passwd-sso-cli 0.4.50 → 0.4.56

package/dist/lib/ssh-session-bind.js

@@ -0,0 +1,272 @@
+/**
+ * SSH session-bind@openssh.com extension parser and verifier.
+ *
+ * Parses and cryptographically verifies the session-bind extension payload
+ * so the agent can record the host-key fingerprint and forwarding flag for
+ * audit metadata without trusting unauthenticated client assertions.
+ *
+ * Reference: RFC 9987 §4.7 + OpenSSH PROTOCOL.agent
+ */
+import { createPublicKey, createVerify, verify as cryptoVerify, createHash, } from "node:crypto";
+import { readString } from "./ssh-agent-protocol.js";
+// ─── Parsing ──────────────────────────────────────────────────
+/**
+ * Parse the payload of a session-bind@openssh.com extension message.
+ *
+ * The contents (after the extension name string) are:
+ *   string  hostkey          (SSH wire-format public key blob)
+ *   string  session-identifier
+ *   string  signature        (SSH wire-format signature blob)
+ *   bool    is_forwarding    (1 byte: 0x01 = true, 0x00 = false)
+ *
+ * @param rest Bytes immediately following the extension name string
+ */
+export function parseSessionBind(rest) {
+    let offset = 0;
+    const { data: hostKeyBlob, nextOffset: o1 } = readString(rest, offset);
+    offset = o1;
+    const { data: sessionId, nextOffset: o2 } = readString(rest, offset);
+    offset = o2;
+    const { data: signature, nextOffset: o3 } = readString(rest, offset);
+    offset = o3;
+    if (offset >= rest.length) {
+        throw new Error("session-bind payload too short: missing is_forwarding byte");
+    }
+    const isForwarding = rest[offset] !== 0;
+    return { hostKeyBlob, sessionId, signature, isForwarding };
+}
+/**
+ * Convert an SSH wire-format public key blob into a Node.js KeyObject.
+ *
+ * Supported types:
+ *   - ssh-ed25519
+ *   - ssh-rsa
+ *   - ecdsa-sha2-nistp256 / nistp384 / nistp521
+ *
+ * Throws an Error for unsupported key types so the caller (verifySessionBind)
+ * can catch it and return false.
+ */
+export function sshWirePublicKeyToKeyObject(blob) {
+    const { data: keyTypeBuf, nextOffset } = readString(blob, 0);
+    const keyType = keyTypeBuf.toString("utf-8");
+    switch (keyType) {
+        case "ssh-ed25519": {
+            const { data: pubPoint } = readString(blob, nextOffset);
+            if (pubPoint.length !== 32) {
+                throw new Error(`Invalid Ed25519 public key length: ${pubPoint.length}`);
+            }
+            const key = createPublicKey({
+                key: {
+                    kty: "OKP",
+                    crv: "Ed25519",
+                    x: base64url(pubPoint),
+                },
+                format: "jwk",
+            });
+            return { key, keyType };
+        }
+        case "ssh-rsa": {
+            // SSH RSA wire format: string(e), string(n) — both big-endian mpints
+            const { data: e, nextOffset: o1 } = readString(blob, nextOffset);
+            const { data: n } = readString(blob, o1);
+            const key = createPublicKey({
+                key: {
+                    kty: "RSA",
+                    n: base64url(stripLeadingZero(n)),
+                    e: base64url(stripLeadingZero(e)),
+                },
+                format: "jwk",
+            });
+            return { key, keyType };
+        }
+        case "ecdsa-sha2-nistp256":
+        case "ecdsa-sha2-nistp384":
+        case "ecdsa-sha2-nistp521": {
+            // SSH ECDSA wire format: string(curve-name), string(Q point 0x04||x||y)
+            const { data: curveNameBuf, nextOffset: o1 } = readString(blob, nextOffset);
+            const curveName = curveNameBuf.toString("utf-8");
+            const { data: qPoint } = readString(blob, o1);
+            const curveMap = {
+                "nistp256": { crv: "P-256", size: 32 },
+                "nistp384": { crv: "P-384", size: 48 },
+                "nistp521": { crv: "P-521", size: 66 },
+            };
+            const curve = curveMap[curveName];
+            if (!curve) {
+                throw new Error(`Unsupported ECDSA curve: ${curveName}`);
+            }
+            if (qPoint[0] !== 0x04) {
+                throw new Error("Only uncompressed ECDSA points are supported");
+            }
+            const x = qPoint.subarray(1, 1 + curve.size);
+            const y = qPoint.subarray(1 + curve.size, 1 + 2 * curve.size);
+            const key = createPublicKey({
+                key: {
+                    kty: "EC",
+                    crv: curve.crv,
+                    x: base64url(x),
+                    y: base64url(y),
+                },
+                format: "jwk",
+            });
+            return { key, keyType };
+        }
+        default:
+            throw new Error(`Unsupported SSH public key type: ${keyType}`);
+    }
+}
+// ─── Signature verification ────────────────────────────────────
+/**
+ * Verify that the session-bind signature is valid.
