Integrate FASP signature handling with existing system.

pfefferle · pfefferle · commit 396e265aaec0 · 2026-01-20T18:36:28.000+01:00
- Add `activitypub_pre_get_public_key` filter to Remote_Actors::get_public_key()
  allowing custom key resolution for non-URL keyIds (like FASP serverIds)

- Add Ed25519 signature verification using WordPress's sodium_compat:
  - Http_Message_Signature now handles Ed25519 keys via sodium_crypto_sign_verify_detached()
  - Ed25519 keys are passed as arrays: ['type' =&gt; 'ed25519', 'key' =&gt; $raw_bytes]

- FASP integration:
  - Fasp::init() registers filter to provide Ed25519 public keys for serverId lookups
  - Fasp::get_registration_by_server_id() added for server_id based lookups
  - FASP now uses the same signature verification code path as ActivityPub

- Reuse Application actor's RSA keypair for signing FASP responses (already in place)
diff --git a/includes/class-fasp.php b/includes/class-fasp.php
@@ -19,7 +19,88 @@ class Fasp {
 	 * Initialize the class, registering WordPress hooks.
 	 */
 	public static function init() {
-		// No hooks needed currently.
+		\add_filter( 'activitypub_pre_get_public_key', array( __CLASS__, 'get_public_key_for_server_id' ), 10, 2 );
+	}
+
+	/**
+	 * Provide public key for FASP serverId lookups.
+	 *
+	 * This filter integrates FASP signature verification with the existing
+	 * ActivityPub signature system. When a signature's keyId matches a
+	 * registered FASP's serverId, we return the stored public key.
+	 *
+	 * FASP uses Ed25519 keys, so we return an array with type information
+	 * that the signature verification system can use.
+	 *
+	 * @param resource|string|array|\WP_Error|null $public_key The current public key (null to continue lookup).
+	 * @param string                               $key_id     The key ID from the signature.
+	 * @return resource|string|array|\WP_Error|null The public key or null to continue default lookup.
+	 */
+	public static function get_public_key_for_server_id( $public_key, $key_id ) {
+		// If another filter already provided a key, don't override.
+		if ( null !== $public_key ) {
+			return $public_key;
+		}
+
+		// Try to find a FASP registration matching this serverId.
+		$registration = self::get_registration_by_server_id( $key_id );
+
+		if ( ! $registration ) {
+			return null; // Not a FASP serverId, continue with default lookup.
+		}
+
+		// Check if FASP is approved.
+		if ( 'approved' !== $registration['status'] ) {
+			return new \WP_Error(
+				'fasp_not_approved',
+				'FASP registration is not approved',
+				array( 'status' => 403 )
+			);
+		}
+
+		// Return the stored public key.
+		if ( empty( $registration['fasp_public_key'] ) ) {
+			return new \WP_Error(
+				'fasp_no_public_key',
+				'FASP registration does not have a public key',
+				array( 'status' => 401 )
+			);
+		}
+
+		// FASP uses Ed25519 keys stored as base64.
+		// Decode and return as Ed25519 key array for signature verification.
+		$raw_key = base64_decode( $registration['fasp_public_key'] ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
+
+		if ( false === $raw_key ) {
+			return new \WP_Error(
+				'fasp_invalid_key',
+				'FASP public key is not valid base64',
+				array( 'status' => 401 )
+			);
+		}
+
+		return array(
+			'type' => 'ed25519',
+			'key'  => $raw_key,
+		);
+	}
+
+	/**
+	 * Get registration by server ID.
+	 *
+	 * @param string $server_id The server ID from the FASP.
+	 * @return array|null Registration data or null if not found.
+	 */
+	public static function get_registration_by_server_id( $server_id ) {
+		$registrations = self::get_registrations_store();
+
+		foreach ( $registrations as $registration ) {
+			if ( isset( $registration['server_id'] ) && $registration['server_id'] === $server_id ) {
+				return $registration;
+			}
+		}
+
+		return null;
 	}
 
 
diff --git a/includes/collection/class-remote-actors.php b/includes/collection/class-remote-actors.php
@@ -633,11 +633,47 @@ public static function normalize_identifier( $actor ) {
 	/**
 	 * Get public key from key_id.
 	 *
-	 * @param string $key_id The URL to the public key.
+	 * @param string $key_id The key ID (typically a URL to the public key, but can be any identifier).
 	 *
-	 * @return resource|\WP_Error The public key resource or WP_Error.
+	 * @return resource|array|\WP_Error The public key resource, Ed25519 key array, or WP_Error.
 	 */
 	public static function get_public_key( $key_id ) {
+		/**
+		 * Filter to allow custom public key resolution for non-URL key IDs.
+		 *
+		 * This filter allows other protocols (like FASP) to provide public keys
+		 * for key IDs that are not ActivityPub actor URLs.
+		 *
+		 * Return formats:
+		 * - OpenSSL resource: Standard RSA/EC key
+		 * - PEM string: Will be converted to OpenSSL resource
+		 * - Array with 'type' => 'ed25519' and 'key' => raw bytes: Ed25519 key
+		 * - WP_Error: Return error to caller
+		 * - null: Continue with default ActivityPub lookup
+		 *
+		 * @param resource|string|array|\WP_Error|null $public_key The public key.
+		 * @param string                               $key_id     The key ID from the signature.
+		 */
+		$public_key = \apply_filters( 'activitypub_pre_get_public_key', null, $key_id );
+
+		if ( null !== $public_key ) {
+			// If filter returned an Ed25519 key array, pass it through.
+			if ( \is_array( $public_key ) && isset( $public_key['type'] ) && 'ed25519' === $public_key['type'] ) {
+				return $public_key;
+			}
+
+			// If filter returned a PEM string, convert to resource.
+			if ( \is_string( $public_key ) && ! \is_wp_error( $public_key ) ) {
+				$key_resource = \openssl_pkey_get_public( \rtrim( $public_key ) );
+				if ( $key_resource ) {
+					return $key_resource;
+				}
+				return new \WP_Error( 'activitypub_invalid_key', 'Invalid public key format', array( 'status' => 401 ) );
+			}
+
+			return $public_key;
+		}
+
 		$actor = self::get_by_uri( \strip_fragment_from_url( $key_id ) );
 
