HTTP signatures (#4146)
* Add Request class with HTTP signature generator Spec: https://tools.ietf.org/html/draft-cavage-http-signatures-06 * Add HTTP signature verification concern * Add test for SignatureVerification concern * Add basic test for Request class * Make PuSH subscribe/unsubscribe requests use new Request class Accidentally fix lease_seconds not being set and sent properly, and change the new minimum subscription duration to 1 day * Make all PuSH workers use new Request class * Make Salmon sender use new Request class * Make FetchLinkService use new Request class * Make FetchAtomService use the new Request class * Make Remotable use the new Request class * Make ResolveRemoteAccountService use the new Request class * Add more tests * Allow +-30 seconds window for signed request to remain valid * Disable time window validation for signed requests, restore 7 days as PuSH subscription duration (which was previous default due to a bug)master
Eugen Rochko
7 years ago
committed by
GitHub
parent
c1f201c49a
commit
1618b68bfa
@ -0,0 +1,87 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
# Implemented according to HTTP signatures (Draft 6) |
||||
# <https://tools.ietf.org/html/draft-cavage-http-signatures-06> |
||||
module SignatureVerification |
||||
extend ActiveSupport::Concern |
||||
|
||||
def signed_request? |
||||
request.headers['Signature'].present? |
||||
end |
||||
|
||||
def signed_request_account |
||||
return @signed_request_account if defined?(@signed_request_account) |
||||
|
||||
unless signed_request? |
||||
@signed_request_account = nil |
||||
return |
||||
end |
||||
|
||||
raw_signature = request.headers['Signature'] |
||||
signature_params = {} |
||||
|
||||
raw_signature.split(',').each do |part| |
||||
parsed_parts = part.match(/([a-z]+)="([^"]+)"/i) |
||||
next if parsed_parts.nil? || parsed_parts.size != 3 |
||||
signature_params[parsed_parts[1]] = parsed_parts[2] |
||||
end |
||||
|
||||
if incompatible_signature?(signature_params) |
||||
@signed_request_account = nil |
||||
return |
||||
end |
||||
|
||||
account = ResolveRemoteAccountService.new.call(signature_params['keyId'].gsub(/\Aacct:/, '')) |
||||
|
||||
if account.nil? |
||||
@signed_request_account = nil |
||||
return |
||||
end |
||||
|
||||
signature = Base64.decode64(signature_params['signature']) |
||||
compare_signed_string = build_signed_string(signature_params['headers']) |
||||
|
||||
if account.keypair.public_key.verify(OpenSSL::Digest::SHA256.new, signature, compare_signed_string) |
||||
@signed_request_account = account |
||||
@signed_request_account |
||||
else |
||||
@signed_request_account = nil |
||||
end |
||||
end |
||||
|
||||
private |
||||
|
||||
def build_signed_string(signed_headers) |
||||
signed_headers = 'date' if signed_headers.blank? |
||||
|
||||
signed_headers.split(' ').map do |signed_header| |
||||
if signed_header == Request::REQUEST_TARGET |
||||
"#{Request::REQUEST_TARGET}: #{request.method.downcase} #{request.path}" |
||||
else |
||||
"#{signed_header}: #{request.headers[to_header_name(signed_header)]}" |
||||
end |
||||
end.join("\n") |
||||
end |
||||
|
||||
def matches_time_window? |
||||
begin |
||||
time_sent = DateTime.httpdate(request.headers['Date']) |
||||
rescue ArgumentError |
||||
return false |
||||
end |
||||
|
||||
(Time.now.utc - time_sent).abs <= 30 |
||||
end |
||||
|
||||
def to_header_name(name) |
||||
name.split(/-/).map(&:capitalize).join('-') |
||||
end |
||||
|
||||
def incompatible_signature?(signature_params) |
||||
signature_params['keyId'].blank? || |
||||
signature_params['signature'].blank? || |
||||
signature_params['algorithm'].blank? || |
||||
signature_params['algorithm'] != 'rsa-sha256' || |
||||
!signature_params['keyId'].start_with?('acct:') |
||||
end |
||||
end |
||||
@ -1,17 +0,0 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
module HttpHelper |
||||
def http_client(options = {}) |
||||
timeout = { write: 10, connect: 10, read: 10 }.merge(options) |
||||
|
||||
HTTP.headers(user_agent: user_agent) |
||||
.timeout(:per_operation, timeout) |
||||
.follow |
||||
end |
||||
|
||||
private |
||||
|
||||
def user_agent |
||||
@user_agent ||= "#{HTTP::Request::USER_AGENT} (Mastodon/#{Mastodon::Version}; +http://#{Rails.configuration.x.local_domain}/)" |
||||
end |
||||
end |
||||
@ -0,0 +1,70 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
class Request |
||||
REQUEST_TARGET = '(request-target)' |
||||
|
||||
include RoutingHelper |
||||
|
||||
def initialize(verb, url, options = {}) |
||||
@verb = verb |
||||
@url = Addressable::URI.parse(url).normalize |
||||
@options = options |
||||
@headers = {} |
||||
|
||||
set_common_headers! |
||||
end |
||||
|
||||
def on_behalf_of(account) |
||||
raise ArgumentError unless account.local? |
||||
@account = account |
||||
end |
||||
|
||||
def add_headers(new_headers) |
||||
@headers.merge!(new_headers) |
||||
end |
||||
|
||||
def perform |
||||
http_client.headers(headers).public_send(@verb, @url.to_s, @options) |
||||
end |
||||
|
||||
def headers |
||||
(@account ? @headers.merge('Signature' => signature) : @headers).without(REQUEST_TARGET) |
