payment.ERROR: Signature is invalid.

[soullivaneuh]

I used fake paybox's card in dev env, and I have a invalid signature :

[2013-01-16 17:05:32] request.INFO: Matched route "lexik_paybox_ipn" (parameters: "_controller": "Lexik\Bundle\PayboxBundle\Controller\DefaultController::ipnAction", "time": "1358352320", "_route": "lexik_paybox_ipn") [] []
[2013-01-16 17:05:32] security.INFO: Populated SecurityContext with an anonymous Token [] []
[2013-01-16 17:05:32] payment.INFO: New IPN call. [] []
[2013-01-16 17:05:32] payment.INFO: amount=8252 [] []
[2013-01-16 17:05:32] payment.INFO: cmd=FR201301000001-1358352320 [] []
[2013-01-16 17:05:32] payment.INFO: auto=XXXXXX [] []
[2013-01-16 17:05:32] payment.INFO: trans=4353761 [] []
[2013-01-16 17:05:32] payment.INFO: type=CARTE [] []
[2013-01-16 17:05:32] payment.INFO: card=CB,VISA,EUROCARD_MASTERCARD [] []
[2013-01-16 17:05:32] payment.INFO: error=00000 [] []
[2013-01-16 17:05:32] payment.INFO: country=FRA [] []
[2013-01-16 17:05:32] payment.INFO: Sign=JDg9jvoFcM+i3JDOA6qy9Q6Gx6kFsyc+tymWVSTc7fYkNcwlKqF7SUdvBz6awxsD2tYuqkPtZjtdvTtYJm5mlnJdbrzPn3ixdjD7weTOxkJOcbUqqpmig3LDz2bpKajLFvE9Ut/+MRoemmSawpC3m2sQ2uFGkMtmFGCYfYQzzag= [] []
[2013-01-16 17:05:32] payment.INFO: amount=8252&cmd=FR201301000001-1358352320&auto=XXXXXX&trans=4353761&type=CARTE&card=CB%2CVISA%2CEUROCARD_MASTERCARD&error=00000&country=FRA [] []
[2013-01-16 17:05:32] payment.INFO: JDg9jvoFcM+i3JDOA6qy9Q6Gx6kFsyc+tymWVSTc7fYkNcwlKqF7SUdvBz6awxsD2tYuqkPtZjtdvTtYJm5mlnJdbrzPn3ixdjD7weTOxkJOcbUqqpmig3LDz2bpKajLFvE9Ut/+MRoemmSawpC3m2sQ2uFGkMtmFGCYfYQzzag= [] []
[2013-01-16 17:05:32] payment.ERROR: Signature is invalid. [] []

Here, my paybox form action :

    /**
     * @Route("/paybox")
     * @Template()
     */
    public function payboxAction()
    {
        $ref = $this->getRequest()->get('ref');
        /* @var $invoice Invoice */
        $invoice = $this->getDoctrine()->getRepository('SLLHMainBundle:Invoice')->findOneBy(array('ref' => $ref));

        /* @var $paybox PayboxRequest */
        $paybox = $this->get('lexik_paybox.request_handler');

        $paybox->setParameters(array(
            'PBX_CMD'           => $invoice->getRef().'-'.time(),
            'PBX_DEVISE'        => '978',
            'PBX_PORTEUR'       => 'test@test.net',
            'PBX_RETOUR'        => 'amount:M;cmd:R;auto:A;trans:T;type:P;card:C;countrycard:Y;error:E;country:I',
            'PBX_TOTAL'         => $invoice->getBalance() * 100,
            'PBX_TYPEPAIEMENT'  => 'CARTE',
            'PBX_TYPECARTE'     => 'CB,VISA,EUROCARD_MASTERCARD',
            'PBX_EFFECTUE'      => $this->generateUrl('sllh_front_payment_paybox_return', array('status' => 'success'), true),
            'PBX_REFUSE'        => $this->generateUrl('sllh_front_payment_paybox_return', array('status' => 'denied'), true),
            'PBX_ANNULE'        => $this->generateUrl('sllh_front_payment_paybox_return', array('status' => 'canceled'), true),
            'PBX_RUF1'          => 'POST',
            'PBX_REPONDRE_A'    => $this->generateUrl('lexik_paybox_ipn', array('time' => time()), true),
        ));

        $env = $this->container->getParameter('kernel.environment');

        return array(
            'invoice'   => $invoice,
            'url'       => $paybox->getUrl(),
            'form'      => $paybox->getForm()->createView(),
        );
    }

Did you already have thir error ? How did you fix it ?

Thanks for help.

[soullivaneuh]

I noticed one thing.

Here, the ipn routing:

lexik_paybox_ipn:
    pattern:  /payment-ipn/{time}
    defaults: { _controller: LexikPayboxBundle:Default:ipn }
    requirements:
        _method: GET|POST

And here, the ipnAction:

    public function ipnAction()
    {
        $payboxResponse = $this->container->get('lexik_paybox.response_handler');
        $result = $payboxResponse->verifySignature();

        return new Response($result ? 'OK' : 'KO');;
    }

The time parameter is not needed, so what is it ? It's maybe in relation with this issue...

[Olineuve]

The "time" parameter in the ipn route is actually not used, but it doesn't really matter. This was implemented in vue of a security feature. It is not causing bug since it's only a non used get parameter.

