aboutsummaryrefslogtreecommitdiffstats
path: root/Zotlabs
diff options
context:
space:
mode:
Diffstat (limited to 'Zotlabs')
-rw-r--r--Zotlabs/Module/Magic.php237
-rw-r--r--Zotlabs/Module/Owa.php95
-rw-r--r--Zotlabs/Module/Regdir.php35
3 files changed, 131 insertions, 236 deletions
diff --git a/Zotlabs/Module/Magic.php b/Zotlabs/Module/Magic.php
index 6ac656a04..b4372e26d 100644
--- a/Zotlabs/Module/Magic.php
+++ b/Zotlabs/Module/Magic.php
@@ -1,214 +1,133 @@
<?php
namespace Zotlabs\Module;
+use App;
+use Zotlabs\Web\Controller;
use Zotlabs\Web\HTTPSig;
+use Zotlabs\Lib\Libzot;
+use Zotlabs\Lib\SConfig;
-@require_once('include/zot.php');
-
-
-class Magic extends \Zotlabs\Web\Controller {
+class Magic extends Controller {
function init() {
+
+ $ret = [
+ 'success' => false,
+ 'url' => '',
+ 'message' => ''
+ ];
- $ret = array('success' => false, 'url' => '', 'message' => '');
logger('mod_magic: invoked', LOGGER_DEBUG);
-
- logger('mod_magic: args: ' . print_r($_REQUEST,true),LOGGER_DATA);
-
- $addr = ((x($_REQUEST,'addr')) ? $_REQUEST['addr'] : '');
- $bdest = ((x($_REQUEST,'bdest')) ? $_REQUEST['bdest'] : '');
- $dest = ((x($_REQUEST,'dest')) ? $_REQUEST['dest'] : '');
- $test = ((x($_REQUEST,'test')) ? intval($_REQUEST['test']) : 0);
- $rev = ((x($_REQUEST,'rev')) ? intval($_REQUEST['rev']) : 0);
- $owa = ((x($_REQUEST,'owa')) ? intval($_REQUEST['owa']) : 0);
- $delegate = ((x($_REQUEST,'delegate')) ? $_REQUEST['delegate'] : '');
-
- if($bdest)
+
+ logger('args: ' . print_r($_REQUEST,true),LOGGER_DATA);
+
+ $addr = ((x($_REQUEST,'addr')) ? $_REQUEST['addr'] : '');
+ $bdest = ((x($_REQUEST,'bdest')) ? $_REQUEST['bdest'] : '');
+ $dest = ((x($_REQUEST,'dest')) ? $_REQUEST['dest'] : '');
+ $rev = ((x($_REQUEST,'rev')) ? intval($_REQUEST['rev']) : 0);
+ $owa = ((x($_REQUEST,'owa')) ? intval($_REQUEST['owa']) : 0);
+ $delegate = ((x($_REQUEST,'delegate')) ? $_REQUEST['delegate'] : '');
+
+ // bdest is preferred as it is hex-encoded and can survive url rewrite and argument parsing
+
+ if ($bdest) {
$dest = hex2bin($bdest);
+ }
$parsed = parse_url($dest);
- if(! $parsed) {
- if($test) {
- $ret['message'] .= 'could not parse ' . $dest . EOL;
- return($ret);
- }
+
+ if (! $parsed) {
goaway($dest);
}
-
+
$basepath = $parsed['scheme'] . '://' . $parsed['host'] . (($parsed['port']) ? ':' . $parsed['port'] : '');
-
- $x = q("select * from hubloc where hubloc_url = '%s' order by hubloc_connected desc limit 1",
- dbesc($basepath)
- );
-
- if(! $x) {
-
- /*
- * We have no records for, or prior communications with this hub.
- * If an address was supplied, let's finger them to create a hub record.
- * Otherwise we'll use the special address '[system]' which will return
- * either a system channel or the first available normal channel. We don't
- * really care about what channel is returned - we need the hub information
- * from that response so that we can create signed auth packets destined
- * for that hub.
