@andrewheberle/serverless-ssh-ca 0.21.0 → 0.23.0

package/src/ssh/signer.ts

@@ -0,0 +1,129 @@
+import * as P from "micro-packed"
+import { toFixedWidth } from "../sshsig/sig_parser.js"
+import { decodePublicKey, SSHBytes, SSHText, SSHUnsignedMpint } from "./encoding.js"
+import type { EcdsaCurve, PrivateKey, PublicKey } from "./keys.js"
+
+/**
+ * Signs data with a CA key using WebCrypto, returning signatures in the SSH
+ * wire format
+ */
+export interface Signer {
+	/** The wire encoding of the public key of the signer */
+	readonly publicKey: Uint8Array
+	/**
+	 * Signs data
+	 *
+	 * @param data The data to sign
+	 * @returns The signature in the SSH wire format (RFC 4253 section 6.6)
+	 */
+	sign(data: Uint8Array<ArrayBuffer>): Promise<Uint8Array>
+}
+
+/** An Ed25519 signature: string algorithm, string signature */
+const Ed25519Signature = P.struct({
+	algorithm: SSHText,
+	signature: SSHBytes,
+})
+
+/** An ECDSA signature: string algorithm, string (mpint r, mpint s) */
+const EcdsaSignature = P.struct({
+	algorithm: SSHText,
+	signature: P.prefix(P.U32BE, P.struct({
+		r: SSHUnsignedMpint,
+		s: SSHUnsignedMpint,
+	})),
+})
+
+const EcdsaCurves: Readonly<Record<EcdsaCurve, { namedCurve: string, hash: string, size: number }>> = {
+	nistp256: { namedCurve: "P-256", hash: "SHA-256", size: 32 },
+	nistp384: { namedCurve: "P-384", hash: "SHA-384", size: 48 },
+	nistp521: { namedCurve: "P-521", hash: "SHA-512", size: 66 },
+}
+
+/**
+ * Creates a {@link Signer} for an Ed25519 or ECDSA (P-256, P-384 or P-521)
+ * private key
+ *
+ * @param key The private key to sign with
+ * @returns The signer
+ */
+export const createSigner = async (key: PrivateKey): Promise<Signer> => {
+	const publicKey = key.publicKey.blob
+
+	if (key.type === "ed25519") {
+		const cryptoKey = await crypto.subtle.importKey("jwk", key.jwk, { name: "Ed25519" }, false, ["sign"])
+
+		return {
+			publicKey,
+			sign: async (data) => Ed25519Signature.encode({
+				algorithm: "ssh-ed25519",
+				signature: new Uint8Array(await crypto.subtle.sign({ name: "Ed25519" }, cryptoKey, data)),
+			}),
+		}
+	}
+
+	const curve = EcdsaCurves[key.curve]
+	const cryptoKey = await crypto.subtle.importKey("jwk", key.jwk, { name: "ECDSA", namedCurve: curve.namedCurve }, false, ["sign"])
+
+	return {
+		publicKey,
+		sign: async (data) => {
+			// WebCrypto returns r || s, each the size of the curve
+			const signature = new Uint8Array(await crypto.subtle.sign({ name: "ECDSA", hash: { name: curve.hash } }, cryptoKey, data))
+
+			return EcdsaSignature.encode({
+				// the algorithm is named for the curve of the key, never
+				// worked out from the signature
+				algorithm: `ecdsa-sha2-${key.curve}`,
+				signature: {
+					r: signature.subarray(0, curve.size),
+					s: signature.subarray(curve.size),
+				},
+			})
+		},
+	}
+}
+
+/**
+ * Verifies a signature in the SSH wire format made with an Ed25519 or ECDSA
+ * key
+ *
+ * @param publicKey The key the signature must have been made with
+ * @param signature The signature in the SSH wire format
+ * @param data The data that was signed
+ * @returns true if the signature is valid, false if it is not or the key type is not supported
+ */
+export const verify = async (publicKey: PublicKey, signature: Uint8Array, data: Uint8Array<ArrayBuffer>): Promise<boolean> => {
+	try {
+		const { type, fields } = decodePublicKey(publicKey.blob)
+
+		if (type === "ssh-ed25519") {
+			const { algorithm, signature: raw } = Ed25519Signature.decode(signature)
+			if (algorithm !== type) {
+				return false
+			}
+			const cryptoKey = await crypto.subtle.importKey("raw", new Uint8Array(fields[0]!), { name: "Ed25519" }, false, ["verify"])
+
+			return await crypto.subtle.verify({ name: "Ed25519" }, cryptoKey, new Uint8Array(raw), data)
+		}
+
+		const curveName = type.replace(/^ecdsa-sha2-/, "") as EcdsaCurve
+		const curve = EcdsaCurves[curveName]
+		if (curve !== undefined && type === `ecdsa-sha2-${curveName}`) {
+			const { algorithm, signature: { r, s } } = EcdsaSignature.decode(signature)
+			if (algorithm !== type || r.length > curve.size || s.length > curve.size) {
+				return false
+			}
+			// fields are the curve name and the public point
+			const cryptoKey = await crypto.subtle.importKey("raw", new Uint8Array(fields[1]!), { name: "ECDSA", namedCurve: curve.namedCurve }, false, ["verify"])
+			const raw = P.utils.concatBytes(toFixedWidth(r, curve.size), toFixedWidth(s, curve.size))
+
+			return await crypto.subtle.verify({ name: "ECDSA", hash: { name: curve.hash } }, cryptoKey, new Uint8Array(raw), data)
+		}
+
+		return false
+	} catch {
+		// a signature or key that cannot be decoded or imported is not valid
+		return false
+	}
+}

