299 lines
8.2 KiB
Go
299 lines
8.2 KiB
Go
package webshared
|
|
|
|
import (
|
|
"bytes"
|
|
"cmp"
|
|
"crypto/sha256"
|
|
"crypto/x509"
|
|
"encoding/base64"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"net/url"
|
|
"slices"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/rs/zerolog/log"
|
|
"github.com/yaronf/httpsign"
|
|
|
|
"git.mstar.dev/mstar/linstrom/config"
|
|
"git.mstar.dev/mstar/linstrom/shared"
|
|
"git.mstar.dev/mstar/linstrom/storage-new/dbgen"
|
|
"git.mstar.dev/mstar/linstrom/storage-new/models"
|
|
)
|
|
|
|
/*
|
|
Links for home:
|
|
- https://pkg.go.dev/github.com/yaronf/httpsign#Client.Do
|
|
- https://www.ietf.org/archive/id/draft-richanna-http-message-signatures-00.html
|
|
- https://github.com/mastodon/mastodon/issues/29905
|
|
- https://github.com/fedify-dev/fedify/issues/208
|
|
- https://github.com/mastodon/mastodon/issues/21429
|
|
- https://github.com/go-ap/fedbox/blob/master/httpsig.go
|
|
- https://swicg.github.io/activitypub-http-signature/
|
|
- https://datatracker.ietf.org/doc/html/rfc9421
|
|
*/
|
|
|
|
// Perform a signed request. Tries RFC9421 first and on fail cavage.
|
|
// This double-knocking is because implementations currently use cavage (a precursor to RFC9421).
|
|
// However, Cavage is deprecated now and the RFC should be used instead. And so
|
|
// implementations have slowly begun to implement the RFC in addition to cavage
|
|
//
|
|
// Returns the unmodified response, if the request completed with RFC signing and an error, if any
|
|
func RequestSigned(
|
|
method, target string,
|
|
body []byte,
|
|
actor *models.User,
|
|
) (response *http.Response, wasRfc9421 bool, err error) {
|
|
if method == "POST" {
|
|
storedRequestId, err := prePostRequest(target, body, actor)
|
|
if err != nil {
|
|
return nil, false, err
|
|
}
|
|
defer postPostRequest(response, err, *storedRequestId)
|
|
}
|
|
wasRfc9421 = true
|
|
response, err = RequestSignedRFC9421(method, target, body, actor)
|
|
if err == nil && response.StatusCode < 400 {
|
|
return
|
|
}
|
|
wasRfc9421 = false
|
|
log.Debug().Str("target", target).Msg("RFC9421 signed request failed, trying cavage signed")
|
|
response, err = RequestSignedCavage(method, target, body, actor)
|
|
return
|
|
}
|
|
|
|
// Perform a request, signing it as specified in RFC 9421
|
|
func RequestSignedRFC9421(
|
|
method, target string,
|
|
body []byte,
|
|
actor *models.User,
|
|
) (*http.Response, error) {
|
|
req, err := http.NewRequest(method, target, bytes.NewBuffer(slices.Clone(body)))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
applyDefaultHeaders(req)
|
|
req.Header.Add("Accept", "application/activity+json")
|
|
req.Header.Add("Content-Type", "application/activity+json")
|
|
var signer *httpsign.Signer
|
|
signerFields := httpsign.Headers("@request-target", "content-digest")
|
|
if config.GlobalConfig.Experimental.UseEd25519Keys {
|
|
signer, err = httpsign.NewEd25519Signer(
|
|
actor.PrivateKeyEd,
|
|
httpsign.NewSignConfig(),
|
|
signerFields,
|
|
)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
} else {
|
|
key, err := x509.ParsePKCS1PrivateKey(actor.PrivateKeyRsa)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
signer, err = httpsign.NewRSASigner(*key, httpsign.NewSignConfig(), signerFields)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
clientConfig := httpsign.NewClientConfig().SetSigner(signer)
|
|
if config.GlobalConfig.Experimental.UseEd25519Keys {
|
|
clientConfig = clientConfig.SetSignatureName("sig-ed")
|
|
} else {
|
|
clientConfig = clientConfig.SetSignatureName("sig-rsa")
|
|
}
|
|
client := httpsign.NewClient(
|
|
RequestClient,
|
|
clientConfig,
|
|
)
|
|
res, err := client.Do(req)
|
|
return res, err
|
|
}
|
|
|
|
// Perform a request, signing it as specified in the cavage proposal
|
|
// (https://swicg.github.io/activitypub-http-signature/#how-to-sign-a-request)
|
|
func RequestSignedCavage(
|
|
method, target string,
|
|
body []byte,
|
|
actor *models.User,
|
|
) (*http.Response, error) {
|
|
var bodyReader io.Reader
|
|
if body != nil {
|
|
bodyReader = bytes.NewReader(body)
|
|
}
|
|
req, err := NewRequest(method, target, bodyReader)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
req.Header.Add("Accept", "application/activity+json")
|
|
req.Header.Add("Content-Type", "application/activity+json")
|
|
|
|
var keyBytes []byte
|
|
if config.GlobalConfig.Experimental.UseEd25519Keys {
|
|
keyBytes = actor.PrivateKeyEd
|
|
} else {
|
|
keyBytes = actor.PrivateKeyRsa
|
|
}
|
|
|
|
// Sign and send
|
|
err = SignRequest(
|
|
req,
|
|
actor.ID+"#main-key",
|
|
keyBytes,
|
|
body,
|
|
)
|
|
// err = webshared.SignRequestWithHttpsig(req, linstromActor.ID+"#main-key", keyBytes, nil)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return RequestClient.Do(req)
|
|
}
|
|
|
|
func applyDefaultHeaders(r *http.Request) {
|
|
r.Header.Add(
|
|
"User-Agent",
|
|
"Linstrom "+shared.Version+" ("+config.GlobalConfig.General.GetFullDomain()+")",
|
|
)
|
|
r.Header.Add("Date", time.Now().UTC().Format(http.TimeFormat))
|
|
r.Header.Add("Accept", "application/activity+json")
|
|
}
|
|
|
|
func applyBodyHash(headers http.Header, body []byte) error {
|
|
if len(body) == 0 {
|
|
return nil
|
|
}
|
|
hash := sha256.Sum256(body)
|
|
header := "SHA-256=" + base64.StdEncoding.EncodeToString(hash[:])
|
|
headers.Set("Digest", header)
|
|
return nil
|
|
}
|
|
|
|
// Runs before a signed outbound request.
