@andrewheberle/serverless-ssh-ca 0.21.0 → 0.23.0

package/src/certificate.ts

@@ -1,14 +1,9 @@
 import { seconds } from "itty-time"
-import sshpk from "sshpk"
-import type { Certificate, Identity, Key, PrivateKey } from "sshpk"
-import { SSHExtension } from "./types.js"
+import type { PrivateKey, PublicKey } from "./ssh/keys.js"
 import { getPrivateKey, split } from "./utils.js"
 import type { SshCaBindings } from "./types.js"
-
-// sshpk is CommonJS and Node's ESM loader cannot detect most of its named exports, so values are taken from the default import
-const { createCertificate, identityForHost, identityForUser, identityFromDN } = sshpk
-
-// const sshCertificateExtensions = split(env.SSH_CERTIFICATE_EXTENSIONS)
+import { signCertificate, type CertificateFields, type SshCertificate } from "./ssh/certificate.js"
+import { createSigner } from "./ssh/signer.js"
 
 export type CreateCertificateOptions = {
 	lifetime?: number
@@ -16,12 +11,6 @@ export type CreateCertificateOptions = {
 	extensions?: string[]
 }
 
-/* const DefaultCreateCertificateOptions: CreateCertificateOptions = {
-	lifetime: seconds(env.SSH_CERTIFICATE_LIFETIME),
-	principals: [],
-	extensions: sshCertificateExtensions
-} */
-
 export class CertificateError extends Error {
 	constructor(message: string) {
 		super(message)
@@ -41,18 +30,36 @@ export type GenerateCertificateOptions = {
 	serial?: bigint
 } & CreateCertificateOptions
 
-export const generateCertificate = (env: SshCaBindings, email: string, key: PrivateKey, public_key: Key, options?: GenerateCertificateOptions): Certificate => {
-	let { lifetime } = options ?? {}
-	const { principals, extensions, serial } = options ?? {}
+/**
+ * Signs a certificate with the CA key
+ *
+ * @throws {@link CertificateError} when the certificate has no principals,
+ * as OpenSSH accepts a certificate without principals for any user or host
+ */
+const sign = async (key: PrivateKey, fields: Omit<CertificateFields, "validAfter" | "validBefore">, lifetime: number): Promise<SshCertificate> => {
+	if (fields.principals.length === 0) {
+		throw new CertificateError("a certificate must have at least one principal")
+	}
+
+	// the validity is to the second, so starts at the current second rather
+	// than in the future
+	const validAfter = new Date(Math.floor(Date.now() / 1000) * 1000)
+	const validBefore = new Date(validAfter.getTime() + lifetime * 1000)
 
-	// add identities
+	return await signCertificate({ ...fields, validAfter, validBefore }, await createSigner(key))
+}
+
+export const generateCertificate = async (env: SshCaBindings, email: string, key: PrivateKey, public_key: PublicKey, options?: GenerateCertificateOptions): Promise<SshCertificate> => {
+	const { lifetime, principals, extensions, serial } = options ?? {}
+
+	// add principals
 	const includeSelf = env.SSH_CERTIFICATE_INCLUDE_SELF === undefined
 		? false
 		: typeof env.SSH_CERTIFICATE_INCLUDE_SELF === "string"
 			? env.SSH_CERTIFICATE_INCLUDE_SELF === "true"
 			: env.SSH_CERTIFICATE_INCLUDE_SELF
-	const identity = includeSelf
-		? [identityForUser(email.split("@")[0]!)]
+	const certificatePrincipals = includeSelf
+		? [email.split("@")[0]!]
 		: []
 
 	// add email?
@@ -62,86 +69,43 @@ export const generateCertificate = (env: SshCaBindings, email: string, key: Priv
 			? env.SSH_CERTIFICATE_INCLUDE_SELF_EMAIL === "true"
 			: env.SSH_CERTIFICATE_INCLUDE_SELF_EMAIL
 	if (includeSelfEmail) {
-		identity.push(identityForUser(email))
+		certificatePrincipals.push(email)
 	}
 
 	if (principals !== undefined) {
-		for (const p of principals) {
-			identity.push(identityForUser(p))
-		}
-	}
-
-	for (const p of split(env.SSH_CERTIFICATE_PRINCIPALS)) {
-		identity.push(identityForUser(p))
+		certificatePrincipals.push(...principals)
 	}
 