package/src/types.ts

@@ -20,12 +20,6 @@ export type CertificateRequestJWTPayload = {
     [key: string]: string | string[]
 } & JWTPayload
 
-export type SSHExtension = {
-    critical: boolean;
-    name: string;
-    data: Buffer<ArrayBuffer>
-}
-
 /**
  * The result of executing a statement via {@link CaPreparedStatement.run} or
  * {@link CaDatabase.batch}, modelled on a Cloudflare D1 result.
@@ -99,23 +93,23 @@ export interface CaSecret {
  * {@link CaSecret} for the non-string bindings.
  */
 export interface SshCaBindings {
-    DB: CaDatabase
+	CERTIFICATE_REQUEST_TIME_SKEW_MAX: string
+	JWT_ALGORITHMS: string | string[]
+	JWT_AUD?: string | string[]
+	JWT_ISSUER: string
+	JWT_JWKS_URL: string
+	JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: string
+	LOG_LEVEL?: string
     DB_CERTIFICATE_RETENTION: string
+    DB: CaDatabase
+    ISSUER_DN: string
     PRIVATE_KEY: CaSecret
     SSH_CERTIFICATE_EXTENSIONS: string
-    SSH_CERTIFICATE_LIFETIME: string
-    SSH_CERTIFICATE_INCLUDE_SELF?: string | boolean
     SSH_CERTIFICATE_INCLUDE_SELF_EMAIL?: string | boolean
+    SSH_CERTIFICATE_INCLUDE_SELF?: string | boolean
+    SSH_CERTIFICATE_LIFETIME: string
     SSH_CERTIFICATE_PRINCIPALS?: string | string[]
-    SSH_HOST_CERTIFICATE_LIFETIME: string
     SSH_HOST_CERTIFICATE_ALLOWED_EMAILS?: string | string[]
     SSH_HOST_CERTIFICATE_ALLOWED_ROLES?: string | string[]
-    ISSUER_DN: string
-	JWT_JWKS_URL: string
-	JWT_AUD?: string | string[]
-	JWT_ISSUER: string
-	JWT_ALGORITHMS: string | string[]
-	JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: string
-	CERTIFICATE_REQUEST_TIME_SKEW_MAX: string
-	LOG_LEVEL?: string
+    SSH_HOST_CERTIFICATE_LIFETIME: string
 }

