git.squeep.com Git - akkoma/blob - lib/pleroma/web/salmon/salmon.ex

   1 defmodule Pleroma.Web.Salmon do
   2   use Bitwise
   3   alias Pleroma.Web.XML
   4
   5   def decode(salmon) do
   6     doc = XML.parse_document(salmon)
   7
   8     {:xmlObj, :string, data} = :xmerl_xpath.string('string(//me:data[1])', doc)
   9     {:xmlObj, :string, sig} = :xmerl_xpath.string('string(//me:sig[1])', doc)
  10     {:xmlObj, :string, alg} = :xmerl_xpath.string('string(//me:alg[1])', doc)
  11     {:xmlObj, :string, encoding} = :xmerl_xpath.string('string(//me:encoding[1])', doc)
  12     {:xmlObj, :string, type} = :xmerl_xpath.string('string(//me:data[1]/@type)', doc)
  13
  14
  15     {:ok, data} = Base.url_decode64(to_string(data), ignore: :whitespace)
  16     {:ok, sig} = Base.url_decode64(to_string(sig), ignore: :whitespace)
  17     alg = to_string(alg)
  18     encoding = to_string(encoding)
  19     type = to_string(type)
  20
  21     [data, type, encoding, alg, sig]
  22   end
  23
  24   def fetch_magic_key(salmon) do
  25     [data, _, _, _, _] = decode(salmon)
  26     doc = XML.parse_document(data)
  27     {:xmlObj, :string, uri} = :xmerl_xpath.string('string(//author[1]/uri)', doc)
  28
  29     uri = to_string(uri)
  30     base = URI.parse(uri).host
  31
  32     # TODO: Find out if this endpoint is mandated by the standard.
  33     # At least diaspora does it differently
  34     {:ok, response} = HTTPoison.get(base <> "/.well-known/webfinger", ["Accept": "application/xrd+xml"], [params: [resource: uri]])
  35
  36     doc = XML.parse_document(response.body)
  37
  38     {:xmlObj, :string, magickey} = :xmerl_xpath.string('string(//Link[@rel="magic-public-key"]/@href)', doc)
  39     "data:application/magic-public-key," <> magickey = to_string(magickey)
  40
  41     magickey
  42   end
  43
  44   def decode_and_validate(magickey, salmon) do
  45     [data, type, encoding, alg, sig] = decode(salmon)
  46
  47     signed_text = [data, type, encoding, alg]
  48     |> Enum.map(&Base.url_encode64/1)
  49     |> Enum.join(".")
  50
  51     key = decode_key(magickey)
  52
  53     verify = :public_key.verify(signed_text, :sha256, sig, key)
  54
  55     if verify do
  56       {:ok, data}
  57     else
  58       :error
  59     end
  60   end
  61
  62   def decode_key("RSA." <> magickey) do
  63     make_integer = fn(bin) ->
  64       list = :erlang.binary_to_list(bin)
  65       Enum.reduce(list, 0, fn (el, acc) -> (acc <<< 8) ||| el end)
  66     end
  67
  68     [modulus, exponent] = magickey
  69     |> String.split(".")
  70     |> Enum.map(&Base.url_decode64!/1)
  71     |> Enum.map(make_integer)
  72
  73     {:RSAPublicKey, modulus, exponent}
  74   end
  75
  76   def encode_key({:RSAPublicKey, modulus, exponent}) do
  77     modulus_enc = :binary.encode_unsigned(modulus) |> Base.url_encode64
  78     exponent_enc = :binary.encode_unsigned(exponent) |> Base.url_encode64
  79
  80     "RSA.#{modulus_enc}.#{exponent_enc}"
  81   end
  82
  83   def generate_rsa_pem do
  84     port = Port.open({:spawn, "openssl genrsa"}, [:binary])
  85     {:ok, pem} = receive do
  86       {^port, {:data, pem}} -> {:ok, pem}
  87     end
  88     Port.close(port)
  89     if Regex.match?(~r/RSA PRIVATE KEY/, pem) do
  90       {:ok, pem}
  91     else
  92       :error
  93     end
  94   end
  95
  96   def keys_from_pem(pem) do
  97     [private_key_code] = :public_key.pem_decode(pem)
  98     private_key = :public_key.pem_entry_decode(private_key_code)
  99     {:RSAPrivateKey, _, modulus, exponent, _, _, _, _, _, _, _} = private_key
 100     public_key = {:RSAPublicKey, modulus, exponent}
 101     {:ok, private_key, public_key}
 102   end
 103
 104   def encode(private_key, doc) do
 105     type = "application/atom+xml"
 106     encoding = "base64url"
 107     alg = "RSA-SHA256"
 108
 109     signed_text = [doc, type, encoding, alg]
 110     |> Enum.map(&Base.url_encode64/1)
 111     |> Enum.join(".")
 112
 113     signature = :public_key.sign(signed_text, :sha256, private_key) |> to_string |> Base.url_encode64
 114     doc_base64= doc |> Base.url_encode64
 115
 116     # Don't need proper xml building, these strings are safe to leave unescaped
 117     salmon = """
 118     <?xml version="1.0" encoding="UTF-8"?>
 119     <me:env xmlns:me="http://salmon-protocol.org/ns/magic-env">
 120       <me:data type="application/atom+xml">#{doc_base64}</me:data>
 121       <me:encoding>#{encoding}</me:encoding>
 122       <me:alg>#{alg}</me:alg>
 123       <me:sig>#{signature}</me:sig>
 124     </me:env>
 125     """
 126
 127     {:ok, salmon}
 128   end
 129 end