@andrewheberle/serverless-ssh-ca 0.23.0 → 0.24.0

package/src/api/operations.ts

@@ -2,22 +2,27 @@ import { group, Logger } from "@andrewheberle/ts-slog"
 import {
 	ApiException,
 	ConflictException,
+	InputValidationException,
 	InternalServerErrorException,
 	NotFoundException,
 	UnprocessableEntityException,
 } from "chanfana"
 import type { AppContext } from "../router.js"
 import type { CertificateSignerResponse } from "../types.js"
-import { BadIssuerError } from "../certificate.js"
+import { BadIssuerError, CertificateError } from "../certificate.js"
 import type { SshCertificate } from "../ssh/certificate.js"
 import { KeyParseError, type PublicKey } from "../ssh/keys.js"
 import { getPrivateKey, getPublic, UnsupportedKeyError } from "../utils.js"
 import { CertificateType } from "../db/types.js"
 import { KRLBuilder } from "../krl.js"
+import { z } from "zod"
+import { certificateTypeName } from "./schema.js"
 import {
+	getKrlRevision,
 	getKrlVersion,
 	getRevocationList,
 	recordCertificate,
+	recordRenewal,
 	RevocationStatus,
 	revocationStatus,
 	revokeCertificate,
@@ -71,20 +76,38 @@ export const caPublicKey = async (c: AppContext, l: Logger): Promise<Response> =
  */
 export const revocationList = async (c: AppContext, l: Logger, certificateType: CertificateType): Promise<Response> => {
 	try {
-		// get revoked serials
-		const serials = (await getRevocationList(c.env, certificateType)).map(v => BigInt(v))
-
 		// grab private key from secret store
 		const key = await getPrivateKey(c.env)
 
+		// a cached KRL is keyed by the revision it was generated for, which
+		// changes whenever a certificate is revoked, and by the CA key that
+		// signed it, so a cached KRL is never used once it is out of date. The
+		// revision is read before the revoked serials, so the KRL cached for a
+		// revision includes at least every certificate revoked by then
+		const cache = c.env.CACHE
+		const cacheKey = cache === undefined
+			? undefined
+			: `krl:${certificateTypeName(certificateType)}:${key.publicKey.fingerprint()}:${await getKrlRevision(c.env, certificateType)}`
+
+		if (cache !== undefined && cacheKey !== undefined) {
+			const cached = await readCachedKrl(cache, cacheKey, l)
+			if (cached !== undefined) {
+				return c.json(cached)
+			}
+		}
+
+		// get revoked serials
+		const serials = (await getRevocationList(c.env, certificateType)).map(v => BigInt(v))
+
 		// generate KRL
 		const krl = new KRLBuilder(key)
 			.addSerials(serials)
 
-		// the version only changes when the content of the KRL does
-		const version = await getKrlVersion(c.env, certificateType, await krl.digest())
+		// the version only changes when the content of the KRL does, and every
+		// KRL with the same version has the same generation date
+		const { version, generatedAt } = await getKrlVersion(c.env, certificateType, await krl.digest())
 
-		const krlBytes = krl.generate(version)
+		const krlBytes = krl.generate(version, "", generatedAt)
 
 		// convert to base64
 		const bytes = new Uint8Array(krlBytes)
@@ -96,15 +119,73 @@ export const revocationList = async (c: AppContext, l: Logger, certificateType:
 
 		const signature = await krl.signature()
 
-		return c.json({
+		const response: KrlResponse = {
 			krl: base64Krl,
 			signature: signature,
-		})
+		}
+
+		if (cache !== undefined && cacheKey !== undefined) {
+			try {
+				await cache.put(cacheKey, JSON.stringify(response), { expirationTtl: KrlCacheTtl })
+			} catch (err) {
+				// the KRL is still returned, it is generated again next time
+				l.warn("could not cache KRL", "error", err)
+			}
+		}
+
+		return c.json(response)
 	} catch (err) {
 		throw caKeyError(l, err)
 	}
 }
 
