feat(ocm): align RFC 9421 http-sig with updated OCM spec

Implements the changes from cs3org/OCM-API#391 and closes the
remaining gaps with the HTTP Message Signatures section:

- discover peer JWK Sets via the new `jwksUri` discovery field
  instead of the fixed /.well-known/jwks.json path; advertise
  our own jwksUri and require it (https) from peers advertising
  the `http-sig` capability
- stop covering the Date header; freshness is anchored on the
  `created` signature parameter
- mark and select the OCM signature by its integrity-protected
  tag="ocm" parameter instead of the dictionary label
- require the JWK `alg` parameter and derive the signature
  algorithm from it, accepting fully-specified RFC 9864 names
- reject signed requests whose verification key cannot be
  resolved instead of treating them as unsigned
- derive the signer origin from the spec-canonical fqdn#id
  keyid form

Signed-off-by: Micke Nordin <kano@sunet.se>

Author: mickenordin

lib/private/OCM/Model/OCMProvider.php

@@ -26,6 +26,7 @@ class OCMProvider implements IOCMProvider {
 	private array $capabilities = [];
 	private string $endPoint = '';
 	private string $tokenEndPoint = '';
+	private string $jwksUri = '';
 	/** @var IOCMResource[] */
 	private array $resourceTypes = [];
 	private ?Signatory $signatory = null;
@@ -144,6 +145,26 @@ public function getTokenEndPoint(): string {
 		return '';
 	}
 
+	/**
+	 * @param string $jwksUri
+	 *
+	 * @return $this
+	 */
+	#[\Override]
+	public function setJwksUri(string $jwksUri): static {
+		$this->jwksUri = $jwksUri;
+
+		return $this;
+	}
+
+	/**
+	 * @return string
+	 */
+	#[\Override]
+	public function getJwksUri(): string {
+		return $this->jwksUri;
+	}
+
 	/**
 	 * @return string
 	 */
@@ -311,6 +332,9 @@ public function import(array $data): static {
 		if (isset($data['tokenEndPoint'])) {
 			$this->setTokenEndPoint($data['tokenEndPoint']);
 		}
+		if (is_string($data['jwksUri'] ?? null)) {
+			$this->setJwksUri($data['jwksUri']);
+		}
 
 		if (!$this->looksValid()) {
 			throw new OCMProviderException('remote provider does not look valid');
@@ -357,6 +381,10 @@ public function jsonSerialize(): array {
 		if ($inviteAcceptDialog !== '') {
 			$response['inviteAcceptDialog'] = $inviteAcceptDialog;
 		}
+		$jwksUri = $this->getJwksUri();
+		if ($jwksUri !== '') {
+			$response['jwksUri'] = $jwksUri;
+		}
 		return $response;
 	}
 }

lib/private/OCM/OCMDiscoveryService.php

@@ -209,7 +209,14 @@ public function getLocalOCMProvider(bool $fullDetails = true): IOCMProvider {
 		$provider->setCapabilities(['notifications', 'shares', 'exchange-token']);
 		$provider->setTokenEndPoint($tokenUrl);
 		if ($signingEnabled) {
-			$provider->setCapabilities(['http-sig']);
+			try {
+				// advertising `http-sig` requires publishing the location of
+				// the local JWK Set in `jwksUri` (and it must be https)
+				$provider->setJwksUri($this->signatoryManager->getLocalJwksUri());
+				$provider->setCapabilities(['http-sig']);
+			} catch (IdentityNotFoundException $e) {
+				$this->logger->warning('cannot build local jwksUri, http-sig capability not advertised', ['exception' => $e]);
+			}
 		}
 
 		$resource = $provider->createNewResourceType();

lib/private/OCM/OCMJwksHandler.php

@@ -18,7 +18,11 @@
 use Psr\Log\LoggerInterface;
 use Throwable;
 
-/** Serves `/.well-known/jwks.json` (RFC 7517) with the OCM signing keys. */
+/**
+ * Serves the local JWK Set (RFC 7517) with the OCM signing keys at
+ * `/.well-known/jwks.json`, the URL advertised to peers through the
+ * `jwksUri` field of the OCM discovery response.
+ */
 class OCMJwksHandler implements IHandler {
 	public function __construct(
 		private readonly IAppConfig $appConfig,

lib/private/OCM/OCMSignatoryManager.php

@@ -23,10 +23,12 @@
 use OCP\IConfig;
 use OCP\IURLGenerator;
 use OCP\OCM\Exceptions\OCMProviderException;
+use OCP\OCM\IOCMDiscoveryService;
 use OCP\Security\Signature\Enum\DigestAlgorithm;
 use OCP\Security\Signature\Enum\SignatoryType;
 use OCP\Security\Signature\Enum\SignatureAlgorithm;
 use OCP\Security\Signature\Exceptions\IdentityNotFoundException;
+use OCP\Security\Signature\Exceptions\SignatureException;
 use OCP\Security\Signature\ISignatureManager;
 use OCP\Security\Signature\Model\Signatory;
 use OCP\Server;
@@ -373,31 +375,54 @@ private function signatoryFromPool(int $poolId): ?Signatory {
 		return $signatory;
 	}
 
