commit be894b3

Added an new keyId check.

 1@@ -2686,14 +2686,22 @@ int process_input_message(snac *snac, const xs_dict *msg, const xs_dict *req)
 2 
 3     /* check the signature */
 4     xs *sig_err = NULL;
 5+    xs *key_id = NULL;
 6 
 7-    if (!check_signature(req, &sig_err)) {
 8+    if (!check_signature(req, &sig_err, &key_id)) {
 9         srv_log(xs_fmt("bad signature %s (%s)", actor, sig_err));
10 
11         srv_archive_error("check_signature", sig_err, req, msg);
12         return -1;
13     }
14 
15+    if (strcmp(actor, key_id) != 0) {
16+        srv_log(xs_fmt("mismatched actor '%s' and key '%s'", actor, key_id));
17+
18+        srv_archive_error("mismatched_actor_and_key", "bad keyId", req, msg);
19+        return -1;
20+    }
21+
22     /* if no user is set, no further checks can be done; propagate */
23     if (snac == NULL)
24         return 2;

 1@@ -123,7 +123,7 @@ xs_dict *http_signed_request(snac *snac, const char *method, const char *url,
 2 }
 3 
 4 
 5-int check_signature(const xs_dict *req, xs_str **err)
 6+int check_signature(const xs_dict *req, xs_str **err, xs_str **key_id)
 7 /* check the signature */
 8 {
 9     const char *sig_hdr = xs_dict_get(req, "signature");
10@@ -182,6 +182,9 @@ int check_signature(const xs_dict *req, xs_str **err)
11     if ((p = strchr(keyId, '#')) != NULL)
12         *p = '\0';
13 
14+    /* copy the keyId */
15+    *key_id = xs_dup(keyId);
16+
17     xs *actor = NULL;
18     int status;
19 

1@@ -348,7 +348,7 @@ xs_dict *http_signed_request(snac *snac, const char *method, const char *url,
2                             const char *body, int b_size,
3                             int *status, xs_str **payload, int *p_size,
4                             int timeout);
5-int check_signature(const xs_dict *req, xs_str **err);
6+int check_signature(const xs_dict *req, xs_str **err, xs_str **key_id);
7 
8 srv_state *srv_state_op(xs_str **fname, int op);
9 void httpd(void);