- *
- */
-
- $j = \Zotlabs\Zot\Finger::run((($addr) ? $addr : '[system]@' . $parsed['host']),null);
- if($j['success']) {
- import_xchan($j);
-
- // Now try again
-
- $x = q("select * from hubloc where hubloc_url = '%s' order by hubloc_connected desc limit 1",
- dbesc($basepath)
- );
- }
- }
-
- if(! $x) {
- if($rev)
- goaway($dest);
- else {
- logger('mod_magic: no channels found for requested hub.' . print_r($_REQUEST,true));
- if($test) {
- $ret['message'] .= 'This site has no previous connections with ' . $basepath . EOL;
- return $ret;
- }
- notice( t('Hub not found.') . EOL);
- return;
- }
- }
-
+ $owapath = SConfig::get($basepath,'system','openwebauth', $basepath . '/owa');
+
// This is ready-made for a plugin that provides a blacklist or "ask me" before blindly authenticating.
// By default, we'll proceed without asking.
-
- $arr = array(
- 'channel_id' => local_channel(),
- 'xchan' => $x[0],
+
+ $arr = [
+ 'channel_id' => local_channel(),
'destination' => $dest,
- 'proceed' => true
- );
-
+ 'proceed' => true
+ ];
+
call_hooks('magic_auth',$arr);
$dest = $arr['destination'];
- if(! $arr['proceed']) {
- if($test) {
- $ret['message'] .= 'cancelled by plugin.' . EOL;
- return $ret;
- }
+ if (! $arr['proceed']) {
goaway($dest);
}
-
- if((get_observer_hash()) && ($x[0]['hubloc_url'] === z_root())) {
+
+ if((get_observer_hash()) && (stripos($dest,z_root()) === 0)) {
+
// We are already authenticated on this site and a registered observer.
- // Just redirect.
- if($test) {
- $ret['success'] = true;
- $ret['message'] .= 'Local site - you are already authenticated.' . EOL;
- return $ret;
- }
-
- $delegation_success = false;
- if($delegate) {
+ // First check if this is a delegate request on the local system and process accordingly.
+ // Otherwise redirect.
+
+ if ($delegate) {
+
$r = q("select * from channel left join hubloc on channel_hash = hubloc_hash where hubloc_addr = '%s' limit 1",
dbesc($delegate)
);
-
- if($r && intval($r[0]['channel_id'])) {
- $allowed = perm_is_allowed($r[0]['channel_id'],get_observer_hash(),'delegate');
- if($allowed) {
+
+ if ($r) {
+ $c = array_shift($r);
+ if (perm_is_allowed($c['channel_id'],get_observer_hash(),'delegate')) {
$tmp = $_SESSION;
- $_SESSION['delegate_push'] = $tmp;
- $_SESSION['delegate_channel'] = $r[0]['channel_id'];
- $_SESSION['delegate'] = get_observer_hash();
- $_SESSION['account_id'] = intval($r[0]['channel_account_id']);
- change_channel($r[0]['channel_id']);
-
- $delegation_success = true;
+ $_SESSION['delegate_push'] = $tmp;
+ $_SESSION['delegate_channel'] = $c['channel_id'];
+ $_SESSION['delegate'] = get_observer_hash();
+ $_SESSION['account_id'] = intval($c['channel_account_id']);
+
+ change_channel($c['channel_id']);
}
}
}
-
-
-
- // FIXME: check and honour local delegation
-
-
+
goaway($dest);
}
-
- if(local_channel()) {
- $channel = \App::get_channel();
-
+
+ if (local_channel()) {
+ $channel = App::get_channel();
+
// OpenWebAuth
- if($owa) {
+ if ($owa) {
$dest = strip_zids($dest);
$dest = strip_query_param($dest,'f');
+ // We now post to the OWA endpoint. This improves security by providing a signed digest
+