+const KrlResponseSchema = z.object({
+	krl: z.string(),
+	signature: z.string(),
+})
+
+type KrlResponse = z.infer<typeof KrlResponseSchema>
+
+// how long a cached KRL is kept, in seconds. A cached KRL is only used for
+// the revision it was generated for, so this only removes entries for earlier
+// revisions from the cache
+const KrlCacheTtl = 7 * 24 * 60 * 60
+
+/**
+ * Returns a cached KRL response, or undefined if there is none or it cannot be
+ * used, in which case the KRL is generated again.
+ */
+const readCachedKrl = async (cache: NonNullable<AppContext["env"]["CACHE"]>, key: string, l: Logger): Promise<KrlResponse | undefined> => {
+	let cached: string | null
+	try {
+		cached = await cache.get(key)
+	} catch (err) {
+		l.warn("could not read cached KRL", "error", err)
+		return undefined
+	}
+
+	if (cached === null) {
+		return undefined
+	}
+
+	let json: unknown
+	try {
+		json = JSON.parse(cached)
+	} catch {
+		l.warn("cached KRL was not valid JSON")
+		return undefined
+	}
+
+	const parsed = KrlResponseSchema.safeParse(json)
+	if (!parsed.success) {
+		l.warn("cached KRL was not a valid KRL response")
+		return undefined
+	}
+
+	l.debug("using cached KRL", "key", key)
+	return parsed.data
+}
+
 /**
  * Signs a certificate, records it so it can later be revoked and returns it
  * as the response to a certificate request or renewal.
@@ -116,28 +197,42 @@ export const revocationList = async (c: AppContext, l: Logger, certificateType:
  * @param l The logger for the request
  * @param sign Signs and returns the certificate
  * @param certificateType The type of certificate being issued
+ * @param renews The host certificate being renewed, which is revoked when the new certificate is recorded
  * @returns The response containing the issued certificate
  */
-export const issueCertificate = async (c: AppContext, l: Logger, sign: () => Promise<SshCertificate>, certificateType: CertificateType): Promise<Response> => {
+export const issueCertificate = async (c: AppContext, l: Logger, sign: () => Promise<SshCertificate>, certificateType: CertificateType, renews?: SshCertificate): Promise<Response> => {
 	try {
 		const certificate = await sign()
 		const response: CertificateSignerResponse = {
 			certificate: btoa(certificate.toString())
 		}
 
+		let recorded: boolean
 		try {
-			await recordCertificate(c.env, certificate, certificate.keyId, certificateType)
+			if (renews === undefined) {
+				await recordCertificate(c.env, certificate, certificate.keyId, certificateType)
+				recorded = true
+			} else {
+				recorded = await recordRenewal(c.env, renews, certificate)
+			}
 		} catch (err) {
 			// a certificate that is not recorded cannot be revoked, so do not issue it
 			l.error("there was a problem adding issued certificate to database", "error", err)
 			throw new InternalServerErrorException("there was a problem recording the issued certificate")
 		}
 
+		if (!recorded) {
+			// the certificate was revoked, or renewed by another request, since it was checked
+			l.warn("certificate presented for renewal was revoked before the renewal was recorded")
+			throw new InputValidationException("the provided certificate is revoked", ["body", "certificate"])
+		}
+
 		l.info("completed issuing certificate",
 			...group(
 				"certificate", "principals",
 				certificate.principals.join(","), "serial", certificate.serial,
 			),
+			...(renews === undefined ? [] : group("renewed", "serial", renews.serial)),
 		)
 
