1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69

package logic

import (
	"crypto/x509"
	"encoding/pem"
	"fmt"
	"github.com/go-fed/httpsig"
	"net/http"
	"regexp"
	"rss_parrot/dto"
	"rss_parrot/shared"
	"strings"
)

type IHttpSigChecker interface {
	Check(actor string, w http.ResponseWriter, r *http.Request) (*dto.UserInfo, string, error)
}

type httpSigChecker struct {
	logger        shared.ILogger
	userRetriever IUserRetriever
	reKeyId       *regexp.Regexp
}

func NewHttpSigChecker(logger shared.ILogger, userRetriever IUserRetriever) IHttpSigChecker {
	reKeyId := regexp.MustCompile("keyId=['\"]([^'\"]+)['\"]")
	return &httpSigChecker{logger, userRetriever, reKeyId}
}

func (chk *httpSigChecker) Check(actor string, w http.ResponseWriter, r *http.Request) (*dto.UserInfo, string, error) {

	var err error

	var sigHeader = r.Header.Get("Signature")
	groups := chk.reKeyId.FindStringSubmatch(sigHeader)
	if groups == nil {
		return nil, "Missing or invalid 'Signature' header", nil
	}
	keyId := groups[1]

	if !strings.HasPrefix(keyId, actor) {
		return nil, fmt.Sprintf("Actor is not prefix of keyId; actor: %s, keyId: %s", actor, keyId), nil
	}

	var userInfo *dto.UserInfo
	if userInfo, err = chk.userRetriever.Retrieve(actor); err != nil {
		return nil, fmt.Sprintf("Failed to retrieve user info for actor: %s: %v", actor, err), nil
	}

	verifier, err := httpsig.NewVerifier(r)
	if err != nil {
		chk.logger.Errorf("Failed to create signature verifier: %v", err)
		return nil, "", err
	}

	pubKeyStr := userInfo.PublicKey.PublicKeyPem
	block, _ := pem.Decode([]byte(pubKeyStr))

	var pubKey interface{}
	if pubKey, err = x509.ParsePKIXPublicKey(block.Bytes); err != nil {
		return nil, fmt.Sprintf("Failed to parse sender's public key: %v", err), nil
	}

	if err = verifier.Verify(pubKey, httpsig.RSA_SHA256); err != nil {
		return nil, fmt.Sprintf("Incorrect signature: %v", err), nil
	}

	return userInfo, "", nil
}