$data = json_encode([ 'OpenWebAuth' => random_string() ]);
$headers = [];
$headers['Accept'] = 'application/x-zot+json' ;
+ $headers['Content-Type'] = 'application/x-zot+json' ;
$headers['X-Open-Web-Auth'] = random_string();
- $headers['Host'] = $parsed['host'];
$headers['Digest'] = HTTPSig::generate_digest_header($data);
+ $headers['Host'] = $parsed['host'];
+ $headers['(request-target)'] = 'post ' . '/owa';
- $headers = HTTPSig::create_sig($headers,$channel['channel_prvkey'], 'acct:' . channel_reddress($channel),true,'sha512');
- $x = z_post_url($basepath . '/owa',$data,$redirects,[ 'headers' => $headers ]);
-
- if($x['success']) {
+ $headers = HTTPSig::create_sig($headers,$channel['channel_prvkey'], channel_url($channel),true,'sha512');
+ $x = z_post_url($owapath,$data,$redirects,[ 'headers' => $headers ]);
+ logger('owa fetch returned: ' . print_r($x,true),LOGGER_DATA);
+ if ($x['success']) {
$j = json_decode($x['body'],true);
- if($j['success']) {
+ if ($j['success'] && $j['encrypted_token']) {
+ // decrypt the token using our private key
$token = '';
- if($j['encrypted_token']) {
- openssl_private_decrypt(base64url_decode($j['encrypted_token']),$token,$channel['channel_prvkey']);
- }
- else {
- $token = $j['token'];
- }
-
- $strp = strpbrk($dest,'?&');
- $args = (($strp) ? '&owt=' . $token : '?f=&owt=' . $token) . (($delegate) ? '&delegate=1' : '');
+ openssl_private_decrypt(base64url_decode($j['encrypted_token']),$token,$channel['channel_prvkey']);
+ $x = strpbrk($dest,'?&');
+ // redirect using the encrypted token which will be exchanged for an authenticated session
+ $args = (($x) ? '&owt=' . $token : '?f=&owt=' . $token) . (($delegate) ? '&delegate=1' : '');
goaway($dest . $args);
}
}
- goaway($dest);
- }
-
-
- $token = random_string();
-
- \Zotlabs\Lib\Verify::create('auth',$channel['channel_id'],$token,$x[0]['hubloc_url']);
-
- $target_url = $x[0]['hubloc_callback'] . '/?f=&auth=' . urlencode(channel_reddress($channel))
- . '&sec=' . $token . '&dest=' . urlencode($dest) . '&version=' . ZOT_REVISION;
-
- if($delegate)
- $target_url .= '&delegate=' . urlencode($delegate);
-
- logger('mod_magic: redirecting to: ' . $target_url, LOGGER_DEBUG);
-
- if($test) {
- $ret['success'] = true;
- $ret['url'] = $target_url;
- $ret['message'] = 'token ' . $token . ' created for channel ' . $channel['channel_id'] . ' for url ' . $x[0]['hubloc_url'] . EOL;
- return $ret;
}
-
- goaway($target_url);
-
}
-
- if($test) {
- $ret['message'] = 'Not authenticated or invalid arguments to mod_magic' . EOL;
- return $ret;
- }
-
+
goaway($dest);
-
}
-
+
}
diff --git a/Zotlabs/Module/Owa.php b/Zotlabs/Module/Owa.php
index 4c6fd6216..561e35754 100644
--- a/Zotlabs/Module/Owa.php
+++ b/Zotlabs/Module/Owa.php
@@ -3,10 +3,12 @@
namespace Zotlabs\Module;
use Zotlabs\Web\HTTPSig;
+use Zotlabs\Lib\Verify;
+use Zotlabs\Web\Controller;
/**
* OpenWebAuth verifier and token generator
- * See https://macgirvin.com/wiki/mike/OpenWebAuth/Home
+ * See spec/OpenWebAuth/Home.md
* Requests to this endpoint should be signed using HTTP Signatures
* using the 'Authorization: Signature' authentication method
* If the signature verifies a token is returned.