For the signature verification problem, the only thing i see that can cause trouble is the paybox public key changed, but the travis test still pass properly.

Do you tried remove the dash "-" on your "PBX_CMD" parameter. I don't remember exactly the format expected by Paybox but i'm wondering they wait for a string composed of alphanumerics characters.

[soullivaneuh]

I will test it.

In the stringified return data, I saw this : card=CB%2CVISA%2CEUROCARD_MASTERCARD

The , is url_encoded to %2, is it normal ?

[Olineuve]

Yes

[soullivaneuh]

I remove the - of PBX_CMD, nothing changed...

[soullivaneuh]

I changed a little bit your code in Response.php by following the example code given by Paybox and adding ssl error log.

And I found this error when I tried to get the public key:

[2013-01-17 14:23:04] payment.ERROR: Error while loading public key. error:0906D06C:PEM routines:PEM_read_bio:no start line [] []

This can help you a little more ?

[Olineuve]

I haven't been able to reproduce this error. It look like an environment issue.

Any news about it ?
What is your operating system ? Your openssl version's ?

[soullivaneuh]

The error is not resolved yet, I ignore it for the moment...

OS: Linux 3.6.11-gentoo x86_64
OpenSSL: OpenSSL 1.0.0j 10 May 2012

[fabienpomerol]

One advice not really about your topic : be really carefull with "CB,VISA,EUROCARD_MASTERCARD", if you try real mastercard you'll see that it doesn't work !

You should use "CB" value which works with all kind of CARD

[soullivaneuh]

I think I already did using only "CB", will retry...

[ibasaw]

got same error

[2013-10-01 11:11:29] payment.INFO: New IPN call. [] []
[2013-10-01 11:11:29] payment.INFO: ref=7300|toto@titi.com|0|24cbfff0684e643b0cf68a4fb6c6f0bc|0 [] []
[2013-10-01 11:11:29] payment.INFO: autorisation=XXXXXX [] []
[2013-10-01 11:11:29] payment.INFO: trans=6191315 [] []
[2013-10-01 11:11:29] payment.INFO: abonnement=0 [] []
[2013-10-01 11:11:29] payment.INFO: paiement=CARTE [] []
[2013-10-01 11:11:29] payment.INFO: carte=CB [] []
[2013-10-01 11:11:29] payment.INFO: idtrans=3745027 [] []
[2013-10-01 11:11:29] payment.INFO: erreur=00000 [] []
[2013-10-01 11:11:29] payment.INFO: validite=1411 [] []
[2013-10-01 11:11:29] payment.INFO: IP=FRA [] []
[2013-10-01 11:11:29] payment.INFO: BIN6=111122 [] []
[2013-10-01 11:11:29] payment.INFO: digest=5B434C778490889697170E225029F56AFF19CA47 [] []
[2013-10-01 11:11:29] payment.INFO: Sign=H9e0LjyTU8h3vjaDXc2sKym7OnaPP5A5vh5kImbBFei6R58cEYwh3qLGffOF35zNK/CPlt7kfHblnZfgSXzbSyiU3ioe0rNHxGTjKRXWTkZOqDpG8Dr3ycWO247DkLthlY1vPPMWq9PfifQj2hi+C6h3x8nGHv7TvvfEPMq80Ag= [] []
[2013-10-01 11:11:29] payment.INFO: ref=7300%7Ctoto%40titi.com%7C0%7C24cbfff0684e643b0cf68a4fb6c6f0bc%7C0&autorisation=XXXXXX&trans=6191315&abonnement=0&paiement=CARTE&carte=CB&idtrans=3745027&erreur=00000&validite=1411&IP=FRA&BIN6=111122&digest=5B434C778490889697170E225029F56AFF19CA47 [] []
[2013-10-01 11:11:29] payment.INFO: H9e0LjyTU8h3vjaDXc2sKym7OnaPP5A5vh5kImbBFei6R58cEYwh3qLGffOF35zNK/CPlt7kfHblnZfgSXzbSyiU3ioe0rNHxGTjKRXWTkZOqDpG8Dr3ycWO247DkLthlY1vPPMWq9PfifQj2hi+C6h3x8nGHv7TvvfEPMq80Ag= [] []
[2013-10-01 11:11:29] payment.ERROR: Signature is invalid. [] []

the key is good, i check it with my PROD key on another project

[ibasaw]

i found it !

here how i solve this one in Response.php

    $publicKey = openssl_pkey_get_public($cert);

    $first = strpos ( $_SERVER ['REQUEST_URI'], '?' );
$qrystr = substr ( $_SERVER ['REQUEST_URI'], $first + 1 );
$pos = strrpos ( $qrystr, '&' );
$data = substr ( $qrystr, 0, $pos );
$pos = strpos ( $qrystr, '=', $pos ) + 1;
$this->signature = substr ( $qrystr, $pos );

    $this->signature = base64_decode ( urldecode ( $this->signature ) );

    $result = openssl_verify ( $data, $this->signature, $publicKey );

[soullivaneuh]

@ibasaw, can you send us a PR for exactly see the difference and merge the fix ?

Thanks ! :)

[ibasaw]

@soullivaneuh , i will try, never do a PR before

[fabienpomerol]

The initSignature method normally do this job.

see https://github.com/lexik/LexikPayboxBundle/blob/master/Paybox/System/Base/Response.php#L80

what is the ouput of $this->signature without your fix ?

the request method is POST or GET ?