-
-	// lifetime is the smaller of what was provided in the options or the default
-	lifetime = lifetime !== undefined
-		? Math.min(lifetime, seconds(env.SSH_CERTIFICATE_LIFETIME))
-		: seconds(env.SSH_CERTIFICATE_LIFETIME)
-
-	// generate value for serial of certificate
-	const s = generateSerial(serial)
-
-	// set issuer of certificate based on ISSUER_DN
-	const issuer = identityFromDN(env.ISSUER_DN)
-
-	// create certificate
-	const certificate = createCertificate(identity, public_key, issuer, key, { lifetime: lifetime, serial: s })
-
-	// ensure openssh info is included in certificate (should not occur)
-	if (certificate.signatures.openssh === undefined) {
-		throw new CertificateError("missing openssh information in certificate")
-	}
+	certificatePrincipals.push(...split(env.SSH_CERTIFICATE_PRINCIPALS))
 
 	const sshCertificateExtensions = split(env.SSH_CERTIFICATE_EXTENSIONS)
 
-	// add usage extensions
-	const sshextensions: SSHExtension[] = []
+	// if extensions are provided in request, ensure they do not include extra extensions beyond the defaults
 	if (extensions !== undefined) {
-		// if extensions are provided in request, ensure they do not include extra extensions beyond the defaults
 		for (const ext of extensions) {
 			if (!sshCertificateExtensions.includes(ext)) {
 				throw new CertificateError(`${ext} is not allowed`)
 			}
-
-			// add to list of allowed extensions
-			sshextensions.push({
-				critical: false,
-				name: ext,
-				data: Buffer.alloc(0)
-			})
-		}
-	} else {
-		// use defaults if not provided
-		sshCertificateExtensions.forEach((ext: string) => {
-			sshextensions.push({
-				critical: false,
-				name: ext,
-				data: Buffer.alloc(0)
-			})
-		})
-
-	}
-
-	// add info to certificate
-	certificate.signatures = {
-		openssh: {
-			nonce: certificate.signatures.openssh.nonce,
-			keyId: email,
-			signature: certificate.signatures.openssh.signature,
-			exts: sshextensions
 		}
 	}
 
-	// re-sign after changes
-	certificate.signWith(key)
+	// lifetime is the smaller of what was provided in the options or the default
+	const certificateLifetime = lifetime !== undefined
+		? Math.min(lifetime, seconds(env.SSH_CERTIFICATE_LIFETIME))
+		: seconds(env.SSH_CERTIFICATE_LIFETIME)
 
-	return certificate
+	return await sign(key, {
+		kind: "user",
+		publicKey: public_key,
+		serial: serial ?? generateSerial(),
+		keyId: email,
+		principals: certificatePrincipals,
+		// use defaults if not provided
+		extensions: extensions ?? sshCertificateExtensions,
+	}, certificateLifetime)
 }
 
-export async function createSignedCertificate(env: SshCaBindings, email: string, public_key: Key, options?: CreateCertificateOptions): Promise<Certificate> {
+export async function createSignedCertificate(env: SshCaBindings, email: string, public_key: PublicKey, options?: CreateCertificateOptions): Promise<SshCertificate> {
 	// grab private key from secret store
 	const key = await getPrivateKey(env)
 
@@ -153,13 +117,12 @@ export async function createSignedCertificate(env: SshCaBindings, email: string,
 		}
 	}
 
-	return generateCertificate(env, email, key, public_key, options)
+	return await generateCertificate(env, email, key, public_key, options)
 }
 
 export type CreateHostCertificateOptions = {
 	lifetime?: number
 	principals?: string[]
-	subjects?: Identity[]
 }
 
 export class BadIssuerError extends Error {
@@ -171,54 +134,30 @@ export class BadIssuerError extends Error {
 	}
 }
 
