hscontrol: validate machine key and bind src/dst in SSH check handler

SSHActionHandler now verifies that the Noise session's machine key
matches the dst node before proceeding. The (src, dst) pair is
captured at hold-and-delegate time via a new SSHCheckBinding on
AuthRequest so sshActionFollowUp can verify the follow-up URL
matches. The OIDC non-registration callback requires the
authenticated user to own the src node before approving.

hscontrol/noise.go

@@ -36,6 +36,28 @@ var ErrUnsupportedURLParameterType = errors.New("unsupported URL parameter type"
 // ErrNoAuthSession is returned when an auth_id does not match any active auth session.
 var ErrNoAuthSession = errors.New("no auth session found")
 
+// ErrSSHDstNodeNotFound is returned when the dst node id on a Noise SSH
+// action request does not match any registered node.
+var ErrSSHDstNodeNotFound = errors.New("ssh action: unknown dst node id")
+
+// ErrSSHMachineKeyMismatch is returned when the Noise session's machine
+// key does not match the dst node referenced in the SSH action URL.
+var ErrSSHMachineKeyMismatch = errors.New(
+	"ssh action: noise session machine key does not match dst node",
+)
+
+// ErrSSHAuthSessionNotBound is returned when an SSH action follow-up
+// references an auth session that is not bound to an SSH check pair.
+var ErrSSHAuthSessionNotBound = errors.New(
+	"ssh action: cached auth session is not an SSH-check binding",
+)
+
+// ErrSSHBindingMismatch is returned when an SSH action follow-up's
+// (src, dst) pair does not match the cached binding for its auth_id.
+var ErrSSHBindingMismatch = errors.New(
+	"ssh action: cached binding does not match request src/dst",
+)
+
 const (
 	// ts2021UpgradePath is the path that the server listens on for the WebSockets upgrade.
 	ts2021UpgradePath = "/ts2021"
@@ -337,6 +359,37 @@ func (ns *noiseServer) SSHActionHandler(
 		return
 	}
 
+	// Authenticate the Noise session: the destination node is the
+	// tailscaled instance asking us whether to permit an incoming SSH
+	// connection, so its Noise session must belong to dst. Without this
+	// check any unauthenticated client could open a Noise tunnel with a
+	// throwaway machine key and pollute lastSSHAuth for arbitrary
+	// (src, dst) pairs, defeating SSH check-mode's stolen-key
+	// protections.
+	dstNode, ok := ns.headscale.state.GetNodeByID(dstNodeID)
+	if !ok {
+		httpError(writer, NewHTTPError(
+			http.StatusNotFound,
+			"dst node not found",
+			fmt.Errorf("%w: %d", ErrSSHDstNodeNotFound, dstNodeID),
+		))
+
+		return
+	}
+
+	if dstNode.MachineKey() != ns.machineKey {
+		httpError(writer, NewHTTPError(
+			http.StatusUnauthorized,
+			"machine key does not match dst node",
+			fmt.Errorf(
+				"%w: machine key %s, dst node %d",
+				ErrSSHMachineKeyMismatch, ns.machineKey.ShortString(), dstNodeID,
+			),
+		))
+
+		return
+	}
+
 	reqLog := log.With().
 		Uint64("src_node_id", srcNodeID.Uint64()).
 		Uint64("dst_node_id", dstNodeID.Uint64()).
@@ -426,14 +479,16 @@ func (ns *noiseServer) sshAction(
 	}
 
 	// No auto-approval — create an auth session and hold.
-	return ns.sshActionHoldAndDelegate(reqLog, &action)
+	return ns.sshActionHoldAndDelegate(reqLog, &action, srcNodeID, dstNodeID)
 }
 
-// sshActionHoldAndDelegate creates a new auth session and returns a
-// HoldAndDelegate action that directs the client to authenticate.
+// sshActionHoldAndDelegate creates a new auth session bound to the
+// (src, dst) pair and returns a HoldAndDelegate action that directs the
+// client to authenticate.
 func (ns *noiseServer) sshActionHoldAndDelegate(
 	reqLog zerolog.Logger,
 	action *tailcfg.SSHAction,
+	srcNodeID, dstNodeID types.NodeID,
 ) (*tailcfg.SSHAction, error) {
 	holdURL, err := url.Parse(
 		ns.headscale.cfg.ServerURL +
@@ -457,7 +512,10 @@ func (ns *noiseServer) sshActionHoldAndDelegate(
 		)
 	}
 
-	ns.headscale.state.SetAuthCacheEntry(authID, types.NewAuthRequest())
+	ns.headscale.state.SetAuthCacheEntry(
+		authID,
+		types.NewSSHCheckAuthRequest(srcNodeID, dstNodeID),
+	)
 
 	authURL := ns.headscale.authProvider.AuthURL(authID)
 
@@ -512,6 +570,32 @@ func (ns *noiseServer) sshActionFollowUp(
 		)
 	}
 
+	// Verify the cached binding matches the (src, dst) pair the
+	// follow-up URL claims. Without this check an attacker who knew an
+	// auth_id could submit a follow-up for any other (src, dst) pair
+	// and have its verdict recorded against that pair instead.
+	if !auth.IsSSHCheck() {
+		return nil, NewHTTPError(
+			http.StatusBadRequest,
+			"auth session is not for SSH check",
+			fmt.Errorf("%w: %s", ErrSSHAuthSessionNotBound, authID),
+		)
+	}
+
+	binding := auth.SSHCheckBinding()
+	if binding.SrcNodeID != srcNodeID || binding.DstNodeID != dstNodeID {
+		return nil, NewHTTPError(
+			http.StatusUnauthorized,
+			"src/dst pair does not match auth session",
+			fmt.Errorf(
+				"%w: cached %d->%d, request %d->%d",
+				ErrSSHBindingMismatch,
+				binding.SrcNodeID, binding.DstNodeID,
+				srcNodeID, dstNodeID,
+			),
+		)
+	}
+
 	reqLog.Trace().Caller().Msg("SSH action follow-up")
 
 	verdict := <-auth.WaitForAuth()