From 714e47f38700d6cbb6ba8c338be238a79fd7a333 Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Sat, 29 Dec 2018 16:56:39 -0700 Subject: [PATCH 1/2] Add Accept validator/test --- .env.testing | 2 + app/Util/ActivityPub/Validator/Accept.php | 32 +++++++++++++ tests/Unit/ActivityPub/AcceptVerbTest.php | 55 +++++++++++++++++++++++ 3 files changed, 89 insertions(+) create mode 100644 app/Util/ActivityPub/Validator/Accept.php create mode 100644 tests/Unit/ActivityPub/AcceptVerbTest.php diff --git a/.env.testing b/.env.testing index f7dcfe55e..a37e329eb 100644 --- a/.env.testing +++ b/.env.testing @@ -53,3 +53,5 @@ MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}" MIX_APP_URL="${APP_URL}" MIX_API_BASE="${API_BASE}" MIX_API_SEARCH="${API_SEARCH}" + +TELESCOPE_ENABLED=false diff --git a/app/Util/ActivityPub/Validator/Accept.php b/app/Util/ActivityPub/Validator/Accept.php new file mode 100644 index 000000000..7230a37f3 --- /dev/null +++ b/app/Util/ActivityPub/Validator/Accept.php @@ -0,0 +1,32 @@ + 'required', + 'id' => 'required|string', + 'type' => [ + 'required', + Rule::in(['Accept']) + ], + 'actor' => 'required|url|active_url', + 'object' => 'required', + 'object.id' => 'required|url|active_url', + 'object.type' => [ + 'required', + Rule::in(['Follow']) + ], + 'object.actor' => 'required|url|active_url', + 'object.object' => 'required|url|active_url|same:actor', + ])->passes(); + + return $valid; + } +} \ No newline at end of file diff --git a/tests/Unit/ActivityPub/AcceptVerbTest.php b/tests/Unit/ActivityPub/AcceptVerbTest.php new file mode 100644 index 000000000..c949624db --- /dev/null +++ b/tests/Unit/ActivityPub/AcceptVerbTest.php @@ -0,0 +1,55 @@ +validAccept = [ + '@context' => 'https://www.w3.org/ns/activitystreams', + 'id' => 'https://example.org/og/b3e4a40b-0b26-4c5a-9079-094bd633fab7', + 'type' => 'Accept', + 'actor' => 'https://example.org/u/alice', + 'object' => [ + 'id' => 'https://example.net/u/bob#follows/bb27f601-ddb9-4567-8f16-023d90605ca9', + 'type' => 'Follow', + 'actor' => 'https://example.net/u/bob', + 'object' => 'https://example.org/u/alice' + ] + ]; + $this->invalidAccept = [ + '@context' => 'https://www.w3.org/ns/activitystreams', + 'id' => 'https://example.org/og/b3e4a40b-0b26-4c5a-9079-094bd633fab7', + 'type' => 'Accept2', + 'actor' => 'https://example.org/u/alice', + 'object' => [ + 'id' => 'https://example.net/u/bob#follows/bb27f601-ddb9-4567-8f16-023d90605ca9', + 'type' => 'Follow', + 'actor' => 'https://example.net/u/bob', + 'object' => 'https://example.org/u/alice' + ] + ]; + } + + /** @test */ + public function basic_accept() + { + $this->assertTrue(Accept::validate($this->validAccept)); + } + + /** @test */ + public function invalid_accept() + { + $this->assertFalse(Accept::validate($this->invalidAccept)); + } +} From 2d2c9a60f8b118b7fbe34c70ea820f4b9094be4a Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Sat, 29 Dec 2018 21:50:37 -0700 Subject: [PATCH 2/2] Fixes #719, add blind key rotation --- app/Http/Controllers/FederationController.php | 44 +++++++++++++++++-- 1 file changed, 40 insertions(+), 4 deletions(-) diff --git a/app/Http/Controllers/FederationController.php b/app/Http/Controllers/FederationController.php index c93b1b664..508874341 100644 --- a/app/Http/Controllers/FederationController.php +++ b/app/Http/Controllers/FederationController.php @@ -180,6 +180,20 @@ XML; if($profile->status != null) { return ProfileController::accountCheck($profile); } + $body = $request->getContent(); + $bodyDecoded = json_decode($body, true, 8); + if($this->verifySignature($request, $profile) == true) { + InboxWorker::dispatch($request->headers->all(), $profile, $bodyDecoded); + } else if($this->blindKeyRotation($request, $profile) == true) { + InboxWorker::dispatch($request->headers->all(), $profile, $bodyDecoded); + } else { + abort(400, 'Bad Signature'); + } + return; + } + + protected function verifySignature(Request $request, Profile $profile) + { $body = $request->getContent(); $bodyDecoded = json_decode($body, true, 8); $signature = $request->header('signature'); @@ -209,11 +223,33 @@ XML; $pkey = openssl_pkey_get_public($actor->public_key); $inboxPath = "/users/{$profile->username}/inbox"; list($verified, $headers) = HTTPSignature::verify($pkey, $signatureData, $request->headers->all(), $inboxPath, $body); - if($verified !== 1) { - abort(400, 'Invalid signature.'); + if($verified == 1) { + return true; + } else { + return false; } - InboxWorker::dispatch($request->headers->all(), $profile, $bodyDecoded); - return; + } + + protected function blindKeyRotation(Request $request, Profile $profile) + { + $signature = $request->header('signature'); + if(!$signature) { + abort(400, 'Missing signature header'); + } + $signatureData = HttpSignature::parseSignatureHeader($signature); + $keyId = Helpers::validateUrl($signatureData['keyId']); + $actor = Profile::whereKeyId($keyId)->first(); + $res = Zttp::timeout(5)->withHeaders([ + 'Accept' => 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', + 'User-Agent' => 'PixelFedBot v0.1 - https://pixelfed.org', + ])->get($actor->remote_url); + $res = json_decode($res->body(), true, 8); + if($res['publicKey']['id'] !== $actor->key_id) { + return false; + } + $actor->public_key = $res['publicKey']['publicKeyPem']; + $actor->save(); + return $this->verifySignature($request, $profile); } public function userFollowing(Request $request, $username)