123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359 |
- <?php
- class MagicEnvelope
- {
- const ENCODING = 'base64url';
- const NS = 'http://salmon-protocol.org/ns/magic-env';
- protected $data = null;
- protected $data_type = null;
- protected $encoding = null;
- protected $alg = null;
- protected $sig = null;
-
- public function __construct($xml=null) {
- if (!empty($xml)) {
- $dom = DOMDocument::loadXML($xml);
- if (!$dom instanceof DOMDocument) {
- throw new ServerException('Tried to load malformed XML as DOM');
- } elseif (!$this->fromDom($dom)) {
- throw new ServerException('Could not load MagicEnvelope from DOM');
- }
- }
- }
-
- public function getKeyPair(Profile $profile, $discovery=false) {
- $magicsig = Magicsig::getKV('user_id', $profile->id);
- if ($discovery && !$magicsig instanceof Magicsig) {
-
- $keypair = $this->discoverKeyPair($profile);
- $magicsig = new Magicsig();
- $magicsig->user_id = $profile->id;
- $magicsig->importKeys($keypair);
-
-
-
- $magicsig->insert();
- } elseif (!$magicsig instanceof Magicsig) {
- throw new ServerException(sprintf('No public key found for profile (id==%d)', $profile->id));
- }
- assert($magicsig->publicKey instanceof Crypt_RSA);
- return $magicsig;
- }
-
- public function discoverKeyPair(Profile $profile)
- {
- $signer_uri = $profile->getUri();
- if (empty($signer_uri)) {
- throw new ServerException(sprintf('Profile missing URI (id==%d)', $profile->id));
- }
- $disco = new Discovery();
-
- $xrd = $disco->lookup($signer_uri);
- $link = $xrd->get(Magicsig::PUBLICKEYREL);
- if (is_null($link)) {
-
- throw new Exception(_m('Unable to locate signer public key.'));
- }
-
- $keypair = false;
- $parts = explode(',', $link->href);
- if (count($parts) == 2) {
- $keypair = $parts[1];
- } else {
-
- $parts = explode(';', $link->href);
- if (count($parts) == 2) {
- $keypair = $parts[1];
- }
- }
- if ($keypair === false) {
-
-
- throw new Exception(_m('Incorrectly formatted public key element.'));
- }
- return $keypair;
- }
-
- public function signingText() {
- return implode('.', array($this->data,
- Magicsig::base64_url_encode($this->data_type),
- Magicsig::base64_url_encode($this->encoding),
- Magicsig::base64_url_encode($this->alg)));
- }
-
- public function signMessage($text, $mimetype, Magicsig $magicsig)
- {
- assert($magicsig->privateKey instanceof Crypt_RSA);
-
- $this->data = Magicsig::base64_url_encode($text);
- $this->data_type = $mimetype;
- $this->encoding = self::ENCODING;
- $this->alg = $magicsig->getName();
-
- $this->sig = $magicsig->sign($this->signingText());
- }
-
- public function toXML() {
- $xs = new XMLStringer();
- $xs->startXML();
- $xs->elementStart('me:env', array('xmlns:me' => self::NS));
- $xs->element('me:data', array('type' => $this->data_type), $this->data);
- $xs->element('me:encoding', null, $this->encoding);
- $xs->element('me:alg', null, $this->alg);
- $xs->element('me:sig', null, $this->getSignature());
- $xs->elementEnd('me:env');
- $string = $xs->getString();
- return $string;
- }
-
- public function getPayload()
- {
- $dom = new DOMDocument();
- if (!$dom->loadXML(Magicsig::base64_url_decode($this->data))) {
- throw new ServerException('Malformed XML in Salmon payload');
- }
- switch ($this->data_type) {
- case 'application/atom+xml':
- if ($dom->documentElement->namespaceURI !== Activity::ATOM
- || $dom->documentElement->tagName !== 'entry') {
- throw new ServerException(_m('Salmon post must be an Atom entry.'));
- }
- $prov = $dom->createElementNS(self::NS, 'me:provenance');
- $prov->setAttribute('xmlns:me', self::NS);
- $data = $dom->createElementNS(self::NS, 'me:data', $this->data);
- $data->setAttribute('type', $this->data_type);
- $prov->appendChild($data);
- $enc = $dom->createElementNS(self::NS, 'me:encoding', $this->encoding);
- $prov->appendChild($enc);
- $alg = $dom->createElementNS(self::NS, 'me:alg', $this->alg);
- $prov->appendChild($alg);
- $sig = $dom->createElementNS(self::NS, 'me:sig', $this->getSignature());
- $prov->appendChild($sig);
-
- $dom->documentElement->appendChild($prov);
- break;
- default:
- throw new ServerException('Unknown Salmon payload data type');
- }
- return $dom;
- }
- public function getSignature()
- {
- return $this->sig;
- }
-
- public function getAuthorUri() {
- $doc = $this->getPayload();
- $authors = $doc->documentElement->getElementsByTagName('author');
- foreach ($authors as $author) {
- $uris = $author->getElementsByTagName('uri');
- foreach ($uris as $uri) {
- return $uri->nodeValue;
- }
- }
- throw new ServerException('No author URI found in Salmon payload data');
- }
-
- public function verify(Profile $profile)
- {
- if ($this->alg != 'RSA-SHA256') {
- common_log(LOG_DEBUG, "Salmon error: bad algorithm");
- return false;
- }
- if ($this->encoding != self::ENCODING) {
- common_log(LOG_DEBUG, "Salmon error: bad encoding");
- return false;
- }
- try {
- $magicsig = $this->getKeyPair($profile, true);
- } catch (Exception $e) {
- common_log(LOG_DEBUG, "Salmon error: ".$e->getMessage());
- return false;
- }
- return $magicsig->verify($this->signingText(), $this->getSignature());
- }
-
- protected function fromDom(DOMDocument $dom)
- {
- $env_element = $dom->getElementsByTagNameNS(self::NS, 'env')->item(0);
- if (!$env_element) {
- $env_element = $dom->getElementsByTagNameNS(self::NS, 'provenance')->item(0);
- }
- if (!$env_element) {
- return false;
- }
- $data_element = $env_element->getElementsByTagNameNS(self::NS, 'data')->item(0);
- $sig_element = $env_element->getElementsByTagNameNS(self::NS, 'sig')->item(0);
- $this->data = preg_replace('/\s/', '', $data_element->nodeValue);
- $this->data_type = $data_element->getAttribute('type');
- $this->encoding = $env_element->getElementsByTagNameNS(self::NS, 'encoding')->item(0)->nodeValue;
- $this->alg = $env_element->getElementsByTagNameNS(self::NS, 'alg')->item(0)->nodeValue;
- $this->sig = preg_replace('/\s/', '', $sig_element->nodeValue);
- return true;
- }
-
- public static function signAsUser($text, User $user)
- {
-
- $magicsig = Magicsig::getKV('user_id', $user->id);
- if (!$magicsig instanceof Magicsig) {
- $magicsig = Magicsig::generate($user);
- }
- assert($magicsig instanceof Magicsig);
- assert($magicsig->privateKey instanceof Crypt_RSA);
- $magic_env = new MagicEnvelope();
- $magic_env->signMessage($text, 'application/atom+xml', $magicsig);
- return $magic_env;
- }
- }
|