 		if ( \is_wp_error( $actor ) ) {
diff --git a/includes/rest/class-fasp-controller.php b/includes/rest/class-fasp-controller.php
@@ -509,7 +509,7 @@ private function extract_keyid_from_request( $headers ) {
 	}
 
 	/**
-	 * Look up FASP registration by keyId.
+	 * Look up FASP registration by keyId (serverId).
 	 *
 	 * Per FASP spec, the keyId MUST be the identifier exchanged during registration (serverId).
 	 *
@@ -519,20 +519,17 @@ private function extract_keyid_from_request( $headers ) {
 	 * @return array|\WP_Error FASP data or error.
 	 */
 	private function get_fasp_by_keyid( $keyid ) {
-		$registrations = $this->get_registration_records();
+		$registration = Fasp::get_registration_by_server_id( $keyid );
 
-		// Match by server_id (the identifier exchanged during registration).
-		foreach ( $registrations as $registration ) {
-			if ( $keyid === $registration['server_id'] ) {
-				return $registration;
-			}
+		if ( ! $registration ) {
+			return new \WP_Error(
+				'fasp_not_found',
+				'FASP not found for provided keyId',
+				array( 'status' => 404 )
+			);
 		}
 
-		return new \WP_Error(
-			'fasp_not_found',
-			'FASP not found for provided keyId',
-			array( 'status' => 404 )
-		);
+		return $registration;
 	}
 
 	/**
diff --git a/includes/signature/class-http-message-signature.php b/includes/signature/class-http-message-signature.php
@@ -277,12 +277,6 @@ private function verify_signature_label( $data, $headers, $body ) {
 			return $public_key;
 		}
 
-		// Algorithm verification.
-		$algorithm = $this->verify_algorithm( $params['alg'] ?? '', $public_key );
-		if ( \is_wp_error( $algorithm ) ) {
-			return $algorithm;
-		}
-
 		// Digest verification.
 		$result = $this->verify_content_digest( $headers, $body );
 		if ( \is_wp_error( $result ) ) {
@@ -292,6 +286,17 @@ private function verify_signature_label( $data, $headers, $body ) {
 		$components     = $this->get_component_values( $data['components'], $headers );
 		$signature_base = $this->get_signature_base_string( $components, $params );
 
+		// Handle Ed25519 keys (e.g., from FASP).
+		if ( \is_array( $public_key ) && isset( $public_key['type'] ) && 'ed25519' === $public_key['type'] ) {
+			return $this->verify_ed25519_signature( $signature_base, $data['signature'], $public_key['key'] );
+		}
+
+		// Standard OpenSSL verification for RSA/EC keys.
+		$algorithm = $this->verify_algorithm( $params['alg'] ?? '', $public_key );
+		if ( \is_wp_error( $algorithm ) ) {
+			return $algorithm;
+		}
+
 		$verified = \openssl_verify( $signature_base, $data['signature'], $public_key, $algorithm ) > 0;
 		if ( ! $verified ) {
 			return new \WP_Error( 'activitypub_signature', 'Invalid signature' );
@@ -300,6 +305,45 @@ private function verify_signature_label( $data, $headers, $body ) {
 		return true;
 	}
 
+	/**
+	 * Verify an Ed25519 signature using WordPress's sodium_compat.
+	 *
+	 * @param string $message   The message that was signed.
+	 * @param string $signature The signature to verify.
+	 * @param string $public_key The Ed25519 public key (32 bytes).
+	 * @return bool|\WP_Error True if valid, WP_Error on failure.
+	 */
+	private function verify_ed25519_signature( $message, $signature, $public_key ) {
+		// Ed25519 signatures are 64 bytes.
+		if ( \strlen( $signature ) !== SODIUM_CRYPTO_SIGN_BYTES ) {
+			return new \WP_Error(
+				'invalid_signature_length',
+				\sprintf( 'Invalid Ed25519 signature length: expected %d bytes, got %d', SODIUM_CRYPTO_SIGN_BYTES, \strlen( $signature ) )
+			);
+		}
+
+		// Ed25519 public keys are 32 bytes.
+		if ( \strlen( $public_key ) !== SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES ) {
+			return new \WP_Error(
+				'invalid_key_length',
+				\sprintf( 'Invalid Ed25519 public key length: expected %d bytes, got %d', SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES, \strlen( $public_key ) )
+			);
+		}
+
+		try {
+			// Use WordPress's sodium_compat for Ed25519 verification.
+			$verified = \sodium_crypto_sign_verify_detached( $signature, $message, $public_key );
+		} catch ( \Exception $e ) {
+			return new \WP_Error( 'ed25519_verification_failed', 'Ed25519 signature verification failed: ' . $e->getMessage() );
+		}
+
+		if ( ! $verified ) {
+			return new \WP_Error( 'activitypub_signature', 'Invalid Ed25519 signature' );
+		}
+
+		return true;
+	}
+
 	/**
 	 * Verify the Content-Digest header against the request body.
 	 *
