Added an new keyId check.

activitypub.c

@@ -2686,14 +2686,22 @@ int process_input_message(snac *snac, const xs_dict *msg, const xs_dict *req)
 
     /* check the signature */
     xs *sig_err = NULL;
+    xs *key_id = NULL;
 
-    if (!check_signature(req, &sig_err)) {
+    if (!check_signature(req, &sig_err, &key_id)) {
         srv_log(xs_fmt("bad signature %s (%s)", actor, sig_err));
 
         srv_archive_error("check_signature", sig_err, req, msg);
         return -1;
     }
 
+    if (strcmp(actor, key_id) != 0) {
+        srv_log(xs_fmt("mismatched actor '%s' and key '%s'", actor, key_id));
+
+        srv_archive_error("mismatched_actor_and_key", "bad keyId", req, msg);
+        return -1;
+    }
+
     /* if no user is set, no further checks can be done; propagate */
     if (snac == NULL)
         return 2;

http.c

@@ -123,7 +123,7 @@ xs_dict *http_signed_request(snac *snac, const char *method, const char *url,
 }
 
 
-int check_signature(const xs_dict *req, xs_str **err)
+int check_signature(const xs_dict *req, xs_str **err, xs_str **key_id)
 /* check the signature */
 {
     const char *sig_hdr = xs_dict_get(req, "signature");
@@ -182,6 +182,9 @@ int check_signature(const xs_dict *req, xs_str **err)
     if ((p = strchr(keyId, '#')) != NULL)
         *p = '\0';
 
+    /* copy the keyId */
+    *key_id = xs_dup(keyId);
+
     xs *actor = NULL;
     int status;
 

snac.h

@@ -348,7 +348,7 @@ xs_dict *http_signed_request(snac *snac, const char *method, const char *url,
                             const char *body, int b_size,
                             int *status, xs_str **payload, int *p_size,
                             int timeout);
-int check_signature(const xs_dict *req, xs_str **err);
+int check_signature(const xs_dict *req, xs_str **err, xs_str **key_id);
 
 srv_state *srv_state_op(xs_str **fname, int op);
 void httpd(void);