/src/libssh2/src/transport.c

Source
/* Copyright (C) The Written Word, Inc.
 * Copyright (C) Daniel Stenberg
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are met:
 *
 * 1. Redistributions of source code must retain the above copyright notice,
 *    this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright notice,
 *    this list of conditions and the following disclaimer in the documentation
 *    and/or other materials provided with the distribution.
 *
 * 3. Neither the name of the copyright holder nor the names of its
 *    contributors may be used to endorse or promote products derived from this
 *    software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 * SPDX-License-Identifier: BSD-3-Clause
 */

/*
 * This file handles reading and writing to the SECSH transport layer. RFC4253.
 */

#include "libssh2_priv.h"

#include <ctype.h>
#include <assert.h>

#include "transport.h"
#include "mac.h"

#ifdef LIBSSH2DEBUG
#define UNPRINTABLE_CHAR '.'
static void transport_debugdump(LIBSSH2_SESSION *session, const char *desc,
                                const unsigned char *ptr, size_t size)
{
    size_t i;
    size_t c;
    unsigned int width = 0x10;
    char buffer[256];  /* Must be enough for width*4 + about 30 or so */
    size_t used;
    static const char *hex_chars = "0123456789ABCDEF";

    if(!(session->showmask & LIBSSH2_TRACE_TRANS))
        return;  /* not asked for, bail out */

    used = ssh2_snprintf(buffer, sizeof(buffer), "=> %s (%lu bytes)\n",
                         desc, (unsigned long)size);
    if(session->tracehandler)
        (session->tracehandler)(session, session->tracehandler_context,
                                buffer, used);
    else
        /* !checksrc! disable BANNEDFUNC 1 */
        fprintf(stderr, "%s", buffer);

    for(i = 0; i < size; i += width) {

        used = ssh2_snprintf(buffer, sizeof(buffer), "%04lx: ",
                             (unsigned long)i);

        /* hex not disabled, show it */
        for(c = 0; c < width; c++) {
            if(i + c < size) {
                buffer[used++] = hex_chars[(ptr[i + c] >> 4) & 0xF];
                buffer[used++] = hex_chars[ptr[i + c] & 0xF];
            }
            else {
                buffer[used++] = ' ';
                buffer[used++] = ' ';
            }

            buffer[used++] = ' ';
            if((width / 2) - 1 == c)
                buffer[used++] = ' ';
        }

        buffer[used++] = ':';
        buffer[used++] = ' ';

        for(c = 0; c < width && (i + c) < size; c++) {
            buffer[used++] = isprint(ptr[i + c]) ?
                ptr[i + c] : UNPRINTABLE_CHAR;
        }
        buffer[used] = 0;

        if(session->tracehandler)
            (session->tracehandler)(session, session->tracehandler_context,
                                    buffer, used);
        else
            /* !checksrc! disable BANNEDFUNC 1 */
            fprintf(stderr, "%s\n", buffer);
    }
}
#else
#define transport_debugdump(a, x, y, z) do {} while(0)
#endif

/* transport_decrypt() decrypts 'len' bytes from 'source' to 'dest' in units of
 * blocksize.
 *
 * returns 0 on success and negative on failure
 */
static int transport_decrypt(LIBSSH2_SESSION *session, unsigned char *source,
                             unsigned char *dest, ssize_t len, int firstlast)
{
    struct transportpacket *p = &session->packet;
    int blocksize = session->remote.crypt->blocksize;

    /* if we get called with a len that is not an even number of blocksizes
       we risk losing those extra bytes. AAD is an exception, since those first
       few bytes are not encrypted so it throws off the rest of the count. */
    if(!CRYPT_FLAG_R(session, PKTLEN_AAD))
        assert((len % blocksize) == 0);

    while(len > 0) {
        /* normally decrypt up to blocksize bytes at a time */
        ssize_t decryptlen = SSH2_MIN(blocksize, len);
        /* The first block is special (since it needs to be decoded to get the
           length of the remainder of the block) and takes priority. When the
           length finally gets to the last blocksize bytes, and there is no
           more data to come, it is the end. */
        int lowerfirstlast = IS_FIRST(firstlast) ? FIRST_BLOCK :
            ((len <= blocksize) ? firstlast : MIDDLE_BLOCK);
        /* If the last block would be less than a whole blocksize, combine it
           with the previous block to make it larger. This ensures that the
           whole MAC is included in a single decrypt call. */
        if(CRYPT_FLAG_R(session, PKTLEN_AAD) && IS_LAST(firstlast) &&
           (len < blocksize * 2)) {
            decryptlen = len;
            lowerfirstlast = LAST_BLOCK;
        }

        if(session->remote.crypt->crypt(session, 0, source, decryptlen,
                                        &session->remote.crypt_abstract,
                                        lowerfirstlast)) {
            SSH2_SAFEFREE(session, p->payload);
            return LIBSSH2_ERROR_DECRYPT;
        }

