mirror of
https://github.com/superseriousbusiness/gotosocial.git
synced 2024-12-04 22:20:53 +01:00
1d51e3c8d6
* update activity library so dereferencer returns full response and checks *final* link to allow for redirects * temporarily add bodged fixed library * remove unused code * update getAccountFeatured() to use dereferenceCollectionPage() * make sure to release map * perform a 2nd decode to ensure reader is empty after primary decode * add comment explaining choice of using Decode() instead of Unmarshal() * update embedded activity library to latest matching https://github.com/superseriousbusiness/activity/pull/21 * add checks to look for changed URI and re-check database if redirected * update max iteration count to 512, add checks during dereferenceAncestors() for indirect URLs * remove doubled-up code * fix use of status instead of current * use URIs for checking equality for security * use the latest known URI for boost_of_uri in case original was an indirect * add dereferenceCollection() function for dereferenceAccountFeatured() * pull in latest github.com/superseriousbusiness/activity version (and remove the bodge!!) * fix typo in code comments * update decodeType() to accept a readcloser and handle body closing * switch to checking using BoostOfID and add note why not using BoostOfURI * ensure InReplyTo gets unset when deleting status parent in case currently stubbed * add tests for Collection and CollectionPage iterators
593 lines
19 KiB
Go
593 lines
19 KiB
Go
// GoToSocial
|
|
// Copyright (C) GoToSocial Authors admin@gotosocial.org
|
|
// SPDX-License-Identifier: AGPL-3.0-or-later
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
package federation
|
|
|
|
import (
|
|
"context"
|
|
"crypto/rsa"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"net/url"
|
|
"time"
|
|
|
|
"codeberg.org/gruf/go-kv"
|
|
"github.com/superseriousbusiness/activity/streams"
|
|
"github.com/superseriousbusiness/gotosocial/internal/ap"
|
|
"github.com/superseriousbusiness/gotosocial/internal/config"
|
|
"github.com/superseriousbusiness/gotosocial/internal/db"
|
|
"github.com/superseriousbusiness/gotosocial/internal/gtscontext"
|
|
"github.com/superseriousbusiness/gotosocial/internal/gtserror"
|
|
"github.com/superseriousbusiness/gotosocial/internal/gtsmodel"
|
|
"github.com/superseriousbusiness/gotosocial/internal/log"
|
|
"github.com/superseriousbusiness/httpsig"
|
|
)
|
|
|
|
var (
|
|
errUnsigned = errors.New("http request wasn't signed or http signature was invalid")
|
|
)
|
|
|
|
// PubKeyAuth models authorization information for a remote
|
|
// Actor making a signed HTTP request to this GtS instance
|
|
// using a public key.
|
|
type PubKeyAuth struct {
|
|
// CachedPubKey is the public key found in the db
|
|
// for the Actor whose request we're now authenticating.
|
|
// Will be set only in cases where we had the Owner
|
|
// of the key stored in the database already.
|
|
CachedPubKey *rsa.PublicKey
|
|
|
|
// FetchedPubKey is an up-to-date public key fetched
|
|
// from the remote instance. Will be set in cases
|
|
// where EITHER we hadn't seen the Actor before whose
|
|
// request we're now authenticating, OR a CachedPubKey
|
|
// was found in our database, but was expired.
|
|
FetchedPubKey *rsa.PublicKey
|
|
|
|
// OwnerURI is the ActivityPub id of the owner of
|
|
// the public key used to sign the request we're
|
|
// now authenticating. This will always be set.
|
|
OwnerURI *url.URL
|
|
|
|
// Owner is the account corresponding to
|
|
// OwnerURI. This will always be set UNLESS
|
|
// the PubKeyAuth.Handshaking field is set..
|
|
Owner *gtsmodel.Account
|
|
|
|
// Handshaking indicates that uncached owner
|
|
// account was NOT dereferenced due to an ongoing
|
|
// handshake with another instance.
|
|
Handshaking bool
|
|
}
|
|
|
|
// AuthenticateFederatedRequest authenticates any kind of incoming federated
|
|
// request from a remote server. This includes things like GET requests for
|
|
// dereferencing our users or statuses etc, and POST requests for delivering
|
|
// new Activities. The function returns details of the public key(s) used to
|
|
// authenticate the requesting http signature.
