') {
- dataString = data
- } else {
- try {
- dataString = JSON.stringify(data)
- } catch (err) {
- logger.error('Cannot sign data.', { error: err })
- return ''
- }
- }
+// User password checks
- sign.update(dataString, 'utf8')
+function comparePassword (plainPassword: string, hashPassword: string) {
+ return bcryptComparePromise(plainPassword, hashPassword)
+}
- // TODO: make async
- const certPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME)
- const myKey = fs.readFileSync(certPath)
- const signature = sign.sign(myKey.toString(), SIGNATURE_ENCODING)
+async function cryptPassword (password: string) {
+ const salt = await bcryptGenSaltPromise(BCRYPT_SALT_SIZE)
- return signature
+ return bcryptHashPromise(password, salt)
}
-function comparePassword (plainPassword, hashPassword, callback) {
- bcrypt.compare(plainPassword, hashPassword, function (err, isPasswordMatch) {
- if (err) return callback(err)
+// HTTP Signature
- return callback(null, isPasswordMatch)
- })
+function isHTTPSignatureDigestValid (rawBody: Buffer, req: Request): boolean {
+ if (req.headers[HTTP_SIGNATURE.HEADER_NAME] && req.headers['digest']) {
+ return buildDigest(rawBody.toString()) === req.headers['digest']
+ }
+
+ return true
}
-function createCertsIfNotExist (callback) {
- certsExist(function (err, exist) {
- if (err) return callback(err)
+function isHTTPSignatureVerified (httpSignatureParsed: any, actor: MActor): boolean {
+ return httpSignature.verifySignature(httpSignatureParsed, actor.publicKey) === true
+}
- if (exist === true) {
- return callback(null)
- }
+function parseHTTPSignature (req: Request, clockSkew?: number) {
+ const headers = req.method === 'POST'
+ ? HTTP_SIGNATURE.REQUIRED_HEADERS.POST
+ : HTTP_SIGNATURE.REQUIRED_HEADERS.ALL
- createCerts(function (err) {
- return callback(err)
- })
- })
+ return httpSignature.parse(req, { clockSkew, headers })
}
-function cryptPassword (password, callback) {
- bcrypt.genSalt(BCRYPT_SALT_SIZE, function (err, salt) {
- if (err) return callback(err)
+// JSONLD
- bcrypt.hash(password, salt, function (err, hash) {
- return callback(err, hash)
- })
- })
+function isJsonLDSignatureVerified (fromActor: MActor, signedDocument: any): Promise<boolean> {
+ if (signedDocument.signature.type === 'RsaSignature2017') {
+ return isJsonLDRSA2017Verified(fromActor, signedDocument)
+ }
+
+ logger.warn('Unknown JSON LD signature %s.', signedDocument.signature.type, signedDocument)
+
+ return Promise.resolve(false)
+}
+
+// Backward compatibility with "other" implementations
+async function isJsonLDRSA2017Verified (fromActor: MActor, signedDocument: any) {
+ const [ documentHash, optionsHash ] = await Promise.all([
+ createDocWithoutSignatureHash(signedDocument),
+ createSignatureHash(signedDocument.signature)
+ ])
+
+ const toVerify = optionsHash + documentHash
+
+ const verify = createVerify('RSA-SHA256')
+ verify.update(toVerify, 'utf8')
+
+ return verify.verify(fromActor.publicKey, signedDocument.signature.signatureValue, 'base64')
}
-function getMyPrivateCert (callback) {
- const certPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME)
- fs.readFile(certPath, 'utf8', callback)
+async function signJsonLDObject <T> (byActor: MActor, data: T) {
+ const signature = {
+ type: 'RsaSignature2017',
+ creator: byActor.url,
+ created: new Date().toISOString()
+ }
+
+ const [ documentHash, optionsHash ] = await Promise.all([
+ createDocWithoutSignatureHash(data),
+ createSignatureHash(signature)
+ ])
+
+ const toSign = optionsHash + documentHash
+
+ const sign = createSign('RSA-SHA256')
+ sign.update(toSign, 'utf8')
+
+ const signatureValue = sign.sign(byActor.privateKey, 'base64')
+ Object.assign(signature, { signatureValue })
+
+ return Object.assign(data, { signature })
}
-function getMyPublicCert (callback) {
- const certPath = join(CONFIG.STORAGE.CERT_DIR, PUBLIC_CERT_NAME)
- fs.readFile(certPath, 'utf8', callback)
+function buildDigest (body: any) {
+ const rawBody = typeof body === 'string' ? body : JSON.stringify(body)
+
+ return 'SHA-256=' + sha256(rawBody, 'base64')
}
// ---------------------------------------------------------------------------
export {
- checkSignature,
+ isHTTPSignatureDigestValid,
+ parseHTTPSignature,
+ isHTTPSignatureVerified,
+ buildDigest,
+ isJsonLDSignatureVerified,
comparePassword,
- createCertsIfNotExist,
+ createPrivateAndPublicKeys,
cryptPassword,
- getMyPrivateCert,
- getMyPublicCert,
- sign
+ signJsonLDObject
}
// ---------------------------------------------------------------------------
-function certsExist (callback) {
- const certPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME)
- fs.access(certPath, function (err) {
- // If there is an error the certificates do not exist
- const exists = !err
- return callback(null, exists)
- })
+function hashObject (obj: any): Promise<any> {
+ return jsonld.promises
+ .normalize(obj, {
+ algorithm: 'URDNA2015',
+ format: 'application/n-quads'
+ })
+ .then(res => sha256(res))
}
-function createCerts (callback) {
- certsExist(function (err, exist) {
- if (err) return callback(err)
-
- if (exist === true) {
- const string = 'Certs already exist.'
- logger.warning(string)
- return callback(new Error(string))
- }
-
- logger.info('Generating a RSA key...')
-
- const privateCertPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME)
- const genRsaOptions = {
- 'out': privateCertPath,
- '2048': false
- }
- openssl.exec('genrsa', genRsaOptions, function (err) {
- if (err) {
- logger.error('Cannot create private key on this pod.')
- return callback(err)
- }
-
- logger.info('RSA key generated.')
- logger.info('Managing public key...')
-
- const publicCertPath = join(CONFIG.STORAGE.CERT_DIR, 'peertube.pub')
- const rsaOptions = {
- 'in': privateCertPath,
- 'pubout': true,
- 'out': publicCertPath
- }
- openssl.exec('rsa', rsaOptions, function (err) {
- if (err) {
- logger.error('Cannot create public key on this pod.')
- return callback(err)
- }
-
- logger.info('Public key managed.')
- return callback(null)
- })
- })
+function createSignatureHash (signature: any) {
+ const signatureCopy = cloneDeep(signature)
+ Object.assign(signatureCopy, {
+ '@context': [
+ 'https://w3id.org/security/v1',
+ { RsaSignature2017: 'https://w3id.org/security#RsaSignature2017' }
+ ]
})
+
+ delete signatureCopy.type
+ delete signatureCopy.id
+ delete signatureCopy.signatureValue
+
+ return hashObject(signatureCopy)
+}
+
+function createDocWithoutSignatureHash (doc: any) {
+ const docWithoutSignature = cloneDeep(doc)
+ delete docWithoutSignature.signature
+
+ return hashObject(docWithoutSignature)
}
projects / github / Chocobozzz / PeerTube.git / blobdiff