@andrewheberle/serverless-ssh-ca 0.17.12 → 0.17.15

package/src/certificate.ts

@@ -0,0 +1,214 @@
+import { seconds } from "itty-time"
+import { Certificate, createCertificate, Identity, identityForHost, identityForUser, identityFromDN, Key, parsePrivateKey, PrivateKey } from "sshpk"
+import { SSHExtension } from "./types"
+import { split } from "./utils"
+import type { SshCaBindings } from "./types"
+
+// const sshCertificateExtensions = split(env.SSH_CERTIFICATE_EXTENSIONS)
+
+export type CreateCertificateOptions = {
+	lifetime?: number
+	principals?: string[]
+	extensions?: string[]
+}
+
+/* const DefaultCreateCertificateOptions: CreateCertificateOptions = {
+	lifetime: seconds(env.SSH_CERTIFICATE_LIFETIME),
+	principals: [],
+	extensions: sshCertificateExtensions
+} */
+
+export class CertificateError extends Error {
+	constructor(message: string) {
+		super(message)
+		this.name = "CertificateError"
+
+		// This is necessary for proper stack trace in TypeScript
+		Object.setPrototypeOf(this, CertificateError.prototype)
+	}
+}
+
+export type GenerateCertificateOptions = {
+	/**
+	 * @internal
+	 * Override the certificate serial number.
+	 * Should only be set in tests.
+	 */
+	serial?: bigint
+} & CreateCertificateOptions
+
+export const generateCertificate = (env: SshCaBindings, email: string, key: PrivateKey, public_key: Key, options?: GenerateCertificateOptions): Certificate => {
+	let { lifetime, principals, extensions, serial } = options ?? {}
+
+	// add identities
+	const identity = env.SSH_CERTIFICATE_INCLUDE_SELF as string === "true"
+		? [identityForUser(email.split("@")[0]!)]
+		: []
+	if (principals !== undefined) {
+		for (const p of principals) {
+			identity.push(identityForUser(p))
+		}
+	}
+	if (env.SSH_CERTIFICATE_PRINCIPALS as string !== "") {
+		for (const p of split(env.SSH_CERTIFICATE_PRINCIPALS)) {
+			identity.push(identityForUser(p))
+		}
+	}
+
+	// lifetime is the smaller of what was provided in the options or the default
+	lifetime = lifetime !== undefined
+		? Math.min(lifetime, seconds(env.SSH_CERTIFICATE_LIFETIME))
+		: seconds(env.SSH_CERTIFICATE_LIFETIME)
+
+	// generate value for serial of certificate
+	const s = generateSerial(serial)
+
+	// set issuer of certificate based on ISSUER_DN
+	const issuer = identityFromDN(env.ISSUER_DN)
+
+	// create certificate
+	const certificate = createCertificate(identity, public_key, issuer, key, { lifetime: lifetime, serial: s })
+
+	// ensure openssh info is included in certificate (should not occur)
+	if (certificate.signatures.openssh === undefined) {
+		throw new CertificateError("missing openssh information in certificate")
+	}
+
+	const sshCertificateExtensions = split(env.SSH_CERTIFICATE_EXTENSIONS)
+
+	// add usage extensions
+	const sshextensions: SSHExtension[] = []
+	if (extensions !== undefined) {
+		// if extensions are provided in request, ensure they do not include extra extensions beyond the defaults
+		for (const ext of extensions) {
+			if (!sshCertificateExtensions.includes(ext)) {
+				throw new CertificateError(`${ext} is not allowed`)
+			}
+
+			// add to list of allowed extensions
+			sshextensions.push({
+				critical: false,
+				name: ext,
+				data: Buffer.alloc(0)
+			})
+		}
+	} else {