-export async function createSignedHostCertificate(env: SshCaBindings, public_key: Key, options?: CreateHostCertificateOptions): Promise<Certificate> {
-	if (options === undefined) {
-		options = {
-			lifetime: seconds(env.SSH_HOST_CERTIFICATE_LIFETIME),
-			principals: []
-		}
-	}
-	// generate list of identities for host key
-	const identity: Identity[] = []
-	if (options.principals !== undefined) {
-		for (const p of options.principals) {
-			identity.push(identityForHost(p))
-		}
-	}
-
-	// add any already provided subjects (for renewals only)
-	if (options.subjects !== undefined) {
-		identity.push(...options.subjects)
-	}
+export async function createSignedHostCertificate(env: SshCaBindings, public_key: PublicKey, options?: CreateHostCertificateOptions): Promise<SshCertificate> {
+	const principals = options?.principals ?? []
 
 	// grab private key from secret store
 	const key = await getPrivateKey(env)
 
 	// lifetime is the smaller of what was provided in the options or the default
-	const lifetime = options.lifetime !== undefined
+	const lifetime = options?.lifetime !== undefined
 		? Math.min(options.lifetime, seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
 		: seconds(env.SSH_HOST_CERTIFICATE_LIFETIME)
 
-	// generate value for serial of certificate
-	const serial = generateSerial()
-
-	// set issuer of certificate based on ISSUER_DN
-	const issuer = identityFromDN(env.ISSUER_DN)
-
-	// create certificate
-	const certificate = createCertificate(identity, public_key, issuer, key, { lifetime: lifetime, serial: serial })
-
-	return certificate
+	return await sign(key, {
+		kind: "host",
+		publicKey: public_key,
+		serial: generateSerial(),
+		keyId: `host_${principals[0]}`,
+		principals,
+		extensions: [],
+	}, lifetime)
 }
 
-export const generateSerial = (serial?: bigint): Buffer<ArrayBuffer> => {
-	if (serial !== undefined) {
-		const s = Buffer.alloc(8)
-		s.writeBigUInt64BE(serial)
-
-		return s
-	}
-
-	const randomBytes = crypto.getRandomValues(new Uint8Array(8))
-	return Buffer.from(randomBytes)
+/**
+ * Returns a random certificate serial number
+ */
+export const generateSerial = (): bigint => {
+	return new DataView(crypto.getRandomValues(new Uint8Array(8)).buffer).getBigUint64(0)
 }

package/src/db/index.ts

@@ -1,31 +1,12 @@
-import type { Certificate, Format, Identity } from "sshpk"
+import { PublicKey } from "../ssh/keys.js"
+import type { SshCertificate } from "../ssh/certificate.js"
 import { logger } from "../logger.js"
 import type { SshCaBindings } from "../types.js"
 import { D1QB } from "workers-qb"
+import { z } from "zod"
 import { migrateOnce } from "./migrate.js"
 import { migrations } from "./migrations/index.js"
-
-export enum CertificateType {
-	User,
-	Host
-}
-
-export type CertificateRecord = {
-	id: number
-	serial: string
-	key_id: string
-	principals: string
-	extensions: string | null
-	valid_after: Date
-	valid_before: Date
-	revoked_at: Date | null
-	certificate_type: CertificateType
-	public_key: string | null
-}
-
-export type DatabaseSchema = {
-	certificates: CertificateRecord
-}
+import { CertificateType, type CertificateRecord, type DatabaseSchema, type KrlRecord } from "./types.js"
 
 const connect = async (env: SshCaBindings): Promise<D1QB<DatabaseSchema>> => {
 	const l = logger(env)
@@ -68,27 +49,22 @@ export const dbCleanup = async (env: SshCaBindings) => {
 	}
 }
 