|
|
// If the request is POST, stores it in the db as not processed yet.
|
|
// This is to ensure data consistency
|
|
func prePostRequest(
|
|
target string,
|
|
body []byte,
|
|
actor *models.User,
|
|
) (*uint64, error) {
|
|
targetUrl, err := url.Parse(target)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
server, err := dbgen.RemoteServer.Where(dbgen.RemoteServer.Domain.Eq(targetUrl.Hostname())).
|
|
First()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
fr := dbgen.FailedOutboundRequest
|
|
now := time.Now()
|
|
data := models.FailedOutboundRequest{
|
|
TargetServer: server,
|
|
TargetServerId: server.ID,
|
|
ActingUserId: actor.ID,
|
|
ActingUser: actor,
|
|
NrOfAttempts: 1,
|
|
RawData: body,
|
|
FirstAttempt: now,
|
|
LastAttempt: now,
|
|
LastFailureReason: string(models.RequestFailureNotAttemptedYet),
|
|
}
|
|
err = fr.Create(&data)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return &data.Id, nil
|
|
}
|
|
|
|
// Updates the db request based on the results of the request
|
|
func postPostRequest(resp *http.Response, reqErr error, dbId uint64) {
|
|
fr := dbgen.FailedOutboundRequest
|
|
failureReason := "generic"
|
|
update := true // Flag to tell defer func to not update since request info has been deleted
|
|
defer func() {
|
|
if !update {
|
|
return
|
|
}
|
|
_, err := fr.Where(fr.Id.Eq(dbId)).UpdateColumn(fr.LastFailureReason, failureReason)
|
|
if err != nil {
|
|
log.Error().
|
|
Err(err).
|
|
Str("reason", failureReason).
|
|
Uint64("request-id", dbId).
|
|
Msg("Failed to update failure reason")
|
|
}
|
|
}()
|
|
if reqErr != nil {
|
|
failureReason = string(models.RequestFailureRequestError)
|
|
return
|
|
}
|
|
// Only check response data after handling response error
|
|
// Response could be nil otherwise, causing a panic (or an extra, useless check)
|
|
|
|
// If response status is ok (< 400) delete entry in db to not process it again
|
|
if resp.StatusCode < 400 {
|
|
update = false
|
|
fr.Where(fr.Id.Eq(dbId)).Delete()
|
|
return
|
|
}
|
|
if resp.StatusCode == 429 {
|
|
// Always prefer the rate limit headers as defined by https://www.ietf.org/archive/id/draft-polli-ratelimit-headers-02.html
|
|
limit := cmp.Or(
|
|
resp.Header.Get("RateLimit-Limit"),
|
|
resp.Header.Get("X-RateLimit-Limit"),
|
|
resp.Header.Get("X-Rate-Limit-Limit"),
|
|
)
|
|
remaining := cmp.Or(
|
|
resp.Header.Get("RateLimit-Remaining"),
|
|
resp.Header.Get("X-RateLimit-Remaining"),
|
|
resp.Header.Get("X-Rate-Limit-Remaining"),
|
|
)
|
|
reset := cmp.Or(
|
|
resp.Header.Get("RateLimit-Reset"),
|
|
resp.Header.Get("X-RateLimit-Reset"),
|
|
resp.Header.Get("X-Rate-Limit-Reset"),
|
|
)
|
|
if cmp.Or(limit, remaining, reset) == "" {
|
|
failureReason = string(models.RequestFailureRateLimitedNoInfo)
|
|
return
|
|
} else {
|
|
limit = strings.Split(limit, ",")[0]
|
|
limit = strings.Split(limit, ";")[0]
|
|
if limit == "" {
|
|
limit = "-1"
|
|
}
|
|
limitNum, err := strconv.Atoi(limit)
|
|
if err != nil {
|
|
failureReason = string(models.RequestFailureRateLimitedNoInfo)
|
|
return
|
|
}
|
|
if remaining == "" {
|
|
remaining = "-1"
|
|
}
|
|
remainingNum, err := strconv.Atoi(remaining)
|
|
if err != nil {
|
|
failureReason = string(models.RequestFailureRateLimitedNoInfo)
|
|
return
|
|
}
|
|
if reset == "" {
|
|
reset = "-1"
|
|
}
|
|
resetNum, err := strconv.Atoi(reset)
|
|
if err != nil {
|
|
failureReason = string(models.RequestFailureRateLimitedNoInfo)
|
|
return
|
|
}
|
|
failureReason = fmt.Sprintf(string(models.RequestFailureRateLimitTemplate), limitNum, remainingNum, resetNum)
|
|
}
|
|
return
|
|
} else {
|
|
if resp.StatusCode >= 500 {
|
|
failureReason = string(models.RequestFailureInternalError)
|
|
} else {
|
|
failureReason = string(models.RequestFailureRejected)
|
|
}
|
|
}
|
|
}
|