+		// use defaults if not provided
+		sshCertificateExtensions.forEach((ext: string) => {
+			sshextensions.push({
+				critical: false,
+				name: ext,
+				data: Buffer.alloc(0)
+			})
+		})
+
+	}
+
+	// add info to certificate
+	certificate.signatures = {
+		openssh: {
+			nonce: certificate.signatures.openssh.nonce,
+			keyId: email,
+			signature: certificate.signatures.openssh.signature,
+			exts: sshextensions
+		}
+	}
+
+	// re-sign after changes
+	certificate.signWith(key)
+
+	return certificate
+}
+
+export async function createSignedCertificate(env: SshCaBindings, email: string, public_key: Key, options?: CreateCertificateOptions): Promise<Certificate> {
+	// grab private key from secret store
+	const secret = await env.PRIVATE_KEY.get()
+
+	// parse key
+	const key = parsePrivateKey(secret)
+
+	if (options === undefined) {
+		options = {
+			lifetime: seconds(env.SSH_CERTIFICATE_LIFETIME),
+			principals: [],
+			extensions: split(env.SSH_CERTIFICATE_EXTENSIONS)
+		}
+	}
+
+	return generateCertificate(env, email, key, public_key, options)
+}
+
+export type CreateHostCertificateOptions = {
+	lifetime?: number
+	principals?: string[]
+	subjects?: Identity[]
+}
+
+/* const DefaultCreateHostertificateOptions: CreateHostCertificateOptions = {
+	lifetime: seconds(env.SSH_HOST_CERTIFICATE_LIFETIME),
+	principals: [],
+} */
+
+export class BadIssuerError extends Error {
+	constructor(message: string) {
+		super(message)
+		this.name = "BadIssuerError"
+
+		Object.setPrototypeOf(this, BadIssuerError.prototype)
+	}
+}
+
+export async function createSignedHostCertificate(env: SshCaBindings, public_key: Key, options?: CreateHostCertificateOptions): Promise<Certificate> {
+	if (options === undefined) {
+		options = {
+			lifetime: seconds(env.SSH_HOST_CERTIFICATE_LIFETIME),
+			principals: []
+		}
+	}
+	// generate list of identities for host key
+	const identity: Identity[] = []
+	if (options.principals !== undefined) {
+		for (const p of options.principals) {
+			identity.push(identityForHost(p))
+		}
+	}
+
+	// add any already provided subjects (for renewals only)
+	if (options.subjects !== undefined) {
+		identity.push(...options.subjects)
+	}
+
+	// grab private key from secret store
+	const secret = await env.PRIVATE_KEY.get()
+
+	// parse private key
+	const key = parsePrivateKey(secret)
+
+	// lifetime is the smaller of what was provided in the options or the default
+	const lifetime = options.lifetime !== undefined
+		? Math.min(options.lifetime, seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+		: seconds(env.SSH_HOST_CERTIFICATE_LIFETIME)
+
+	// generate value for serial of certificate
+	const serial = generateSerial()
+
+	// set issuer of certificate based on ISSUER_DN
+	const issuer = identityFromDN(env.ISSUER_DN)
+
+	// create certificate
+	const certificate = createCertificate(identity, public_key, issuer, key, { lifetime: lifetime, serial: serial })
+
+	return certificate
+}
+
+export const generateSerial = (serial?: bigint): Buffer<ArrayBuffer> => {
+	if (serial !== undefined) {
+		const s = Buffer.alloc(8)
+		s.writeBigUInt64BE(serial)
+
+		return s
+	}
+
+	const randomBytes = crypto.getRandomValues(new Uint8Array(8))
+	return Buffer.from(randomBytes)
+}

