From e99b9a0442ca53f41c1337af02c98784afa5c1ce Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Nov 18 2016 09:50:49 +0000 Subject: [PATCH 1/3] Add SHA256 signature to webhooks Signed-off-by: Patrick Uiterwijk --- diff --git a/doc/usage/using_webhooks.rst b/doc/usage/using_webhooks.rst index f5127ec..34469c2 100644 --- a/doc/usage/using_webhooks.rst +++ b/doc/usage/using_webhooks.rst @@ -18,6 +18,7 @@ Each POST request made contains two specific headers: X-Pagure-Topic X-Pagure-Signature + X-Pagure-Signature-256 ``X-Pagure-Topic`` is a global header giving a clue about the type of action @@ -27,6 +28,9 @@ that just occurred. For example ``issue.edit``. ``X-Pagure-Signature`` contains the signature of the message allowing to check that the message comes from pagure. +``X-Pagure-Signature-256`` contains the SHA-256 signature of the message +allowing to check that the message comes from pagure. + .. warning:: These headers are present for convenience only, they are not signed and therefore should not be trusted. Rely on the payload after checking the signature to make any decision. diff --git a/webhook-server/pagure-webhook-server.py b/webhook-server/pagure-webhook-server.py index 8697e0d..0be6126 100644 --- a/webhook-server/pagure-webhook-server.py +++ b/webhook-server/pagure-webhook-server.py @@ -71,9 +71,12 @@ def call_web_hooks(project, topic, msg): content = json.dumps(msg) hashhex = hmac.new( str(project.hook_token), content, hashlib.sha1).hexdigest() + hashhex256 = hmac.new( + str(project.hook_token), content, hashlib.sha256).hexdigest() headers = { 'X-Pagure-Topic': topic, - 'X-Pagure-Signature': hashhex + 'X-Pagure-Signature': hashhex, + 'X-Pagure-Signature-256': hashhex256 } msg = json.dumps(msg) for url in project.settings.get('Web-hooks').split('\n'): From 124d8f3c812b3ff5575f686c65fb2af0e5ebd466 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Nov 18 2016 09:50:49 +0000 Subject: [PATCH 2/3] Update documentation to indicate only the X-Pagure-Topic header is unsigned Signed-off-by: Patrick Uiterwijk --- diff --git a/doc/usage/using_webhooks.rst b/doc/usage/using_webhooks.rst index 34469c2..2c1b8ec 100644 --- a/doc/usage/using_webhooks.rst +++ b/doc/usage/using_webhooks.rst @@ -24,6 +24,10 @@ Each POST request made contains two specific headers: ``X-Pagure-Topic`` is a global header giving a clue about the type of action that just occurred. For example ``issue.edit``. +.. warning:: This header is present for convenience only, it is not + signed and therefore should not be trusted. Rely on the payload + after checking the signature to make any decision. + ``X-Pagure-Signature`` contains the signature of the message allowing to check that the message comes from pagure. @@ -31,10 +35,6 @@ check that the message comes from pagure. ``X-Pagure-Signature-256`` contains the SHA-256 signature of the message allowing to check that the message comes from pagure. -.. warning:: These headers are present for convenience only, they are not - signed and therefore should not be trusted. Rely on the payload - after checking the signature to make any decision. - Pagure relies on ``hmac`` to sign the content of its messages. If you want to validate the message, in python, you can do something like the following: From 2130593365ccfe09ecdc61e80b7e5705e9338b77 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Nov 18 2016 09:50:49 +0000 Subject: [PATCH 3/3] Document the obvious about signatures Signed-off-by: Patrick Uiterwijk --- diff --git a/doc/usage/using_webhooks.rst b/doc/usage/using_webhooks.rst index 2c1b8ec..f138a40 100644 --- a/doc/usage/using_webhooks.rst +++ b/doc/usage/using_webhooks.rst @@ -35,6 +35,10 @@ check that the message comes from pagure. ``X-Pagure-Signature-256`` contains the SHA-256 signature of the message allowing to check that the message comes from pagure. +.. note:: These headers are present to allow you to verify that the webhook + was actually sent by the correct Pagure instance. These are not + included in the signed data. + Pagure relies on ``hmac`` to sign the content of its messages. If you want to validate the message, in python, you can do something like the following: