X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=server%2Fhelpers%2Fpeertube-crypto.ts;h=31705e7fa700bb373e16fa13b51a0a093d5b5ade;hb=06aad80165d09a8863ab8103149a8ff518b10641;hp=feb32a4cd7a2374425c4342a8bdce0a03b904cb1;hpb=4d4e5cd4dca78480ec7f40e747f424cd107376a4;p=github%2FChocobozzz%2FPeerTube.git diff --git a/server/helpers/peertube-crypto.ts b/server/helpers/peertube-crypto.ts index feb32a4cd..31705e7fa 100644 --- a/server/helpers/peertube-crypto.ts +++ b/server/helpers/peertube-crypto.ts @@ -1,171 +1,163 @@ -import * as crypto from 'crypto' -import * as bcrypt from 'bcrypt' -import * as fs from 'fs' -import * as openssl from 'openssl-wrapper' -import { join } from 'path' - -import { - SIGNATURE_ALGORITHM, - SIGNATURE_ENCODING, - PRIVATE_CERT_NAME, - CONFIG, - BCRYPT_SALT_SIZE, - PUBLIC_CERT_NAME -} from '../initializers' +import { compare, genSalt, hash } from 'bcrypt' +import { createSign, createVerify } from 'crypto' +import { Request } from 'express' +import { cloneDeep } from 'lodash' +import { BCRYPT_SALT_SIZE, HTTP_SIGNATURE, PRIVATE_RSA_KEY_SIZE } from '../initializers/constants' +import { MActor } from '../types/models' +import { sha256 } from '@shared/core-utils/crypto' +import { createPrivateKey, getPublicKey, promisify1, promisify2 } from './core-utils' +import { jsonld } from './custom-jsonld-signature' import { logger } from './logger' -function checkSignature (publicKey, data, hexSignature) { - const verify = crypto.createVerify(SIGNATURE_ALGORITHM) - - let dataString - if (typeof data === 'string') { - dataString = data - } else { - try { - dataString = JSON.stringify(data) - } catch (err) { - logger.error('Cannot check signature.', { error: err }) - return false - } - } +const bcryptComparePromise = promisify2(compare) +const bcryptGenSaltPromise = promisify1(genSalt) +const bcryptHashPromise = promisify2(hash) + +const httpSignature = require('@peertube/http-signature') - verify.update(dataString, 'utf8') +async function createPrivateAndPublicKeys () { + logger.info('Generating a RSA key...') - const isValid = verify.verify(publicKey, hexSignature, SIGNATURE_ENCODING) - return isValid + const { key } = await createPrivateKey(PRIVATE_RSA_KEY_SIZE) + const { publicKey } = await getPublicKey(key) + + return { privateKey: key, publicKey } } -function sign (data) { - const sign = crypto.createSign(SIGNATURE_ALGORITHM) - - let dataString - if (typeof data === 'string') { - dataString = data - } else { - try { - dataString = JSON.stringify(data) - } catch (err) { - logger.error('Cannot sign data.', { error: err }) - return '' - } - } +// User password checks - sign.update(dataString, 'utf8') +function comparePassword (plainPassword: string, hashPassword: string) { + return bcryptComparePromise(plainPassword, hashPassword) +} - // TODO: make async - const certPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME) - const myKey = fs.readFileSync(certPath) - const signature = sign.sign(myKey.toString(), SIGNATURE_ENCODING) +async function cryptPassword (password: string) { + const salt = await bcryptGenSaltPromise(BCRYPT_SALT_SIZE) - return signature + return bcryptHashPromise(password, salt) } -function comparePassword (plainPassword, hashPassword, callback) { - bcrypt.compare(plainPassword, hashPassword, function (err, isPasswordMatch) { - if (err) return callback(err) +// HTTP Signature - return callback(null, isPasswordMatch) - }) +function isHTTPSignatureDigestValid (rawBody: Buffer, req: Request): boolean { + if (req.headers[HTTP_SIGNATURE.HEADER_NAME] && req.headers['digest']) { + return buildDigest(rawBody.toString()) === req.headers['digest'] + } + + return true } -function createCertsIfNotExist (callback) { - certsExist(function (err, exist) { - if (err) return callback(err) +function isHTTPSignatureVerified (httpSignatureParsed: any, actor: MActor): boolean { + return httpSignature.verifySignature(httpSignatureParsed, actor.publicKey) === true +} - if (exist === true) { - return callback(null) - } +function parseHTTPSignature (req: Request, clockSkew?: number) { + const headers = req.method === 'POST' + ? HTTP_SIGNATURE.REQUIRED_HEADERS.POST + : HTTP_SIGNATURE.REQUIRED_HEADERS.ALL - createCerts(function (err) { - return callback(err) - }) - }) + return httpSignature.parse(req, { clockSkew, headers }) } -function cryptPassword (password, callback) { - bcrypt.genSalt(BCRYPT_SALT_SIZE, function (err, salt) { - if (err) return callback(err) +// JSONLD - bcrypt.hash(password, salt, function (err, hash) { - return callback(err, hash) - }) - }) +function isJsonLDSignatureVerified (fromActor: MActor, signedDocument: any): Promise { + if (signedDocument.signature.type === 'RsaSignature2017') { + return isJsonLDRSA2017Verified(fromActor, signedDocument) + } + + logger.warn('Unknown JSON LD signature %s.', signedDocument.signature.type, signedDocument) + + return Promise.resolve(false) +} + +// Backward compatibility with "other" implementations +async function isJsonLDRSA2017Verified (fromActor: MActor, signedDocument: any) { + const [ documentHash, optionsHash ] = await Promise.all([ + createDocWithoutSignatureHash(signedDocument), + createSignatureHash(signedDocument.signature) + ]) + + const toVerify = optionsHash + documentHash + + const verify = createVerify('RSA-SHA256') + verify.update(toVerify, 'utf8') + + return verify.verify(fromActor.publicKey, signedDocument.signature.signatureValue, 'base64') } -function getMyPrivateCert (callback) { - const certPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME) - fs.readFile(certPath, 'utf8', callback) +async function signJsonLDObject (byActor: MActor, data: T) { + const signature = { + type: 'RsaSignature2017', + creator: byActor.url, + created: new Date().toISOString() + } + + const [ documentHash, optionsHash ] = await Promise.all([ + createDocWithoutSignatureHash(data), + createSignatureHash(signature) + ]) + + const toSign = optionsHash + documentHash + + const sign = createSign('RSA-SHA256') + sign.update(toSign, 'utf8') + + const signatureValue = sign.sign(byActor.privateKey, 'base64') + Object.assign(signature, { signatureValue }) + + return Object.assign(data, { signature }) } -function getMyPublicCert (callback) { - const certPath = join(CONFIG.STORAGE.CERT_DIR, PUBLIC_CERT_NAME) - fs.readFile(certPath, 'utf8', callback) +function buildDigest (body: any) { + const rawBody = typeof body === 'string' ? body : JSON.stringify(body) + + return 'SHA-256=' + sha256(rawBody, 'base64') } // --------------------------------------------------------------------------- export { - checkSignature, + isHTTPSignatureDigestValid, + parseHTTPSignature, + isHTTPSignatureVerified, + buildDigest, + isJsonLDSignatureVerified, comparePassword, - createCertsIfNotExist, + createPrivateAndPublicKeys, cryptPassword, - getMyPrivateCert, - getMyPublicCert, - sign + signJsonLDObject } // --------------------------------------------------------------------------- -function certsExist (callback) { - const certPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME) - fs.access(certPath, function (err) { - // If there is an error the certificates do not exist - const exists = !err - return callback(null, exists) - }) +function hashObject (obj: any): Promise { + return jsonld.promises + .normalize(obj, { + algorithm: 'URDNA2015', + format: 'application/n-quads' + }) + .then(res => sha256(res)) } -function createCerts (callback) { - certsExist(function (err, exist) { - if (err) return callback(err) - - if (exist === true) { - const string = 'Certs already exist.' - logger.warning(string) - return callback(new Error(string)) - } - - logger.info('Generating a RSA key...') - - const privateCertPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME) - const genRsaOptions = { - 'out': privateCertPath, - '2048': false - } - openssl.exec('genrsa', genRsaOptions, function (err) { - if (err) { - logger.error('Cannot create private key on this pod.') - return callback(err) - } - - logger.info('RSA key generated.') - logger.info('Managing public key...') - - const publicCertPath = join(CONFIG.STORAGE.CERT_DIR, 'peertube.pub') - const rsaOptions = { - 'in': privateCertPath, - 'pubout': true, - 'out': publicCertPath - } - openssl.exec('rsa', rsaOptions, function (err) { - if (err) { - logger.error('Cannot create public key on this pod.') - return callback(err) - } - - logger.info('Public key managed.') - return callback(null) - }) - }) +function createSignatureHash (signature: any) { + const signatureCopy = cloneDeep(signature) + Object.assign(signatureCopy, { + '@context': [ + 'https://w3id.org/security/v1', + { RsaSignature2017: 'https://w3id.org/security#RsaSignature2017' } + ] }) + + delete signatureCopy.type + delete signatureCopy.id + delete signatureCopy.signatureValue + + return hashObject(signatureCopy) +} + +function createDocWithoutSignatureHash (doc: any) { + const docWithoutSignature = cloneDeep(doc) + delete docWithoutSignature.signature + + return hashObject(docWithoutSignature) }