|
|
//
|
|
// 'Authenticate' in this case is defined as making sure that the http request
|
|
// is actually signed by whoever claims to have signed it, by fetching the public
|
|
// key from the signature and checking it against the remote public key.
|
|
//
|
|
// The provided username will be used to generate a transport for making remote
|
|
// requests/derefencing the public key ID of the request signature. Ideally you
|
|
// should pass in the username of the user *being requested*, so that the remote
|
|
// server can decide how to handle the request based on who's making it. Ie., if
|
|
// the request on this server is for https://example.org/users/some_username then
|
|
// you should pass in the username 'some_username'. The remote server will then
|
|
// know that this is the user making the dereferencing request, and they can decide
|
|
// to allow or deny the request depending on their settings.
|
|
//
|
|
// This function will handle dereferencing and storage of any new remote accounts
|
|
// and / or instances. The returned PubKeyAuth{}.Owner account will ONLY ever be
|
|
// nil in the case that there is an ongoing handshake involving this account.
|
|
//
|
|
// Note that it is also valid to pass in an empty string here, in which case the
|
|
// keys of the instance account will be used.
|
|
func (f *Federator) AuthenticateFederatedRequest(ctx context.Context, requestedUsername string) (*PubKeyAuth, gtserror.WithCode) {
|
|
// Thanks to the signature check middleware,
|
|
// we should already have an http signature
|
|
// verifier set on the context. If we don't,
|
|
// this is an unsigned request.
|
|
verifier := gtscontext.HTTPSignatureVerifier(ctx)
|
|
if verifier == nil {
|
|
err := gtserror.Newf("%w", errUnsigned)
|
|
errWithCode := gtserror.NewErrorUnauthorized(err, errUnsigned.Error(), "(verifier)")
|
|
return nil, errWithCode
|
|
}
|
|
|
|
// We should have the signature itself set too.
|
|
signature := gtscontext.HTTPSignature(ctx)
|
|
if signature == "" {
|
|
err := gtserror.Newf("%w", errUnsigned)
|
|
errWithCode := gtserror.NewErrorUnauthorized(err, errUnsigned.Error(), "(signature)")
|
|
return nil, errWithCode
|
|
}
|
|
|
|
// And finally the public key ID URI.
|
|
pubKeyID := gtscontext.HTTPSignaturePubKeyID(ctx)
|
|
if pubKeyID == nil {
|
|
err := gtserror.Newf("%w", errUnsigned)
|
|
errWithCode := gtserror.NewErrorUnauthorized(err, errUnsigned.Error(), "(pubKeyID)")
|
|
return nil, errWithCode
|
|
}
|
|
|
|
// At this point we know the request was signed,
|
|
// so now we need to validate the signature.
|
|
|
|
var (
|
|
pubKeyIDStr = pubKeyID.String()
|
|
isLocal = (pubKeyID.Host == config.GetHost())
|
|
pubKeyAuth *PubKeyAuth
|
|
errWithCode gtserror.WithCode
|
|
)
|
|
|
|
l := log.
|
|
WithContext(ctx).
|
|
WithFields(kv.Fields{
|
|
{"requestedUsername", requestedUsername},
|
|
{"pubKeyID", pubKeyIDStr},
|
|
}...)
|
|
|
|
if isLocal {
|
|
l.Trace("public key is local, no dereference needed")
|
|
pubKeyAuth, errWithCode = f.derefPubKeyDBOnly(ctx, pubKeyIDStr)
|
|
} else {
|
|
l.Trace("public key is remote, checking if we need to dereference")
|
|
pubKeyAuth, errWithCode = f.derefPubKey(ctx, requestedUsername, pubKeyIDStr, pubKeyID)
|
|
}
|
|
|
|
if errWithCode != nil {
|
|
return nil, errWithCode
|
|
}
|
|
|
|
if isLocal && pubKeyAuth == nil {
|
|
// We signed this request, apparently, but
|
|
// local lookup didn't find anything. This
|
|
// is an almost impossible error condition!
|
|
err := gtserror.Newf("local public key %s could not be found; "+
|
|
"has the account been manually removed from the db?", pubKeyIDStr)
|
|
return nil, gtserror.NewErrorInternalError(err)
|
|
}
|
|
|
|
// Attempt to verify auth with both fetched and cached keys.
