mirror of https://github.com/friendica/friendica
96 lines
3.4 KiB
PHP
96 lines
3.4 KiB
PHP
<?php
|
|
/**
|
|
* @copyright Copyright (C) 2010-2022, the Friendica project
|
|
*
|
|
* @license GNU AGPL version 3 or any later version
|
|
*
|
|
* This program is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU Affero General Public License as
|
|
* published by the Free Software Foundation, either version 3 of the
|
|
* License, or (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU Affero General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Affero General Public License
|
|
* along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
*
|
|
*/
|
|
|
|
namespace Friendica\Security\OAuth1\Signature;
|
|
|
|
use Friendica\Security\OAuth1\OAuthRequest;
|
|
|
|
/**
|
|
* The RSA-SHA1 signature method uses the RSASSA-PKCS1-v1_5 signature algorithm as defined in
|
|
* [RFC3447] section 8.2 (more simply known as PKCS#1), using SHA-1 as the hash function for
|
|
* EMSA-PKCS1-v1_5. It is assumed that the Consumer has provided its RSA public key in a
|
|
* verified way to the Service Provider, in a manner which is beyond the scope of this
|
|
* specification.
|
|
* - Chapter 9.3 ("RSA-SHA1")
|
|
*/
|
|
abstract class OAuthSignatureMethod_RSA_SHA1 extends OAuthSignatureMethod
|
|
{
|
|
public function get_name()
|
|
{
|
|
return "RSA-SHA1";
|
|
}
|
|
|
|
// Up to the SP to implement this lookup of keys. Possible ideas are:
|
|
// (1) do a lookup in a table of trusted certs keyed off of consumer
|
|
// (2) fetch via http using a url provided by the requester
|
|
// (3) some sort of specific discovery code based on request
|
|
//
|
|
// Either way should return a string representation of the certificate
|
|
protected abstract function fetch_public_cert(&$request);
|
|
|
|
// Up to the SP to implement this lookup of keys. Possible ideas are:
|
|
// (1) do a lookup in a table of trusted certs keyed off of consumer
|
|
//
|
|
// Either way should return a string representation of the certificate
|
|
protected abstract function fetch_private_cert(&$request);
|
|
|
|
public function build_signature(OAuthRequest $request, \Friendica\Security\OAuth1\OAuthConsumer $consumer, \Friendica\Security\OAuth1\OAuthToken $token = null)
|
|
{
|
|
$base_string = $request->get_signature_base_string();
|
|
$request->base_string = $base_string;
|
|
|
|
// Fetch the private key cert based on the request
|
|
$cert = $this->fetch_private_cert($request);
|
|
|
|
// Pull the private key ID from the certificate
|
|
$privatekeyid = openssl_get_privatekey($cert);
|
|
|
|
// Sign using the key
|
|
openssl_sign($base_string, $signature, $privatekeyid);
|
|
|
|
// Release the key resource
|
|
openssl_free_key($privatekeyid);
|
|
|
|
return base64_encode($signature);
|
|
}
|
|
|
|
public function check_signature(OAuthRequest $request, \Friendica\Security\OAuth1\OAuthConsumer $consumer, $signature, \Friendica\Security\OAuth1\OAuthToken $token = null)
|
|
{
|
|
$decoded_sig = base64_decode($signature);
|
|
|
|
$base_string = $request->get_signature_base_string();
|
|
|
|
// Fetch the public key cert based on the request
|
|
$cert = $this->fetch_public_cert($request);
|
|
|
|
// Pull the public key ID from the certificate
|
|
$publickeyid = openssl_get_publickey($cert);
|
|
|
|
// Check the computed signature against the one passed in the query
|
|
$ok = openssl_verify($base_string, $decoded_sig, $publickeyid);
|
|
|
|
// Release the key resource
|
|
openssl_free_key($publickeyid);
|
|
|
|
return $ok == 1;
|
|
}
|
|
}
|