-export const recordCertificate = async (env: SshCaBindings, certificate: Certificate, keyid: string, certificateType: CertificateType = CertificateType.User) => {
-	const serial = certificate.serial.readBigUInt64BE(0)
-	const subjects = certificate.subjects.map((v: Identity): string => {
-		return v.toString()
-	}).join(",")
-	const extensions = certificate.getExtensions().map((v: Format.OpenSshSignatureExt | Format.x509SignatureExt): string => {
-		// @ts-expect-error: the name property does exist
-		return v.name as string
-	}).join(",")
+export const recordCertificate = async (env: SshCaBindings, certificate: SshCertificate, keyid: string, certificateType: CertificateType = CertificateType.User) => {
+	// principals are recorded as distinguished names, as they were when
+	// certificates were created with sshpk
+	const principals = certificate.principals.map((p) => `${certificate.kind === "host" ? "CN" : "UID"}=${p}`).join(",")
 	const qb = await connect(env)
 	const res = await qb.insert({
 		tableName: "certificates",
 		data: {
-			serial: `${serial}`,
+			serial: `${certificate.serial}`,
 			key_id: keyid,
-			principals: subjects,
-			extensions: extensions,
-			valid_after: certificate.validFrom.toISOString(),
-			valid_before: certificate.validUntil.toISOString(),
+			principals: principals,
+			extensions: certificate.extensions.join(","),
+			valid_after: certificate.validAfter.toISOString(),
+			valid_before: certificate.validBefore.toISOString(),
 			certificate_type: certificateType,
-			public_key: certificate.subjectKey.toString("ssh")
+			public_key: certificate.publicKey.toString()
 		},
 	}).execute()
 
@@ -115,21 +91,44 @@ export enum RevocationStatus {
 	NotFound,
 	Revoked,
 	Revokable,
-	Unrevokable
 }
 
-export const revocationStatus = async (env: SshCaBindings, serial: bigint, publickey: string, certificateType: CertificateType): Promise<RevocationStatus> => {
+// whether a public key recorded in OpenSSH format is the same as another key,
+// treating a recorded key that cannot be parsed as a different key
+const isKey = (recorded: string, publicKey: PublicKey): boolean => {
+	try {
+		return PublicKey.parse(recorded).equals(publicKey)
+	} catch {
+		return false
+	}
+}
+
+/**
+ * Returns whether a certificate can be revoked by the holder of a public key.
+ *
+ * The public key is compared by fingerprint, so a key with a different
+ * comment to the one the certificate was issued for still matches.
+ *
+ * @param env The CA bindings
+ * @param serial The serial of the certificate
+ * @param publicKey The public key the requester has proven possession of
+ * @param certificateType The type of certificate
+ * @returns The revocation status of the certificate
+ */
+export const revocationStatus = async (env: SshCaBindings, serial: bigint, publicKey: PublicKey, certificateType: CertificateType): Promise<RevocationStatus> => {
 	const qb = await connect(env)
 	const res = await qb.fetchOne({
 		tableName: "certificates",
 		fields: ["public_key", "revoked_at"],
 		where: {
-			conditions: "serial = ? AND public_key = ? AND certificate_type = ?",
-			params: [`${serial}`, publickey, certificateType]
+			conditions: "serial = ? AND certificate_type = ?",
+			params: [`${serial}`, certificateType]
 		}
 	}).execute()
 
-	if (res.results === undefined) {
+	// a certificate issued for another key is reported as not found, so
+	// requests cannot be used to discover which serials exist
+	if (res.results?.public_key == null || !isKey(res.results.public_key, publicKey)) {
 		return RevocationStatus.NotFound
 	}
 
@@ -137,16 +136,14 @@ export const revocationStatus = async (env: SshCaBindings, serial: bigint, publi
 		return RevocationStatus.Revoked
 	}
 
-	if (publickey === res.results.public_key) {
-		return RevocationStatus.Revokable
-	}
-
-	return RevocationStatus.Unrevokable
+	return RevocationStatus.Revokable
 }
 
 export const getRevocationList = async (env: SshCaBindings, certificateType: CertificateType): Promise<string[]> => {
 	const qb = await connect(env)
-	const res = await qb.fetchAll({
+	// fetchAll cannot infer the table from its parameters, so it is given explicitly
+	// as otherwise the result is untyped once the schema has more than one table
+	const res = await qb.fetchAll<"certificates", "serial">({
 		tableName: "certificates",
 		fields: ["serial"],
 		where: {
@@ -192,3 +189,70 @@ export const revokeCertificate = async (env: SshCaBindings, serial: bigint): Pro
 
