@andrewheberle/serverless-ssh-ca 0.17.5

package/dist/src/utils.js

@@ -0,0 +1,370 @@
+import { env } from "cloudflare:workers";
+import { JWKInvalid, JWKSInvalid, JWSInvalid, JWTClaimValidationFailed, JWTInvalid } from "jose/errors";
+import { KeyParseError, CertificateParseError, parseCertificate, parseKey, parsePrivateKey } from "sshpk";
+import z from "zod";
+import { verifyJWT } from "./verify";
+import { RenewalProofOfPossession, ProofOfPossession, PossessionParseError } from "./proof";
+import { isRevoked } from "./db";
+import { logger } from "./logger";
+export const fatalIssue = (ctx, message, val) => {
+    ctx.issues.push({
+        code: "custom",
+        message: message,
+        input: val
+    });
+    return z.NEVER;
+};
+export const transformProofOfPossession = (val, ctx) => {
+    try {
+        const proof = new ProofOfPossession(val, { logger: logger });
+        return proof;
+    }
+    catch (err) {
+        logger.error("proof of possession parsing error", "error", err);
+        switch (true) {
+            case (err instanceof PossessionParseError):
+                ctx.issues.push({
+                    code: "custom",
+                    message: err.message,
+                    input: val
+                });
+                break;
+            default:
+                ctx.issues.push({
+                    code: "custom",
+                    message: "proof of possession transform unhandled error",
+                    input: val
+                });
+        }
+        return z.NEVER;
+    }
+};
+export const transformAuthorizationHeader = async (val, ctx) => {
+    const jwt = val.replace("Bearer ", "");
+    if (jwt === "") {
+        return fatalIssue(ctx, "request did not contain a JWT", val);
+    }
+    try {
+        // verify jwt
+        const { payload } = await verifyJWT(jwt);
+        if (payload.email === undefined) {
+            return fatalIssue(ctx, "JWT was verified but was missing required email claim", val);
+        }
+        return {
+            email: payload.email,
+            sub: payload.sub,
+        };
+    }
+    catch (err) {
+        switch (true) {
+            case (err instanceof JWSInvalid):
+                return fatalIssue(ctx, "the access token was invalid", val);
+            case (err instanceof JWTInvalid):
+                return fatalIssue(ctx, "the access token failed verification", val);
+            case (err instanceof JWKInvalid):
+                return fatalIssue(ctx, "the access token JWK was invalid", val);
+            case (err instanceof JWKSInvalid):
+                return fatalIssue(ctx, "the access token JWKS was invalid", val);
+            case (err instanceof JWTClaimValidationFailed):
+                return fatalIssue(ctx, "claim validtion of the JWT failed", val);
+            default:
+                logger.error("unhandled access token validation error", "in", "transformAuthorizationHeader", "error", err);
+                return fatalIssue(ctx, "unhandled access token validation error", val);
+        }
+    }
+};
+export const transformPublicKey = (val, ctx) => {
+    try {
+        const key = typeof val === "string" ? parseKey(Buffer.from(val, "base64")) : parseKey(val);
+        return key;
+    }
+    catch (err) {
+        switch (true) {
+            case (err instanceof TypeError):
+                ctx.issues.push({
+                    code: "custom",
+                    message: err.message,
+                    input: val
+                });
+                break;
+            case (err instanceof KeyParseError):
+                ctx.issues.push({
+                    code: "custom",
+                    message: err.message,
+                    input: val
+                });
+                break;
+            default:
+                ctx.issues.push({
+                    code: "custom",
+                    message: "unhandled error parsing public_key",
+                    input: val
+                });
+        }
+        return z.NEVER;
+    }
+};
+export const identityPrincipals = (payload, claim) => {
+    if (claim === undefined) {
+        claim = env.JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM;
+    }
+    const p = payload[claim];
+    if (p === undefined) {
+        logger.warn("claim was missing despite being set in CA config", "claim", claim);
+        return [];
+    }
+    if (p === "") {
+        logger.warn("claim was present but was an empty string", "claim", claim);
+        return [];
+    }
+    // make sure its always a string[]
+    const principals = typeof p === "string" ? [p] : p;
+    // replace any spaces with underscores
+    principals.forEach((value, index, array) => {
+        array[index] = value.replaceAll(" ", "_");
+    });
+    logger.info("identity token included principals", "principals", principals);