|
|
if !verifyAuth(&l, verifier, pubKeyAuth.CachedPubKey) &&
|
|
!verifyAuth(&l, verifier, pubKeyAuth.FetchedPubKey) {
|
|
|
|
const format = "authentication NOT PASSED for public key %s; tried algorithms %+v; signature value was '%s'"
|
|
text := fmt.Sprintf(format, pubKeyIDStr, signingAlgorithms, signature)
|
|
return nil, gtserror.NewErrorUnauthorized(errors.New(text), text)
|
|
}
|
|
|
|
if pubKeyAuth.Owner == nil {
|
|
// Ensure we have instance stored in
|
|
// database for the account at URI.
|
|
err := f.fetchAccountInstance(ctx,
|
|
requestedUsername,
|
|
pubKeyAuth.OwnerURI,
|
|
)
|
|
if err != nil {
|
|
return nil, gtserror.NewErrorInternalError(err)
|
|
}
|
|
|
|
// If we're currently handshaking with another instance, return
|
|
// without derefing the owner, the only possible time we do this.
|
|
// This prevents deadlocks when GTS instances mutually deref.
|
|
if f.Handshaking(requestedUsername, pubKeyAuth.OwnerURI) {
|
|
log.Warnf(ctx, "network race during %s handshake", pubKeyAuth.OwnerURI)
|
|
pubKeyAuth.Handshaking = true
|
|
return pubKeyAuth, nil
|
|
}
|
|
|
|
// Dereference the account located at owner URI.
|
|
pubKeyAuth.Owner, _, err = f.GetAccountByURI(ctx,
|
|
requestedUsername,
|
|
pubKeyAuth.OwnerURI,
|
|
)
|
|
if err != nil {
|
|
if gtserror.StatusCode(err) == http.StatusGone {
|
|
// This can happen here instead of the pubkey 'gone'
|
|
// checks due to: the server sending account deletion
|
|
// notifications out, we start processing, the request above
|
|
// succeeds, and *then* the profile is removed and starts
|
|
// returning 410 Gone, at which point _this_ request fails.
|
|
return nil, gtserror.NewErrorGone(err)
|
|
}
|
|
|
|
err := gtserror.Newf("error dereferencing account %s: %w", pubKeyAuth.OwnerURI, err)
|
|
return nil, gtserror.NewErrorInternalError(err)
|
|
}
|
|
|
|
// Catch a possible (but very rare) race condition where
|
|
// we've fetched a key, then fetched the Actor who owns the
|
|
// key, but the Key of the Actor has changed in the meantime.
|
|
if !pubKeyAuth.Owner.PublicKey.Equal(pubKeyAuth.FetchedPubKey) {
|
|
err := gtserror.Newf(
|
|
"key mismatch: fetched key %s does not match pubkey of fetched Actor %s",
|
|
pubKeyID, pubKeyAuth.Owner.URI,
|
|
)
|
|
return nil, gtserror.NewErrorUnauthorized(err)
|
|
}
|
|
}
|
|
|
|
if !pubKeyAuth.Owner.SuspendedAt.IsZero() {
|
|
const text = "requesting account suspended"
|
|
return nil, gtserror.NewErrorForbidden(errors.New(text))
|
|
}
|
|
|
|
return pubKeyAuth, nil
|
|
}
|
|
|
|
// derefPubKeyDBOnly tries to dereference the given
|
|
// pubKey using only entries already in the database.
|
|
//
|
|
// In case of a db or URL error, will return the error.
|
|
//
|
|
// In case an entry for the pubKey owner just doesn't
|
|
// exist in the db (yet), will return nil, nil.
|
|
func (f *Federator) derefPubKeyDBOnly(
|
|
ctx context.Context,
|
|
pubKeyIDStr string,
|
|
) (
|
|
*PubKeyAuth,
|
|
gtserror.WithCode,
|
|
) {
|
|
// Look for pubkey ID owner in the database.
|
|
owner, err := f.db.GetAccountByPubkeyID(ctx, pubKeyIDStr)
|
|
if err != nil && !errors.Is(err, db.ErrNoEntries) {
|
|
err = gtserror.Newf("db error getting account with pubKeyID %s: %w", pubKeyIDStr, err)
|
|
return nil, gtserror.NewErrorInternalError(err)
|
|
}
|
|
|
|
if owner == nil {
|
|
// We don't have this
|
|
// account stored (yet).
|
|
return nil, nil
|
|
}
|
|
|
|
// Parse owner account URI as URL obj.