@@ -14,74 +16,51 @@ use Zotlabs\Web\HTTPSig;
* This token may be exchanged for an authenticated cookie.
*/
-class Owa extends \Zotlabs\Web\Controller {
+class Owa extends Controller {
function init() {
$ret = [ 'success' => false ];
- foreach([ 'REDIRECT_REMOTE_USER', 'HTTP_AUTHORIZATION' ] as $head) {
- if(array_key_exists($head,$_SERVER) && substr(trim($_SERVER[$head]),0,9) === 'Signature') {
- if($head !== 'HTTP_AUTHORIZATION') {
- $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER[$head];
- continue;
- }
-
- $sigblock = HTTPSig::parse_sigheader($_SERVER[$head]);
- if($sigblock) {
- $keyId = $sigblock['keyId'];
-
- if($keyId) {
-
- // Hubzilla connections can have both zot6 and zot hublocs
- // The connections will usually be zot6 so match those first
-
- $r = q("select * from hubloc left join xchan on hubloc_hash = xchan_hash
- where ( hubloc_addr = '%s' or hubloc_id_url = '%s' ) and hubloc_network = 'zot6' ",
- dbesc(str_replace('acct:','',$keyId)),
- dbesc($keyId)
- );
+ if (array_key_exists('REDIRECT_REMOTE_USER',$_SERVER) && (! array_key_exists('HTTP_AUTHORIZATION',$_SERVER))) {
+ $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER['REDIRECT_REMOTE_USER'];
+ }
- // If nothing was found, try searching on any network
-
- if (! $r) {
+ if (array_key_exists('HTTP_AUTHORIZATION',$_SERVER) && substr(trim($_SERVER['HTTP_AUTHORIZATION']),0,9) === 'Signature') {
+ $sigblock = HTTPSig::parse_sigheader($_SERVER['HTTP_AUTHORIZATION']);
+ if ($sigblock) {
+ $keyId = $sigblock['keyId'];
+ if ($keyId) {
+ $r = q("select * from hubloc left join xchan on hubloc_hash = xchan_hash
+ where ( hubloc_addr = '%s' or hubloc_id_url = '%s' ) ",
+ dbesc(str_replace('acct:','',$keyId)),
+ dbesc($keyId)
+ );
+ if (! $r) {
+ $found = discover_by_webbie(str_replace('acct:','',$keyId));
+ if ($found) {
$r = q("select * from hubloc left join xchan on hubloc_hash = xchan_hash
- where ( hubloc_addr = '%s' or hubloc_id_url = '%s' )",
+ where ( hubloc_addr = '%s' or hubloc_id_url = '%s' ) ",
dbesc(str_replace('acct:','',$keyId)),
dbesc($keyId)
);
}
-
- // If nothing was found on any network, use network discovery and create a new record
-
- if (! $r) {
- $found = discover_by_webbie(str_replace('acct:','',$keyId));
- if($found) {
- $r = q("select * from hubloc left join xchan on hubloc_hash = xchan_hash
- where ( hubloc_addr = '%s' or hubloc_id_url = '%s' ) ",
- dbesc(str_replace('acct:','',$keyId)),
- dbesc($keyId)
- );
- }
- }
-
- if ($r) {
- foreach($r as $hubloc) {
- $verified = HTTPSig::verify(file_get_contents('php://input'),$hubloc['xchan_pubkey']);
- if($verified && $verified['header_signed'] && $verified['header_valid']) {
- logger('OWA header: ' . print_r($verified,true),LOGGER_DATA);
- logger('OWA success: ' . $hubloc['hubloc_addr'],LOGGER_DATA);
- $ret['success'] = true;
- $token = random_string(32);
- \Zotlabs\Lib\Verify::create('owt',0,$token,$hubloc['hubloc_network'] . ',' . $hubloc['hubloc_addr']);
- $result = '';
- openssl_public_encrypt($token,$result,$hubloc['xchan_pubkey']);
- $ret['encrypted_token'] = base64url_encode($result);