+    return principals;
+};
+export const parseIdentity = async (jwt, claim) => {
+    if (jwt === undefined) {
+        throw new Error("missing identity token");
+    }
+    const aud = env.JWT_AUD === undefined || env.JWT_AUD === "" ? undefined : split(env.JWT_AUD);
+    const { payload } = await verifyJWT(jwt, { aud: aud });
+    const principals = identityPrincipals(payload, claim);
+    return {
+        sub: payload.sub,
+        principals: principals,
+    };
+};
+export const transformIdentityToken = async (val, ctx) => {
+    try {
+        const identity = await parseIdentity(val, env.JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM);
+        return identity;
+    }
+    catch (err) {
+        ctx.issues.push({
+            code: "custom",
+            message: "problem parsing identity token",
+            input: val
+        });
+        return z.NEVER;
+    }
+};
+/**
+ *
+ * @param val A SSH certificate either a base64 encoded "string" or a "Buffer\<ArrayBufferLike\>"
+ * @param ctx The Zod context for any errors
+ * @returns
+ */
+export const transformCertificate = (val, ctx) => {
+    try {
+        const cert = typeof val === "string" ? parseCertificate(Buffer.from(val, "base64"), "openssh") : parseCertificate(val, "openssh");
+        return cert;
+    }
+    catch (err) {
+        switch (true) {
+            case (err instanceof TypeError):
+                ctx.issues.push({
+                    code: "custom",
+                    message: err.message,
+                    input: val
+                });
+                break;
+            case (err instanceof CertificateParseError):
+                ctx.issues.push({
+                    code: "custom",
+                    message: err.message,
+                    input: val
+                });
+                break;
+            default:
+                ctx.issues.push({
+                    code: "custom",
+                    message: "unhandled error parsing certificate",
+                    input: val
+                });
+        }
+        return z.NEVER;
+    }
+};
+export const refineCertificateRequest = async (val, ctx) => {
+    try {
+        // check proof of possession fingerprint matches public key
+        if (!val.proof.matches(val.public_key)) {
+            return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val);
+        }
+        // verify proof of possession signature
+        const verified = await val.proof.verify();
+        if (!verified) {
+            return fatalIssue(ctx, "proof of possession signature validation failed", val);
+        }
+        return z.NEVER;
+    }
+    catch (err) {
+        logger.error("proof of possession verification unhandled error", "in", "refineCertificateRequest", "error", err);
+        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
+    }
+};
+export const refineLegacyCertificateRequest = async (val, ctx) => {
+    try {
+        // check proof of possession fingerprint matches public key
+        if (!val.nonce.matches(val.public_key)) {
+            return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val);
+        }
+        // verify proof of possession signature
+        const verified = await val.nonce.verify("file");
+        if (!verified) {
+            return fatalIssue(ctx, "proof of possession signature validation failed", val);
+        }
+        return z.NEVER;
+    }
+    catch (err) {
+        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
+    }
+};
+export const transformRenewalProofOfPossession = (val, ctx) => {
+    try {
+        return new RenewalProofOfPossession(val, { logger: logger });
+    }
+    catch (err) {
+        if (err instanceof PossessionParseError) {
+            return fatalIssue(ctx, err.message, val);
+        }
+        logger.error("proof of possession verification unhandled error", "in", "transformRenewalProofOfPossession", "error", err);
+        return fatalIssue(ctx, "proof of possession transform unhandled error", val);
+    }
+};
+export const refineHostCertificateRequest = async (val, ctx) => {
+    const l = logger.with("in", "refineHostCertificateRequest");
+    l.debug("started");
+    try {
+        // check proof of possession fingerprint matches public key
+        l.debug("checking val.proof.matches()", "public_key", val.public_key.toString("ssh"));
+        if (!val.proof.matches(val.public_key)) {
+            l.warn("proof of possession fingerprint did not match public_key");
+            return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val);
+        }
+        // verify proof of possession signature
+        l.debug("await val.proof.verify()");
+        const verified = await val.proof.verify();
+        if (!verified) {
+            l.warn("proof of possession signature validation failed");
