From 13335b14d365b8697514dc3a75744f8548b4b71e Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Fri, 10 Aug 2018 16:14:22 -0500
Subject: [PATCH] implement http signatures

---
 viera/__init__.py        |  7 ++-
 viera/actor.py           |  1 +
 viera/http_signatures.py | 92 ++++++++++++++++++++++++++++++++++++++++
 viera/remote_actor.py    | 14 ++++++
 4 files changed, 113 insertions(+), 1 deletion(-)
 create mode 100644 viera/http_signatures.py
 create mode 100644 viera/remote_actor.py

diff --git a/viera/__init__.py b/viera/__init__.py
index 71b7c2a..99bd3a3 100644
--- a/viera/__init__.py
+++ b/viera/__init__.py
@@ -15,7 +15,12 @@ def load_config():
 CONFIG = load_config()
 
 
-app = aiohttp.web.Application()
+from .http_signatures import http_signatures_middleware
+
+
+app = aiohttp.web.Application(middlewares=[
+    http_signatures_middleware
+])
 
 
 from . import database
diff --git a/viera/actor.py b/viera/actor.py
index 95e194c..1ba32e8 100644
--- a/viera/actor.py
+++ b/viera/actor.py
@@ -1,3 +1,4 @@
+import aiohttp
 import aiohttp.web
 import logging
 from Crypto.PublicKey import RSA
diff --git a/viera/http_signatures.py b/viera/http_signatures.py
new file mode 100644
index 0000000..44d4a27
--- /dev/null
+++ b/viera/http_signatures.py
@@ -0,0 +1,92 @@
+import aiohttp
+import aiohttp.web
+import base64
+import logging
+
+from Crypto.PublicKey import RSA
+from Crypto.Hash import SHA, SHA256, SHA512
+from Crypto.Signature import PKCS1_v1_5
+
+from .remote_actor import fetch_actor
+
+
+HASHES = {
+    'sha1': SHA,
+    'sha256': SHA256,
+    'sha512': SHA512
+}
+
+
+def split_signature(sig):
+    default = {"headers": "date"}
+
+    sig = sig.strip().split(',')
+
+    for chunk in sig:
+        k, _, v = chunk.partition('=')
+        v = v.strip('\"')
+        default[k] = v
+
+    default['headers'] = default['headers'].split()
+    return default
+
+
+def build_signing_string(headers, used_headers):
+    return '\n'.join(map(lambda x: ': '.join([x, headers[x]]), used_headers))
+
+
+async def fetch_actor_key(actor):
+    actor_data = await fetch_actor(actor)
+
+    if 'publicKey' not in actor_data:
+         return None
+
+    if 'publicKeyPem' not in actor_data['publicKey']:
+         return None
+
+    return RSA.importKey(actor_data['publicKey']['publicKeyPem'])
+
+
+async def validate(actor, request):
+    pubkey = await fetch_actor_key(actor)
+    logging.debug('actor key: %r', pubkey)
+
+    headers = request.headers.copy()
+    headers['(request-target)'] = ' '.join([request.method.lower(), request.path])
+
+    sig = split_signature(headers['signature'])
+    logging.debug('sigdata: %r', sig)
+
+    sigstring = build_signing_string(headers, sig['headers'])
+    logging.debug('sigstring: %r', sigstring)
+
+    sign_alg, _, hash_alg = sig['algorithm'].partition('-')
+    logging.debug('sign alg: %r, hash alg: %r', sign_alg, hash_alg)
+
+    sigdata = base64.b64decode(sig['signature'])
+
+    pkcs = PKCS1_v1_5.new(pubkey)
+    h = HASHES[hash_alg].new()
+    h.update(sigstring.encode('ascii'))
+    result = pkcs.verify(h, sigdata)
+
+    logging.debug('validates? %r', result)
+    return result
+
+
+async def http_signatures_middleware(app, handler):
+    async def http_signatures_handler(request):
+        if 'signature' in request.headers:
+            data = await request.json()
+            if 'actor' not in data:
+                raise aiohttp.web.HTTPUnauthorized(body='signature check failed, no actor in message')
+
+            actor = data["actor"]
+            if not (await validate(actor, request)):
+                raise aiohttp.web.HTTPUnauthorized(body='signature check failed, signature did not match key')
+
+            return (await handler(request))
+
+        return (await handler(request))
+
+    return http_signatures_handler
diff --git a/viera/remote_actor.py b/viera/remote_actor.py
new file mode 100644
index 0000000..d1862f9
--- /dev/null
+++ b/viera/remote_actor.py
@@ -0,0 +1,14 @@
+import aiohttp
+from .database import DATABASE
+
+
+ACTORS = DATABASE.get("actors", {})
+async def fetch_actor(uri, force=False):
+    if uri in ACTORS and not force:
+        return ACTORS[uri]
+
+    async with aiohttp.ClientSession() as session:
+        async with session.get(uri, headers={'Accept': 'application/activity+json'}) as resp:
+            ACTORS[uri] = (await resp.json())
+            DATABASE["actors"] = ACTORS
+            return ACTORS[uri]