+	/**
+	 * Absolute https URL of the local JWK Set document, advertised as
+	 * `jwksUri` in the OCM discovery response. The spec mandates https and
+	 * requires the field whenever the `http-sig` capability is exposed.
+	 *
+	 * @throws IdentityNotFoundException
+	 */
+	public function getLocalJwksUri(): string {
+		return $this->buildLocalUrl('/.well-known/jwks.json');
+	}
+
 	/**
 	 * @param string $fragment URL fragment (e.g. 'signature' for cavage, 'ecdsa-p256-sha256' for the JWKS-published key)
 	 * @return string
 	 * @throws IdentityNotFoundException
 	 */
 	private function buildLocalKeyId(string $fragment): string {
+		return $this->buildLocalUrl('/ocm#' . $fragment);
+	}
+
+	/**
+	 * Prefix $path with 'https://' and the signing identity of this instance,
+	 * including a possible subfolder.
+	 *
+	 * @param string $path absolute path, starting with a slash
+	 * @return string
+	 * @throws IdentityNotFoundException
+	 */
+	private function buildLocalUrl(string $path): string {
 		if ($this->appConfig->hasKey('core', self::APPCONFIG_SIGN_IDENTITY_EXTERNAL, true)) {
 			$identity = $this->appConfig->getValueString('core', self::APPCONFIG_SIGN_IDENTITY_EXTERNAL, lazy: true);
-			return 'https://' . $identity . '/ocm#' . $fragment;
+			return 'https://' . $identity . $path;
 		}
 
 		try {
-			return $this->signatureManager->generateKeyIdFromConfig('/ocm#' . $fragment);
+			return $this->signatureManager->generateKeyIdFromConfig($path);
 		} catch (IdentityNotFoundException) {
 		}
 
 		$url = $this->urlGenerator->linkToRouteAbsolute('cloud_federation_api.requesthandlercontroller.addShare');
 		$identity = $this->signatureManager->extractIdentityFromUri($url);
 
-		// catching possible subfolder to create a keyId like 'https://hostname/subfolder/ocm#<fragment>'
-		$path = parse_url($url, PHP_URL_PATH);
-		$pos = strpos($path, '/ocm/shares');
-		$sub = ($pos) ? substr($path, 0, $pos) : '';
+		// catching possible subfolder to create a URL like 'https://hostname/subfolder/ocm#<fragment>'
+		$routePath = parse_url($url, PHP_URL_PATH);
+		$pos = strpos($routePath, '/ocm/shares');
+		$sub = ($pos) ? substr($routePath, 0, $pos) : '';
 
-		return 'https://' . $identity . $sub . '/ocm#' . $fragment;
+		return 'https://' . $identity . $sub . $path;
 	}
 
 	/**
@@ -476,10 +501,16 @@ private function readCachedJwks(string $origin): ?array {
 	}
 
 	/**
+	 * Fetch the peer's JWK Set from the URL advertised in the `jwksUri`
+	 * field of its discovery response.
+	 *
 	 * @return list<array<string, mixed>>|null
 	 */
 	private function fetchJwks(string $origin): ?array {
-		$url = 'https://' . $origin . '/.well-known/jwks.json';
+		$url = $this->resolveJwksUri($origin);
+		if ($url === null) {
+			return null;
+		}
 		$options = [
 			'timeout' => 10,
 			'connect_timeout' => 10,
@@ -508,6 +539,34 @@ private function fetchJwks(string $origin): ?array {
 		return array_values(array_filter($decoded['keys'], 'is_array'));
 	}
 