 		return c.json(response)
@@ -151,6 +246,12 @@ export const issueCertificate = async (c: AppContext, l: Logger, sign: () => Pro
 				throw err
 			case (err instanceof BadIssuerError):
 				throw new UnprocessableEntityException(err.message)
+			case (err instanceof CertificateError):
+				// the request was valid but asked for a certificate the CA's
+				// configuration does not allow, such as an extension that is
+				// not permitted or one without any principals
+				l.warn("certificate could not be issued", "error", err.message)
+				throw new UnprocessableEntityException(err.message)
 			default:
 				// otherwise throw as InternalServerErrorException
 				l.error("unhandled error", "error", err)
@@ -186,7 +287,9 @@ export const revoke = async (c: AppContext, l: Logger, serial: bigint, publicKey
 		const res = await revokeCertificate(c.env, serial)
 
 		if (res.length === 0) {
-			throw new InternalServerErrorException("no results were returned for revocation")
+			// another request revoked the certificate after its status was checked
+			l.warn("certificate was revoked by another request")
+			throw new ConflictException("certificate is already revoked")
 		}
 
 		if (res.length > 1) {

package/src/api/schema.ts

@@ -1,6 +1,7 @@
 import z from "zod"
 import type { SshCaBindings } from "../types.js"
 import {
+	refineSubjectKey,
 	transformAuthorizationHeader,
 	transformPublicKey,
 	transformIdentityToken,
@@ -71,6 +72,14 @@ export const publicKey = openapiStringByte
 		example: "ZWNkc2Etc2hhMi1uaXN0cDI1NiBBQUFBRTJWalpITmhMWE5vWVRJdGJtbHpkSEF5TlRZQUFBQUlibWx6ZEhBeU5UWUFBQUJCQkdNcFNKdHRmMEl0dE5DVmMyOFR6WEZSMUQweHZPM25wNjdWemVBUXNiZFpza3JEY1lqU2x3SjZIUERtVHBYYVUwbEVhWDlMNFloYy9jQ2YxTWU5RlRrPQo="
 	})
 
+export const subjectPublicKey = openapiStringByte
+	.transform(transformPublicKey)
+	.superRefine(refineSubjectKey)
+	.meta({
+		description: "SSH public key to sign",
+		example: "ZWNkc2Etc2hhMi1uaXN0cDI1NiBBQUFBRTJWalpITmhMWE5vWVRJdGJtbHpkSEF5TlRZQUFBQUlibWx6ZEhBeU5UWUFBQUJCQkdNcFNKdHRmMEl0dE5DVmMyOFR6WEZSMUQweHZPM25wNjdWemVBUXNiZFpza3JEY1lqU2x3SjZIUERtVHBYYVUwbEVhWDlMNFloYy9jQ2YxTWU5RlRrPQo="
+	})
+
 export const createIdentityTokenSchema = (env: SshCaBindings) => (
 	z.string()
 		.meta({

package/src/api/v3/index.ts

@@ -174,6 +174,7 @@ const HostCertificateRenewEndpoint = (env: SshCaBindings) => {
 			return await issueCertificate(c, l,
 				() => createSignedHostCertificate(c.env, data.body.public_key, opts),
 				CertificateType.Host,
+				data.body.certificate,
 			)
 		}
 	}

package/src/api/v3/schema.ts

@@ -1,6 +1,7 @@
 import z from "zod"
 import type { SshCaBindings } from "../../types.js"
 import {
+	refineHostPrincipal,
 	split,
 	refineCertificateRequest,
 	transformProofOfPossession,
@@ -16,6 +17,7 @@ import {
 	ForbiddenException,
 	InputValidationException,
 	InternalServerErrorException,
+	TooManyRequestsException,
 	UnauthorizedException,
 	UnprocessableEntityException,
 } from "chanfana"
@@ -31,6 +33,7 @@ import {
 	openapiStringByte,
 	proofOfPossession,
 	publicKey,
+	subjectPublicKey,
 } from "../schema.js"
 