package/src/db/index.ts

@@ -0,0 +1,194 @@
+import { Certificate, Format, Identity } from "sshpk"
+import { logger } from "../logger"
+import type { SshCaBindings } from "../types"
+import { D1QB } from "workers-qb"
+import { migrations } from "./migrations"
+
+export enum CertificateType {
+	User,
+	Host
+}
+
+export type CertificateRecord = {
+	id: number
+	serial: string
+	key_id: string
+	principals: string
+	extensions: string | null
+	valid_after: Date
+	valid_before: Date
+	revoked_at: Date | null
+	certificate_type: CertificateType
+	public_key: string | null
+}
+
+export type DatabaseSchema = {
+	certificates: CertificateRecord
+}
+
+const connect = async (env: SshCaBindings): Promise<D1QB<DatabaseSchema>> => {
+	const l = logger(env)
+
+	try {
+		l.info("connecting to database")
+
+		const qb = new D1QB<DatabaseSchema>(env.DB)
+		const migrationBuilder = qb.migrations({ migrations })
+		const appliedMigrations = await migrationBuilder.apply()
+
+		l.info("applied database migrations", "migrations", appliedMigrations.length, "migration_names", appliedMigrations.map(m => m.name))
+
+		return qb
+	} catch (err) {
+		l.error("error connecting to database", "error", err)
+		throw err
+	}
+}
+
+export const dbCleanup = async (env: SshCaBindings) => {
+	const l = logger(env).with("retention", env.DB_CERTIFICATE_RETENTION)
+
+	if (env.DB_CERTIFICATE_RETENTION === "infinite") {
+		l.info("skipping database cleanup")
+	}
+
+	l.info("starting database cleanup")
+	try {
+		const qb = await connect(env)
+		const res = await qb.delete({
+			tableName: "certificates",
+			where: {
+				conditions: "unixepoch('subsec') > unixepoch(valid_before,'subsec',?)",
+				params: env.DB_CERTIFICATE_RETENTION
+			}
+		}).execute()
+		l.info("completed database cleanup", "changes", res.meta?.changes)
+	} catch (err) {
+		l.error("error during database cleanup", "retention", env.DB_CERTIFICATE_RETENTION)
+	}
+}
+
+export const recordCertificate = async (env: SshCaBindings, certificate: Certificate, keyid: string, certificateType: CertificateType = CertificateType.User) => {
+	const serial = certificate.serial.readBigUInt64BE(0)
+	const subjects = certificate.subjects.map((v: Identity): string => {
+		return v.toString()
+	}).join(",")
+	const extensions = certificate.getExtensions().map((v: Format.OpenSshSignatureExt | Format.x509SignatureExt): string => {
+		// @ts-ignore: the name property does exist
+		return v.name as string
+	}).join(",")
+	const qb = await connect(env)
+	const res = await qb.insert({
+		tableName: "certificates",
+		data: {
+			serial: `${serial}`,
+			key_id: keyid,
+			principals: subjects,
+			extensions: extensions,
+			valid_after: certificate.validFrom.toISOString(),
+			valid_before: certificate.validUntil.toISOString(),
+			certificate_type: certificateType,
+			public_key: certificate.subjectKey.toString("ssh")
+		},
+	}).execute()
+
+	if (!res.success) {
+		throw new Error("error during query")
+	}
+}
+
+export const isRevoked = async (env: SshCaBindings, serial: bigint): Promise<boolean> => {
+	const qb = await connect(env)
+	const res = await qb.fetchOne({
+		tableName: "certificates",
+		fields: ["serial"],
+		where: {
+			conditions: "serial = ? AND revoked_at NOTNULL",
+			params: `${serial}`
+		},
+	}).execute()
+
+	return res.results !== undefined
+}
+
+export enum RevocationStatus {
+	NotFound,
+	Revoked,
+	Revokable,
+	Unrevokable
+}
+
+export const revocationStatus = async (env: SshCaBindings, serial: bigint, publickey: string, certificateType: CertificateType): Promise<RevocationStatus> => {
+	const qb = await connect(env)
+	const res = await qb.fetchOne({
+		tableName: "certificates",
+		fields: ["public_key", "revoked_at"],
+		where: {
+			conditions: "serial = ? AND public_key = ? AND certificate_type = ?",
+			params: [`${serial}`, publickey, certificateType]
+		}
+	}).execute()
+
+	if (res.results === undefined) {
+		return RevocationStatus.NotFound
+	}
+
+	if (res.results.revoked_at !== null) {
+		return RevocationStatus.Revoked
+	}
+
+	if (publickey === res.results.public_key) {
+		return RevocationStatus.Revokable
+	}
+
+	return RevocationStatus.Unrevokable
+}
+
+export const getRevocationList = async (env: SshCaBindings, certificateType: CertificateType): Promise<string[]> => {
+	const qb = await connect(env)
+	const res = await qb.fetchAll({
+		tableName: "certificates",
+		fields: ["serial"],
+		where: {
+			conditions: "revoked_at NOTNULL AND certificate_type = ? AND unixepoch('subsec') < unixepoch(valid_before,'subsec','24 hours')",
+			params: certificateType
+		}
+	}).execute()
+
+	if (!res.success) {
+		throw new Error("error during query")
+	}
+
+	if (res.results === undefined) {
+		return []
+	}
+
+	return res.results.map(item => item.serial)
+}
+
+type RevokedCertificate = Pick<CertificateRecord, "revoked_at">
+
+export const revokeCertificate = async (env: SshCaBindings, serial: bigint): Promise<RevokedCertificate[]> => {
+	const qb = await connect(env)
+	const res = await qb.update<RevokedCertificate>({
+		tableName: "certificates",
+		data: {
+			revoked_at: (new Date).toISOString()
+		},
+		where: {
+			conditions: "serial = ?",
+			params: `${serial}`
+		},
+		returning: ["revoked_at"]
+	}).execute()
+
+	if (!res.success) {
+		throw new Error("error during query")
+	}
+
+	if (res.results === undefined) {
+		return []
+	}
+
+	return res.results
+}

