diff options
author | fabrixxm <fabrix.xm@gmail.com> | 2011-08-17 17:35:37 +0200 |
---|---|---|
committer | fabrixxm <fabrix.xm@gmail.com> | 2011-08-17 17:35:37 +0200 |
commit | bdf42473a0341f291cd256323d122aa80bb0cb0b (patch) | |
tree | 922a5ba24a34d7ea89673019e82f68436edb7091 /mod/salmon.php | |
parent | 6c423feed2d8bc5bd36d2a1cbac073915e523749 (diff) | |
parent | db03b1ab173d61b1ee75271dac1e48f3475ad42c (diff) | |
download | volse-hubzilla-bdf42473a0341f291cd256323d122aa80bb0cb0b.tar.gz volse-hubzilla-bdf42473a0341f291cd256323d122aa80bb0cb0b.tar.bz2 volse-hubzilla-bdf42473a0341f291cd256323d122aa80bb0cb0b.zip |
Merge remote-tracking branch 'friendika/master' into newui
Diffstat (limited to 'mod/salmon.php')
-rw-r--r-- | mod/salmon.php | 54 |
1 files changed, 25 insertions, 29 deletions
diff --git a/mod/salmon.php b/mod/salmon.php index 56ac071b0..0264e820d 100644 --- a/mod/salmon.php +++ b/mod/salmon.php @@ -5,6 +5,7 @@ // complicated process to try and sort out. require_once('include/salmon.php'); +require_once('include/crypto.php'); require_once('library/simplepie/simplepie.inc'); function salmon_return($val) { @@ -33,7 +34,7 @@ function salmon_post(&$a) { dbesc($nick) ); if(! count($r)) - salmon_return(500); + http_status_exit(500); $importer = $r[0]; @@ -52,7 +53,7 @@ function salmon_post(&$a) { if(! $base) { logger('mod-salmon: unable to locate salmon data in xml '); - salmon_return(400); + http_status_exit(400); } // Stash the signature away for now. We have to find their key or it won't be good for anything. @@ -72,12 +73,16 @@ function salmon_post(&$a) { $encoding = $base->encoding; $alg = $base->alg; - // If we're talking to status.net or one of their ilk, they aren't following the magic envelope spec - // and only signed the data element. We'll be nice and let them validate anyway. + // Salmon magic signatures have evolved and there is no way of knowing ahead of time which + // flavour we have. We'll try and verify it regardless. $stnet_signed_data = $data; + $signed_data = $data . '.' . base64url_encode($type) . '.' . base64url_encode($encoding) . '.' . base64url_encode($alg); + $compliant_format = str_replace('=','',$signed_data); + + // decode the data $data = base64url_decode($data); @@ -113,7 +118,7 @@ function salmon_post(&$a) { if(! $author_link) { logger('mod-salmon: Could not retrieve author URI.'); - salmon_return(400); + http_status_exit(400); } // Once we have the author URI, go to the web and try to find their public key @@ -125,44 +130,35 @@ function salmon_post(&$a) { if(! $key) { logger('mod-salmon: Could not retrieve author key.'); - salmon_return(400); + http_status_exit(400); } - // Setup RSA stuff to verify the signature - - set_include_path(get_include_path() . PATH_SEPARATOR . 'library/phpsec'); - - require_once('library/phpsec/Crypt/RSA.php'); - $key_info = explode('.',$key); $m = base64url_decode($key_info[1]); $e = base64url_decode($key_info[2]); - logger('mod-salmon: key details: ' . print_r($key_info,true)); - - $rsa = new CRYPT_RSA(); - $rsa->signatureMode = CRYPT_RSA_SIGNATURE_PKCS1; - $rsa->setHash('sha256'); + logger('mod-salmon: key details: ' . print_r($key_info,true), LOGGER_DEBUG); - $rsa->modulus = new Math_BigInteger($m, 256); - $rsa->k = strlen($rsa->modulus->toBytes()); - $rsa->exponent = new Math_BigInteger($e, 256); + $pubkey = metopem($m,$e); // We should have everything we need now. Let's see if it verifies. - // If it fails with the proper data format, try again using just the data - // (e.g. status.net) - $verify = $rsa->verify($signed_data,$signature); + $verify = rsa_verify($compliant_format,$signature,$pubkey); + + if(! $verify) { + logger('mod-salmon: message did not verify using protocol. Trying padding hack.'); + $verify = rsa_verify($signed_data,$signature,$pubkey); + } if(! $verify) { - logger('mod-salmon: message did not verify using protocol. Trying statusnet hack.'); - $verify = $rsa->verify($stnet_signed_data,$signature); + logger('mod-salmon: message did not verify using padding. Trying old statusnet hack.'); + $verify = rsa_verify($stnet_signed_data,$signature,$pubkey); } if(! $verify) { logger('mod-salmon: Message did not verify. Discarding.'); - salmon_return(400); + http_status_exit(400); } logger('mod-salmon: Message verified.'); @@ -187,9 +183,9 @@ function salmon_post(&$a) { // is this a follower? Or have we ignored the person? // If so we can not accept this post. - if((count($r)) && (($r[0]['readonly']) || ($r[0]['rel'] == REL_VIP) || ($r[0]['blocked']))) { + if((count($r)) && (($r[0]['readonly']) || ($r[0]['rel'] == CONTACT_IS_FOLLOWER) || ($r[0]['blocked']))) { logger('mod-salmon: Ignoring this author.'); - salmon_return(202); + http_status_exit(202); // NOTREACHED } @@ -211,7 +207,7 @@ function salmon_post(&$a) { consume_feed($feedxml,$importer,$contact_rec,$hub); - salmon_return(200); + http_status_exit(200); } |