X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=server%2Fhelpers%2Fpeertube-crypto.ts;h=dcf47ce761efb5752cb2af92c0fb7283a9a62cf4;hb=2166c058f34dff6f91566930d12448805d829de7;hp=fbc3bdcc2cb84c31db2e9957376cb5b6cb80fce2;hpb=d412e80e5f748f92118541a5334c14ebd4a90881;p=github%2FChocobozzz%2FPeerTube.git diff --git a/server/helpers/peertube-crypto.ts b/server/helpers/peertube-crypto.ts index fbc3bdcc2..dcf47ce76 100644 --- a/server/helpers/peertube-crypto.ts +++ b/server/helpers/peertube-crypto.ts @@ -1,148 +1,168 @@ -import * as crypto from 'crypto' -import { join } from 'path' - -import { - SIGNATURE_ALGORITHM, - SIGNATURE_ENCODING, - PRIVATE_CERT_NAME, - CONFIG, - BCRYPT_SALT_SIZE, - PUBLIC_CERT_NAME -} from '../initializers' -import { - readFilePromise, - bcryptComparePromise, - bcryptGenSaltPromise, - bcryptHashPromise, - accessPromise, - opensslExecPromise -} from './core-utils' +import { compare, genSalt, hash } from 'bcrypt' +import { createSign, createVerify } from 'crypto' +import { Request } from 'express' +import { cloneDeep } from 'lodash' +import { sha256 } from '@shared/extra-utils' +import { BCRYPT_SALT_SIZE, HTTP_SIGNATURE, PRIVATE_RSA_KEY_SIZE } from '../initializers/constants' +import { MActor } from '../types/models' +import { generateRSAKeyPairPromise, promisify1, promisify2 } from './core-utils' +import { jsonld } from './custom-jsonld-signature' import { logger } from './logger' -function checkSignature (publicKey: string, data: string, hexSignature: string) { - const verify = crypto.createVerify(SIGNATURE_ALGORITHM) - - let dataString - if (typeof data === 'string') { - dataString = data - } else { - try { - dataString = JSON.stringify(data) - } catch (err) { - logger.error('Cannot check signature.', err) - return false - } - } +const bcryptComparePromise = promisify2(compare) +const bcryptGenSaltPromise = promisify1(genSalt) +const bcryptHashPromise = promisify2(hash) + +const httpSignature = require('@peertube/http-signature') + +function createPrivateAndPublicKeys () { + logger.info('Generating a RSA key...') + + return generateRSAKeyPairPromise(PRIVATE_RSA_KEY_SIZE) +} + +// User password checks + +function comparePassword (plainPassword: string, hashPassword: string) { + if (!plainPassword) return Promise.resolve(false) + + return bcryptComparePromise(plainPassword, hashPassword) +} - verify.update(dataString, 'utf8') +async function cryptPassword (password: string) { + const salt = await bcryptGenSaltPromise(BCRYPT_SALT_SIZE) - const isValid = verify.verify(publicKey, hexSignature, SIGNATURE_ENCODING) - return isValid + return bcryptHashPromise(password, salt) } -async function sign (data: string|Object) { - const sign = crypto.createSign(SIGNATURE_ALGORITHM) - - let dataString: string - if (typeof data === 'string') { - dataString = data - } else { - try { - dataString = JSON.stringify(data) - } catch (err) { - logger.error('Cannot sign data.', err) - return '' - } +// HTTP Signature + +function isHTTPSignatureDigestValid (rawBody: Buffer, req: Request): boolean { + if (req.headers[HTTP_SIGNATURE.HEADER_NAME] && req.headers['digest']) { + return buildDigest(rawBody.toString()) === req.headers['digest'] } - sign.update(dataString, 'utf8') + return true +} - const myKey = await getMyPrivateCert() - return sign.sign(myKey, SIGNATURE_ENCODING) +function isHTTPSignatureVerified (httpSignatureParsed: any, actor: MActor): boolean { + return httpSignature.verifySignature(httpSignatureParsed, actor.publicKey) === true } -function comparePassword (plainPassword: string, hashPassword: string) { - return bcryptComparePromise(plainPassword, hashPassword) +function parseHTTPSignature (req: Request, clockSkew?: number) { + const requiredHeaders = req.method === 'POST' + ? [ '(request-target)', 'host', 'digest' ] + : [ '(request-target)', 'host' ] + + const parsed = httpSignature.parse(req, { clockSkew, headers: requiredHeaders }) + + const parsedHeaders = parsed.params.headers + if (!parsedHeaders.includes('date') && !parsedHeaders.includes('(created)')) { + throw new Error(`date or (created) must be included in signature`) + } + + return parsed } -async function createCertsIfNotExist () { - const exist = await certsExist() - if (exist === true) { - return +// JSONLD + +function