+	/**
+	 * Location of the peer's JWK Set, read from the `jwksUri` field of its
+	 * discovery response. A peer that advertises `http-sig` without a https
+	 * `jwksUri` is non-conformant: no keys can be obtained from it, so its
+	 * signed requests will fail verification.
+	 */
+	private function resolveJwksUri(string $origin): ?string {
+		try {
+			$provider = Server::get(IOCMDiscoveryService::class)->discover($origin);
+		} catch (NotFoundExceptionInterface|ContainerExceptionInterface|OCMProviderException $e) {
+			$this->logger->warning('cannot discover remote OCM provider for JWKS', ['exception' => $e, 'origin' => $origin]);
+			return null;
+		}
+
+		$jwksUri = $provider->getJwksUri();
+		if ($jwksUri === '') {
+			if ($provider->hasCapability('http-sig')) {
+				$this->logger->warning('remote advertises http-sig but no jwksUri; non-conformant peer', ['origin' => $origin]);
+			}
+			return null;
+		}
+		if (!str_starts_with($jwksUri, 'https://')) {
+			$this->logger->warning('remote jwksUri does not use https, ignoring', ['origin' => $origin, 'jwksUri' => $jwksUri]);
+			return null;
+		}
+		return $jwksUri;
+	}
+
 	/**
 	 * @param list<array<string, mixed>>|null $keys
 	 */
@@ -519,8 +578,25 @@ private function findKid(?array $keys, string $keyId): ?Key {
 			if (($entry['kid'] ?? null) !== $keyId) {
 				continue;
 			}
+			// every published JWK must carry an `alg` parameter naming an
+			// acceptable asymmetric signature algorithm; keys without one
+			// are rejected as non-conformant
+			$alg = $entry['alg'] ?? null;
+			if (!is_string($alg) || $alg === '') {
+				$this->logger->warning('remote JWK carries no alg parameter', ['kid' => $keyId]);
+				return null;
+			}
 			try {
-				return JWK::parseKey($entry, Algorithm::deriveJoseAlgFromJwk($entry));
+				$native = Algorithm::normalize($alg);
+				$derived = Algorithm::deriveJoseAlgFromJwk($entry);
+				if ($derived !== null && Algorithm::normalize($derived) !== $native) {
+					$this->logger->warning('remote JWK alg does not match its key type', ['kid' => $keyId, 'alg' => $alg]);
+					return null;
+				}
+				return JWK::parseKey($entry);
+			} catch (SignatureException $e) {
+				$this->logger->warning('remote JWK alg is not acceptable', ['exception' => $e, 'kid' => $keyId, 'alg' => $alg]);
+				return null;
 			} catch (Throwable $e) {
 				$this->logger->warning('failed to parse remote JWK', ['exception' => $e, 'kid' => $keyId]);
 				return null;

lib/private/Security/Signature/Model/Rfc9421IncomingSignedRequest.php

@@ -34,28 +34,33 @@
 
 /**
  * RFC 9421 implementation of {@see IIncomingSignedRequest}. Parses the
- * inbound Signature-Input / Signature dictionaries, picks the OCM-labeled
- * entry (RFC 9421 §3.2 lets verifiers scope by policy), and rebuilds the
- * signature base per RFC 9421 §2.5. Crypto is deferred to {@see verify()},
- * which needs a {@see Key} attached via {@see setKey()}. Body integrity
- * (RFC 9530 content-digest) is checked before verify() if covered.
+ * inbound Signature-Input / Signature dictionaries, picks the single entry
+ * carrying the `tag="ocm"` signature parameter (disregarding dictionary
+ * labels, as mandated by the OCM spec), and rebuilds the signature base per
+ * RFC 9421 §2.5. Crypto is deferred to {@see verify()}, which needs a
+ * {@see Key} attached via {@see setKey()}. Body integrity (RFC 9530
+ * content-digest) is checked before verify() if covered.
  */
 class Rfc9421IncomingSignedRequest extends SignedRequest implements
 	IIncomingSignedRequest,
 	JsonSerializable {
-	/** Baseline cover for OCM. Override via `rfc9421.requiredComponents`. */
+	/**
+	 * Baseline cover for OCM. Override via `rfc9421.requiredComponents`.
+	 * The `Date` header is deliberately not part of the required set:
+	 * freshness is anchored on the `created` signature parameter.
+	 */
 	private const DEFAULT_REQUIRED_COMPONENTS = [
 		'@method',
 		'@target-uri',
 		'content-digest',
 		'content-length',
-		'date',
 	];
 
 	/** Max clock skew (seconds) for `created`. Override via `rfc9421.maxClockSkew`. */
 	private const DEFAULT_MAX_FUTURE_SKEW = 60;
 
 	private string $origin = '';
+	private string $label;
 	/** @var list<string> */
 	private array $components;
 	/** @var array<string, scalar> */
@@ -88,26 +93,42 @@ public function __construct(
 		$inputs = self::parseSignatureInput($signatureInputHeader);
 		$signatures = self::parseSignature($signatureHeader);
 