- break;
- }
- else {
- logger('OWA fail: ' . $hubloc['hubloc_id'] . ' ' . $hubloc['hubloc_addr']);
- }
+ }
+ if ($r) {
+ foreach ($r as $hubloc) {
+ $verified = HTTPSig::verify(file_get_contents('php://input'));
+ if ($verified && $verified['header_signed'] && $verified['header_valid'] && ($verified['content_valid'] || (! $verified['content_signed']))) {
+ logger('OWA header: ' . print_r($verified,true),LOGGER_DATA);
+ logger('OWA success: ' . $hubloc['hubloc_addr'],LOGGER_DATA);
+ $ret['success'] = true;
+ $token = random_string(32);
+ Verify::create('owt',0,$token,$hubloc['hubloc_addr']);
+ $result = '';
+ openssl_public_encrypt($token,$result,$hubloc['xchan_pubkey']);
+ $ret['encrypted_token'] = base64url_encode($result);
+ break;
+ } else {
+ logger('OWA fail: ' . $hubloc['hubloc_id'] . ' ' . $hubloc['hubloc_addr']);
}
}
}
diff --git a/Zotlabs/Module/Regdir.php b/Zotlabs/Module/Regdir.php
index f4d16c562..e49f89231 100644
--- a/Zotlabs/Module/Regdir.php
+++ b/Zotlabs/Module/Regdir.php
@@ -1,6 +1,9 @@
<?php
namespace Zotlabs\Module;
+use Zotlabs\Lib\Zotfinger;
+use Zotlabs\Web\Controller;
+
/**
* With args, register a directory server for this realm.
* With no args, return a JSON array of directory servers for this realm.
@@ -14,7 +17,7 @@ namespace Zotlabs\Module;
* @param App &$a
*/
-class Regdir extends \Zotlabs\Web\Controller {
+class Regdir extends Controller {
function init() {
@@ -25,7 +28,7 @@ class Regdir extends \Zotlabs\Web\Controller {
$valid = 0;
// we probably don't need the realm as we will find out in the probe.
- // What we may want to die is throw an error if you're trying to register in a different realm
+ // What we may want to do is throw an error if you're trying to register in a different realm
// so this configuration issue can be discovered.
$realm = $_REQUEST['realm'];
@@ -59,34 +62,28 @@ class Regdir extends \Zotlabs\Web\Controller {
json_return_and_die($result);
}
- $j = \Zotlabs\Zot\Finger::run('[system]@' . $m['host']);
- if($j['success'] && $j['guid']) {
- $x = import_xchan($j);
- if($x['success']) {
- $result['success'] = true;
- }
+ $j = Zotfinger::exec($url);
+ if($j) {
+ $result['success'] = true;
}
-
- if(! $result['success'])
+ else {
$valid = 0;
-
+ }
+
q("update site set site_valid = %d where site_url = '%s'",
intval($valid),
strtolower($url)
);
-
+
json_return_and_die($result);
- } else {
-
- // We can put this in the sql without the condition after 31 august 2015 assuming
- // most directory servers will have updated by then
- // This just makes sure it happens if I forget
+
+ }
+ else {
- $sql_extra = ((datetime_convert() > datetime_convert('UTC','UTC','2015-08-31')) ? ' and site_valid = 1 ' : '' );
if ($dirmode == DIRECTORY_MODE_STANDALONE) {
$r = array(array('site_url' => z_root()));
} else {
- $r = q("select site_url from site where site_flags in ( 1, 2 ) and site_realm = '%s' and site_type = %d $sql_extra ",
+ $r = q("select site_url from site where site_flags in ( 1, 2 ) and site_realm = '%s' and site_type = %d and site_valid = 1 ",
dbesc(get_directory_realm()),
intval(SITE_TYPE_ZOT)
);