UA-Fediland/pixelfed
2
0
Fork 0
mirror of https://github.com/pixelfed/pixelfed.git synced 2024-11-22 06:21:27 +00:00
Code Issues Projects Releases Packages Wiki Activity

Updaet InboxPipelines, improve handling of missing signature validation headers

Browse source
This commit is contained in:
Daniel Supernault 2023-03-18 22:46:22 -06:00
parent da38b33a24
commit 419c0fb0fb
No known key found for this signature in database
GPG key ID: 0DEF1C662C9033F7
3 changed files with 357 additions and 328 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
app/Jobs/InboxPipeline/DeleteWorker.php
View file

@ -126,6 +126,11 @@ class DeleteWorker implements ShouldQueue
return false; return false;
} }
$signatureData = HttpSignature::parseSignatureHeader($signature); $signatureData = HttpSignature::parseSignatureHeader($signature);
if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) {
return false;
}
$keyId = Helpers::validateUrl($signatureData['keyId']); $keyId = Helpers::validateUrl($signatureData['keyId']);
$id = Helpers::validateUrl($bodyDecoded['id']); $id = Helpers::validateUrl($bodyDecoded['id']);
$keyDomain = parse_url($keyId, PHP_URL_HOST); $keyDomain = parse_url($keyId, PHP_URL_HOST);
@ -186,6 +191,11 @@ class DeleteWorker implements ShouldQueue
return; return;
} }
$signatureData = HttpSignature::parseSignatureHeader($signature); $signatureData = HttpSignature::parseSignatureHeader($signature);
if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) {
return;
}
$keyId = Helpers::validateUrl($signatureData['keyId']); $keyId = Helpers::validateUrl($signatureData['keyId']);
$actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first(); $actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first();
if(!$actor) { if(!$actor) {

352
app/Jobs/InboxPipeline/InboxValidator.php
View file

@ -5,9 +5,9 @@ namespace App\Jobs\InboxPipeline;
use Cache; use Cache;
use App\Profile; use App\Profile;
use App\Util\ActivityPub\{ use App\Util\ActivityPub\{
Helpers, Helpers,
HttpSignature, HttpSignature,
Inbox Inbox
}; };
use Illuminate\Bus\Queueable; use Illuminate\Bus\Queueable;
use Illuminate\Contracts\Queue\ShouldQueue; use Illuminate\Contracts\Queue\ShouldQueue;
@ -21,189 +21,199 @@ use Illuminate\Support\Lottery;
class InboxValidator implements ShouldQueue class InboxValidator implements ShouldQueue
{ {
use Dispatchable, InteractsWithQueue, Queueable, SerializesModels; use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
protected $username; protected $username;
protected $headers; protected $headers;
protected $payload; protected $payload;
public $timeout = 300; public $timeout = 300;
public $tries = 1; public $tries = 1;
public $maxExceptions = 1; public $maxExceptions = 1;
/** /**
* Create a new job instance. * Create a new job instance.
* *
* @return void * @return void
*/ */
public function __construct($username, $headers, $payload) public function __construct($username, $headers, $payload)
{ {
$this->username = $username; $this->username = $username;
$this->headers = $headers; $this->headers = $headers;
$this->payload = $payload; $this->payload = $payload;
} }
/** /**
* Execute the job. * Execute the job.
