Anon/pleroma
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

HTTP Signatures: Work with all test vectors.

Browse Source
This commit is contained in:
Roger Braun 2017-09-18 18:10:21 +02:00
parent 9cefbaf016
commit 6268b7e0eb
2 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/pleroma/web/http_signatures/http_signatures.ex
View File

@ -1,9 +1,9 @@
# https://tools.ietf.org/html/draft-cavage-http-signatures-08 # https://tools.ietf.org/html/draft-cavage-http-signatures-08
defmodule Pleroma.Web.HTTPSignatures do defmodule Pleroma.Web.HTTPSignatures do
def split_signature(sig) do def split_signature(sig) do
default = %{"headers" => ["date"]} default = %{"headers" => "date"}
sig sig = sig
|> String.trim() |> String.trim()
|> String.split(",") |> String.split(",")
|> Enum.reduce(default, fn(part, acc) -> |> Enum.reduce(default, fn(part, acc) ->
@ -11,6 +11,8 @@ defmodule Pleroma.Web.HTTPSignatures do
value = Enum.join(rest, "=") value = Enum.join(rest, "=")
Map.put(acc, key, String.trim(value, "\"")) Map.put(acc, key, String.trim(value, "\""))
end) end)
Map.put(sig, "headers", String.split(sig["headers"], ~r/\s/))
end end
def validate(headers, signature, public_key) do def validate(headers, signature, public_key) do

18
test/web/http_sigs/http_sig_test.exs
View File

@ -25,6 +25,14 @@ defmodule Pleroma.Web.HTTPSignaturesTest do
keyId="Test",algorithm="rsa-sha256",signature="jKyvPcxB4JbmYY4mByyBY7cZfNl4OW9HpFQlG7N4YcJPteKTu4MWCLyk+gIr0wDgqtLWf9NLpMAMimdfsH7FSWGfbMFSrsVTHNTk0rK3usrfFnti1dxsM4jl0kYJCKTGI/UWkqiaxwNiKqGcdlEDrTcUhhsFsOIo8VhddmZTZ8w=" keyId="Test",algorithm="rsa-sha256",signature="jKyvPcxB4JbmYY4mByyBY7cZfNl4OW9HpFQlG7N4YcJPteKTu4MWCLyk+gIr0wDgqtLWf9NLpMAMimdfsH7FSWGfbMFSrsVTHNTk0rK3usrfFnti1dxsM4jl0kYJCKTGI/UWkqiaxwNiKqGcdlEDrTcUhhsFsOIo8VhddmZTZ8w="
""" """
@basic_signature """
keyId="Test",algorithm="rsa-sha256",headers="(request-target) host date",signature="HUxc9BS3P/kPhSmJo+0pQ4IsCo007vkv6bUm4Qehrx+B1Eo4Mq5/6KylET72ZpMUS80XvjlOPjKzxfeTQj4DiKbAzwJAb4HX3qX6obQTa00/qPDXlMepD2JtTw33yNnm/0xV7fQuvILN/ys+378Ysi082+4xBQFwvhNvSoVsGv4="
"""
@all_headers_signature """
keyId="Test",algorithm="rsa-sha256",headers="(request-target) host date content-type digest content-length",signature="Ef7MlxLXoBovhil3AlyjtBwAL9g4TN3tibLj7uuNB3CROat/9KaeQ4hW2NiJ+pZ6HQEOx9vYZAyi+7cmIkmJszJCut5kQLAwuX+Ms/mUFvpKlSo9StS2bMXDBNjOh4Auj774GFj4gwjS+3NhFeoqyr/MuN6HsEnkvn6zdgfE2i0="
"""
test "split up a signature" do test "split up a signature" do
expected = %{ expected = %{
"keyId" => "Test", "keyId" => "Test",
@ -41,6 +49,16 @@ defmodule Pleroma.Web.HTTPSignaturesTest do
assert HTTPSignatures.validate(@headers, signature, @public_key) assert HTTPSignatures.validate(@headers, signature, @public_key)
end end
test "validates the basic case" do
signature = HTTPSignatures.split_signature(@basic_signature)
assert HTTPSignatures.validate(@headers, signature, @public_key)
end
test "validates the all-headers case" do
signature = HTTPSignatures.split_signature(@all_headers_signature)
assert HTTPSignatures.validate(@headers, signature, @public_key)
end
test "it contructs a signing string" do test "it contructs a signing string" do
expected = "date: Thu, 05 Jan 2014 21:31:40 GMT\ncontent-length: 18" expected = "date: Thu, 05 Jan 2014 21:31:40 GMT\ncontent-length: 18"
assert expected == HTTPSignatures.build_signing_string(@headers, ["date", "content-length"]) assert expected == HTTPSignatures.build_signing_string(@headers, ["date", "content-length"])