        /* if the crypt() function would write to a given address it
           would not have to memcpy() and we could avoid this memcpy()
           too */
        memcpy(dest, source, decryptlen);

        len -= decryptlen;       /* less bytes left */
        dest += decryptlen;      /* advance write pointer */
        source += decryptlen;    /* advance read pointer */
    }
    return LIBSSH2_ERROR_NONE;         /* all is fine */
}

/*
 * transport_fullpacket() gets called when a full packet has been received and
 * properly collected.
 */
static int transport_fullpacket(LIBSSH2_SESSION *session,
                                int encrypted /* 1 or 0 */)
{
    unsigned char macbuf[MAX_MACSIZE];
    struct transportpacket *p = &session->packet;
    int rc;
    int compressed;
    const struct mac_method *remote_mac = NULL;
    uint32_t seq = session->remote.seqno;

    memset(macbuf, '\0', sizeof(macbuf));

    if(!encrypted || (!CRYPT_FLAG_R(session, REQUIRES_FULL_PACKET) &&
                      !CRYPT_FLAG_R(session, INTEGRATED_MAC)))
        remote_mac = session->remote.mac;

    if(session->fullpacket_state == ssh2_NB_state_idle) {
        session->fullpacket_macstate = SSH2_MAC_CONFIRMED;
        session->fullpacket_payload_len = p->packet_length - 1;

        if(encrypted && remote_mac) {

            /* Calculate MAC hash */
            int etm = remote_mac->etm;
            size_t mac_len = remote_mac->mac_len;
            if(etm)  /* store hash here */
                remote_mac->hash(session, macbuf,
                                 session->remote.seqno,
                                 p->payload, p->total_num - mac_len,
                                 NULL, 0,
                                 &session->remote.mac_abstract);
            else  /* store hash here */
                remote_mac->hash(session, macbuf,
                                 session->remote.seqno,
                                 p->init, 5,
                                 p->payload,
                                 session->fullpacket_payload_len,
                                 &session->remote.mac_abstract);

            /* Compare the calculated hash with the MAC we read from
             * the network. The read one is at the end of the payload
             * buffer. Note that 'payload_len' here is the packet_length
             * field which includes the padding but not the MAC.
             */
            if(ssh2_timingsafe_bcmp(macbuf,
                                    p->payload + p->total_num - mac_len,
                                    mac_len)) {
                ssh2_deb((session, LIBSSH2_TRACE_SOCKET, "Failed MAC check"));
                session->fullpacket_macstate = SSH2_MAC_INVALID;
            }
            else if(etm) {
                /* MAC was ok and we start by decrypting the first block that
                   contains padding length since this allows us to decrypt
                   all other blocks to the right location in memory
                   avoiding moving a larger block of memory one byte. */
                unsigned char first_block[MAX_BLOCKSIZE];
                ssize_t decrypt_size;
                unsigned char *decrypt_buffer;
                int blocksize = session->remote.crypt->blocksize;

                first_block[0] = 0;

                rc = transport_decrypt(session, p->payload + 4,
                                       first_block, blocksize, FIRST_BLOCK);
                if(rc)
                    return rc;

                /* we need buffer for decrypt */
                decrypt_size = p->total_num - mac_len - 4;
                decrypt_buffer = SSH2_ALLOC(session, decrypt_size);
                if(!decrypt_buffer)
                    return LIBSSH2_ERROR_ALLOC;

                /* grab padding length and copy anything else
                   into target buffer */
                p->padding_length = first_block[0];

                if(p->padding_length > p->packet_length - 1) {
                    SSH2_FREE(session, decrypt_buffer);
                    return LIBSSH2_ERROR_PROTO;
                }

                if(blocksize > 1)
                    memcpy(decrypt_buffer, first_block + 1, blocksize - 1);