+            return fatalIssue(ctx, "proof of possession signature validation failed", val);
+        }
+        l.debug("done");
+        return z.NEVER;
+    }
+    catch (err) {
+        l.error("proof of possession verification unhandled error", "error", err);
+        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
+    }
+};
+export const refineLegacyHostCertificateRequest = async (val, ctx) => {
+    try {
+        // check proof of possession fingerprint matches public key
+        if (!val.nonce.matches(val.public_key)) {
+            return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val);
+        }
+        // verify proof of possession signature
+        const verified = await val.nonce.verify("file");
+        if (!verified) {
+            return fatalIssue(ctx, "proof of possession signature validation failed", val);
+        }
+        return z.NEVER;
+    }
+    catch (err) {
+        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
+    }
+};
+export const refineHostCertificateRenewal = async (val, ctx) => {
+    try {
+        // ensure certificate is signed by CA
+        const issuer = await getPublic();
+        if (!val.certificate.isSignedByKey(issuer)) {
+            return fatalIssue(ctx, "the provided certificate was not signed by this CA", val);
+        }
+        // check certificate is not expired
+        if (val.certificate.isExpired()) {
+            return fatalIssue(ctx, "the provided certificate is expired", val);
+        }
+        // ensure certificate presented for renewal is not revoked
+        const serial = val.certificate.serial.readBigUInt64BE(0);
+        if (await isRevoked(serial)) {
+            return fatalIssue(ctx, "the provided certificate is revoked", val);
+        }
+        // check proof of possession fingerprint matches public key and certificate subject key
+        if (!val.proof.matches(val.public_key, val.certificate.subjectKey)) {
+            return fatalIssue(ctx, "proof of possession fingerprints did not match public_key and/or certificate", val);
+        }
+        // verify proof of possession signature
+        const verified = await val.proof.verify();
+        if (!verified) {
+            return fatalIssue(ctx, "proof of possession signature validation failed", val);
+        }
+        return z.NEVER;
+    }
+    catch (err) {
+        logger.error("proof of possession verification unhandled error", "in", "refineHostCertificateRenewal", "error", err);
+        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
+    }
+};
+export const refineRevokeCertificate = async (val, ctx) => {
+    try {
+        // check proof of possession fingerprint matches public key
+        if (!val.proof.matches(val.public_key)) {
+            return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val);
+        }
+        // verify proof of possession signature
+        const verified = await val.proof.verify();
+        if (!verified) {
+            return fatalIssue(ctx, "proof of possession signature validation failed", val);
+        }
+        return z.NEVER;
+    }
+    catch (err) {
+        logger.error("proof of possession verification unhandled error", "in", "refineRevokeCertificate", "error", err);
+        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
+    }
+};
+export const refineLegacyHostCertificateRenewal = async (val, ctx) => {
+    try {
+        // check certificate is not expired
+        if (val.certificate.isExpired()) {
+            return fatalIssue(ctx, "certificate is expired", val);
+        }
+        // check proof of possession fingerprint matches public key and certificate subject key
+        if (!val.nonce.matches(val.public_key, val.certificate.subjectKey)) {
+            return fatalIssue(ctx, "proof of possession fingerprints did not match public_key and/or certificate", val);
+        }
+        // verify proof of possession signature
+        const verified = await val.nonce.verify("file");
+        if (!verified) {
+            return fatalIssue(ctx, "proof of possession signature validation failed", val);
+        }
+        return z.NEVER;
+    }
+    catch (err) {
+        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
+    }
+};
+export const split = (v) => {
+    if (v === "" || v === undefined) {
+        return [];
+    }
+    return v.split(",");
+};
+export const getPublic = async (key) => {
+    if (key === undefined) {
+        // grab private key from secret store
+        const secret = await env.PRIVATE_KEY.get();
+        // parse it
+        key = parsePrivateKey(secret);
+    }
+    // convert to a public key and add comment
+    const pub = key.toPublic();
+    pub.comment = env.ISSUER_DN;
+    // return in ssh format trimmed of any whitespace
+    return pub;
+};

