SocialPub/PrivaPub/Federation/Signing/MessageSignatures.cs

using Microsoft.AspNetCore.Http.Features;

using System.Globalization;
using System.Security.Cryptography;
using System.Text;

namespace PrivaPub.Federation.Signing
{
	// One signature of RFC 9421 (HTTP Message Signatures): its label, the components it covers, its parameters as they were
	// sent (the base ends with them, byte for byte) and the signature itself.
	public sealed record MessageSignature(string Label, string KeyId, string Algorithm, string[] Components, string Parameters,
		byte[] Signature, long? Created, long? Expires);

	// RFC 9421, as WordPress's ActivityPub plugin, Ghost and Fedify sign: Signature-Input names what is covered, Signature
	// carries it, and Content-Digest (RFC 9530) the body. Verified with the key of the actor that keyid names, RSA with
	// PKCS#1 v1.5 or PSS; a server that tries it first and falls back to draft-cavage (the "double knock") needs only one
	// request once this answers. The target is our own public address, as the sender addressed it.
	public static class MessageSignatures
	{
		public static bool Present(HttpRequest request) => request.Headers.ContainsKey("Signature-Input");

		public static MessageSignature Parse(string signatureInput, string signature)
		{
			if (string.IsNullOrWhiteSpace(signatureInput) || string.IsNullOrWhiteSpace(signature))
				return default;
			var signatures = Members(signature);
			foreach (var (label, value) in Members(signatureInput))
			{
				if (!signatures.TryGetValue(label, out var bytes) || !value.StartsWith('('))
					continue;
				var close = value.IndexOf(')');
				if (close < 0)
					continue;
				var components = value[1..close].Split(' ', StringSplitOptions.RemoveEmptyEntries).Select(c => c.Trim('"').ToLowerInvariant()).ToArray();
				var parameters = Parameters(value[(close + 1)..]);
				if (!parameters.TryGetValue("keyid", out var keyId) || bytes.Length < 2 || bytes[0] != ':' || bytes[^1] != ':')
					continue;
				byte[] decoded;
				try
				{
					decoded = Convert.FromBase64String(bytes[1..^1]);
				}
				catch (FormatException)
				{
					continue;
				}
				return new MessageSignature(label, keyId, parameters.GetValueOrDefault("alg"), components, value, decoded,
					Number(parameters.GetValueOrDefault("created")), Number(parameters.GetValueOrDefault("expires")));
			}
			return default;
		}

		// the signature base (RFC 9421 §2.5), or null when a covered component is missing from the request
		public static string Base(HttpRequest request, MessageSignature signature, string baseAddress)
		{
			var lines = new List<string>();
			var target = RequestTarget(request);
			var origin = new Uri(baseAddress);
			foreach (var component in signature.Components)
			{
				var value = component switch
				{
					"@method" => request.Method.ToUpperInvariant(),
					"@target-uri" => origin.GetLeftPart(UriPartial.Authority) + target,
					"@authority" => origin.IsDefaultPort ? origin.Host.ToLowerInvariant() : origin.Authority.ToLowerInvariant(),
					"@scheme" => origin.Scheme,
					"@request-target" => target,
					"@path" => target.Split('?')[0],
					"@query" => target.Contains('?') ? target[target.IndexOf('?')..] : "?",
					_ when component.StartsWith('@') => default,
					_ => request.Headers.TryGetValue(component, out var header) ? string.Join(", ", header.Select(v => v.Trim())) : default
				};
				if (value == default)
					return default;
				lines.Add($"\"{component}\": {value}");
			}
			lines.Add($"\"@signature-params\": {signature.Parameters}");
			return string.Join("\n", lines);
		}

		public static string CheckRequest(HttpRequest request, MessageSignature signature, byte[] body) =>
			CheckRequest(request, signature, body, DateTimeOffset.UtcNow);

		public static string CheckRequest(HttpRequest request, MessageSignature signature, byte[] body, DateTimeOffset now)
		{
			if (signature.Algorithm is not (null or "rsa-v1_5-sha256" or "rsa-pss-sha512"))
				return $"unsupported signature algorithm '{signature.Algorithm}'";
			if (!signature.Components.Contains("@method"))
				return "@method is not signed";
			if (!signature.Components.Contains("@target-uri") && !(signature.Components.Contains("@path") && signature.Components.Contains("@authority")))
				return "the target is not signed";
			if (body is { Length: > 0 })
			{
				if (!signature.Components.Contains("content-digest"))
					return "the digest is not signed";
				if (!DigestMatches(request.Headers["Content-Digest"].ToString(), body))
					return "the digest does not match the body";
			}
			if (signature.Created is not { } created)
				return "neither date nor (created) is signed";
			var signedAt = DateTimeOffset.FromUnixTimeSeconds(created);
			if (signedAt < now - HttpSignatures.MaxAge || signedAt > now + HttpSignatures.MaxClockSkew)
				return "(created) is outside the allowed window";
			if (signature.Expires is { } expires && DateTimeOffset.FromUnixTimeSeconds(expires) < now - HttpSignatures.MaxClockSkew)
				return "the signature has expired";
			return default;
		}