package/src/utils.ts

@@ -1,7 +1,7 @@
 import type { SshCaBindings } from "./types.js"
 import { JWKInvalid, JWKSInvalid, JWSInvalid, JWSSignatureVerificationFailed, JWTClaimValidationFailed, JWTExpired, JWTInvalid } from "jose/errors"
-import sshpk from "sshpk"
-import type { Certificate, Key, PrivateKey } from "sshpk"
+import { CertificateParseError, SshCertificate } from "./ssh/certificate.js"
+import { KeyParseError, parsePrivateKey, PublicKey, UnsupportedKeyError, type PrivateKey } from "./ssh/keys.js"
 import z from "zod"
 import { verifyJWT } from "./verify.js"
 import { CertificateRequestJWTPayload } from "./types.js"
@@ -11,8 +11,7 @@ import { logger } from "./logger.js"
 import { ms } from "itty-time"
 import { InternalServerErrorException } from "chanfana"
 
-// sshpk is CommonJS and Node's ESM loader cannot detect most of its named exports, so values are taken from the default import
-const { KeyParseError, CertificateParseError, parseCertificate, parseKey, parsePrivateKey } = sshpk
+export { UnsupportedKeyError }
 
 export const fatalIssue = (ctx: z.RefinementCtx, message: string, val: unknown) => {
 	ctx.issues.push({
@@ -104,11 +103,20 @@ export const transformAuthorizationHeader = async (env: SshCaBindings, val: stri
 	}
 }
 
-export const transformPublicKey = (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx): Key | never => {
-	try {
-		const key = typeof val === "string" ? parseKey(Buffer.from(val, "base64")) : parseKey(val)
+// decodes a value sent as base64, which may already have been decoded by the schema
+const fromBase64 = (val: string | Buffer<ArrayBufferLike>): string => {
+	return (typeof val === "string" ? Buffer.from(val, "base64") : Buffer.from(val)).toString("utf8")
+}
 
-		return key
+/**
+ * Parses a public key in OpenSSH format, `${type} ${base64}[ ${comment}]`
+ *
+ * @param val The public key, either base64 encoded or as bytes
+ * @param ctx The Zod context for any errors
+ */
+export const transformPublicKey = (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx): PublicKey | never => {
+	try {
+		return PublicKey.parse(fromBase64(val))
 	} catch (err) {
 		switch (true) {
 			case (err instanceof TypeError):
@@ -234,11 +242,9 @@ export const transformIdentityToken = async (env: SshCaBindings, val: string, ct
  * @param ctx The Zod context for any errors
  * @returns
  */
-export const transformCertificate = (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx): Certificate | never => {
+export const transformCertificate = (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx): SshCertificate | never => {
 	try {
-		const cert = typeof val === "string" ? parseCertificate(Buffer.from(val, "base64"), "openssh") : parseCertificate(val, "openssh")
-
-		return cert
+		return SshCertificate.parse(fromBase64(val))
 	} catch (err) {
 		switch (true) {
 			case (err instanceof TypeError):
@@ -269,7 +275,7 @@ export const transformCertificate = (val: string | Buffer<ArrayBufferLike>, ctx:
 
 type ParsedCertificateRequest = {
 	proof: ProofOfPossession
-	public_key: Key
+	public_key: PublicKey
 	lifetime: number
 	identity: IdentityToken
 	extensions: string[]
@@ -311,7 +317,7 @@ export const transformRenewalProofOfPossession = (env: SshCaBindings, val: strin
 }
 
 type HostCertificateRequest = {
-	public_key: Key
+	public_key: PublicKey
 	lifetime: number
 }
 
@@ -327,7 +333,7 @@ export const refineHostCertificateRequest = async (env: SshCaBindings, val: Pars
 
 	try {
 		// check proof of possession fingerprint matches public key
-		l.debug("checking val.proof.matches()", "public_key", val.public_key.toString("ssh"))
+		l.debug("checking val.proof.matches()", "public_key", val.public_key.toString())
 		if (!val.proof.matches(val.public_key)) {
 			l.warn("proof of possession fingerprint did not match public_key")
 			return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val)
@@ -351,38 +357,86 @@ export const refineHostCertificateRequest = async (env: SshCaBindings, val: Pars
 }
 
 type ParsedHostCertificateRenewal = {
-	certificate: Certificate
+	certificate: SshCertificate
 	proof: RenewalProofOfPossession
 } & HostCertificateRequest
 