* *
* @return void * @return void
*/ */
public function handle() public function handle()
{ {
$username = $this->username; $username = $this->username;
$headers = $this->headers; $headers = $this->headers;
if(empty($headers) || empty($this->payload) || !isset($headers['signature']) || !isset($headers['date'])) { if(empty($headers) || empty($this->payload) || !isset($headers['signature']) || !isset($headers['date'])) {
return; return;
} }
$payload = json_decode($this->payload, true, 8); $payload = json_decode($this->payload, true, 8);
if(isset($payload['id'])) { if(isset($payload['id'])) {
$lockKey = 'pf:ap:user-inbox:activity:' . hash('sha256', $payload['id']); $lockKey = 'pf:ap:user-inbox:activity:' . hash('sha256', $payload['id']);
if(Cache::get($lockKey) !== null) { if(Cache::get($lockKey) !== null) {
// Job processed already // Job processed already
return 1; return 1;
} }
Cache::put($lockKey, 1, 3600); Cache::put($lockKey, 1, 3600);
} }
$profile = Profile::whereNull('domain')->whereUsername($username)->first(); $profile = Profile::whereNull('domain')->whereUsername($username)->first();
if(empty($profile) || empty($headers) || empty($payload)) { if(empty($profile) || empty($headers) || empty($payload)) {
return; return;
} }
if($profile->status != null) { if($profile->status != null) {
return; return;
} }
if($this->verifySignature($headers, $profile, $payload) == true) { if($this->verifySignature($headers, $profile, $payload) == true) {
if(isset($payload['type']) && in_array($payload['type'], ['Follow', 'Accept']) ) { if(isset($payload['type']) && in_array($payload['type'], ['Follow', 'Accept']) ) {
ActivityHandler::dispatch($headers, $profile, $payload)->onQueue('follow'); ActivityHandler::dispatch($headers, $profile, $payload)->onQueue('follow');
} else { } else {
$onQueue = Lottery::odds(1, 12)->winner(fn () => 'high')->loser(fn () => 'inbox')->choose(); $onQueue = Lottery::odds(1, 12)->winner(fn () => 'high')->loser(fn () => 'inbox')->choose();
ActivityHandler::dispatch($headers, $profile, $payload)->onQueue($onQueue); ActivityHandler::dispatch($headers, $profile, $payload)->onQueue($onQueue);
} }
return; return;
} else { } else {
return; return;
} }
} }
protected function verifySignature($headers, $profile, $payload) protected function verifySignature($headers, $profile, $payload)
{ {
$body = $this->payload; $body = $this->payload;
$bodyDecoded = $payload; $bodyDecoded = $payload;
$signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature']; $signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature'];
$date = is_array($headers['date']) ? $headers['date'][0] : $headers['date']; $date = is_array($headers['date']) ? $headers['date'][0] : $headers['date'];
if(!$signature) { if(!$signature) {
return false; return false;
} }
if(!$date) { if(!$date) {
return false; return false;
} }
if(!now()->parse($date)->gt(now()->subDays(1)) || if(!now()->parse($date)->gt(now()->subDays(1)) ||
!now()->parse($date)->lt(now()->addDays(1)) !now()->parse($date)->lt(now()->addDays(1))
) { ) {
return false; return false;
} }
if(!isset($bodyDecoded['id'])) { if(!isset($bodyDecoded['id'])) {
return false; return false;
} }
$signatureData = HttpSignature::parseSignatureHeader($signature); $signatureData = HttpSignature::parseSignatureHeader($signature);
$keyId = Helpers::validateUrl($signatureData['keyId']);
$id = Helpers::validateUrl($bodyDecoded['id']);
$keyDomain = parse_url($keyId, PHP_URL_HOST);
$idDomain = parse_url($id, PHP_URL_HOST);
if(isset($bodyDecoded['object'])
&& is_array($bodyDecoded['object'])
&& isset($bodyDecoded['object']['attributedTo'])
) {
$attr = Helpers::pluckval($bodyDecoded['object']['attributedTo']);
if(is_array($attr)) {
if(isset($attr['id'])) {
$attr = $attr['id'];
} else {
$attr = "";
}
}
if(parse_url($attr, PHP_URL_HOST) !== $keyDomain) {
return false;
}
}
if(!$keyDomain || !$idDomain || $keyDomain !== $idDomain) {
return false;
}
$actor = Profile::whereKeyId($keyId)->first();
if(!$actor) {
$actorUrl = Helpers::pluckval($bodyDecoded['actor']);
$actor = Helpers::profileFirstOrNew($actorUrl);
}
if(!$actor) {
return false;
}
$pkey = openssl_pkey_get_public($actor->public_key);
if(!$pkey) {
return false;
}
$inboxPath = "/users/{$profile->username}/inbox";
list($verified, $headers) = HttpSignature::verify($pkey, $signatureData, $headers, $inboxPath, $body);
if($verified == 1) {
return true;
} else {
return false;
}
}
protected function blindKeyRotation($headers, $profile, $payload) if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) {
{ return false;
$signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature']; }