package/dist/src/verify.d.ts

@@ -0,0 +1,6 @@
+import { CertificateRequestJWTPayload } from "./types";
+type VerifyOptions = {
+    aud?: string | string[];
+};
+export declare const verifyJWT: (jwt: string, opts?: VerifyOptions) => Promise<import("jose").JWTVerifyResult<CertificateRequestJWTPayload> & import("jose").ResolvedKey>;
+export {};

package/dist/src/verify.js

@@ -0,0 +1,17 @@
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { env } from "cloudflare:workers";
+import { split } from "./utils";
+export const verifyJWT = async (jwt, opts = {}) => {
+    const JWKS = createRemoteJWKSet(new URL(env.JWT_JWKS_URL));
+    if (opts.aud !== undefined) {
+        return await jwtVerify(jwt, JWKS, {
+            issuer: env.JWT_ISSUER,
+            algorithms: split(env.JWT_ALGORITHMS),
+            audience: opts.aud
+        });
+    }
+    return await jwtVerify(jwt, JWKS, {
+        issuer: env.JWT_ISSUER,
+        algorithms: split(env.JWT_ALGORITHMS),
+    });
+};

package/dist/sshsig/armor.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Removes armoring from text SSH signatures and decodes it to raw bytes.
+ *
+ * @param {string} text SSH signature in armored format.
+ * @returns {Uint8Array} Raw bytes of the signature.
+ */
+export declare function dearmor(text: string): Uint8Array<ArrayBuffer>;

package/dist/sshsig/armor.js

@@ -0,0 +1,18 @@
+/**
+ * Removes armoring from text SSH signatures and decodes it to raw bytes.
+ *
+ * @param {string} text SSH signature in armored format.
+ * @returns {Uint8Array} Raw bytes of the signature.
+ */
+export function dearmor(text) {
+    const lines = text.trim().split("\n");
+    const first = lines.shift();
+    if (first !== "-----BEGIN SSH SIGNATURE-----") {
+        throw new Error("Bad header line, expected -----BEGIN SSH SIGNATURE----- got: " + first);
+    }
+    const last = lines.pop();
+    if (last !== "-----END SSH SIGNATURE-----") {
+        throw new Error("Bad trailer line, expected -----END SSH SIGNATURE----- got: " + last);
+    }
+    return Uint8Array.from(atob(lines.join("")).split("").map((x) => x.charCodeAt(0)));
+}