-export const refineHostCertificateRenewal = async (env: SshCaBindings, isRevoked: typeof IsRevokedFn, val: ParsedHostCertificateRenewal, ctx: z.RefinementCtx): Promise<never> => {
+/**
+ * Checks a certificate presented for renewal was issued by this CA, is a host
+ * certificate, is within its validity period and has not been revoked.
+ *
+ * @param env The CA bindings
+ * @param isRevoked Returns whether a serial has been revoked
+ * @param certificate The certificate presented for renewal
+ * @returns The reason the certificate cannot be renewed, or undefined if it can be
+ * @throws {@link UnsupportedKeyError} when the CA key is not supported
+ */
+export const checkRenewableCertificate = async (env: SshCaBindings, isRevoked: typeof IsRevokedFn, certificate: SshCertificate): Promise<string | undefined> => {
+	// ensure certificate is signed by CA
+	const issuer = await getPublic(env)
+	if (!await certificate.isSignedBy(issuer)) {
+		return "the provided certificate was not signed by this CA"
+	}
+
+	// only host certificates can be renewed, as renewal does not need the
+	// OIDC authentication a user certificate is issued with
+	if (certificate.kind !== "host") {
+		return "the provided certificate is not a host certificate"
+	}
+
+	// check certificate is within its validity period, allowing for clock
+	// skew at the start as a certificate issued moments ago may have a
+	// validity start up to a second in the future
+	const now = Date.now()
+	if (now >= certificate.validBefore.getTime()) {
+		return "the provided certificate is expired"
+	}
+	if (certificate.validAfter.getTime() > now + ms(env.CERTIFICATE_REQUEST_TIME_SKEW_MAX)) {
+		return "the provided certificate is not yet valid"
+	}
+
+	// ensure certificate presented for renewal is not revoked
+	if (await isRevoked(env, certificate.serial)) {
+		return "the provided certificate is revoked"
+	}
+
+	return undefined
+}
+
+/**
+ * Refines a host certificate renewal so only a certificate that can be
+ * renewed (see {@link checkRenewableCertificate}) is accepted.
+ */
+export const refineRenewableCertificate = async (env: SshCaBindings, isRevoked: typeof IsRevokedFn, val: { certificate: SshCertificate }, ctx: z.RefinementCtx): Promise<never> => {
 	const l = logger(env)
 	try {
-		// ensure certificate is signed by CA
-		const issuer = await getPublic(env)
-		if (!val.certificate.isSignedByKey(issuer)) {
-			return fatalIssue(ctx, "the provided certificate was not signed by this CA", val)
+		const reason = await checkRenewableCertificate(env, isRevoked, val.certificate)
+		if (reason !== undefined) {
+			return fatalIssue(ctx, reason, val)
 		}
 
-		// check certificate is within its validity period, allowing for clock
-		// skew at the start as a certificate issued moments ago may have a
-		// validity start up to a second in the future
-		const now = Date.now()
-		if (now >= val.certificate.validUntil.getTime()) {
-			return fatalIssue(ctx, "the provided certificate is expired", val)
-		}
-		if (val.certificate.validFrom.getTime() > now + ms(env.CERTIFICATE_REQUEST_TIME_SKEW_MAX)) {
-			return fatalIssue(ctx, "the provided certificate is not yet valid", val)
+		return z.NEVER
+	} catch (err) {
+		// a misconfigured CA key is a server error, not a validation failure
+		if (err instanceof UnsupportedKeyError) {
+			l.error(err.message, "in", "refineRenewableCertificate")
+			throw new InternalServerErrorException(err.message)
 		}
+		l.error("certificate renewal check unhandled error", "in", "refineRenewableCertificate", "error", err)
+		return fatalIssue(ctx, "certificate renewal check unhandled error", val)
+	}
+}
 
