@andrewheberle/serverless-ssh-ca 0.17.5

package/dist/utils.js

@@ -0,0 +1,323 @@
+import { JWKInvalid, JWKSInvalid, JWSInvalid, JWTClaimValidationFailed, JWTInvalid } from "jose/errors";
+import { KeyParseError, CertificateParseError, parseCertificate, parseKey, parsePrivateKey } from "sshpk";
+import z from "zod";
+import { verifyJWT } from "./verify";
+import { RenewalProofOfPossession, ProofOfPossession, PossessionParseError } from "./proof";
+import { isRevoked } from "./db";
+import { logger } from "./logger";
+import { ms } from "itty-time";
+export const fatalIssue = (ctx, message, val) => {
+    ctx.issues.push({
+        code: "custom",
+        message: message,
+        input: val
+    });
+    return z.NEVER;
+};
+export const transformProofOfPossession = (env, val, ctx) => {
+    const l = logger(env);
+    try {
+        const proof = new ProofOfPossession(val, { logger: l, skew: ms(env.CERTIFICATE_REQUEST_TIME_SKEW_MAX) });
+        return proof;
+    }
+    catch (err) {
+        l.error("proof of possession parsing error", "error", err);
+        switch (true) {
+            case (err instanceof PossessionParseError):
+                ctx.issues.push({
+                    code: "custom",
+                    message: err.message,
+                    input: val
+                });
+                break;
+            default:
+                ctx.issues.push({
+                    code: "custom",
+                    message: "proof of possession transform unhandled error",
+                    input: val
+                });
+        }
+        return z.NEVER;
+    }
+};
+export const transformAuthorizationHeader = async (env, val, ctx) => {
+    const jwt = val.replace("Bearer ", "");
+    const l = logger(env);
+    if (jwt === "") {
+        return fatalIssue(ctx, "request did not contain a JWT", val);
+    }
+    try {
+        // verify jwt
+        const { payload } = await verifyJWT(env, jwt);
+        if (payload.email === undefined) {
+            return fatalIssue(ctx, "JWT was verified but was missing required email claim", val);
+        }
+        return {
+            email: payload.email,
+            sub: payload.sub,
+        };
+    }
+    catch (err) {
+        switch (true) {
+            case (err instanceof JWSInvalid):
+                return fatalIssue(ctx, "the access token was invalid", val);
+            case (err instanceof JWTInvalid):
+                return fatalIssue(ctx, "the access token failed verification", val);
+            case (err instanceof JWKInvalid):
+                return fatalIssue(ctx, "the access token JWK was invalid", val);
+            case (err instanceof JWKSInvalid):
+                return fatalIssue(ctx, "the access token JWKS was invalid", val);
+            case (err instanceof JWTClaimValidationFailed):
+                return fatalIssue(ctx, "claim validtion of the JWT failed", val);
+            default:
+                l.error("unhandled access token validation error", "in", "transformAuthorizationHeader", "error", err);
+                return fatalIssue(ctx, "unhandled access token validation error", val);
+        }
+    }
+};
+export const transformPublicKey = (val, ctx) => {
+    try {
+        const key = typeof val === "string" ? parseKey(Buffer.from(val, "base64")) : parseKey(val);
+        return key;
+    }
+    catch (err) {
+        switch (true) {
+            case (err instanceof TypeError):
+                ctx.issues.push({
+                    code: "custom",
+                    message: err.message,
+                    input: val
+                });
+                break;
+            case (err instanceof KeyParseError):
+                ctx.issues.push({
+                    code: "custom",
+                    message: err.message,
+                    input: val
+                });
+                break;
+            default:
+                ctx.issues.push({
+                    code: "custom",
+                    message: "unhandled error parsing public_key",
+                    input: val
+                });
+        }
+        return z.NEVER;
+    }
+};
+export const identityPrincipals = (env, payload, claim) => {
+    if (claim === undefined) {
+        claim = env.JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM;
+    }
+    const l = logger(env);
+    if (claim === "__proto__" || claim === "prototype" || claim === "constructor") {
+        l.warn("invalid principals claim configured", "claim", claim);
+        return [];
+    }
+    const p = payload[claim];
+    if (p === undefined) {
+        l.warn("claim was missing despite being set in CA config", "claim", claim);
+        return [];
+    }
+    if (p === "") {
+        l.warn("claim was present but was an empty string", "claim", claim);
+        return [];
+    }
+    // make sure its always a string[] and replace any spaces with underscores
+    const principals = (typeof p === "string" ? [p] : p)
+        .map((value) => value.replaceAll(" ", "_"));
+    l.info("identity token included principals", "principals", principals);
+    return principals;
+};
+export const parseIdentity = async (env, jwt, claim) => {
+    if (jwt === undefined) {
+        throw new Error("missing identity token");
+    }
+    const aud = env.JWT_AUD === undefined || env.JWT_AUD === "" ? undefined : split(env.JWT_AUD);
+    const { payload } = await verifyJWT(env, jwt, { aud: aud });
+    const principals = identityPrincipals(env, payload, claim);
+    return {
+        sub: payload.sub,
+        principals: principals,
+    };
+};
+export const transformIdentityToken = async (env, val, ctx) => {
+    try {
+        const identity = await parseIdentity(env, val, env.JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM);
+        return identity;
+    }
+    catch (err) {
+        ctx.issues.push({
+            code: "custom",
+            message: "problem parsing identity token",
+            input: val
+        });
+        return z.NEVER;
+    }
+};
+/**
+ *
+ * @param val A SSH certificate either a base64 encoded "string" or a "Buffer\<ArrayBufferLike\>"
+ * @param ctx The Zod context for any errors
+ * @returns
+ */
+export const transformCertificate = (val, ctx) => {
+    try {
+        const cert = typeof val === "string" ? parseCertificate(Buffer.from(val, "base64"), "openssh") : parseCertificate(val, "openssh");