package/dist/sshsig/formats.d.ts

@@ -0,0 +1,52 @@
+import { Reader } from "./reader";
+/**
+ * Represents an SSH public key.
+ */
+export type Pubkey = {
+    pk_algo: "ssh-rsa";
+    e: Uint8Array;
+    n: Uint8Array;
+    toString(): string;
+} | {
+    pk_algo: "ssh-ed25519";
+    key: Uint8Array;
+    toString(): string;
+} | {
+    pk_algo: "ecdsa-sha2-nistp256" | "ecdsa-sha2-nistp384" | "ecdsa-sha2-nistp521";
+    curve: string;
+    point: Uint8Array;
+    toString(): string;
+} | {
+    pk_algo: "sk-ecdsa-sha2-nistp256@openssh.com";
+    curve: string;
+    point: Uint8Array;
+    application: string;
+    toString(): string;
+} | {
+    pk_algo: "sk-ssh-ed25519@openssh.com";
+    key: Uint8Array;
+    application: string;
+    toString(): string;
+};
+export declare function parsePubkey(pk_algo: string, publickey: Reader, raw_publickey: ArrayBuffer): Pubkey;
+export declare function convertPublicKey(publickey: Pubkey): {
+    format: "jwk";
+    keyData: JsonWebKey;
+} | {
+    format: "raw";
+    keyData: ArrayBuffer;
+};
+export declare function convertAlgorithm(sig_algo: string): {
+    name: string;
+    hash: {
+        name: string;
+    };
+    namedCurve?: undefined;
+} | {
+    name: string;
+    namedCurve: string;
+    hash: {
+        name: string;
+    };
+};
+export declare function convertHash(hashName: string): string;