$date = is_array($headers['date']) ? $headers['date'][0] : $headers['date'];
if(!$signature) {
return;
}
if(!$date) {
return;
}
if(!now()->parse($date)->gt(now()->subDays(1)) ||
!now()->parse($date)->lt(now()->addDays(1))
) {
return;
}
$signatureData = HttpSignature::parseSignatureHeader($signature);
$keyId = Helpers::validateUrl($signatureData['keyId']);
$actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first();
if(!$actor) {
return;
}
if(Helpers::validateUrl($actor->remote_url) == false) {
return;
}
try { $keyId = Helpers::validateUrl($signatureData['keyId']);
$res = Http::timeout(20)->withHeaders([ $id = Helpers::validateUrl($bodyDecoded['id']);
'Accept' => 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', $keyDomain = parse_url($keyId, PHP_URL_HOST);
'User-Agent' => 'PixelfedBot v0.1 - https://pixelfed.org', $idDomain = parse_url($id, PHP_URL_HOST);
])->get($actor->remote_url); if(isset($bodyDecoded['object'])
} catch (ConnectionException $e) { && is_array($bodyDecoded['object'])
return false; && isset($bodyDecoded['object']['attributedTo'])
} ) {
$attr = Helpers::pluckval($bodyDecoded['object']['attributedTo']);
if(is_array($attr)) {
if(isset($attr['id'])) {
$attr = $attr['id'];
} else {
$attr = "";
}
}
if(parse_url($attr, PHP_URL_HOST) !== $keyDomain) {
return false;
}
}
if(!$keyDomain || !$idDomain || $keyDomain !== $idDomain) {
return false;
}
$actor = Profile::whereKeyId($keyId)->first();
if(!$actor) {
$actorUrl = Helpers::pluckval($bodyDecoded['actor']);
$actor = Helpers::profileFirstOrNew($actorUrl);
}
if(!$actor) {
return false;
}
$pkey = openssl_pkey_get_public($actor->public_key);
if(!$pkey) {
return false;
}
$inboxPath = "/users/{$profile->username}/inbox";
list($verified, $headers) = HttpSignature::verify($pkey, $signatureData, $headers, $inboxPath, $body);
if($verified == 1) {
return true;
} else {
return false;
}
}
if(!$res->ok()) { protected function blindKeyRotation($headers, $profile, $payload)
return false; {
} $signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature'];
$date = is_array($headers['date']) ? $headers['date'][0] : $headers['date'];
if(!$signature) {
return;
}
if(!$date) {
return;
}
if(!now()->parse($date)->gt(now()->subDays(1)) ||
!now()->parse($date)->lt(now()->addDays(1))
) {
return;
}
$signatureData = HttpSignature::parseSignatureHeader($signature);
$res = json_decode($res->body(), true, 8); if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) {
if(!$res || empty($res) || !isset($res['publicKey']) || !isset($res['publicKey']['id'])) { return;
return; }
}
if($res['publicKey']['id'] !== $actor->key_id) { $keyId = Helpers::validateUrl($signatureData['keyId']);
return; $actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first();
} if(!$actor) {
$actor->public_key = $res['publicKey']['publicKeyPem']; return;
$actor->save(); }
return $this->verifySignature($headers, $profile, $payload); if(Helpers::validateUrl($actor->remote_url) == false) {
} return;
}
try {
$res = Http::timeout(20)->withHeaders([
'Accept' => 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"',
'User-Agent' => 'PixelfedBot v0.1 - https://pixelfed.org',
])->get($actor->remote_url);
} catch (ConnectionException $e) {
return false;
}
if(!$res->ok()) {
return false;
}
$res = json_decode($res->body(), true, 8);
if(!$res || empty($res) || !isset($res['publicKey']) || !isset($res['publicKey']['id'])) {
return;
}
if($res['publicKey']['id'] !== $actor->key_id) {
return;
}
$actor->public_key = $res['publicKey']['publicKeyPem'];
$actor->save();
return $this->verifySignature($headers, $profile, $payload);
}
} }

323
app/Jobs/InboxPipeline/InboxWorker.php
View file

@ -5,9 +5,9 @@ namespace App\Jobs\InboxPipeline;
use Cache; use Cache;
use App\Profile; use App\Profile;
use App\Util\ActivityPub\{ use App\Util\ActivityPub\{
Helpers, Helpers,
HttpSignature, HttpSignature,
Inbox Inbox
}; };
use Illuminate\Bus\Queueable; use Illuminate\Bus\Queueable;
use Illuminate\Contracts\Queue\ShouldQueue; use Illuminate\Contracts\Queue\ShouldQueue;
@ -20,171 +20,180 @@ use Illuminate\Http\Client\ConnectionException;
class InboxWorker implements ShouldQueue class InboxWorker implements ShouldQueue
{ {
use Dispatchable, InteractsWithQueue, Queueable, SerializesModels; use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
protected $headers; protected $headers;
protected $payload; protected $payload;
public $timeout = 300; public $timeout = 300;
public $tries = 1; public $tries = 1;
public $maxExceptions = 1; public $maxExceptions = 1;
/** /**
* Create a new job instance. * Create a new job instance.