+        return cert;
+    }
+    catch (err) {
+        switch (true) {
+            case (err instanceof TypeError):
+                ctx.issues.push({
+                    code: "custom",
+                    message: err.message,
+                    input: val
+                });
+                break;
+            case (err instanceof CertificateParseError):
+                ctx.issues.push({
+                    code: "custom",
+                    message: err.message,
+                    input: val
+                });
+                break;
+            default:
+                ctx.issues.push({
+                    code: "custom",
+                    message: "unhandled error parsing certificate",
+                    input: val
+                });
+        }
+        return z.NEVER;
+    }
+};
+export const refineCertificateRequest = async (env, val, ctx) => {
+    const l = logger(env);
+    try {
+        // check proof of possession fingerprint matches public key
+        if (!val.proof.matches(val.public_key)) {
+            return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val);
+        }
+        // verify proof of possession signature
+        const verified = await val.proof.verify();
+        if (!verified) {
+            return fatalIssue(ctx, "proof of possession signature validation failed", val);
+        }
+        return z.NEVER;
+    }
+    catch (err) {
+        l.error("proof of possession verification unhandled error", "in", "refineCertificateRequest", "error", err);
+        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
+    }
+};
+export const transformRenewalProofOfPossession = (env, val, ctx) => {
+    const l = logger(env);
+    try {
+        return new RenewalProofOfPossession(val, { logger: l, skew: ms(env.CERTIFICATE_REQUEST_TIME_SKEW_MAX) });
+    }
+    catch (err) {
+        if (err instanceof PossessionParseError) {
+            return fatalIssue(ctx, err.message, val);
+        }
+        l.error("proof of possession verification unhandled error", "in", "transformRenewalProofOfPossession", "error", err);
+        return fatalIssue(ctx, "proof of possession transform unhandled error", val);
+    }
+};
+export const refineHostCertificateRequest = async (env, val, ctx) => {
+    const l = logger(env).with("in", "refineHostCertificateRequest");
+    l.debug("started");
+    try {
+        // check proof of possession fingerprint matches public key
+        l.debug("checking val.proof.matches()", "public_key", val.public_key.toString("ssh"));
+        if (!val.proof.matches(val.public_key)) {
+            l.warn("proof of possession fingerprint did not match public_key");
+            return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val);
+        }
+        // verify proof of possession signature
+        l.debug("await val.proof.verify()");
+        const verified = await val.proof.verify();
+        if (!verified) {
+            l.warn("proof of possession signature validation failed");
+            return fatalIssue(ctx, "proof of possession signature validation failed", val);
+        }
+        l.debug("done");
+        return z.NEVER;
+    }
+    catch (err) {
+        l.error("proof of possession verification unhandled error", "error", err);
+        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
+    }
+};
+export const refineHostCertificateRenewal = async (env, val, ctx) => {
+    const l = logger(env);
+    try {
+        // ensure certificate is signed by CA
+        const issuer = await getPublic(env);
+        if (!val.certificate.isSignedByKey(issuer)) {
+            return fatalIssue(ctx, "the provided certificate was not signed by this CA", val);
+        }
+        // check certificate is not expired
+        if (val.certificate.isExpired()) {
+            return fatalIssue(ctx, "the provided certificate is expired", val);
+        }
+        // ensure certificate presented for renewal is not revoked
+        const serial = val.certificate.serial.readBigUInt64BE(0);
+        if (await isRevoked(env, serial)) {
+            return fatalIssue(ctx, "the provided certificate is revoked", val);
+        }
+        // check proof of possession fingerprint matches public key and certificate subject key
+        if (!val.proof.matches(val.public_key, val.certificate.subjectKey)) {
+            return fatalIssue(ctx, "proof of possession fingerprints did not match public_key and/or certificate", val);
+        }
+        // verify proof of possession signature
+        const verified = await val.proof.verify();
+        if (!verified) {
+            return fatalIssue(ctx, "proof of possession signature validation failed", val);
+        }
+        return z.NEVER;
+    }
+    catch (err) {
+        l.error("proof of possession verification unhandled error", "in", "refineHostCertificateRenewal", "error", err);
+        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
+    }
+};
+export const refineRevokeCertificate = async (env, val, ctx) => {
+    const l = logger(env);
+    try {
+        // check proof of possession fingerprint matches public key
+        if (!val.proof.matches(val.public_key)) {
+            return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val);
+        }
+        // verify proof of possession signature
+        const verified = await val.proof.verify();
+        if (!verified) {
+            return fatalIssue(ctx, "proof of possession signature validation failed", val);
+        }
+        return z.NEVER;
+    }
+    catch (err) {
+        l.error("proof of possession verification unhandled error", "in", "refineRevokeCertificate", "error", err);
+        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
+    }
+};
+export const split = (v) => {
+    if (v === "" || v === undefined) {
+        return [];
+    }
+    return v.split(",");
+};
+export const getPublic = async (env, key) => {
+    if (key === undefined) {
+        // grab private key from secret store
+        const secret = await env.PRIVATE_KEY.get();
+        // parse it
+        key = parsePrivateKey(secret);
+    }
+    // convert to a public key and add comment
+    const pub = key.toPublic();
+    pub.comment = env.ISSUER_DN;
+    // return in ssh format trimmed of any whitespace
+    return pub;
+};

