gotosocial/internal/middleware/signaturecheck.go

// GoToSocial
// Copyright (C) GoToSocial Authors admin@gotosocial.org
// SPDX-License-Identifier: AGPL-3.0-or-later
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program.  If not, see <http://www.gnu.org/licenses/>.

package middleware

import (
	"context"
	"net/http"
	"net/url"

	"github.com/superseriousbusiness/gotosocial/internal/db"
	"github.com/superseriousbusiness/gotosocial/internal/gtscontext"
	"github.com/superseriousbusiness/gotosocial/internal/log"

	"github.com/gin-gonic/gin"
	"github.com/go-fed/httpsig"
)

const (
	sigHeader  = string(httpsig.Signature)
	authHeader = string(httpsig.Authorization)
	// untyped error returned by httpsig when no signature is present
	noSigError = "neither \"" + sigHeader + "\" nor \"" + authHeader + "\" have signature parameters"
)

// SignatureCheck returns a gin middleware for checking http signatures.
//
// The middleware first checks whether an incoming http request has been
// http-signed with a well-formed signature. If so, it will check if the
// domain that signed the request is permitted to access the server, using
// the provided uriBlocked function. If the domain is blocked, the middleware
// will abort the request chain with http code 403 forbidden. If it is not
// blocked, the handler will set the key verifier and the signature in the
// context for use down the line.
//
// In case of an error, the request will be aborted with http code 500.
func SignatureCheck(uriBlocked func(context.Context, *url.URL) (bool, db.Error)) func(*gin.Context) {
	return func(c *gin.Context) {
		ctx := c.Request.Context()

		// Create the signature verifier from the request;
		// this will error if the request wasn't signed.
		verifier, err := httpsig.NewVerifier(c.Request)
		if err != nil {
			// Only actually *abort* the request with 401
			// if a signature was present but malformed.
			// Otherwise proceed with an unsigned request;
			// it's up to other functions to reject this.
			if err.Error() != noSigError {
				log.Debugf(ctx, "http signature was present but invalid: %s", err)
				c.AbortWithStatus(http.StatusUnauthorized)
			}

			return
		}

		// The request was signed! The key ID should be given
		// in the signature so that we know where to fetch it
		// from the remote server. This will be something like:
		// https://example.org/users/some_remote_user#main-key
		pubKeyIDStr := verifier.KeyId()

		// Key can sometimes be nil, according to url parse
		// func: 'Trying to parse a hostname and path without
		// a scheme is invalid but may not necessarily return
		// an error, due to parsing ambiguities'. Catch this.
		pubKeyID, err := url.Parse(pubKeyIDStr)
		if err != nil || pubKeyID == nil {
			log.Warnf(ctx, "pubkey id %s could not be parsed as a url", pubKeyIDStr)
			c.AbortWithStatus(http.StatusUnauthorized)
			return
		}

		// If the domain is blocked we want to bail as fast as
		// possible without the request proceeding further.
		blocked, err := uriBlocked(ctx, pubKeyID)
		if err != nil {
			log.Errorf(ctx, "error checking block for domain %s: %s", pubKeyID.Host, err)
			c.AbortWithStatus(http.StatusInternalServerError)
			return
		}

		if blocked {
			log.Infof(ctx, "domain %s is blocked", pubKeyID.Host)
			c.AbortWithStatus(http.StatusForbidden)
			return
		}

		// Assume signature was set on Signature header,
		// but fall back to Authorization header if necessary.
		signature := c.GetHeader(sigHeader)
		if signature == "" {
			signature = c.GetHeader(authHeader)
		}

		// Set relevant values on the request context
		// to save some work further down the line.
		ctx = gtscontext.SetHTTPSignatureVerifier(ctx, verifier)
		ctx = gtscontext.SetHTTPSignature(ctx, signature)
		ctx = gtscontext.SetHTTPSignaturePubKeyID(ctx, pubKeyID)

		// Replace request with a shallow
		// copy with the new context.
		c.Request = c.Request.WithContext(ctx)
	}
}