package/src/db/migrations/0001_initial_schema.ts

@@ -0,0 +1,25 @@
+import { type Migration } from "workers-qb";
+
+export const migration: Migration = {
+	name: "0001_initial_schema",
+	sql: `
+		CREATE TABLE IF NOT EXISTS certificates (
+			id INTEGER PRIMARY KEY,
+			serial TEXT UNIQUE NOT NULL,
+			key_id TEXT NOT NULL,
+			principals TEXT NOT NULL,
+			extensions TEXT,
+			valid_after TIMESTAMP NOT NULL,
+			valid_before TIMESTAMP NOT NULL,
+			revoked_at TIMESTAMP,
+			certificate_type INTEGER NOT NULL DEFAULT 0,
+			public_key TEXT
+		);
+
+		CREATE INDEX IF NOT EXISTS idx_certificates_serial ON certificates(serial);
+		CREATE INDEX IF NOT EXISTS idx_certificates_valid_after ON certificates(valid_after);
+		CREATE INDEX IF NOT EXISTS idx_certificates_valid_before ON certificates(valid_before);
+		CREATE INDEX IF NOT EXISTS idx_certificates_revoked_at ON certificates(revoked_at);
+		CREATE INDEX IF NOT EXISTS idx_certificates_certificate_type ON certificates(certificate_type);
+	`
+}

package/src/db/migrations/index.ts

@@ -0,0 +1,6 @@
+import { type Migration } from "workers-qb"
+import { migration as initialSchema0001 } from "./0001_initial_schema"
+
+export const migrations: Migration[] = [
+	initialSchema0001
+]

package/src/index.ts

@@ -0,0 +1,18 @@
+import { dbCleanup } from "./db"
+import { createApp } from "./router"
+import type { SshCaBindings } from "./types"
+export type { SshCaBindings } from "./types"
+
+let app: ReturnType<typeof createApp> | undefined
+
+export default {
+    fetch(req: Request, env: SshCaBindings, ctx: ExecutionContext) {
+        if (app === undefined) {
+            app = createApp(env)
+        }
+        return app.fetch(req, env, ctx)
+    },
+    async scheduled(controller: ScheduledController, env: SshCaBindings, ctx: ExecutionContext) {
+        ctx.waitUntil(dbCleanup(env))
+    },
+} satisfies ExportedHandler<SshCaBindings>