isJsonLDSignatureVerified (fromActor: MActor, signedDocument: any): Promise { + if (signedDocument.signature.type === 'RsaSignature2017') { + return isJsonLDRSA2017Verified(fromActor, signedDocument) } - return await createCerts() + logger.warn('Unknown JSON LD signature %s.', signedDocument.signature.type, signedDocument) + + return Promise.resolve(false) } -async function cryptPassword (password: string) { - const salt = await bcryptGenSaltPromise(BCRYPT_SALT_SIZE) +// Backward compatibility with "other" implementations +async function isJsonLDRSA2017Verified (fromActor: MActor, signedDocument: any) { + const [ documentHash, optionsHash ] = await Promise.all([ + createDocWithoutSignatureHash(signedDocument), + createSignatureHash(signedDocument.signature) + ]) + + const toVerify = optionsHash + documentHash + + const verify = createVerify('RSA-SHA256') + verify.update(toVerify, 'utf8') - return await bcryptHashPromise(password, salt) + return verify.verify(fromActor.publicKey, signedDocument.signature.signatureValue, 'base64') } -function getMyPrivateCert () { - const certPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME) - return readFilePromise(certPath, 'utf8') +async function signJsonLDObject (byActor: MActor, data: T) { + const signature = { + type: 'RsaSignature2017', + creator: byActor.url, + created: new Date().toISOString() + } + + const [ documentHash, optionsHash ] = await Promise.all([ + createDocWithoutSignatureHash(data), + createSignatureHash(signature) + ]) + + const toSign = optionsHash + documentHash + + const sign = createSign('RSA-SHA256') + sign.update(toSign, 'utf8') + + const signatureValue = sign.sign(byActor.privateKey, 'base64') + Object.assign(signature, { signatureValue }) + + return Object.assign(data, { signature }) } -function getMyPublicCert () { - const certPath = join(CONFIG.STORAGE.CERT_DIR, PUBLIC_CERT_NAME) - return readFilePromise(certPath, 'utf8') +function buildDigest (body: any) { + const rawBody = typeof body === 'string' ? body : JSON.stringify(body) + + return 'SHA-256=' + sha256(rawBody, 'base64') } // --------------------------------------------------------------------------- export { - checkSignature, + isHTTPSignatureDigestValid, + parseHTTPSignature, + isHTTPSignatureVerified, + buildDigest, + isJsonLDSignatureVerified, comparePassword, - createCertsIfNotExist, + createPrivateAndPublicKeys, cryptPassword, - getMyPrivateCert, - getMyPublicCert, - sign + signJsonLDObject } // --------------------------------------------------------------------------- -async function certsExist () { - const certPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME) - - // If there is an error the certificates do not exist - try { - await accessPromise(certPath) - - return true - } catch { - return false - } +function hashObject (obj: any): Promise { + return jsonld.promises.normalize(obj, { + safe: false, + algorithm: 'URDNA2015', + format: 'application/n-quads' + }).then(res => sha256(res)) } -async function createCerts () { - const exist = await certsExist() - if (exist === true) { - const errorMessage = 'Certs already exist.' - logger.warning(errorMessage) - throw new Error(errorMessage) - } +function createSignatureHash (signature: any) { + const signatureCopy = cloneDeep(signature) + Object.assign(signatureCopy, { + '@context': [ + 'https://w3id.org/security/v1', + { RsaSignature2017: 'https://w3id.org/security#RsaSignature2017' } + ] + }) - logger.info('Generating a RSA key...') - - const privateCertPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME) - const genRsaOptions = { - 'out': privateCertPath, - '2048': false - } + delete signatureCopy.type + delete signatureCopy.id + delete signatureCopy.signatureValue - await opensslExecPromise('genrsa', genRsaOptions) - logger.info('RSA key generated.') - logger.info('Managing public key...') + return hashObject(signatureCopy) +} - const publicCertPath = join(CONFIG.STORAGE.CERT_DIR, 'peertube.pub') - const rsaOptions = { - 'in': privateCertPath, - 'pubout': true, - 'out': publicCertPath - } +function createDocWithoutSignatureHash (doc: any) { + const docWithoutSignature = cloneDeep(doc) + delete docWithoutSignature.signature - await opensslExecPromise('rsa', rsaOptions) + return hashObject(docWithoutSignature) }