|
|
ownerURI, err := url.Parse(owner.URI)
|
|
if err != nil {
|
|
err := gtserror.Newf("error parsing account uri with pubKeyID %s: %w", pubKeyIDStr, err)
|
|
return nil, gtserror.NewErrorInternalError(err)
|
|
}
|
|
|
|
return &PubKeyAuth{
|
|
CachedPubKey: owner.PublicKey,
|
|
OwnerURI: ownerURI,
|
|
Owner: owner,
|
|
}, nil
|
|
}
|
|
|
|
// derefPubKey tries to dereference the given public key by first
|
|
// checking in the database, and then (if no entry found, or entry
|
|
// found but pubKey expired) calling the remote pub key URI and
|
|
// extracting the key.
|
|
func (f *Federator) derefPubKey(
|
|
ctx context.Context,
|
|
requestedUsername string,
|
|
pubKeyIDStr string,
|
|
pubKeyID *url.URL,
|
|
) (
|
|
*PubKeyAuth,
|
|
gtserror.WithCode,
|
|
) {
|
|
l := log.
|
|
WithContext(ctx).
|
|
WithFields(kv.Fields{
|
|
{"requestedUsername", requestedUsername},
|
|
{"pubKeyID", pubKeyIDStr},
|
|
}...)
|
|
|
|
// Try a database only deref first. We may already
|
|
// have the requesting account cached locally.
|
|
pubKeyAuth, errWithCode := f.derefPubKeyDBOnly(ctx, pubKeyIDStr)
|
|
if errWithCode != nil {
|
|
return nil, errWithCode
|
|
}
|
|
|
|
var (
|
|
// Just haven't seen this
|
|
// Actor + their pubkey yet.
|
|
uncached = (pubKeyAuth == nil)
|
|
|
|
// Have seen this Actor + their
|
|
// pubkey but latter is now expired.
|
|
expired = (!uncached && pubKeyAuth.Owner.PubKeyExpired())
|
|
)
|
|
|
|
switch {
|
|
case uncached:
|
|
l.Trace("public key was not cached, trying dereference of public key")
|
|
case !expired:
|
|
l.Trace("public key cached and up to date, no dereference needed")
|
|
return pubKeyAuth, nil
|
|
case expired:
|
|
// This is fairly rare and it may be helpful for
|
|
// admins to see what's going on, so log at info.
|
|
l.Infof(
|
|
"public key was cached, but expired at %s, trying dereference of new public key",
|
|
pubKeyAuth.Owner.PublicKeyExpiresAt,
|
|
)
|
|
}
|
|
|
|
// If we've tried to get this account before and we
|
|
// now have a tombstone for it (ie., it's been deleted
|
|
// from remote), don't try to dereference it again.
|
|
gone, err := f.CheckGone(ctx, pubKeyID)
|
|
if err != nil {
|
|
err := gtserror.Newf("error checking for tombstone (%s): %w", pubKeyIDStr, err)
|
|
return nil, gtserror.NewErrorInternalError(err)
|
|
}
|
|
|
|
if gone {
|
|
err := gtserror.Newf("account with public key is gone (%s)", pubKeyIDStr)
|
|
return nil, gtserror.NewErrorGone(err)
|
|
}
|
|
|
|
// Make an http call to get the (refreshed) pubkey.
|
|
pubKeyBytes, errWithCode := f.callForPubKey(ctx, requestedUsername, pubKeyID)
|
|
if errWithCode != nil {
|
|
return nil, errWithCode
|
|
}
|
|
|
|
// Extract the key and the owner from the response.
|
|
pubKey, pubKeyOwner, err := parsePubKeyBytes(ctx, pubKeyBytes, pubKeyID)
|
|
if err != nil {
|
|
err := gtserror.Newf("error parsing public key (%s): %w", pubKeyID, err)
|
|
return nil, gtserror.NewErrorUnauthorized(err)
|
|
}
|
|
|
|
if !expired {
|
|
// PubKeyResponse was nil before because
|
|
// we had nothing cached; return the key
|
|
// we just fetched, and nothing else.
|
|
return &PubKeyAuth{
|
|
FetchedPubKey: pubKey,
|
|
OwnerURI: pubKeyOwner,
|
|
}, nil
|
|
}
|
|
|
|
// Add newly-fetched key to response.
|
|
pubKeyAuth.FetchedPubKey = pubKey
|
|
|
|
// If key was expired, that means we already
|
|
// had an owner stored for it locally. Since
|
|
// we now successfully refreshed the pub key,
|
|
// we should update the account to reflect that.
|
|
owner := pubKeyAuth.Owner
|
|
owner.PublicKey = pubKeyAuth.FetchedPubKey
|
|
owner.PublicKeyExpiresAt = time.Time{}
|
|
if err := f.db.UpdateAccount(
|
|
ctx,
|
|
owner,
|
|
"public_key",
|
|
"public_key_expires_at",
|
|
); err != nil {
|
|
err := gtserror.Newf("db error updating account with refreshed public key (%s): %w", pubKeyIDStr, err)
|
|
return nil, gtserror.NewErrorInternalError(err)
|
|
}
|
|
|
|
l.Info("obtained new public key to replace expired; attempting auth with old / new")
|
|
|
|
// Return both new and cached (now
|
|
// expired) keys, authentication
|
|
// will be attempted with both.
|
|
return pubKeyAuth, nil
|
|
}
|
|
|
|
// callForPubKey handles the nitty gritty of actually
|
|
// making a request for the given pubKeyID with a
|
|
// transport created on behalf of requestedUsername.
|
|
func (f *Federator) callForPubKey(
|
|
ctx context.Context,
|
|
requestedUsername string,
|
|
pubKeyID *url.URL,
|
|
) ([]byte, gtserror.WithCode) {
|
|
// Use a transport to dereference the remote.
|
|
trans, err := f.transportController.NewTransportForUsername(
|
|
// We're on a hot path: don't retry if req fails.
|
|
gtscontext.SetFastFail(ctx),
|
|
requestedUsername,
|
|
)
|
|
if err != nil {
|
|
err = gtserror.Newf("error creating transport for %s: %w", requestedUsername, err)
|
|
return nil, gtserror.NewErrorInternalError(err)
|
|
}
|
|
|
|
// The actual http call to the remote server is
|
|
// made right here by the Dereference function.
|
|
rsp, err := trans.Dereference(ctx, pubKeyID)
|
|
|
|
if err == nil {
|
|
// Read the response body data.
|
|
b, err := io.ReadAll(rsp.Body)
|
|
_ = rsp.Body.Close() // done
|
|
|
|
if err != nil {
|
|
err := gtserror.Newf("error reading pubkey: %w", err)
|
|
return nil, gtserror.NewErrorInternalError(err)
|
|
}
|
|
|
|
return b, nil
|
|
}
|
|
|
|
if gtserror.StatusCode(err) == http.StatusGone {
|
|
// 410 indicates remote public key no longer exists
|
|
// (account deleted, moved, etc). Add a tombstone
|
|
// to our database so that we can avoid trying to
|
|
// dereference it in future.
|
|
if err := f.HandleGone(ctx, pubKeyID); err != nil {
|
|
err := gtserror.Newf("error marking public key %s as gone: %w", pubKeyID, err)
|
|
return nil, gtserror.NewErrorInternalError(err)
|
|
}
|
|
|
|
err := gtserror.Newf("account with public key %s is gone", pubKeyID)
|
|
return nil, gtserror.NewErrorGone(err)
|
|
}
|
|
|
|
// Fall back to generic error.
|
|
err = gtserror.Newf("error dereferencing public key %s: %w", pubKeyID, err)
|
|
return nil, gtserror.NewErrorInternalError(err)
|
|
}
|
|
|
|
// fetchAccountInstance ensures that an instance model exists in
|
|
// the database for the given account URI, deref'ing if necessary.
|
|
func (f *Federator) fetchAccountInstance(
|
|
ctx context.Context,
|
|
requestedUsername string,
|
|
accountURI *url.URL,
|
|
) error {
|
|
// Look for an existing entry for instance in database.
|
|
instance, err := f.db.GetInstance(ctx, accountURI.Host)
|
|
if err != nil && !errors.Is(err, db.ErrNoEntries) {
|
|
return gtserror.Newf("error getting instance from database: %w", err)
|
|
}
|
|
|
|
if instance != nil {
|
|
// already fetched.
|
|
return nil
|
|
}
|
|
|
|
// We don't have an entry for this
|
|
// instance yet; go dereference it.