+ *
+ * The host proves session control by signing the session identifier with the
+ * host private key. This binds the agent connection to a specific SSH session
+ * and host, preventing forwarded-agent hijack attacks.
+ *
+ * Algorithm binding (RFC 9987 §3.2): the signature algorithm name embedded in
+ * the signature blob must be consistent with the host-key type. Inconsistent
+ * algorithm names are rejected to prevent downgrade attacks.
+ *
+ * Returns false (never throws) on any parse error, unsupported type, or
+ * invalid signature.
+ */
+export function verifySessionBind(parsed) {
+    try {
+        const { key, keyType } = sshWirePublicKeyToKeyObject(parsed.hostKeyBlob);
+        // Parse the SSH signature blob: string(algo-name) + string(raw-sig)
+        const { data: algoNameBuf, nextOffset } = readString(parsed.signature, 0);
+        const algoName = algoNameBuf.toString("utf-8");
+        const { data: rawSig } = readString(parsed.signature, nextOffset);
+        // Algorithm-binding check: reject mismatched algo/key pairs
+        if (!isAlgoConsistentWithKeyType(algoName, keyType)) {
+            return false;
+        }
+        return verifySshSignature(key, keyType, algoName, rawSig, parsed.sessionId);
+    }
+    catch {
+        // Any parse or crypto error → treat as invalid
+        return false;
+    }
+}
+// ─── Fingerprint ──────────────────────────────────────────────
+/**
+ * Compute the standard OpenSSH SHA256 fingerprint of a public key blob.
+ *
+ * Format: "SHA256:<base64-no-padding>" (matches `ssh-keygen -l -E sha256` output).
+ */
+export function fingerprintPublicKey(blob) {
+    const digest = createHash("sha256").update(blob).digest("base64");
+    // Remove trailing "=" padding to match OpenSSH output
+    const base64noPad = digest.replace(/=+$/, "");
+    return `SHA256:${base64noPad}`;
+}
+// ─── Internal helpers ─────────────────────────────────────────
+/**
+ * Check that a signature algorithm name is consistent with the host key type.
+ *
+ * Prevents an attacker from substituting a weaker algorithm (e.g. ssh-rsa/SHA1)
+ * for a key that supports stronger hashes, or from mixing algorithms across
+ * key families entirely.
+ */
+function isAlgoConsistentWithKeyType(algoName, keyType) {
+    switch (keyType) {
+        case "ssh-ed25519":
+            return algoName === "ssh-ed25519";
+        case "ssh-rsa":
+            // RSA host key: require SHA-2 signatures only. Modern OpenSSH (7.8+) emits
+            // rsa-sha2-256/512 for session-bind even with ssh-rsa host keys; the legacy
+            // ssh-rsa (SHA-1) signature algorithm is rejected (no SHA-1 in the trust path).