package/dist/sshsig/formats.js

@@ -0,0 +1,174 @@
+export function parsePubkey(pk_algo, publickey, raw_publickey) {
+    let pubkey;
+    if (pk_algo === "ssh-rsa") {
+        pubkey = {
+            pk_algo,
+            e: new Uint8Array(publickey.readString().bytes()),
+            n: new Uint8Array(publickey.readString().bytes()),
+            toString() {
+                return `${pk_algo} ${base64Encode(new Uint8Array(raw_publickey))}`;
+            },
+        };
+    }
+    else if (pk_algo === "ssh-ed25519") {
+        pubkey = {
+            pk_algo,
+            key: new Uint8Array(publickey.readString().bytes()),
+            toString() {
+                return `${pk_algo} ${base64Encode(new Uint8Array(raw_publickey))}`;
+            },
+        };
+    }
+    else if (pk_algo === "sk-ssh-ed25519@openssh.com") {
+        const key = new Uint8Array(publickey.readString().bytes());
+        const application = publickey.readString().toString();
+        pubkey = {
+            pk_algo,
+            key,
+            application,
+            toString() {
+                return `${pk_algo} ${base64Encode(new Uint8Array(raw_publickey))}`;
+            },
+        };
+    }
+    else if (pk_algo === "ecdsa-sha2-nistp256" || pk_algo === "ecdsa-sha2-nistp384" ||
+        pk_algo === "ecdsa-sha2-nistp521") {
+        const curve = publickey.readString().toString();
+        const point = new Uint8Array(publickey.readString().bytes());
+        pubkey = {
+            pk_algo,
+            curve,
+            point,
+            toString() {
+                return `${pk_algo} ${base64Encode(new Uint8Array(raw_publickey))}`;
+            },
+        };
+    }
+    else if (pk_algo === "sk-ecdsa-sha2-nistp256@openssh.com") {
+        const curve = publickey.readString().toString();
+        const point = new Uint8Array(publickey.readString().bytes());
+        const application = publickey.readString().toString();
+        pubkey = {
+            pk_algo,
+            curve,
+            point,
+            application,
+            toString() {
+                return `${pk_algo} ${base64Encode(new Uint8Array(raw_publickey))}`;
+            },
+        };
+    }
+    else {
+        throw new Error(`Unsupported pk_algo: ${pk_algo}`);
+    }
+    return pubkey;
+}
+function base64Encode(bytes) {
+    return btoa(String.fromCharCode.apply(null, bytes));
+}
+function base64UrlEncode(bytes) {
+    return base64Encode(bytes)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=/g, "");
+}
+export function convertPublicKey(publickey) {
+    const pk_algo = publickey.pk_algo;
+    if (pk_algo === "ssh-rsa") {
+        return {
+            keyData: {
+                kty: "RSA",
+                e: base64UrlEncode(publickey.e),
+                n: base64UrlEncode(publickey.n),
+            },
+            format: "jwk",
+        };
+    }
+    else if (pk_algo === "ssh-ed25519" || pk_algo === "sk-ssh-ed25519@openssh.com") {
+        return {
+            keyData: publickey.key.buffer.slice(publickey.key.byteOffset, publickey.key.byteOffset + publickey.key.byteLength),
+            format: "raw",
+        };
+    }
+    else if (pk_algo === "ecdsa-sha2-nistp256" || pk_algo === "ecdsa-sha2-nistp384" ||
+        pk_algo === "ecdsa-sha2-nistp521" ||
+        pk_algo === "sk-ecdsa-sha2-nistp256@openssh.com") {
+        if (publickey.point[0] !== 0x04) {
+            throw new Error("Only uncompressed (0x04) format is supported");
+        }
+        const point = publickey.point.slice(1);
+        let crv;
+        if (pk_algo === "ecdsa-sha2-nistp256" ||
+            pk_algo === "sk-ecdsa-sha2-nistp256@openssh.com") {
+            crv = "P-256";
+        }
+        else if (pk_algo === "ecdsa-sha2-nistp384") {
+            crv = "P-384";
+        }
+        {
+            crv = "P-521";
+        }
+        return {
+            keyData: {
+                kty: "EC",
+                crv,
+                x: base64UrlEncode(point.slice(0, point.length / 2)),
+                y: base64UrlEncode(point.slice(point.length / 2)),
+            },
+            format: "jwk",
+        };
+    }
+    else {
+        throw new Error(`Unsupported algo: ${pk_algo}`);
+    }
+}
+export function convertAlgorithm(sig_algo) {
+    if (sig_algo === "rsa-sha2-512") {
+        return {
+            name: "RSASSA-PKCS1-v1_5",
+            hash: { name: "SHA-512" },
+        };
+    }
+    else if (sig_algo === "ssh-ed25519" || sig_algo === "sk-ssh-ed25519@openssh.com") {
+        return {
+            name: "Ed25519",
+            hash: { name: "SHA-512" },
+        };
+    }
+    else if (sig_algo === "ecdsa-sha2-nistp256" ||
+        sig_algo === "sk-ecdsa-sha2-nistp256@openssh.com") {
+        return {
+            name: "ECDSA",
+            namedCurve: "P-256",
+            hash: { name: "SHA-256" },
+        };
+    }
+    else if (sig_algo === "ecdsa-sha2-nistp384") {
+        return {
+            name: "ECDSA",
+            namedCurve: "P-384",
+            hash: { name: "SHA-384" },
+        };
+    }
+    else if (sig_algo === "ecdsa-sha2-nistp521") {
+        return {
+            name: "ECDSA",
+            namedCurve: "P-521",
+            hash: { name: "SHA-512" },
+        };
+    }
+    else {
+        throw new Error(`Unsupported algo: ${sig_algo}`);
+    }
+}
+export function convertHash(hashName) {
+    if (hashName === "sha256") {
+        return "SHA-256";
+    }
+    else if (hashName === "sha512") {
+        return "SHA-512";
+    }
+    else {
+        throw new Error(`Unknown hash: ${hashName}`);
+    }
+}

package/dist/sshsig/index.d.ts

@@ -0,0 +1,15 @@
+import { Sig } from "./sig";
+/**
+ * Verifies SSH signature against provided data.
+ *
+ * Returns `true` if the `signature` is a valid signature over `signed_data`, `false` otherwise.
+ *
+ * @param {Sig | string} signature SSH signature.
+ * @param {Uint8Array | string} signed_data Data that has been signed.
+ * @param {object} options Pass-in subtle crypto if required or a specific namespace.
+ * @returns {Promise<boolean>} Resolves to true if the signature is valid, to false otherwise.
+ */
+export declare function verify(signature: Sig | string, signed_data: Uint8Array | string, options?: {
+    subtle?: SubtleCrypto;
+    namespace?: string;
+}): Promise<boolean>;