indymedia
/
epicyon
mirror of https://gitlab.com/bashrc2/epicyon
7
4
Fork 1
Code Issues 14 Releases Wiki Activity

Allow incoming posts with failing http signatures provided that they have a json signature which passes 

This provides the same level of assurance, but allows posts to arrive via relays
merge-requests/30/head
Bob Mottram 2021-02-14 15:22:03 +00:00
parent 1efec2d8ac
commit e6b9382a0a
2 changed files with 39 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
inbox.py
View File

@ -2726,6 +2726,7 @@ def runInboxQueue(recentPostsCache: {}, maxRecentPosts: int,
print('DEBUG: checking http header signature') print('DEBUG: checking http header signature')
pprint(queueJson['httpHeaders']) pprint(queueJson['httpHeaders'])
postStr = json.dumps(queueJson['post']) postStr = json.dumps(queueJson['post'])
httpSignatureFailed = False
if not verifyPostHeaders(httpPrefix, if not verifyPostHeaders(httpPrefix,
pubKey, pubKey,
queueJson['httpHeaders'], queueJson['httpHeaders'],
@ -2733,19 +2734,15 @@ def runInboxQueue(recentPostsCache: {}, maxRecentPosts: int,
queueJson['digest'], queueJson['digest'],
postStr, postStr,
debug): debug):
httpSignatureFailed = True
print('Queue: Header signature check failed') print('Queue: Header signature check failed')
pprint(queueJson['httpHeaders']) pprint(queueJson['httpHeaders'])
if os.path.isfile(queueFilename): else:
os.remove(queueFilename)
if len(queue) > 0:
queue.pop(0)
continue
if debug: if debug:
print('DEBUG: http header signature check success') print('DEBUG: http header signature check success')
# check if a json signature exists on this post # check if a json signature exists on this post
checkJsonSignature = False hasJsonSignature = False
originalJson = queueJson['original'] originalJson = queueJson['original']
if originalJson.get('@context') and \ if originalJson.get('@context') and \
originalJson.get('signature'): originalJson.get('signature'):
@ -2756,25 +2753,31 @@ def runInboxQueue(recentPostsCache: {}, maxRecentPosts: int,
if jwebsig.get('type') and jwebsig.get('signatureValue'): if jwebsig.get('type') and jwebsig.get('signatureValue'):
if jwebsig['type'] == 'RsaSignature2017': if jwebsig['type'] == 'RsaSignature2017':
if hasValidContext(originalJson): if hasValidContext(originalJson):
checkJsonSignature = True hasJsonSignature = True
else: else:
print('unrecognised @context: ' + print('unrecognised @context: ' +
str(originalJson['@context'])) str(originalJson['@context']))
# strict enforcement of json signatures # strict enforcement of json signatures
if verifyAllSignatures and \ if not hasJsonSignature:
not checkJsonSignature: if httpSignatureFailed:
print('inbox post does not have a jsonld signature ' + print('Queue: Header signature check failed and ' +
'unable to check json signature')
if verifyAllSignatures:
print('Queue: inbox post does not have a jsonld signature ' +
keyId + ' ' + str(originalJson)) keyId + ' ' + str(originalJson))
if httpSignatureFailed or verifyAllSignatures:
if os.path.isfile(queueFilename): if os.path.isfile(queueFilename):
os.remove(queueFilename) os.remove(queueFilename)
if len(queue) > 0: if len(queue) > 0:
queue.pop(0) queue.pop(0)
continue continue
else:
if checkJsonSignature and verifyAllSignatures: if httpSignatureFailed or verifyAllSignatures:
# use the original json message received, not one which may have # use the original json message received, not one which
# been modified along the way # may have been modified along the way
if not verifyJsonSignature(originalJson, pubKey): if not verifyJsonSignature(originalJson, pubKey):
if debug: if debug:
print('WARN: jsonld inbox signature check failed ' + print('WARN: jsonld inbox signature check failed ' +
@ -2787,6 +2790,10 @@ def runInboxQueue(recentPostsCache: {}, maxRecentPosts: int,
if len(queue) > 0: if len(queue) > 0:
queue.pop(0) queue.pop(0)
continue continue
else:
if httpSignatureFailed:
print('jsonld inbox signature check success ' +
'via relay ' + keyId)
else: else:
print('jsonld inbox signature check success ' + keyId) print('jsonld inbox signature check success ' + keyId)