Add plug to validate signed http requests.

This commit is contained in:
Roger Braun 2017-12-12 10:17:21 +01:00
parent e2e6365035
commit a9c23e1c32
3 changed files with 43 additions and 1 deletions

View File

@ -0,0 +1,19 @@
defmodule Pleroma.Web.Plugs.HTTPSignaturePlug do
alias Pleroma.Web.HTTPSignatures
import Plug.Conn
def init(options) do
options
end
def call(conn, opts) do
if get_req_header(conn, "signature") do
conn = conn
|> put_req_header("(request-target)", String.downcase("#{conn.method} #{conn.request_path}"))
assign(conn, :valid_signature, HTTPSignatures.validate_conn(conn))
else
conn
end
end
end

View File

@ -376,4 +376,14 @@ defmodule Pleroma.User do
:ok :ok
end end
def get_public_key_for_ap_id(ap_id) do
with %User{} = user <- get_cached_by_ap_id(ap_id),
%{info: %{"magic_key" => magic_key}} <- user,
public_key <- Pleroma.Web.Salmon.decode_key(magic_key) do
{:ok, public_key}
else
_ -> :error
end
end
end end

View File

@ -1,5 +1,7 @@
# https://tools.ietf.org/html/draft-cavage-http-signatures-08 # https://tools.ietf.org/html/draft-cavage-http-signatures-08
defmodule Pleroma.Web.HTTPSignatures do defmodule Pleroma.Web.HTTPSignatures do
alias Pleroma.User
def split_signature(sig) do def split_signature(sig) do
default = %{"headers" => "date"} default = %{"headers" => "date"}
@ -18,7 +20,18 @@ defmodule Pleroma.Web.HTTPSignatures do
def validate(headers, signature, public_key) do def validate(headers, signature, public_key) do
sigstring = build_signing_string(headers, signature["headers"]) sigstring = build_signing_string(headers, signature["headers"])
{:ok, sig} = Base.decode64(signature["signature"]) {:ok, sig} = Base.decode64(signature["signature"])
verify = :public_key.verify(sigstring, :sha256, sig, public_key) :public_key.verify(sigstring, :sha256, sig, public_key)
end
def validate_conn(conn) do
# TODO: How to get the right key and see if it is actually valid for that request.
# For now, fetch the key for the actor.
with actor_id <- conn.params["actor"],
{:ok, public_key} <- User.get_public_key_for_ap_id(actor_id) do
validate_conn(conn, public_key)
else
_ -> false
end
end end
def validate_conn(conn, public_key) do def validate_conn(conn, public_key) do