* *
* @return void * @return void
*/ */
public function __construct($headers, $payload) public function __construct($headers, $payload)
{ {
$this->headers = $headers; $this->headers = $headers;
$this->payload = $payload; $this->payload = $payload;
} }
/** /**
* Execute the job. * Execute the job.
* *
* @return void * @return void
*/ */
public function handle() public function handle()
{ {
$profile = null; $profile = null;
$headers = $this->headers; $headers = $this->headers;
if(empty($headers) || empty($this->payload) || !isset($headers['signature']) || !isset($headers['date'])) { if(empty($headers) || empty($this->payload) || !isset($headers['signature']) || !isset($headers['date'])) {
return; return;
} }
$payload = json_decode($this->payload, true, 8); $payload = json_decode($this->payload, true, 8);
if(isset($payload['id'])) { if(isset($payload['id'])) {
$lockKey = 'pf:ap:user-inbox:activity:' . hash('sha256', $payload['id']); $lockKey = 'pf:ap:user-inbox:activity:' . hash('sha256', $payload['id']);
if(Cache::get($lockKey) !== null) { if(Cache::get($lockKey) !== null) {
// Job processed already // Job processed already
return 1; return 1;
} }
Cache::put($lockKey, 1, 3600); Cache::put($lockKey, 1, 3600);
} }
if($this->verifySignature($headers, $payload) == true) { if($this->verifySignature($headers, $payload) == true) {
ActivityHandler::dispatch($headers, $profile, $payload)->onQueue('shared'); ActivityHandler::dispatch($headers, $profile, $payload)->onQueue('shared');
return; return;
} else { } else {
return; return;
} }
} }
protected function verifySignature($headers, $payload) protected function verifySignature($headers, $payload)
{ {
$body = $this->payload; $body = $this->payload;
$bodyDecoded = $payload; $bodyDecoded = $payload;
$signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature']; $signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature'];
$date = is_array($headers['date']) ? $headers['date'][0] : $headers['date']; $date = is_array($headers['date']) ? $headers['date'][0] : $headers['date'];
if(!$signature) { if(!$signature) {
return false; return false;
} }
if(!$date) { if(!$date) {
return false; return false;
} }
if(!now()->parse($date)->gt(now()->subDays(1)) || if(!now()->parse($date)->gt(now()->subDays(1)) ||
!now()->parse($date)->lt(now()->addDays(1)) !now()->parse($date)->lt(now()->addDays(1))
) { ) {
return false; return false;
} }
if(!isset($bodyDecoded['id'])) { if(!isset($bodyDecoded['id'])) {
return false; return false;
} }
$signatureData = HttpSignature::parseSignatureHeader($signature); $signatureData = HttpSignature::parseSignatureHeader($signature);
$keyId = Helpers::validateUrl($signatureData['keyId']);
$id = Helpers::validateUrl($bodyDecoded['id']);
$keyDomain = parse_url($keyId, PHP_URL_HOST);
$idDomain = parse_url($id, PHP_URL_HOST);
if(isset($bodyDecoded['object'])
&& is_array($bodyDecoded['object'])
&& isset($bodyDecoded['object']['attributedTo'])
) {
$attr = Helpers::pluckval($bodyDecoded['object']['attributedTo']);
if(is_array($attr)) {
if(isset($attr['id'])) {
$attr = $attr['id'];
} else {
$attr = "";
}
}
if(parse_url($attr, PHP_URL_HOST) !== $keyDomain) {
return false;
}
}
if(!$keyDomain || !$idDomain || $keyDomain !== $idDomain) {
return false;
}
$actor = Profile::whereKeyId($keyId)->first();
if(!$actor) {
$actorUrl = Helpers::pluckval($bodyDecoded['actor']);
$actor = Helpers::profileFirstOrNew($actorUrl);
}
if(!$actor) {
return false;
}
$pkey = openssl_pkey_get_public($actor->public_key);
if(!$pkey) {
return false;
}
$inboxPath = "/f/inbox";
list($verified, $headers) = HttpSignature::verify($pkey, $signatureData, $headers, $inboxPath, $body);
if($verified == 1) {
return true;
} else {
return false;
}
}
protected function blindKeyRotation($headers, $payload) if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) {