|
|
instance, err = f.GetRemoteInstance(
|
|
gtscontext.SetFastFail(ctx),
|
|
requestedUsername,
|
|
&url.URL{
|
|
Scheme: accountURI.Scheme,
|
|
Host: accountURI.Host,
|
|
},
|
|
)
|
|
if err != nil {
|
|
return gtserror.Newf("error dereferencing instance %s: %w", accountURI.Host, err)
|
|
}
|
|
|
|
// Insert new instance into the datbase.
|
|
err = f.db.PutInstance(ctx, instance)
|
|
if err != nil && !errors.Is(err, db.ErrAlreadyExists) {
|
|
return gtserror.Newf("error inserting instance %s into database: %w", accountURI.Host, err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// parsePubKeyBytes extracts an rsa public key from the
|
|
// given pubKeyBytes by trying to parse the pubKeyBytes
|
|
// as an ActivityPub type. It will return the public key
|
|
// itself, and the URI of the public key owner.
|
|
func parsePubKeyBytes(
|
|
ctx context.Context,
|
|
pubKeyBytes []byte,
|
|
pubKeyID *url.URL,
|
|
) (*rsa.PublicKey, *url.URL, error) {
|
|
m := make(map[string]interface{})
|
|
if err := json.Unmarshal(pubKeyBytes, &m); err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
t, err := streams.ToType(ctx, m)
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
withPublicKey, ok := t.(ap.WithPublicKey)
|
|
if !ok {
|
|
err = gtserror.Newf("resource at %s with type %T could not be converted to ap.WithPublicKey", pubKeyID, t)
|
|
return nil, nil, err
|
|
}
|
|
|
|
pubKey, _, pubKeyOwnerID, err := ap.ExtractPublicKey(withPublicKey)
|
|
if err != nil {
|
|
err = gtserror.Newf("resource at %s with type %T did not contain recognizable public key", pubKeyID, t)
|
|
return nil, nil, err
|
|
}
|
|
|
|
return pubKey, pubKeyOwnerID, nil
|
|
}
|
|
|
|
var signingAlgorithms = []httpsig.Algorithm{
|
|
httpsig.RSA_SHA256, // Prefer common RSA_SHA256.
|
|
httpsig.RSA_SHA512, // Fall back to less common RSA_SHA512.
|
|
httpsig.ED25519, // Try ED25519 as a long shot.
|
|
}
|
|
|
|
// Cheeky type to wrap a signing option with a
|
|
// description of that option for logging purposes.
|
|
type signingOption struct {
|
|
desc string // Description of this options set.
|
|
sigOpt httpsig.SignatureOption // The options themselves.
|
|
}
|
|
|
|
var signingOptions = []signingOption{
|
|
{
|
|
// Prefer include query params.
|
|
desc: "include query params",
|
|
sigOpt: httpsig.SignatureOption{
|
|
ExcludeQueryStringFromPathPseudoHeader: false,
|
|
},
|
|
},
|
|
{
|
|
// Fall back to exclude query params.
|
|
desc: "exclude query params",
|
|
sigOpt: httpsig.SignatureOption{
|
|
ExcludeQueryStringFromPathPseudoHeader: true,
|
|
},
|
|
},
|
|
}
|
|
|
|
// verifyAuth verifies auth using generated verifier,
|
|
// according to pubkey, our supported signing algorithms,
|
|
// and signature options. The loops in the function are
|
|
// arranged in such a way that the most common combos are
|
|
// tried first, so that we can hopefully succeed quickly
|
|
// without wasting too many CPU cycles.
|
|
func verifyAuth(
|
|
l *log.Entry,
|
|
verifier httpsig.VerifierWithOptions,
|
|
pubKey *rsa.PublicKey,
|
|
) bool {
|
|
if pubKey == nil {
|
|
return false
|
|
}
|
|
|
|
// Loop through supported algorithms.
|
|
for _, algo := range signingAlgorithms {
|
|
|
|
// Loop through signing options.
|
|
for _, opt := range signingOptions {
|
|
|
|
// Try to verify according to this pubkey,
|
|
// algo, and signing options combination.
|
|
err := verifier.VerifyWithOptions(pubKey, algo, opt.sigOpt)
|
|
if err != nil {
|
|
l.Tracef("authentication NOT PASSED with %s (%s): %v", algo, opt.desc, err)
|
|
continue
|
|
}
|
|
|
|
l.Tracef("authenticated PASSED with %s (%s)", algo, opt.desc)
|
|
return true
|
|
}
|
|
}
|
|
|
|
return false
|
|
}
|