 export {
@@ -44,7 +47,7 @@ export {
 
 export const userCertificateRequestEndpointBodySchema = (env: SshCaBindings) => (
 	z.object({
-		public_key: publicKey,
+		public_key: subjectPublicKey,
 		proof: proofOfPossession
 			.transform((val, ctx) => transformProofOfPossession(env, val, ctx)),
 		identity: createIdentityTokenSchema(env),
@@ -84,16 +87,17 @@ export const createUserCertificateRequestEndpointSchema = (env: SshCaBindings) =
 		...InputValidationException.schema(),
 		...UnprocessableEntityException.schema(),
 		...InternalServerErrorException.schema(),
+		...TooManyRequestsException.schema(),
 	}
 })
 
 export const hostCertificateRequestEndpointBodySchema = (env: SshCaBindings) => (
 	z.object({
-				public_key: publicKey,
+				public_key: subjectPublicKey,
 				proof: proofOfPossession
 					.transform((val, ctx) => transformProofOfPossession(env, val, ctx)),
 				identity: createIdentityTokenSchema(env),
-				principals: z.array(z.string()).min(1)
+				principals: z.array(z.string().superRefine(refineHostPrincipal)).min(1)
 					.meta({ description: "List of principals to include on the issued certificate" }),
 				lifetime: z.int()
 					.min(seconds("24 hours"))
@@ -128,6 +132,7 @@ export const createHostCertificateRequestEndpointSchema = (env: SshCaBindings) =
 		...InputValidationException.schema(),
 		...UnprocessableEntityException.schema(),
 		...InternalServerErrorException.schema(),
+		...TooManyRequestsException.schema(),
 	}
 })
 
@@ -152,7 +157,7 @@ export const hostCertificateRenewEndpointBodySchema = (env: SshCaBindings) => (
 export const createHostCertificateRenewEndpointSchema = (env: SshCaBindings) => ({
 	tags: [certificateTypeTag(CertificateType.Host)],
 	summary: "Renew a host certificate",
-	description: "Issues a new SSH host certificate with the same principals as an existing, unexpired and unrevoked host certificate issued by this CA. No OIDC authentication is required; instead the public key must match the existing certificate and the proof of possession must be made with its private key. The lifetime of the renewed certificate is no longer than that of the existing certificate.",
+	description: "Issues a new SSH host certificate with the same principals as an existing, unexpired and unrevoked host certificate issued by this CA. No OIDC authentication is required; instead the public key must match the existing certificate and the proof of possession must be made with its private key. The lifetime of the renewed certificate is no longer than that of the existing certificate. The existing certificate is revoked, so it cannot be used or renewed again once the renewed certificate is installed.",
 	request: {
 		body: contentJson(hostCertificateRenewEndpointBodySchema(env))
 	},
@@ -170,6 +175,7 @@ export const createHostCertificateRenewEndpointSchema = (env: SshCaBindings) =>
 		...InputValidationException.schema(),
 		...UnprocessableEntityException.schema(),
 		...InternalServerErrorException.schema(),
+		...TooManyRequestsException.schema(),
 	}
 })
 
@@ -211,6 +217,7 @@ export const createRevokeCertificateEndpointSchema = (env: SshCaBindings, certif
 		...InputValidationException.schema(),
 		...UnprocessableEntityException.schema(),
 		...InternalServerErrorException.schema(),
+		...TooManyRequestsException.schema(),
 		...ConflictException.schema()
 	}
 })

package/src/api/v4/index.ts

@@ -222,6 +222,7 @@ const RenewHostCertificateEndpoint = (env: SshCaBindings) => {
 			return await issueCertificate(c, l,
 				() => createSignedHostCertificate(c.env, data.body.certificate.publicKey, opts),
 				CertificateType.Host,
+				data.body.certificate,
 			)
 		}
 	}

package/src/api/v4/schema.ts

@@ -1,6 +1,7 @@
 import z from "zod"
 import type { SshCaBindings } from "../../types.js"
 import {
+	refineHostPrincipal,
 	refineRenewableCertificate,
 	split,
 	transformCertificate,
@@ -11,6 +12,7 @@ import {
 	contentJson,
 	InputValidationException,
 	InternalServerErrorException,
+	TooManyRequestsException,
 	NotFoundException,
 	UnauthorizedException,
 	ForbiddenException,
@@ -28,7 +30,7 @@ import {
 	createIdentityTokenSchema,
 	createRevocationListEndpointSchema,
 	openapiStringByte,
-	publicKey,
+	subjectPublicKey,
 } from "../schema.js"
 