{ return false;
$signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature']; }
$date = is_array($headers['date']) ? $headers['date'][0] : $headers['date'];
if(!$signature) {
return;
}
if(!$date) {
return;
}
if(!now()->parse($date)->gt(now()->subDays(1)) ||
!now()->parse($date)->lt(now()->addDays(1))
) {
return;
}
$signatureData = HttpSignature::parseSignatureHeader($signature);
$keyId = Helpers::validateUrl($signatureData['keyId']);
$actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first();
if(!$actor) {
return;
}
if(Helpers::validateUrl($actor->remote_url) == false) {
return;
}
try { $keyId = Helpers::validateUrl($signatureData['keyId']);
$res = Http::timeout(20)->withHeaders([ $id = Helpers::validateUrl($bodyDecoded['id']);
'Accept' => 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"', $keyDomain = parse_url($keyId, PHP_URL_HOST);
'User-Agent' => 'PixelfedBot v0.1 - https://pixelfed.org', $idDomain = parse_url($id, PHP_URL_HOST);
])->get($actor->remote_url); if(isset($bodyDecoded['object'])
} catch (ConnectionException $e) { && is_array($bodyDecoded['object'])
return false; && isset($bodyDecoded['object']['attributedTo'])
} ) {
$attr = Helpers::pluckval($bodyDecoded['object']['attributedTo']);
if(is_array($attr)) {
if(isset($attr['id'])) {
$attr = $attr['id'];
} else {
$attr = "";
}
}
if(parse_url($attr, PHP_URL_HOST) !== $keyDomain) {
return false;
}
}
if(!$keyDomain || !$idDomain || $keyDomain !== $idDomain) {
return false;
}
$actor = Profile::whereKeyId($keyId)->first();
if(!$actor) {
$actorUrl = Helpers::pluckval($bodyDecoded['actor']);
$actor = Helpers::profileFirstOrNew($actorUrl);
}
if(!$actor) {
return false;
}
$pkey = openssl_pkey_get_public($actor->public_key);
if(!$pkey) {
return false;
}
$inboxPath = "/f/inbox";
list($verified, $headers) = HttpSignature::verify($pkey, $signatureData, $headers, $inboxPath, $body);
if($verified == 1) {
return true;
} else {
return false;
}
}
if(!$res->ok()) { protected function blindKeyRotation($headers, $payload)
return false; {
} $signature = is_array($headers['signature']) ? $headers['signature'][0] : $headers['signature'];
$date = is_array($headers['date']) ? $headers['date'][0] : $headers['date'];
if(!$signature) {
return;
}
if(!$date) {
return;
}
if(!now()->parse($date)->gt(now()->subDays(1)) ||
!now()->parse($date)->lt(now()->addDays(1))
) {
return;
}
$signatureData = HttpSignature::parseSignatureHeader($signature);
if(!isset($signatureData['keyId'], $signatureData['signature'], $signatureData['headers']) || isset($signatureData['error'])) {
return;
}
$res = json_decode($res->body(), true, 8); $keyId = Helpers::validateUrl($signatureData['keyId']);
if(!$res || empty($res) || !isset($res['publicKey']) || !isset($res['publicKey']['id'])) { $actor = Profile::whereKeyId($keyId)->whereNotNull('remote_url')->first();
return; if(!$actor) {
} return;
if($res['publicKey']['id'] !== $actor->key_id) { }
return; if(Helpers::validateUrl($actor->remote_url) == false) {
} return;
$actor->public_key = $res['publicKey']['publicKeyPem']; }
$actor->save();
return $this->verifySignature($headers, $payload); try {
} $res = Http::timeout(20)->withHeaders([
'Accept' => 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"',
'User-Agent' => 'PixelfedBot v0.1 - https://pixelfed.org',
])->get($actor->remote_url);
} catch (ConnectionException $e) {
return false;
}
if(!$res->ok()) {
return false;
}
$res = json_decode($res->body(), true, 8);
if(!$res || empty($res) || !isset($res['publicKey']) || !isset($res['publicKey']['id'])) {
return;
}
if($res['publicKey']['id'] !== $actor->key_id) {
return;
}
$actor->public_key = $res['publicKey']['publicKeyPem'];
$actor->save();
return $this->verifySignature($headers, $payload);
}
} }