		public static bool Verify(string publicKeyPem, MessageSignature signature, string signatureBase)
		{
			if (string.IsNullOrEmpty(publicKeyPem) || signatureBase == null)
				return false;
			try
			{
				using var rsa = RSA.Create();
				rsa.ImportFromPem(publicKeyPem);
				var data = Encoding.UTF8.GetBytes(signatureBase);
				return signature.Algorithm == "rsa-pss-sha512"
					? rsa.VerifyData(data, signature.Signature, HashAlgorithmName.SHA512, RSASignaturePadding.Pss)
					: rsa.VerifyData(data, signature.Signature, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
			}
			catch (Exception ex) when (ex is CryptographicException or ArgumentException)
			{
				return false;
			}
		}

		// signs a request as WordPress does (rsa-v1_5-sha256 over the method, the target and the body's digest)
		public static void Sign(HttpRequestMessage request, string keyId, string privateKeyPem, byte[] body, DateTimeOffset? at = default)
		{
			var components = new List<string> { "@method", "@target-uri" };
			var values = new List<string> { request.Method.Method.ToUpperInvariant(), request.RequestUri!.AbsoluteUri };
			if (body != null)
			{
				var digest = $"sha-256=:{Convert.ToBase64String(SHA256.HashData(body))}:";
				request.Content!.Headers.TryAddWithoutValidation("Content-Digest", digest);
				components.Add("content-digest");
				values.Add(digest);
			}
			var parameters = $"({string.Join(' ', components.Select(c => $"\"{c}\""))});created={(at ?? DateTimeOffset.UtcNow).ToUnixTimeSeconds()};keyid=\"{keyId}\";alg=\"rsa-v1_5-sha256\"";
			var signatureBase = string.Join("\n", components.Zip(values, (c, v) => $"\"{c}\": {v}").Append($"\"@signature-params\": {parameters}"));
			using var rsa = RSA.Create();
			rsa.ImportFromPem(privateKeyPem);
			var signed = rsa.SignData(Encoding.UTF8.GetBytes(signatureBase), HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
			request.Headers.TryAddWithoutValidation("Signature-Input", $"sig1={parameters}");
			request.Headers.TryAddWithoutValidation("Signature", $"sig1=:{Convert.ToBase64String(signed)}:");
		}

		static bool DigestMatches(string header, byte[] body)
		{
			foreach (var (algorithm, value) in Members(header))
			{
				if (value.Length < 2 || value[0] != ':' || value[^1] != ':')
					continue;
				var expected = algorithm.ToLowerInvariant() switch
				{
					"sha-256" => Convert.ToBase64String(SHA256.HashData(body)),
					"sha-512" => Convert.ToBase64String(SHA512.HashData(body)),
					_ => default
				};
				if (expected != default && expected == value[1..^1])
					return true;
			}
			return false;
		}

		// a structured-field dictionary's members, their values as written (RFC 8941; commas inside strings and inner lists
		// do not separate members)
		static Dictionary<string, string> Members(string field)
		{
			var members = new Dictionary<string, string>(StringComparer.Ordinal);
			var depth = 0;
			var quoted = false;
			var start = 0;
			for (var i = 0; i <= field.Length; i++)
			{
				var c = i < field.Length ? field[i] : ',';
				if (c == '"' && (i == 0 || field[i - 1] != '\\'))
					quoted = !quoted;
				else if (!quoted && c == '(')
					depth++;
				else if (!quoted && c == ')')
					depth--;
				if (c != ',' || quoted || depth > 0)
					continue;
				var member = field[start..i].Trim();
				start = i + 1;
				var equals = member.IndexOf('=');
				if (equals > 0)
					members.TryAdd(member[..equals].Trim(), member[(equals + 1)..].Trim());
			}
			return members;
		}

		static Dictionary<string, string> Parameters(string text)
		{
			var parameters = new Dictionary<string, string>(StringComparer.Ordinal);
			foreach (var part in text.Split(';', StringSplitOptions.RemoveEmptyEntries))
			{
				var equals = part.IndexOf('=');
				if (equals > 0)
					parameters[part[..equals].Trim()] = part[(equals + 1)..].Trim().Trim('"');
			}
			return parameters;
		}

		static long? Number(string value) =>
			long.TryParse(value, NumberStyles.Integer, CultureInfo.InvariantCulture, out var number) ? number : null;

		static string RequestTarget(HttpRequest request)
		{
			var raw = request.HttpContext.Features.Get<IHttpRequestFeature>()?.RawTarget;
			return string.IsNullOrEmpty(raw) || raw[0] != '/' ? $"{request.PathBase}{request.Path}{request.QueryString}" : raw;
		}
	}
}