From be894b379e72126a28c1aeaa79d4c5eab787638a Mon Sep 17 00:00:00 2001
From: grunfink <grunfink@comam.es>
Date: Wed, 24 Jun 2026 08:45:27 +0200
Subject: Added an new keyId check.

---
 activitypub.c | 10 +++++++++-
 http.c        |  5 ++++-
 snac.h        |  2 +-
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/activitypub.c b/activitypub.c
index 1357b6e..845d92f 100644
--- a/activitypub.c
+++ b/activitypub.c
@@ -2686,14 +2686,22 @@ int process_input_message(snac *snac, const xs_dict *msg, const xs_dict *req)
 
     /* check the signature */
     xs *sig_err = NULL;
+    xs *key_id = NULL;
 
-    if (!check_signature(req, &sig_err)) {
+    if (!check_signature(req, &sig_err, &key_id)) {
         srv_log(xs_fmt("bad signature %s (%s)", actor, sig_err));
 
         srv_archive_error("check_signature", sig_err, req, msg);
         return -1;
     }
 
+    if (strcmp(actor, key_id) != 0) {
+        srv_log(xs_fmt("mismatched actor '%s' and key '%s'", actor, key_id));
+
+        srv_archive_error("mismatched_actor_and_key", "bad keyId", req, msg);
+        return -1;
+    }
+
     /* if no user is set, no further checks can be done; propagate */
     if (snac == NULL)
         return 2;
diff --git a/http.c b/http.c
index 125d346..95cc489 100644
--- a/http.c
+++ b/http.c
@@ -123,7 +123,7 @@ xs_dict *http_signed_request(snac *snac, const char *method, const char *url,
 }
 
 
-int check_signature(const xs_dict *req, xs_str **err)
+int check_signature(const xs_dict *req, xs_str **err, xs_str **key_id)
 /* check the signature */
 {
     const char *sig_hdr = xs_dict_get(req, "signature");
@@ -182,6 +182,9 @@ int check_signature(const xs_dict *req, xs_str **err)
     if ((p = strchr(keyId, '#')) != NULL)
         *p = '\0';
 
+    /* copy the keyId */
+    *key_id = xs_dup(keyId);
+
     xs *actor = NULL;
     int status;
 
diff --git a/snac.h b/snac.h
index f1fadad..b61cc6c 100644
--- a/snac.h
+++ b/snac.h
@@ -348,7 +348,7 @@ xs_dict *http_signed_request(snac *snac, const char *method, const char *url,
                             const char *body, int b_size,
                             int *status, xs_str **payload, int *p_size,
                             int timeout);
-int check_signature(const xs_dict *req, xs_str **err);
+int check_signature(const xs_dict *req, xs_str **err, xs_str **key_id);
 
 srv_state *srv_state_op(xs_str **fname, int op);
 void httpd(void);
-- 
cgit