                /* decrypt all other blocks packet */
                if(blocksize < decrypt_size) {
                    rc = transport_decrypt(session,
                                           p->payload + blocksize + 4,
                                           decrypt_buffer + blocksize - 1,
                                           decrypt_size - blocksize,
                                           LAST_BLOCK);
                    if(rc) {
                        SSH2_FREE(session, decrypt_buffer);
                        return rc;
                    }
                }

                /* replace encrypted payload with plain text payload */
                SSH2_FREE(session, p->payload);
                p->payload = decrypt_buffer;
            }
        }
        else if(encrypted && CRYPT_FLAG_R(session, REQUIRES_FULL_PACKET))
            /* etm trim off padding byte from payload */
            memmove(p->payload, &p->payload[1], p->packet_length - 1);

        session->remote.seqno++;

        /* ignore the padding */
        session->fullpacket_payload_len -= p->padding_length;

        /* Check for and deal with decompression */
        compressed = session->local.comp &&
                     session->local.comp->compress &&
                     ((session->state & SSH2_STATE_AUTHENTICATED) ||
                      session->local.comp->use_in_auth);

        if(compressed && session->remote.comp_abstract) {
            /*
             * The buffer for the decompression (remote.comp_abstract) is
             * initialised in time when it is needed so as long it is NULL we
             * cannot decompress.
             */

            unsigned char *data = NULL;
            size_t data_len = 0;
            rc = session->remote.comp->decomp(session,
                                              &data, &data_len,
                                              LIBSSH2_PACKET_MAXDECOMP,
                                              p->payload,
                                              session->fullpacket_payload_len,
                                              &session->remote.comp_abstract);
            SSH2_SAFEFREE(session, p->payload);
            if(rc)
                return rc;

            p->payload = data;
            session->fullpacket_payload_len = data_len;
        }

        session->fullpacket_packet_type = p->payload[0];

        transport_debugdump(session, "ssh2_transport_read() plain",
                            p->payload, session->fullpacket_payload_len);

        session->fullpacket_state = ssh2_NB_state_created;
    }

    if(session->fullpacket_state == ssh2_NB_state_created) {
        rc = ssh2_packet_add(session, p->payload,
                             session->fullpacket_payload_len,
                             session->fullpacket_macstate, seq);
        if(rc == LIBSSH2_ERROR_EAGAIN) {
            /* ssh2_packet_add() queues the packet into session->packets before
             * attempting follow-up work like key re-exchange. If EAGAIN occurs
             * during that work, packAdd_state is reset to idle and the data is
             * already owned by the packet queue. Clear p->payload to prevent
             * double-free in session cleanup. */
            if(session->packAdd_state == ssh2_NB_state_idle)
                p->payload = NULL;
            return rc;
        }
        /* ssh2_packet_add() takes ownership of the payload on all non-EAGAIN
         * paths, so clear the pointer */
        p->payload = NULL;
        if(rc) {
            session->fullpacket_state = ssh2_NB_state_idle;
            return rc;
        }
    }

    session->fullpacket_state = ssh2_NB_state_idle;

    if(session->kex_strict &&
       session->fullpacket_packet_type == SSH_MSG_NEWKEYS)
        session->remote.seqno = 0;

    return session->fullpacket_packet_type;
}

/*
 * Collect a packet into the input queue.
 *
 * Returns packet type added to input queue (0 if nothing added), or a
 * negative error number.
 *
 * This function reads the binary stream as specified in chapter 6 of RFC4253
 * "The Secure Shell (SSH) Transport Layer Protocol"
 *
 * DOES NOT call ssh2_err() for ANY error case.
 */
int ssh2_transport_read(LIBSSH2_SESSION *session)
{
    int rc;
    struct transportpacket *p = &session->packet;
    ssize_t remainpack; /* how much there is left to add to the current payload
                           package */
    ssize_t remainbuf;  /* how much data there is remaining in the buffer to
                           deal with before we should read more from the
                           network */
    ssize_t numbytes;   /* how much data to deal with from the buffer on this
                           iteration through the loop */
    ssize_t numdecrypt; /* number of bytes to decrypt this iteration */
    unsigned char block[MAX_BLOCKSIZE]; /* working block buffer */
    int blocksize;  /* minimum number of bytes we need before we can
                       use them */
    int encrypted = 1; /* whether the packet is encrypted or not */
    int firstlast = FIRST_BLOCK; /* if the first or last block to decrypt */
    unsigned int auth_len = 0; /* length of the authentication tag */
    const struct mac_method *remote_mac = NULL; /* The remote MAC, if used */

    block[4] = 0;

