// Verifies that the message is properly signed.
Verifies that the message is properly signed.
Verifies that the message is properly signed .
fn validate_signature(
    validator: &dyn IngressSigVerifier,
    message_id: &MessageId,
    signature: &UserSignature,
    current_time: Time,
    registry_version: RegistryVersion,
) -> Result<CanisterIdSet, RequestValidationError> {
    validate_sender_delegation_expiry(&signature.sender_delegation, current_time)?;
    let empty_vec = Vec::new();
    let signed_delegations = match &signature.sender_delegation {
        None => &empty_vec,
        Some(delegations) => delegations,
    };
    let (pubkey, targets) = validate_delegations(
        validator,
        signed_delegations.as_slice(),
        signature.signer_pubkey.clone(),
        registry_version,
    )?;
    let (pk, pk_type) = public_key_from_bytes(&pubkey).map_err(InvalidSignature)?;
    match pk_type {
        KeyBytesContentType::EcdsaP256PublicKeyDerWrappedCose
        | KeyBytesContentType::RsaSha256PublicKeyDerWrappedCose => {
            let webauthn_sig = WebAuthnSignature::try_from(signature.signature.as_slice())
                .map_err(WebAuthnError)
                .map_err(InvalidSignature)?;
            validate_webauthn_sig(validator, &webauthn_sig, message_id, &pk)
                .map_err(WebAuthnError)
                .map_err(InvalidSignature)?;
            Ok(targets)
        }
        KeyBytesContentType::Ed25519PublicKeyDer
        | KeyBytesContentType::EcdsaP256PublicKeyDer
        | KeyBytesContentType::EcdsaSecp256k1PublicKeyDer => {
            let basic_sig = BasicSigOf::from(BasicSig(signature.signature.clone()));
            validate_signature_plain(validator, message_id, &basic_sig, &pk)
                .map_err(InvalidSignature)?;
            Ok(targets)
        }
        KeyBytesContentType::IcCanisterSignatureAlgPublicKeyDer => {
            let canister_sig = CanisterSigOf::from(CanisterSig(signature.signature.clone()));
            validator
                .verify_canister_sig(&canister_sig, message_id, &pk, registry_version)
                .map_err(InvalidCanisterSignature)
                .map_err(InvalidSignature)?;
            Ok(targets)
        }
        KeyBytesContentType::RsaSha256PublicKeyDer => {
            Err(RequestValidationError::InvalidSignature(
                AuthenticationError::InvalidBasicSignature(CryptoError::AlgorithmNotSupported {
                    algorithm: AlgorithmId::RsaSha256,
                    reason: "RSA signatures are not allowed except in webauthn context".to_owned(),
                }),
            ))
        }
    }
}
fn validate_signature ( validator : & dyn IngressSigVerifier , message_id : & MessageId , signature : & UserSignature , current_time : Time , registry_version : RegistryVersion , ) -> Result < CanisterIdSet , RequestValidationError > { validate_sender_delegation_expiry ( & signature . sender_delegation , current_time ) ? ; let empty_vec = Vec :: new ( ) ; let signed_delegations = match & signature . sender_delegation { None => & empty_vec , Some ( delegations ) => delegations , } ; let ( pubkey , targets ) = validate_delegations ( validator , signed_delegations . as_slice ( ) , signature . signer_pubkey . clone ( ) , registry_version , ) ? ; let ( pk , pk_type ) = public_key_from_bytes ( & pubkey ) . map_err ( InvalidSignature ) ? ; match pk_type { KeyBytesContentType :: EcdsaP256PublicKeyDerWrappedCose | KeyBytesContentType :: RsaSha256PublicKeyDerWrappedCose => { let webauthn_sig = WebAuthnSignature :: try_from ( signature . signature . as_slice ( ) ) . map_err ( WebAuthnError ) . map_err ( InvalidSignature ) ? ; validate_webauthn_sig ( validator , & webauthn_sig , message_id , & pk ) . map_err ( WebAuthnError ) . map_err ( InvalidSignature ) ? ; Ok ( targets ) } KeyBytesContentType :: Ed25519PublicKeyDer | KeyBytesContentType :: EcdsaP256PublicKeyDer | KeyBytesContentType :: EcdsaSecp256k1PublicKeyDer => { let basic_sig = BasicSigOf :: from ( BasicSig ( signature . signature . clone ( ) ) ) ; validate_signature_plain ( validator , message_id , & basic_sig , & pk ) . map_err ( InvalidSignature ) ? ; Ok ( targets ) } KeyBytesContentType :: IcCanisterSignatureAlgPublicKeyDer => { let canister_sig = CanisterSigOf :: from ( CanisterSig ( signature . signature . clone ( ) ) ) ; validator . verify_canister_sig ( & canister_sig , message_id , & pk , registry_version ) . map_err ( InvalidCanisterSignature ) . map_err ( InvalidSignature ) ? ; Ok ( targets ) } KeyBytesContentType :: RsaSha256PublicKeyDer => { Err ( RequestValidationError :: InvalidSignature ( AuthenticationError :: InvalidBasicSignature ( CryptoError :: AlgorithmNotSupported { algorithm : AlgorithmId :: RsaSha256 , reason : " " . to_owned ( ) , } ) , ) ) } } }
Verifies that the message is properly signed.
Verifies that the message is properly signed .
validator
&dyn IngressSigVerifier
message_id
&MessageId
signature
&UserSignature
current_time
Time
registry_version
RegistryVersion