 /**
@@ -96,7 +98,7 @@ export const createGetRevocationListEndpointSchema = (certificateType: Certifica
 
 export const issueUserCertificateEndpointBodySchema = (env: SshCaBindings) => (
 	z.object({
-		public_key: publicKey,
+		public_key: subjectPublicKey,
 		identity: createIdentityTokenSchema(env),
 		extensions: z.array(z.string())
 			.default(split(env.SSH_CERTIFICATE_EXTENSIONS))
@@ -130,14 +132,15 @@ export const createIssueUserCertificateEndpointSchema = (env: SshCaBindings) =>
 		...InputValidationException.schema(),
 		...UnprocessableEntityException.schema(),
 		...InternalServerErrorException.schema(),
+		...TooManyRequestsException.schema(),
 	}
 })
 
 export const issueHostCertificateEndpointBodySchema = (env: SshCaBindings) => (
 	z.object({
-		public_key: publicKey,
+		public_key: subjectPublicKey,
 		identity: createIdentityTokenSchema(env),
-		principals: z.array(z.string()).min(1)
+		principals: z.array(z.string().superRefine(refineHostPrincipal)).min(1)
 			.meta({ description: "List of principals to include on the issued certificate" }),
 		lifetime: z.int()
 			.min(seconds("24 hours"))
@@ -168,6 +171,7 @@ export const createIssueHostCertificateEndpointSchema = (env: SshCaBindings) =>
 		...InputValidationException.schema(),
 		...UnprocessableEntityException.schema(),
 		...InternalServerErrorException.schema(),
+		...TooManyRequestsException.schema(),
 	}
 })
 
@@ -190,7 +194,7 @@ export const createRenewHostCertificateEndpointSchema = (env: SshCaBindings) =>
 	tags: [certificateTypeTag(CertificateType.Host)],
 	operationId: "renew_host_certificate",
 	summary: "Renew a host certificate",
-	description: `Issues a new SSH host certificate for the same public key and principals as an existing, unexpired and unrevoked host certificate issued by this CA. No OIDC authentication is required; instead the \`${ProofHeader}\` header must contain a proof of possession of the private key for the existing certificate made for this request. The lifetime of the renewed certificate is no longer than that of the existing certificate.`,
+	description: `Issues a new SSH host certificate for the same public key and principals as an existing, unexpired and unrevoked host certificate issued by this CA. No OIDC authentication is required; instead the \`${ProofHeader}\` header must contain a proof of possession of the private key for the existing certificate made for this request. The lifetime of the renewed certificate is no longer than that of the existing certificate. The existing certificate is revoked, so it cannot be used or renewed again once the renewed certificate is installed.`,
 	request: {
 		params: serialParamSchema,
 		headers: createProofHeaderSchema(env),
@@ -206,6 +210,7 @@ export const createRenewHostCertificateEndpointSchema = (env: SshCaBindings) =>
 		...InputValidationException.schema(),
 		...UnprocessableEntityException.schema(),
 		...InternalServerErrorException.schema(),
+		...TooManyRequestsException.schema(),
 	}
 })
 
@@ -231,5 +236,6 @@ export const createRevokeCertificateEndpointSchema = (env: SshCaBindings, certif
 		...NotFoundException.schema(),
 		...ConflictException.schema(),
 		...InternalServerErrorException.schema(),
+		...TooManyRequestsException.schema(),
 	}
 })