mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2025-12-07 14:09:47 +00:00
8ee4a7d658
To make sure that the code stays maintainable, I added the `importas` linter to ensure that the imports for models and services stay consistent. I realised that this might be needed after finding some discrepancies between singular/plural naming, and, especially in the case of the `forgejo.org/services/context` package, multiple different aliases like `gitea_ctx`, `app_context` and `forgejo_context`. I decided for `app_context`, as that seems to be the most commonly used naming. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/10253 Reviewed-by: Gusted <gusted@noreply.codeberg.org> Co-authored-by: nachtjasmin <nachtjasmin@posteo.de> Co-committed-by: nachtjasmin <nachtjasmin@posteo.de>
94 lines
2.5 KiB
Go
94 lines
2.5 KiB
Go
// Copyright 2022 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package activitypub
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"forgejo.org/modules/log"
|
|
"forgejo.org/modules/setting"
|
|
app_context "forgejo.org/services/context"
|
|
"forgejo.org/services/federation"
|
|
|
|
"github.com/42wim/httpsig"
|
|
)
|
|
|
|
func verifyHTTPUserOrInstanceSignature(ctx app_context.APIContext) (authenticated bool, err error) {
|
|
if !setting.Federation.SignatureEnforced {
|
|
return true, nil
|
|
}
|
|
|
|
r := ctx.Req
|
|
|
|
// 1. Figure out what key we need to verify
|
|
v, err := httpsig.NewVerifier(r)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
signatureAlgorithm := httpsig.Algorithm(setting.Federation.SignatureAlgorithms[0])
|
|
pubKey, err := federation.FindOrCreateFederatedUserKey(ctx, v.KeyId())
|
|
if err != nil || pubKey == nil {
|
|
pubKey, err = federation.FindOrCreateFederationHostKey(ctx, v.KeyId())
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
}
|
|
|
|
err = v.Verify(pubKey, signatureAlgorithm)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
return true, nil
|
|
}
|
|
|
|
func verifyHTTPUserSignature(ctx app_context.APIContext) (authenticated bool, err error) {
|
|
if !setting.Federation.SignatureEnforced {
|
|
return true, nil
|
|
}
|
|
|
|
r := ctx.Req
|
|
|
|
// 1. Figure out what key we need to verify
|
|
v, err := httpsig.NewVerifier(r)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
signatureAlgorithm := httpsig.Algorithm(setting.Federation.SignatureAlgorithms[0])
|
|
pubKey, err := federation.FindOrCreateFederatedUserKey(ctx, v.KeyId())
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
err = v.Verify(pubKey, signatureAlgorithm)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
return true, nil
|
|
}
|
|
|
|
// ReqHTTPSignature function
|
|
func ReqHTTPUserOrInstanceSignature() func(ctx *app_context.APIContext) {
|
|
return func(ctx *app_context.APIContext) {
|
|
if authenticated, err := verifyHTTPUserOrInstanceSignature(*ctx); err != nil {
|
|
log.Warn("verifyHttpSignatures failed: %v", err)
|
|
ctx.Error(http.StatusBadRequest, "reqSignature", "request signature verification failed")
|
|
} else if !authenticated {
|
|
ctx.Error(http.StatusForbidden, "reqSignature", "request signature verification failed")
|
|
}
|
|
}
|
|
}
|
|
|
|
// ReqHTTPUserSignature function
|
|
func ReqHTTPUserSignature() func(ctx *app_context.APIContext) {
|
|
return func(ctx *app_context.APIContext) {
|
|
if authenticated, err := verifyHTTPUserSignature(*ctx); err != nil {
|
|
log.Warn("verifyHttpSignatures failed: %v", err)
|
|
ctx.Error(http.StatusBadRequest, "reqSignature", "request signature verification failed")
|
|
} else if !authenticated {
|
|
ctx.Error(http.StatusForbidden, "reqSignature", "request signature verification failed")
|
|
}
|
|
}
|
|
}
|