@andrewheberle/serverless-ssh-ca 0.17.18 → 0.18.0

package/src/sshsig/sig_parser.ts

@@ -3,6 +3,75 @@ import { Reader } from "./reader";
 import { parsePubkey } from "./formats";
 import { dearmor } from "./armor";
 
+/**
+ * ECDSA signature algorithms whose signatures need converting from SSH
+ * mpint encoding to the raw r || s format used by WebCrypto.
+ */
+export type EcdsaSigAlgo =
+  | "ecdsa-sha2-nistp256"
+  | "ecdsa-sha2-nistp384"
+  | "ecdsa-sha2-nistp521"
+  | "sk-ecdsa-sha2-nistp256@openssh.com";
+
+/**
+ * Narrow a signature algorithm name to an {@link EcdsaSigAlgo}.
+ *
+ * @param sig_algo Signature algorithm name from the SSH signature.
+ */
+export function isEcdsaSigAlgo(sig_algo: string): sig_algo is EcdsaSigAlgo {
+  return sig_algo === "ecdsa-sha2-nistp256" ||
+    sig_algo === "ecdsa-sha2-nistp384" ||
+    sig_algo === "ecdsa-sha2-nistp521" ||
+    sig_algo === "sk-ecdsa-sha2-nistp256@openssh.com";
+}
+
+/**
+ * Size in bytes of each of the r and s signature components for the curve
+ * used by an {@link EcdsaSigAlgo}.
+ *
+ * @param sig_algo ECDSA signature algorithm name.
+ */
+export function ecdsaComponentSize(sig_algo: EcdsaSigAlgo): number {
+  switch (sig_algo) {
+    case "ecdsa-sha2-nistp256":
+    case "sk-ecdsa-sha2-nistp256@openssh.com":
+      return 32;
+    case "ecdsa-sha2-nistp384":
+      return 48;
+    case "ecdsa-sha2-nistp521":
+      return 66;
+    default: {
+      const exhaustive: never = sig_algo;
+      throw new Error(`unsupported ECDSA signature algorithm: ${exhaustive}`);
+    }
+  }
+}
+
+/**
+ * Convert an SSH mpint encoded ECDSA signature component (r or s) to a
+ * fixed-width big-endian value of `size` bytes.
+ *
+ * Leading zero bytes are removed and the value is then left-padded with
+ * zeros to `size`. This throws an Error when the value is zero or does not
+ * fit in `size` bytes.
+ *
+ * @param mpint Component bytes as encoded in the SSH signature.
+ * @param size Required width in bytes, see {@link ecdsaComponentSize}.
+ */
+export function toFixedWidth(mpint: Uint8Array, size: number): Uint8Array {
+  let start = 0;
+  while (start < mpint.length && mpint[start] === 0x00) {
+    start++;
+  }
+  const value = mpint.subarray(start);
+  if (value.length === 0 || value.length > size) {
+    throw new Error("invalid ECDSA signature component");
+  }
+  const out = new Uint8Array(size);
+  out.set(value, size - value.length);
+  return out;
+}
+
 /**
  * Parse bytes into an SSH signature object.
  *
@@ -39,26 +108,16 @@ export function parse(signature: DataView | string): Sig {
   const sig_algo = raw_signature.readString().toString();
   const sig_bytes = raw_signature.readString();
   let bytes;
-  if (
-    sig_algo === "ecdsa-sha2-nistp256" || sig_algo === "ecdsa-sha2-nistp384" ||
-    sig_algo === "ecdsa-sha2-nistp512" ||
-    sig_algo === "sk-ecdsa-sha2-nistp256@openssh.com"
-  ) {
-    let r = new Uint8Array(sig_bytes.readString().bytes());
-	  if (r.length === 0) {
-      throw new Error("invalid ECDSA signature component")
-    }
-    if (r[0] === 0x00 && r.length % 2 == 1) {
-      r = r.slice(1);
-    }
-    let s = new Uint8Array(sig_bytes.readString().bytes());
-		if (s.length === 0) {
-      throw new Error("invalid ECDSA signature component")
-    }
-    if (s[0] === 0x00 && s.length % 2 == 1) {
-      s = s.slice(1);
-    }
-    bytes = new Uint8Array([...r, ...s]).buffer as ArrayBuffer;
+  if (isEcdsaSigAlgo(sig_algo)) {
+    // SSH encodes r and s as minimal-length mpints, but WebCrypto expects
+    // the fixed-width concatenation r || s
+    const size = ecdsaComponentSize(sig_algo);
+    const r = toFixedWidth(new Uint8Array(sig_bytes.readString().bytes()), size);
+    const s = toFixedWidth(new Uint8Array(sig_bytes.readString().bytes()), size);
+    const raw = new Uint8Array(size * 2);
+    raw.set(r, 0);
+    raw.set(s, size);
+    bytes = raw.buffer;
   } else {
     bytes = sig_bytes.bytes();
   }