 	return res.results
 }
+
+const KrlVersionRow = z.object({
+	version: z.number().int().nonnegative(),
+	digest: z.string().nullable(),
+})
+
+// the number of times to retry when another request updates the KRL version concurrently
+const KRL_VERSION_ATTEMPTS = 5
+
+/**
+ * Get the version of the KRL for a certificate type, incrementing it if the
+ * content of the KRL has changed since the version was last returned.
+ *
+ * The version is only ever incremented, so clients can use it to detect a
+ * newer KRL. When several requests see the same change concurrently the
+ * version is incremented once.
+ *
+ * @param env The bindings for the CA, see {@link SshCaBindings}
+ * @param certificateType The type of certificates in the KRL, see {@link CertificateType}
+ * @param digest A digest of the content of the KRL, which changes whenever the content does
+ * @returns The version to use for the KRL
+ */
+export const getKrlVersion = async (env: SshCaBindings, certificateType: CertificateType, digest: string): Promise<bigint> => {
+	const qb = await connect(env)
+
+	for (let attempt = 0; attempt < KRL_VERSION_ATTEMPTS; attempt++) {
+		const res = await qb.fetchOne({
+			tableName: "krl",
+			fields: ["version", "digest"],
+			where: {
+				conditions: "certificate_type = ?",
+				params: certificateType
+			}
+		}).execute()
+
+		const current = KrlVersionRow.parse(res.results)
+		if (current.digest === digest) {
+			return BigInt(current.version)
+		}
+
+		// only update if the version has not been changed by another request
+		const next = current.version + 1
+		const updated = await qb.update<Pick<KrlRecord, "version">>({
+			tableName: "krl",
+			data: {
+				version: next,
+				digest: digest,
+				updated_at: (new Date).toISOString()
+			},
+			where: {
+				conditions: "certificate_type = ? AND version = ?",
+				params: [certificateType, current.version]
+			},
+			returning: ["version"]
+		}).execute()
+
+		if (!updated.success) {
+			throw new Error("error during query")
+		}
+
+		if (updated.results !== undefined && updated.results.length > 0) {
+			return BigInt(next)
+		}
+	}
+
+	throw new Error("unable to update KRL version due to concurrent updates")
+}

package/src/db/migrations/0002_krl_version.ts

@@ -0,0 +1,16 @@
+import type { Migration } from "../migrate.js"
+
+export const migration: Migration = {
+	name: "0002_krl_version",
+	statements: [
+		`CREATE TABLE IF NOT EXISTS krl (
+			certificate_type INTEGER PRIMARY KEY,
+			version INTEGER NOT NULL,
+			digest TEXT,
+			updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP NOT NULL
+		)`,
+		// KRLs were previously always version 1 and have no digest, so the
+		// first KRL generated after this migration is version 2
+		"INSERT OR IGNORE INTO krl (certificate_type, version, digest) VALUES (0, 1, NULL), (1, 1, NULL)",
+	]
+}

package/src/db/migrations/index.ts

@@ -1,6 +1,8 @@
 import type { Migration } from "../migrate.js"
 import { migration as initialSchema0001 } from "./0001_initial_schema.js"
+import { migration as krlVersion0002 } from "./0002_krl_version.js"
 
 export const migrations: Migration[] = [
-	initialSchema0001
+	initialSchema0001,
+	krlVersion0002,
 ]

package/src/db/types.ts

@@ -0,0 +1,40 @@
+/**
+ * Database types used by workers-qb to type queries.
+ *
+ * These must match the schema created by the migrations in `./migrations`, so
+ * update them with any change to the database.
+ */
+
+/** The type of certificate, as stored in the `certificate_type` column */
+export enum CertificateType {
+	User,
+	Host
+}
+
+/** A row in the `certificates` table */
+export type CertificateRecord = {
+	id: number
+	serial: string
+	key_id: string
+	principals: string
+	extensions: string | null
+	valid_after: Date
+	valid_before: Date
+	revoked_at: Date | null
+	certificate_type: CertificateType
+	public_key: string | null
+}
+
+/** A row in the `krl` table, holding the current version of the KRL for a {@link CertificateType} */
+export type KrlRecord = {
+	certificate_type: CertificateType
+	version: number
+	digest: string | null
+	updated_at: Date
+}
+
+/** The tables in the database, used to type queries made with workers-qb */
+export type DatabaseSchema = {
+	certificates: CertificateRecord
+	krl: KrlRecord
+}