||||
end |
||||
|
||||
private |
||||
|
||||
def set_common_headers! |
||||
@headers[REQUEST_TARGET] = "#{@verb} #{@url.path}" |
||||
@headers['User-Agent'] = user_agent |
||||
@headers['Host'] = @url.host |
||||
@headers['Date'] = Time.now.utc.httpdate |
||||
end |
||||
|
||||
def signature |
||||
key_id = @account.to_webfinger_s |
||||
algorithm = 'rsa-sha256' |
||||
signature = Base64.strict_encode64(@account.keypair.sign(OpenSSL::Digest::SHA256.new, signed_string)) |
||||
|
||||
"keyId=\"#{key_id}\",algorithm=\"#{algorithm}\",headers=\"#{signed_headers}\",signature=\"#{signature}\"" |
||||
end |
||||
|
||||
def signed_string |
||||
@headers.map { |key, value| "#{key.downcase}: #{value}" }.join("\n") |
||||
end |
||||
|
||||
def signed_headers |
||||
@headers.keys.join(' ').downcase |
||||
end |
||||
|
||||
def user_agent |
||||
@user_agent ||= "#{HTTP::Request::USER_AGENT} (Mastodon/#{Mastodon::Version}; +#{root_url})" |
||||
end |
||||
|
||||
def timeout |
||||
{ write: 10, connect: 10, read: 10 } |
||||
end |
||||
|
||||
def http_client |
||||
HTTP.timeout(:per_operation, timeout).follow |
||||
end |
||||
end |
||||
@ -0,0 +1,74 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
require 'rails_helper' |
||||
|
||||
describe ApplicationController, type: :controller do |
||||
controller do |
||||
include SignatureVerification |
||||
|
||||
def success |
||||
head 200 |
||||
end |
||||
|
||||
def alternative_success |
||||
head 200 |
||||
end |
||||
end |
||||
|
||||
before do |
||||
routes.draw { get 'success' => 'anonymous#success' } |
||||
end |
||||
|
||||
context 'without signature header' do |
||||
before do |
||||
get :success |
||||
end |
||||
|
||||
describe '#signed_request?' do |
||||
it 'returns false' do |
||||
expect(controller.signed_request?).to be false |
||||
end |
||||
end |
||||
|
||||
describe '#signed_request_account' do |
||||
it 'returns nil' do |
||||
expect(controller.signed_request_account).to be_nil |
||||
end |
||||
end |
||||
end |
||||
|
||||
context 'with signature header' do |
||||
let!(:author) { Fabricate(:account) } |
||||
|
||||
before do |
||||
get :success |
||||
|
||||
fake_request = Request.new(:get, request.url) |
||||
fake_request.on_behalf_of(author) |
||||
|
||||
request.headers.merge!(fake_request.headers) |
||||
end |
||||
|
||||
describe '#signed_request?' do |
||||
it 'returns true' do |
||||
expect(controller.signed_request?).to be true |
||||
end |
||||
end |
||||
|
||||
describe '#signed_request_account' do |
||||
it 'returns an account' do |
||||
expect(controller.signed_request_account).to eq author |
||||
end |
||||
|
||||
it 'returns nil when path does not match' do |
||||
request.path = '/alternative-path' |
||||
expect(controller.signed_request_account).to be_nil |
||||
end |
||||
|
||||
it 'returns nil when method does not match' do |
||||
post :success |
||||
expect(controller.signed_request_account).to be_nil |
||||
end |
||||
end |
||||
end |
||||
end |
||||
@ -1,13 +0,0 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
require 'rails_helper' |
||||
|
||||
describe HttpHelper do |
||||
describe 'http_client' do |
||||
it 'returns HTTP::Client with default options' do |
||||
options = helper.http_client.default_options |
||||
expect(options.headers['User-Agent']).to match /.+ \(Mastodon\/.+;\ \+http:\/\/cb6e6126\.ngrok\.io\/\)/ |
||||
expect(options.timeout_options).to eq read_timeout: 10, write_timeout: 10, connect_timeout: 10 |
||||
end |
||||
end |
||||
end |
||||
@ -0,0 +1,54 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
require 'rails_helper' |
||||
|
||||
describe Request do |
||||
subject { Request.new(:get, 'http://example.com') } |
||||
|
||||
describe '#headers' do |
||||
it 'returns user agent' do |
||||
expect(subject.headers['User-Agent']).to be_present |
||||
end |
||||
|
||||
it 'returns the date header' do |
||||
expect(subject.headers['Date']).to be_present |
||||
end |
||||
|
||||
it 'returns the host header' do |
||||
expect(subject.headers['Host']).to be_present |
||||
end |
||||
|
||||
it 'does not return virtual request-target header' do |
||||
expect(subject.headers['(request-target)']).to be_nil |
||||
end |
||||
end |
||||
|
||||
describe '#on_behalf_of' do |
||||
it 'when used, adds signature header' do |
||||
subject.on_behalf_of(Fabricate(:account)) |
||||
expect(subject.headers['Signature']).to be_present |
||||
end |
||||
end |
||||
|
||||
describe '#add_headers' do |
||||
it 'adds headers to the request' do |
||||
subject.add_headers('Test' => 'Foo') |
||||
expect(subject.headers['Test']).to eq 'Foo' |
||||
end |
||||
end |
||||
|
||||
describe '#perform' do |
||||
before do |
||||
stub_request(:get, 'http://example.com') |
||||
subject.perform |
||||
end |
||||
|
||||
it 'executes a HTTP request' do |
||||
expect(a_request(:get, 'http://example.com')).to have_been_made.once |
||||
end |
||||
|
||||
it 'sets headers' do |
||||
expect(a_request(:get, 'http://example.com').with(headers: subject.headers)).to have_been_made |
||||
end |
||||
end |
||||
end |
||||
Loading…
Reference in new issue