package/src/utils.ts

@@ -1,5 +1,5 @@
 import type { SshCaBindings } from "./types"
-import { JWKInvalid, JWKSInvalid, JWSInvalid, JWTClaimValidationFailed, JWTInvalid } from "jose/errors"
+import { JWKInvalid, JWKSInvalid, JWSInvalid, JWSSignatureVerificationFailed, JWTClaimValidationFailed, JWTExpired, JWTInvalid } from "jose/errors"
 import { Certificate, Key, KeyParseError, CertificateParseError, parseCertificate, parseKey, parsePrivateKey, PrivateKey } from "sshpk"
 import z from "zod"
 import { verifyJWT } from "./verify"
@@ -8,6 +8,7 @@ import { RenewalProofOfPossession, ProofOfPossession, PossessionParseError } fro
 import type { isRevoked as IsRevokedFn } from "./db"
 import { logger } from "./logger"
 import { ms } from "itty-time"
+import { InternalServerErrorException } from "chanfana"
 
 export const fatalIssue = (ctx: z.RefinementCtx, message: string, val: unknown) => {
 	ctx.issues.push({
@@ -87,7 +88,11 @@ export const transformAuthorizationHeader = async (env: SshCaBindings, val: stri
 			case (err instanceof JWKSInvalid):
 				return fatalIssue(ctx, "the access token JWKS was invalid", val)
 			case (err instanceof JWTClaimValidationFailed):
-				return fatalIssue(ctx, "claim validtion of the JWT failed", val)
+				return fatalIssue(ctx, "claim validation of the JWT failed", val)
+			case (err instanceof JWTExpired):
+				return fatalIssue(ctx, "the access token has expired", val)
+			case (err instanceof JWSSignatureVerificationFailed):
+				return fatalIssue(ctx, "the access token signature verification failed", val)
 			default:
 				l.error("unhandled access token validation error", "in", "transformAuthorizationHeader", "error", err)
 				return fatalIssue(ctx, "unhandled access token validation error", val)
@@ -128,6 +133,21 @@ export const transformPublicKey = (val: string | Buffer<ArrayBufferLike>, ctx: z
 	}
 }
 
+/**
+ * Thrown by {@link identityPrincipals} when the principals claim of an
+ * identity token is not a string or an array of strings.
+ */
+export class PrincipalsClaimError extends Error {
+	constructor(message: string) {
+		super(message)
+		this.name = "PrincipalsClaimError"
+
+		Object.setPrototypeOf(this, PrincipalsClaimError.prototype)
+	}
+}
+
+const PrincipalsClaimSchema = z.union([z.string(), z.array(z.string())]).nullish()
+
 export const identityPrincipals = (env: SshCaBindings, payload: CertificateRequestJWTPayload, claim?: string): string[] => {
 	if (claim === undefined) {
 		claim = env.JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM
@@ -135,13 +155,25 @@ export const identityPrincipals = (env: SshCaBindings, payload: CertificateReque
 
 	const l = logger(env)
 
- 	const p = payload[claim]
+	// the token is verified but the claim type is set by the IdP
+	const parsed = PrincipalsClaimSchema.safeParse(payload[claim])
+	if (!parsed.success) {
+		l.warn("claim was not a string or an array of strings", "claim", claim)
+		throw new PrincipalsClaimError(`the ${claim} claim must be a string or an array of strings`)
+	}
+
+ 	const p = parsed.data
 
 	if (p === undefined) {
 		l.warn("claim was missing despite being set in CA config", "claim", claim)
 		return []
 	}
 
+	if (p === null) {
+		l.warn("claim was present but was null", "claim", claim)
+		return []
+	}
+
 	if (p === "") {
 		l.warn("claim was present but was an empty string", "claim", claim)
 		return []
@@ -151,7 +183,7 @@ export const identityPrincipals = (env: SshCaBindings, payload: CertificateReque
 	const principals = (typeof p === "string" ? [p] : p)
  		.map((value) => value.replaceAll(" ", "_"))
 
