1 use crate::APUB_JSON_CONTENT_TYPE;
2 use actix_web::HttpRequest;
4 use http::{header::HeaderName, HeaderMap, HeaderValue};
5 use http_signature_normalization_actix::Config as ConfigActix;
6 use http_signature_normalization_reqwest::prelude::{Config, SignExt};
7 use lemmy_utils::{LemmyError, REQWEST_TIMEOUT};
8 use once_cell::sync::Lazy;
12 sign::{Signer, Verifier},
14 use reqwest::Response;
15 use reqwest_middleware::ClientWithMiddleware;
16 use serde::{Deserialize, Serialize};
17 use sha2::{Digest, Sha256};
18 use std::str::FromStr;
22 static CONFIG2: Lazy<ConfigActix> = Lazy::new(ConfigActix::new);
23 static HTTP_SIG_CONFIG: Lazy<Config> = Lazy::new(Config::new);
25 /// Creates an HTTP post request to `inbox_url`, with the given `client` and `headers`, and
26 /// `activity` as request body. The request is signed with `private_key` and then sent.
27 pub async fn sign_and_send(
28 client: &ClientWithMiddleware,
33 ) -> Result<Response, LemmyError> {
34 let signing_key_id = format!("{}#main-key", actor_id);
36 let mut headers = HeaderMap::new();
37 let mut host = inbox_url.domain().expect("read inbox domain").to_string();
38 if let Some(port) = inbox_url.port() {
39 host = format!("{}:{}", host, port);
42 HeaderName::from_str("Content-Type")?,
43 HeaderValue::from_str(APUB_JSON_CONTENT_TYPE)?,
45 headers.insert(HeaderName::from_str("Host")?, HeaderValue::from_str(&host)?);
48 .post(&inbox_url.to_string())
49 // signature is only valid for 10 seconds, so no reason to wait any longer
50 .timeout(REQWEST_TIMEOUT)
52 .signature_with_digest(
53 HTTP_SIG_CONFIG.clone(),
57 move |signing_string| {
58 let private_key = PKey::private_key_from_pem(private_key.as_bytes())?;
59 let mut signer = Signer::new(MessageDigest::sha256(), &private_key)?;
60 signer.update(signing_string.as_bytes())?;
62 Ok(base64::encode(signer.sign_to_vec()?)) as Result<_, LemmyError>
67 let response = client.execute(request).await?;
72 /// Verifies the HTTP signature on an incoming inbox request.
73 pub fn verify_signature(request: &HttpRequest, public_key: &str) -> Result<(), LemmyError> {
74 let verified = CONFIG2
77 request.uri().path_and_query(),
78 request.headers().clone(),
80 .verify(|signature, signing_string| -> Result<bool, LemmyError> {
82 "Verifying with key {}, message {}",
83 &public_key, &signing_string
85 let public_key = PKey::public_key_from_pem(public_key.as_bytes())?;
86 let mut verifier = Verifier::new(MessageDigest::sha256(), &public_key)?;
87 verifier.update(signing_string.as_bytes())?;
88 Ok(verifier.verify(&base64::decode(signature)?)?)
92 debug!("verified signature for {}", &request.uri());
95 Err(anyhow!("Invalid signature on request: {}", &request.uri()).into())
99 #[derive(Clone, Debug, Deserialize, Serialize)]
100 #[serde(rename_all = "camelCase")]
101 pub struct PublicKey {
102 pub(crate) id: String,
103 pub(crate) owner: Box<Url>,
104 pub public_key_pem: String,