package/dist/verify.d.ts

@@ -0,0 +1,7 @@
+import { CertificateRequestJWTPayload } from "./types";
+import type { SshCaBindings } from "./types";
+type VerifyOptions = {
+    aud?: string | string[];
+};
+export declare const verifyJWT: (env: SshCaBindings, jwt: string, opts?: VerifyOptions) => Promise<import("jose").JWTVerifyResult<CertificateRequestJWTPayload> & import("jose").ResolvedKey>;
+export {};

package/dist/verify.js

@@ -0,0 +1,16 @@
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { split } from "./utils";
+export const verifyJWT = async (env, jwt, opts = {}) => {
+    const JWKS = createRemoteJWKSet(new URL(env.JWT_JWKS_URL));
+    if (opts.aud !== undefined) {
+        return await jwtVerify(jwt, JWKS, {
+            issuer: env.JWT_ISSUER,
+            algorithms: split(env.JWT_ALGORITHMS),
+            audience: opts.aud
+        });
+    }
+    return await jwtVerify(jwt, JWKS, {
+        issuer: env.JWT_ISSUER,
+        algorithms: split(env.JWT_ALGORITHMS),
+    });
+};

package/package.json

@@ -0,0 +1,58 @@
+{
+	"name": "@andrewheberle/serverless-ssh-ca",
+	"version": "0.17.5",
+	"description": "A serverless SSH CA built on Cloudflare Workers",
+	"type": "module",
+	"main": "dist/index.js",
+	"types": "./dist/index.d.ts",
+	"files": [
+		"dist"
+	],
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"default": "./dist/index.js"
+		}
+	},
+	"scripts": {
+		"build": "tsc",
+		"test": "vitest run",
+		"test:watch": "vitest",
+		"prepublishOnly": "npm run build",
+		"release": "release-it"
+	},
+	"dependencies": {
+		"@andrewheberle/ts-slog": "^1.3.0",
+		"@cloudflare/actors": "^0.0.1-beta.6",
+		"chanfana": "^3.0.0",
+		"hono": "^4.10.6",
+		"itty-time": "^2.0.2",
+		"jose": "^6.0.12",
+		"sshpk": "^1.18.0",
+		"zod": "^4.0.0"
+	},
+	"devDependencies": {
+		"@cloudflare/workers-types": "^4.20260528.1",
+		"@types/sshpk": "^1.17.4",
+		"release-it": "^20.0.1",
+		"tsx": "^4.21.0",
+		"typescript": "^6.0.0"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/andrewheberle/serverless-ssh-ca.git",
+		"directory": "packages/ssh-ca"
+	},
+	"homepage": "https://github.com/andrewheberle/serverless-ssh-ca#readme",
+	"bugs": {
+		"url": "https://github.com/andrewheberle/serverless-ssh-ca/issues"
+	},
+	"author": "Andrew Heberle",
+	"license": "Apache-2.0",
+	"release-it": {
+		"git": false,
+		"npm": {
+			"skipChecks": true
+		}
+	}
+}