From 3dc131757d0a8bf3ac970ffaef0807b2e23c5729 Mon Sep 17 00:00:00 2001 From: redmatrix Date: Sat, 21 May 2016 18:21:04 -0700 Subject: include new finger backend --- Zotlabs/Zot/Finger.php | 130 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 130 insertions(+) create mode 100644 Zotlabs/Zot/Finger.php (limited to 'Zotlabs/Zot/Finger.php') diff --git a/Zotlabs/Zot/Finger.php b/Zotlabs/Zot/Finger.php new file mode 100644 index 000000000..27ba6ddca --- /dev/null +++ b/Zotlabs/Zot/Finger.php @@ -0,0 +1,130 @@ + false); + + self::$token = random_string(); + + if (strpos($webbie,'@') === false) { + $address = $webbie; + $host = App::get_hostname(); + } else { + $address = substr($webbie,0,strpos($webbie,'@')); + $host = substr($webbie,strpos($webbie,'@')+1); + } + + $xchan_addr = $address . '@' . $host; + + if ((! $address) || (! $xchan_addr)) { + logger('zot_finger: no address :' . $webbie); + return $ret; + } + + logger('using xchan_addr: ' . $xchan_addr, LOGGER_DATA, LOG_DEBUG); + + // potential issue here; the xchan_addr points to the primary hub. + // The webbie we were called with may not, so it might not be found + // unless we query for hubloc_addr instead of xchan_addr + + $r = q("select xchan.*, hubloc.* from xchan + left join hubloc on xchan_hash = hubloc_hash + where xchan_addr = '%s' and hubloc_primary = 1 limit 1", + dbesc($xchan_addr) + ); + + if ($r) { + $url = $r[0]['hubloc_url']; + + if ($r[0]['hubloc_network'] && $r[0]['hubloc_network'] !== 'zot') { + logger('zot_finger: alternate network: ' . $webbie); + logger('url: '.$url.', net: '.var_export($r[0]['hubloc_network'],true), LOGGER_DATA, LOG_DEBUG); + return $ret; + } + } + else { + $url = 'https://' . $host; + } + + $rhs = '/.well-known/zot-info'; + $https = ((strpos($url,'https://') === 0) ? true : false); + + logger('zot_finger: ' . $address . ' at ' . $url, LOGGER_DEBUG); + + if ($channel) { + $postvars = array( + 'address' => $address, + 'target' => $channel['channel_guid'], + 'target_sig' => $channel['channel_guid_sig'], + 'key' => $channel['channel_pubkey'], + 'token' => self::$token + ); + + $result = z_post_url($url . $rhs,$postvars); + + if ((! $result['success']) && ($autofallback)) { + if ($https) { + logger('zot_finger: https failed. falling back to http'); + $result = z_post_url('http://' . $host . $rhs,$postvars); + } + } + } + else { + $rhs .= '?f=&address=' . urlencode($address) . '&token=' . self::$token; + + $result = z_fetch_url($url . $rhs); + if ((! $result['success']) && ($autofallback)) { + if ($https) { + logger('zot_finger: https failed. falling back to http'); + $result = z_fetch_url('http://' . $host . $rhs); + } + } + } + + if(! $result['success']) { + logger('zot_finger: no results'); + return $ret; + } + + $x = json_decode($result['body'],true); + if($x) { + $signed_token = $x['signed_token']; + if($signed_token) { + $valid = rsa_verify(self::$token,base64url_decode($signed_token),$x['key']); + if(! $valid) { + logger('invalid signed token: ' . $url . $rhs, LOGGER_NORMAL, LOG_WARN); + return $ret; + } + } + else { + logger('No signed token from ' . $url . $rhs, LOGGER_NORMAL, LOG_WARN); + // after 2017-01-01 this will be a hard error unless you over-ride it. + if((time() > 1483228800) && (! get_config('system','allow_unsigned_zotfinger'))) + return $ret; + } + } + + return $x; + } + +} \ No newline at end of file -- cgit v1.2.3 From de006771c7fe92a889d759c2c75c1473c420ad47 Mon Sep 17 00:00:00 2001 From: redmatrix Date: Sun, 22 May 2016 16:54:30 -0700 Subject: renamed include files identity.php (channel.php) and Contact.php (connections.php) --- Zotlabs/Zot/Finger.