-		// OCM policy (stricter than RFC 8941 §4.2 last-wins): a duplicate
-		// `ocm` entry is ambiguous; the entire request MUST be rejected.
-		if (self::countLabel($signatureInputHeader, 'ocm') > 1
-			|| self::countLabel($signatureHeader, 'ocm') > 1) {
+		// The OCM signature is identified by its integrity-protected
+		// `tag="ocm"` parameter, disregarding dictionary labels. A message
+		// carrying more than one such signature MUST be rejected; one
+		// without any is unsigned as far as OCM is concerned.
+		$tagged = [];
+		foreach ($inputs as $label => $entry) {
+			if (($entry['params']['tag'] ?? null) === 'ocm') {
+				$tagged[] = $label;
+			}
+		}
+		if (count($tagged) > 1) {
+			throw new IncomingRequestException('multiple signatures carrying tag="ocm" in Signature-Input');
+		}
+		if ($tagged === []) {
+			throw new SignatureNotFoundException('no signature carrying tag="ocm" in Signature-Input');
+		}
+		$this->label = $tagged[0];
+
+		// A duplicated dictionary label is collapsed to its last entry by
+		// RFC 8941 §4.2 parsing; that ambiguity on the OCM entry is
+		// rejected outright.
+		if (self::countLabel($signatureInputHeader, $this->label) > 1
+			|| self::countLabel($signatureHeader, $this->label) > 1) {
 			throw new IncomingRequestException(
-				'multiple "' . 'ocm' . '" entries in signature headers'
+				'multiple "' . $this->label . '" entries in signature headers'
 			);
 		}
 
-		if (!isset($inputs['ocm'])) {
-			throw new SignatureNotFoundException('missing "' . 'ocm' . '" entry in Signature-Input');
-		}
-		if (!isset($signatures['ocm'])) {
-			throw new SignatureNotFoundException('missing "' . 'ocm' . '" entry in Signature');
+		if (!isset($signatures[$this->label])) {
+			throw new IncomingRequestException('missing "' . $this->label . '" entry in Signature');
 		}
 
-		$entry = $inputs['ocm'];
+		$entry = $inputs[$this->label];
 		$this->components = $entry['components'];
 		$this->signatureParams = $entry['params'];
-		$this->rawSignature = $signatures['ocm'];
+		$this->rawSignature = $signatures[$this->label];
 
 		$this->verifyRequiredComponents();
 		$this->verifyTimestamps();
@@ -121,9 +142,11 @@ public function __construct(
 		try {
 			$this->origin = Signatory::extractIdentityFromUri($keyId);
 		} catch (IdentityNotFoundException) {
-			// keyid may follow the OCM convention `<fqdn>#<id>`; the OCM layer
-			// derives origin from the message body in that case.
-			$this->origin = '';
+			// keyid is not a URL; the OCM convention (and the examples in
+			// the spec) use `<fqdn>[:port]#<id>`, in which case the origin
+			// is the host part before the '#'. If neither form applies the
+			// origin stays empty and getOrigin() rejects the request.
+			$this->origin = self::extractHostFromKeyId($keyId);
 		}
 
 		$paramsLine = SignatureBase::serializeSignatureParams($this->components, $this->signatureParams);
@@ -136,7 +159,7 @@ public function __construct(
 		);
 
 		$this->setSigningElements([
-			'label' => 'ocm',
+			'label' => $this->label,
 			'keyId' => $keyId,
 			'algorithm' => isset($this->signatureParams['alg']) ? (string)$this->signatureParams['alg'] : '',
 			'created' => isset($this->signatureParams['created']) ? (string)$this->signatureParams['created'] : '',
@@ -289,6 +312,22 @@ private function reconstructTargetUri(): string {
 		return $scheme . '://' . $host . $path;
 	}
 
+	/**
+	 * Derive the signer's origin from the OCM `<fqdn>[:port]#<id>` keyid
+	 * convention, e.g. `sender.example.org#key1`, by parsing the keyid as a
+	 * scheme-less authority. Returns '' when no host can be extracted.
+	 */
+	private static function extractHostFromKeyId(string $keyId): string {
+		if (!str_contains($keyId, '#')) {
+			return '';
+		}
+		try {
+			return Signatory::extractIdentityFromUri('https://' . $keyId);
+		} catch (IdentityNotFoundException) {
+			return '';
+		}
+	}
+
 	/**
 	 * Collect the HTTP request fields covered by the signature, keyed by their
 	 * lowercased name. Derived components (`@*`) are produced inside
@@ -320,7 +359,7 @@ public function jsonSerialize(): array {
 			parent::jsonSerialize(),
 			[
 				'origin' => $this->origin,
-				'label' => 'ocm',
+				'label' => $this->label,
 				'components' => $this->components,
 				'signatureParams' => $this->signatureParams,
 				'signatureBase' => $this->signatureBaseString,