-	l.info("identity token included principals", "principals", principals)
+	l.debug("identity token included principals", "principals", principals)
 
 	return principals
 }
@@ -182,10 +214,10 @@ export const transformIdentityToken = async (env: SshCaBindings, val: string, ct
 		const identity = await parseIdentity(env, val, env.JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM)
 
 		return identity
-	} catch {
+	} catch (err) {
 		ctx.issues.push({
 			code: "custom",
-			message: "problem parsing identity token",
+			message: err instanceof PrincipalsClaimError ? err.message : "problem parsing identity token",
 			input: val
 		})
 		return z.NEVER
@@ -328,10 +360,16 @@ export const refineHostCertificateRenewal = async (env: SshCaBindings, isRevoked
 			return fatalIssue(ctx, "the provided certificate was not signed by this CA", val)
 		}
 
-		// check certificate is not expired
-		if (val.certificate.isExpired()) {
+		// check certificate is within its validity period, allowing for clock
+		// skew at the start as a certificate issued moments ago may have a
+		// validity start up to a second in the future
+		const now = Date.now()
+		if (now >= val.certificate.validUntil.getTime()) {
 			return fatalIssue(ctx, "the provided certificate is expired", val)
 		}
+		if (val.certificate.validFrom.getTime() > now + ms(env.CERTIFICATE_REQUEST_TIME_SKEW_MAX)) {
+			return fatalIssue(ctx, "the provided certificate is not yet valid", val)
+		}
 
 		// ensure certificate presented for renewal is not revoked
 		const serial = val.certificate.serial.readBigUInt64BE(0)
@@ -352,6 +390,11 @@ export const refineHostCertificateRenewal = async (env: SshCaBindings, isRevoked
 
 		return z.NEVER
 	} catch (err) {
+		// a misconfigured CA key is a server error, not a validation failure
+		if (err instanceof UnsupportedKeyError) {
+			l.error(err.message, "in", "refineHostCertificateRenewal")
+			throw new InternalServerErrorException(err.message)
+		}
 		l.error("proof of possession verification unhandled error", "in", "refineHostCertificateRenewal", "error", err)
 		return fatalIssue(ctx, "proof of possession verification unhandled error", val)
 	}
@@ -394,13 +437,47 @@ export const split = (v?: string | string[]): string[] => {
 			: v
 }
 
+/**
+ * Thrown by {@link getPrivateKey} when the CA private key is of a type that
+ * cannot be used.
+ */
+export class UnsupportedKeyError extends Error {
+	constructor(message: string) {
+		super(message)
+		this.name = "UnsupportedKeyError"
+
+		Object.setPrototypeOf(this, UnsupportedKeyError.prototype)
+	}
+}
+
+/**
+ * Load and parse the CA private key from the `PRIVATE_KEY` secret.
+ *
+ * Only Ed25519 and ECDSA keys are supported. RSA keys are rejected because
+ * sshpk signs RSA certificates with SHA-1 (`ssh-rsa`), which OpenSSH 8.2 and
+ * later refuse by default, and because RSA keys in OpenSSH format are
+ * converted with invalid CRT parameters that the Workers runtime rejects.
+ *
+ * @throws KeyParseError when the secret cannot be parsed.
+ * @throws {@link UnsupportedKeyError} when the key is not Ed25519 or ECDSA.
+ */
+export const getPrivateKey = async (env: SshCaBindings): Promise<PrivateKey> => {
+	// grab private key from secret store
+	const secret = await env.PRIVATE_KEY.get()
+
+	// parse it
+	const key = parsePrivateKey(secret)
+
+	if (key.type !== "ed25519" && key.type !== "ecdsa") {
+		throw new UnsupportedKeyError(`CA key type ${key.type} is not supported, the CA key must be Ed25519 or ECDSA`)
+	}
+
+	return key
+}
+
 export const getPublic = async (env: SshCaBindings, key?: PrivateKey): Promise<Key> => {
 	if (key === undefined) {
-		// grab private key from secret store
-		const secret = await env.PRIVATE_KEY.get()
-
-		// parse it
-		key = parsePrivateKey(secret)
+		key = await getPrivateKey(env)
 	}
 
 	// convert to a public key and add comment