vvauth 0.3.2 → 0.3.4

package/index.js

@@ -5,12 +5,10 @@ const os   = require('os');
 const fs    = require('fs');
 const path  = require('path');
 const url   = require('url');
-const net   = require('net');
 const {spawn} = require('child_process');
 
 const {parse} = require('yaml');
 const semver     = require('semver');
-const SSHAgent   = require('ssh-agent-js/client');
 const trim       = require('mout/string/trim');
 const get        = require('mout/object/get');
 const eachLimit = require('nyks/async/eachLimit');
@@ -19,7 +17,9 @@ const walk       = require('nyks/object/walk');
 const request    = require('nyks/http/request');
 const drain      = require('nyks/stream/drain');
 const replaceEnv = require('nyks/string/replaceEnv');
+const promiser   = require('nyks/function/promiser');
 
+const {OpenSSHAgent} = require('ssh2/lib/agent');
 const debug = require('debug');
 
 const logger  = {
@@ -56,13 +56,13 @@ class vvauth {
       }
     }
 
-    this.vault_addr = this.rc.vault_addr;
+    this.VAULT_ADDR = this.rc.vault_addr;
 
-    if(!this.vault_addr)
+    if(!this.VAULT_ADDR)
       throw `Invalid vault remote`;
 
     this.VAULT_TOKEN = process.env.VAULT_TOKEN;
-    console.error("vauth bound to '%s'", this.vault_addr);
+    console.error("vauth bound to '%s'", this.VAULT_ADDR);
   }
 
   async connect() {
@@ -90,7 +90,7 @@ class vvauth {
   _publish_env(env) {
     let cmds = [];
     for(let [k, v] of Object.entries(env)) {
-      cmds.push(`export ${k}="${v}"`);
+      cmds.push(`export ${k}=${shellEscape(v)}`);
       cmds.push(`echo export ${k}=[redacted] >&2`);
     }
     process.stdout.write(cmds.join("\n") + "\n");
@@ -136,7 +136,7 @@ class vvauth {
   async env(source = false) {
     let {profile} = await this._get_profile();
 
-    let env = {VAULT_TOKEN : this.VAULT_TOKEN}, secrets = {},
+    let env = {VAULT_TOKEN : this.VAULT_TOKEN, VAULT_ADDR : this.VAULT_ADDR}, secrets = {},
       {git, map = {}, paths, path : mount = "secrets"} = this.rc.env || {};
 
     if(git) {
@@ -166,7 +166,7 @@ class vvauth {
 
 
   async _read(mount, secret_path) {
-    let remote_url = `${trim(this.vault_addr, '/')}/v1/${mount}/data/${trim(secret_path, '/')}`;
+    let remote_url = `${trim(this.VAULT_ADDR, '/')}/v1/${mount}/data/${trim(secret_path, '/')}`;
     let query = {...url.parse(remote_url), headers : {'x-vault-token' : this.VAULT_TOKEN}, expect : 200};
     let res = await request(query);
     return get(JSON.parse(String(await drain(res))), 'data.data');
@@ -174,33 +174,32 @@ class vvauth {
 
   async _login_vault_ssh({path = 'ssh', role}) {
     logger.info("Trying to auth as '%s'", role);
-    let sock;
-    await new Promise(resolve => (sock = net.connect(process.env.SSH_AUTH_SOCK, resolve)));
-    let agent = new SSHAgent(sock);
-    let keys = Object.values(await agent.list_keys());
+
+
+    let agent = new OpenSSHAgent(process.env.SSH_AUTH_SOCK);
+    let keys = await promiser(chain => agent.getIdentities(chain));
+
 
     let token;
-    await eachLimit(keys, 1, async ({type, ssh_key, fingerprint, comment}) => {
+    await eachLimit(keys, 1, async (pubKey) => {
       if(token)
         return;
 