+            return algoName === "rsa-sha2-256" || algoName === "rsa-sha2-512";
+        case "ecdsa-sha2-nistp256":
+            return algoName === "ecdsa-sha2-nistp256";
+        case "ecdsa-sha2-nistp384":
+            return algoName === "ecdsa-sha2-nistp384";
+        case "ecdsa-sha2-nistp521":
+            return algoName === "ecdsa-sha2-nistp521";
+        default:
+            return false;
+    }
+}
+/**
+ * Dispatch to the correct crypto.verify call based on algorithm.
+ */
+function verifySshSignature(key, keyType, algoName, rawSig, data) {
+    switch (keyType) {
+        case "ssh-ed25519":
+            // Ed25519: no hash (null), raw 64-byte signature
+            return cryptoVerify(null, data, key, rawSig);
+        case "ssh-rsa": {
+            const hash = algoName === "rsa-sha2-512" ? "sha512" : "sha256";
+            const verifier = createVerify(hash);
+            verifier.update(data);
+            return verifier.verify(key, rawSig);
+        }
+        case "ecdsa-sha2-nistp256":
+        case "ecdsa-sha2-nistp384":
+        case "ecdsa-sha2-nistp521": {
+            const hashMap = {
+                "ecdsa-sha2-nistp256": "sha256",
+                "ecdsa-sha2-nistp384": "sha384",
+                "ecdsa-sha2-nistp521": "sha512",
+            };
+            const hash = hashMap[keyType];
+            // SSH ECDSA raw sig: string(r) || string(s) — convert to DER for Node crypto
+            const derSig = sshEcdsaToDer(rawSig);
+            const verifier = createVerify(hash);
+            verifier.update(data);
+            return verifier.verify(key, derSig);
+        }
+        default:
+            return false;
+    }
+}
+/**
+ * Convert an SSH ECDSA signature (string(r) || string(s)) to DER format.
+ *
+ * SSH format: uint32(rLen) || r || uint32(sLen) || s
+ * DER format: SEQUENCE { INTEGER r, INTEGER s }
+ *
+ * This is the inverse of derToSshEcdsa in ssh-key-agent.ts.
+ */
+function sshEcdsaToDer(sshSig) {
+    const { data: r, nextOffset } = readString(sshSig, 0);
+    const { data: s } = readString(sshSig, nextOffset);
+    // DER definite-length encoding: short form (<128) is one byte; long form
+    // (>=128) is 0x80|n followed by n big-endian length bytes. P-521 signatures
+    // push the SEQUENCE length past 127, so short-form-only encoding is invalid.
+    const encodeLen = (len) => {
+        if (len < 0x80)
+            return Buffer.from([len]);
+        const bytes = [];
+        let v = len;
+        while (v > 0) {
+            bytes.unshift(v & 0xff);
+            v >>= 8;
+        }
+        return Buffer.from([0x80 | bytes.length, ...bytes]);
+    };
+    // DER-encode each integer: 0x02 + length + value (with leading 0x00 if MSB set)
+    const encodeInt = (n) => {
+        const needsPad = n[0] !== undefined && (n[0] & 0x80) !== 0;
+        const value = needsPad ? Buffer.concat([Buffer.from([0x00]), n]) : n;
+        return Buffer.concat([Buffer.from([0x02]), encodeLen(value.length), value]);
+    };
+    const rDer = encodeInt(r);
+    const sDer = encodeInt(s);
+    const seq = Buffer.concat([rDer, sDer]);
+    return Buffer.concat([Buffer.from([0x30]), encodeLen(seq.length), seq]);
+}
+function base64url(buf) {
+    return Buffer.from(buf)
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+function stripLeadingZero(buf) {
+    let i = 0;
+    while (i < buf.length - 1 && buf[i] === 0)
+        i++;
+    return i > 0 ? buf.subarray(i) : buf;
+}
+//# sourceMappingURL=ssh-session-bind.js.map

package/dist/lib/ssh-sign-authorizer.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Per-signature server authorization for the SSH agent.
+ *
+ * Before each signature, the agent POSTs to /api/vault/ssh/sign-authorize to
+ * authorize the operation and emit an audit event server-side. The result is
+ * never cached — one authorize call per signature ensures immediate revocation
+ * and a complete audit trail.