-		// ensure certificate presented for renewal is not revoked
-		const serial = val.certificate.serial.readBigUInt64BE(0)
-		if (await isRevoked(env, serial)) {
-			return fatalIssue(ctx, "the provided certificate is revoked", val)
+export const refineHostCertificateRenewal = async (env: SshCaBindings, isRevoked: typeof IsRevokedFn, val: ParsedHostCertificateRenewal, ctx: z.RefinementCtx): Promise<never> => {
+	const l = logger(env)
+	try {
+		const reason = await checkRenewableCertificate(env, isRevoked, val.certificate)
+		if (reason !== undefined) {
+			return fatalIssue(ctx, reason, val)
 		}
 
 		// check proof of possession fingerprint matches public key and certificate subject key
-		if (!val.proof.matches(val.public_key, val.certificate.subjectKey)) {
+		if (!val.proof.matches(val.public_key, val.certificate.publicKey)) {
 			return fatalIssue(ctx, "proof of possession fingerprints did not match public_key and/or certificate", val)
 		}
 
@@ -406,7 +460,7 @@ export const refineHostCertificateRenewal = async (env: SshCaBindings, isRevoked
 
 type ParsedRevokeCertificate = {
 	serial: bigint
-	public_key: Key
+	public_key: PublicKey
 	proof: ProofOfPossession
 }
 
@@ -441,53 +495,29 @@ export const split = (v?: string | string[]): string[] => {
 			: v
 }
 
-/**
- * Thrown by {@link getPrivateKey} when the CA private key is of a type that
- * cannot be used.
- */
-export class UnsupportedKeyError extends Error {
-	constructor(message: string) {
-		super(message)
-		this.name = "UnsupportedKeyError"
-
-		Object.setPrototypeOf(this, UnsupportedKeyError.prototype)
-	}
-}
-
 /**
  * Load and parse the CA private key from the `PRIVATE_KEY` secret.
  *
- * Only Ed25519 and ECDSA keys are supported. RSA keys are rejected because
- * sshpk signs RSA certificates with SHA-1 (`ssh-rsa`), which OpenSSH 8.2 and
- * later refuse by default, and because RSA keys in OpenSSH format are
- * converted with invalid CRT parameters that the Workers runtime rejects.
+ * Only Ed25519 and ECDSA keys are supported, as these are the key types that
+ * certificates and KRLs are signed with (see `createSigner` in `ssh/signer.ts`).
  *
- * @throws KeyParseError when the secret cannot be parsed.
+ * @throws {@link KeyParseError} when the secret cannot be parsed.
  * @throws {@link UnsupportedKeyError} when the key is not Ed25519 or ECDSA.
  */
 export const getPrivateKey = async (env: SshCaBindings): Promise<PrivateKey> => {
 	// grab private key from secret store
 	const secret = await env.PRIVATE_KEY.get()
 
-	// parse it
-	const key = parsePrivateKey(secret)
-
-	if (key.type !== "ed25519" && key.type !== "ecdsa") {
-		throw new UnsupportedKeyError(`CA key type ${key.type} is not supported, the CA key must be Ed25519 or ECDSA`)
-	}
-
-	return key
+	return parsePrivateKey(secret)
 }
 
-export const getPublic = async (env: SshCaBindings, key?: PrivateKey): Promise<Key> => {
+/**
+ * Returns the public key of the CA, with `ISSUER_DN` as its comment
+ */
+export const getPublic = async (env: SshCaBindings, key?: PrivateKey): Promise<PublicKey> => {
 	if (key === undefined) {
 		key = await getPrivateKey(env)
 	}
 
-	// convert to a public key and add comment
-	const pub = key.toPublic()
-	pub.comment = env.ISSUER_DN
-
-	// return in ssh format trimmed of any whitespace
-	return pub
+	return key.publicKey.withComment(env.ISSUER_DN)
 }