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'Zotlabs/Zot/Finger.php') diff --git a/Zotlabs/Zot/Finger.php b/Zotlabs/Zot/Finger.php index 27ba6ddca..63fdd4a4c 100644 --- a/Zotlabs/Zot/Finger.php +++ b/Zotlabs/Zot/Finger.php @@ -17,7 +17,7 @@ class Finger { * @param boolean $autofallback * fallback/failover to http if https connection cannot be established. Default is true. * - * @return array see z_post_url() and \ref mod/zfinger.php + * @return zotinfo array (with 'success' => true) or array('success' => false); */ static public function run($webbie, $channel = null, $autofallback = true) { @@ -108,7 +108,7 @@ class Finger { $x = json_decode($result['body'],true); if($x) { - $signed_token = $x['signed_token']; + $signed_token = ((is_array($x) && array_key_exists('signed_token',$x)) ? $x['signed_token'] : null); if($signed_token) { $valid = rsa_verify(self::$token,base64url_decode($signed_token),$x['key']); if(! $valid) { -- cgit v1.2.3 From bbc71343bdfc724425927ebab404b035c65f569c Mon Sep 17 00:00:00 2001 From: redmatrix Date: Sun, 22 May 2016 22:44:13 -0700 Subject: change the signed token format. We don't folks to be able to submit random text for signing by us, as they could then use these to generate known signatures. --- Zotlabs/Zot/Finger.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'Zotlabs/Zot/Finger.php') diff --git a/Zotlabs/Zot/Finger.php b/Zotlabs/Zot/Finger.php index 63fdd4a4c..07798fbb1 100644 --- a/Zotlabs/Zot/Finger.php +++ b/Zotlabs/Zot/Finger.php @@ -110,7 +110,7 @@ class Finger { if($x) { $signed_token = ((is_array($x) && array_key_exists('signed_token',$x)) ? $x['signed_token'] : null); if($signed_token) { - $valid = rsa_verify(self::$token,base64url_decode($signed_token),$x['key']); + $valid = rsa_verify('token.' . self::$token,base64url_decode($signed_token),$x['key']); if(! $valid) { logger('invalid signed token: ' . $url . $rhs, LOGGER_NORMAL, LOG_WARN); return $ret; -- cgit v1.2.3 From 61304d80d23bf624d9ca13319d2c6c09fdd0d70e Mon Sep 17 00:00:00 2001 From: redmatrix Date: Thu, 26 May 2016 18:45:47 -0700 Subject: track down some issues from the application logs --- Zotlabs/Zot/Finger.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'Zotlabs/Zot/Finger.php') diff --git a/Zotlabs/Zot/Finger.php b/Zotlabs/Zot/Finger.php index 07798fbb1..229fda8bd 100644 --- a/Zotlabs/Zot/Finger.php +++ b/Zotlabs/Zot/Finger.php @@ -112,12 +112,12 @@ class Finger { if($signed_token) { $valid = rsa_verify('token.' . self::$token,base64url_decode($signed_token),$x['key']); if(! $valid) { - logger('invalid signed token: ' . $url . $rhs, LOGGER_NORMAL, LOG_WARN); + logger('invalid signed token: ' . $url . $rhs, LOGGER_NORMAL, LOG_ERR); return $ret; } } else { - logger('No signed token from ' . $url . $rhs, LOGGER_NORMAL, LOG_WARN); + logger('No signed token from ' . $url . $rhs, LOGGER_NORMAL, LOG_WARNING); // after 2017-01-01 this will be a hard error unless you over-ride it. if((time() > 1483228800) && (! get_config('system','allow_unsigned_zotfinger'))) return $ret; -- cgit v1.2.3