+ *
+ * Threat-model note: this is an honest-agent audit/revocation control. A
+ * compromised agent process that already holds the decrypted private key can
+ * always sign locally; per-sign authorize cannot prevent that. The value is
+ * audit completeness and immediate policy enforcement for an honest agent.
+ */
+import type { SessionBinding } from "./ssh-session-bind.js";
+/**
+ * Authorize a single SSH signing operation against the server.
+ *
+ * Returns true only on HTTP 200 with `authorized === true`.
+ * Any other status, network error, or malformed response → false (fail-closed).
+ */
+export declare function authorizeSign(args: {
+    keyId: string;
+    fingerprint: string;
+    binding: SessionBinding | null;
+}): Promise<boolean>;
+/**
+ * Reset the one-time scope hint guard.
+ * Exposed for testing only — do not call from production code.
+ *
+ * @internal
+ */
+export declare function _resetScopeHintForTest(): void;

package/dist/lib/ssh-sign-authorizer.js

@@ -0,0 +1,61 @@
+/**
+ * Per-signature server authorization for the SSH agent.
+ *
+ * Before each signature, the agent POSTs to /api/vault/ssh/sign-authorize to
+ * authorize the operation and emit an audit event server-side. The result is
+ * never cached — one authorize call per signature ensures immediate revocation
+ * and a complete audit trail.
+ *
+ * Threat-model note: this is an honest-agent audit/revocation control. A
+ * compromised agent process that already holds the decrypted private key can
+ * always sign locally; per-sign authorize cannot prevent that. The value is
+ * audit completeness and immediate policy enforcement for an honest agent.
+ */
+import { apiRequest } from "./api-client.js";
+import * as output from "./output.js";
+// One-time hint guard: print "re-run `passwd-sso login`" at most once per run.
+let scopeHintEmitted = false;
+/**
+ * Authorize a single SSH signing operation against the server.
+ *
+ * Returns true only on HTTP 200 with `authorized === true`.
+ * Any other status, network error, or malformed response → false (fail-closed).
+ */
+export async function authorizeSign(args) {
+    const { keyId, fingerprint, binding } = args;
+    try {
+        const body = { keyId, fingerprint };
+        if (binding) {
+            body.host = {
+                hostKeyFingerprint: binding.hostKeyFingerprint,
+                forwarded: binding.forwarded,
+            };
+        }
+        const res = await apiRequest("/api/vault/ssh/sign-authorize", { method: "POST", body });
+        if (res.ok && res.status === 200 && res.data.authorized === true) {
+            return true;
+        }
+        // On scope-deny (401/403 with reason "unauthorized"), print a one-time hint.
+        if ((res.status === 401 || res.status === 403) && res.data.reason === "unauthorized") {
+            if (!scopeHintEmitted) {
+                scopeHintEmitted = true;
+                output.warn("Re-run `passwd-sso login` to grant SSH signing (ssh:sign scope).");
+            }
+        }
+        return false;
+    }
+    catch (err) {
+        output.warn(`SSH sign authorize failed: ${err instanceof Error ? err.message : "network error"}`);
+        return false;
+    }
+}
+/**
+ * Reset the one-time scope hint guard.
+ * Exposed for testing only — do not call from production code.
+ *
+ * @internal
+ */
+export function _resetScopeHintForTest() {
+    scopeHintEmitted = false;
+}
+//# sourceMappingURL=ssh-sign-authorizer.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passwd-sso-cli",
-  "version": "0.4.50",
+  "version": "0.4.56",
   "description": "CLI for passwd-sso password manager",
   "type": "module",
   "license": "MIT",
@@ -48,7 +48,7 @@
     "@types/node": "^22.15.3",
     "tsx": "^4.19.4",
     "typescript": "^5.9.0-beta",
-    "vitest": "^4.0.18"
+    "vitest": "^4.1.8"
   },
   "overrides": {
     "postcss": ">=8.5.10"