-      let remote_url = `${trim(this.vault_addr, '/')}/v1/auth/${path}/nonce`;
+      let remote_url = `${trim(this.VAULT_ADDR, '/')}/v1/auth/${path}/nonce`;
       let query = {...url.parse(remote_url), json : true};
       let res = await request(query);
       let {data : {nonce}} = JSON.parse(String(await drain(res)));
 
-      const public_key = `${type} ${ssh_key}`;
-      const {signature} =  await agent.sign(fingerprint, Buffer.from(nonce));
-
+      const signature =  (await promiser(chain => agent.sign(pubKey, Buffer.from(nonce), {}, chain))).toString('base64');
+      const public_key = pubKey.type + ' ' + pubKey.getPublicSSH().toString('base64');
       const payload = {public_key, role, nonce : Buffer.from(nonce).toString('base64'), signature};
       try {
         token = await this._login_vault(path, payload);
       } catch(err) {
-        logger.debug("ssh : invalid challenge for public key", comment);
+        logger.debug("ssh : invalid challenge for public key", pubKey.comment);
       }
     });
 
-    sock.destroy();
 
     if(!token)
       throw `Could not login to vault`;
@@ -227,7 +226,7 @@ class vvauth {
   }
 
   async _lookup_token(token) {
-    let remote_url = `${trim(this.vault_addr, '/')}/v1/auth/token/lookup-self`;
+    let remote_url = `${trim(this.VAULT_ADDR, '/')}/v1/auth/token/lookup-self`;
     let query = {...url.parse(remote_url), headers : {'x-vault-token' : token}, expect : 200};
     let res = await request(query);
     let response = JSON.parse(await drain(res)).data;
@@ -235,14 +234,14 @@ class vvauth {
   }
 
   async _lookup_identity(token, id) {
-    let remote_url = `${trim(this.vault_addr, '/')}/v1/identity/entity/id/${id}`;
+    let remote_url = `${trim(this.VAULT_ADDR, '/')}/v1/identity/entity/id/${id}`;
     let query = {...url.parse(remote_url), headers : {'x-vault-token' : token}, expect : 200};
     let res = await request(query);
     return JSON.parse(String(await drain(res))).data;
   }
 
   async _update_identity(token, id, payload) {
-    let remote_url = `${trim(this.vault_addr, '/')}/v1/identity/entity/id/${id}`;
+    let remote_url = `${trim(this.VAULT_ADDR, '/')}/v1/identity/entity/id/${id}`;
     let query = {...url.parse(remote_url), headers : {'x-vault-token' : token}, expect : 204, json : true};
     await request(query, payload);
     return payload;
@@ -251,7 +250,7 @@ class vvauth {
 
 
   async _login_vault(path, payload) {
-    let remote_url = `${trim(this.vault_addr, '/')}/v1/auth/${path}/login`;
+    let remote_url = `${trim(this.VAULT_ADDR, '/')}/v1/auth/${path}/login`;
     let query = {...url.parse(remote_url), json : true};
     let res = await request(query, payload);
     let response = String(await drain(res));
@@ -266,6 +265,10 @@ class vvauth {
 
 }
 
+const shellEscape = (arg) =>  {
+  return arg.replace(/([$!'"();`*?{}[\]<>&%#~@\\ ])/g, '\\$1');
+};
+
 //ensure module is called directly, i.e. not required
 if(module.parent === null)
   require('cnyks/lib/bundle')(vvauth);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vvauth",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Vault Auth helper",
   "main": "index.js",
   "bin": {
@@ -15,9 +15,9 @@
     "cnyks": "^3.0.6",
     "debug": "^4.3.4",
     "mout": "^1.0.0",
-    "nyks": "^6.9.1",
+    "nyks": "^6.15.0",
     "semver": "^7.5.4",
-    "ssh-agent-js": "^2.0.4",
+    "ssh2": "^1.16.0",
     "yaml": "^2.6.1"
   },
   "devDependencies": {