    /* default clear the bit */
    session->socket_block_directions &= ~LIBSSH2_SESSION_BLOCK_INBOUND;

    /*
     * All channels, systems, subsystems, etc eventually make it down here
     * when looking for more incoming data. If a key exchange is going on
     * (SSH2_STATE_EXCHANGING_KEYS bit is set) then the remote end
     * ONLY sends key exchange related traffic. In non-blocking mode, there is
     * a chance to break out of the kex_exchange function with an EAGAIN
     * status, and never come back to it. If SSH2_STATE_EXCHANGING_KEYS is
     * active, then we must redirect to the key exchange. However, if
     * kex_exchange is active (as in it is the one that calls this execution
     * of packet_read, then do not redirect, as that would be an infinite loop!
     */

    if(session->state & SSH2_STATE_EXCHANGING_KEYS &&
       !(session->state & SSH2_STATE_KEX_ACTIVE)) {

        /* Whoever wants a packet does not get anything until the key
         * re-exchange is done!
         */
        ssh2_deb((session, LIBSSH2_TRACE_TRANS, "Redirecting into the"
                  " key re-exchange from ssh2_transport_read()"));
        rc = ssh2_kex_exchange(session, 1, &session->startup_key_state);
        if(rc)
            return rc;
    }

    /*
     * =============================== NOTE ===============================
     * I know this is ugly and not a really good use of "goto", but
     * this case statement would be even uglier to do it any other way
     */
    if(session->readPack_state == ssh2_NB_state_jump1) {
        session->readPack_state = ssh2_NB_state_idle;
        encrypted = session->readPack_encrypted;
        goto ssh2_transport_read_point1;
    }

    do {
        int etm;
        if(session->socket_state == SSH2_SOCKET_DISCONNECTED)
            return LIBSSH2_ERROR_SOCKET_DISCONNECT;

        if(session->state & SSH2_STATE_NEWKEYS)
            blocksize = session->remote.crypt->blocksize;
        else {
            encrypted = 0;      /* not encrypted */
            blocksize = 5;      /* not strictly true, but we can use 5 here to
                                   make the checks below work fine still */
        }

        if(encrypted) {
            if(CRYPT_FLAG_R(session, REQUIRES_FULL_PACKET))
                auth_len = session->remote.crypt->auth_len;
            else
                remote_mac = session->remote.mac;
        }

        etm = encrypted && remote_mac ? remote_mac->etm : 0;

        /* read/use a whole big chunk into a temporary area stored in
           the LIBSSH2_SESSION struct. We decrypt data from that
           buffer into the packet buffer so this temp one does not have
           to be able to keep a whole SSH packet, be large enough
           so that we can read big chunks from the network layer. */

        /* how much data there is remaining in the buffer to deal with
           before we should read more from the network */
        remainbuf = p->writeidx - p->readidx;

        /* if remainbuf turns negative we have a bad internal error */
        assert(remainbuf >= 0);

        if(remainbuf < blocksize ||
           (CRYPT_FLAG_R(session, REQUIRES_FULL_PACKET) &&
            ((ssize_t)p->total_num) > remainbuf)) {
            /* If we have less than a blocksize left, it is too
               little data to deal with, read more */
            ssize_t nread;

            /* move any remainder to the start of the buffer so
               that we can do a full refill */
            if(remainbuf) {
                memmove(p->buf, &p->buf[p->readidx], remainbuf);
                p->readidx = 0;
                p->writeidx = remainbuf;
            }
            else /* nothing to move, zero the indexes */
                p->readidx = p->writeidx = 0;

            /* now read a big chunk from the network into the temp buffer */
            nread = SSH2_RECV(session, &p->buf[remainbuf],
                              PACKETBUFSIZE - remainbuf,
                              SSH2_SOCKET_RECV_FLAGS(session));
            if(nread <= 0) {
                /* check if this is due to EAGAIN and return the special
                   return code if so, error out normally otherwise */
                if(nread < 0 && nread == -EAGAIN) {
                    session->socket_block_directions |=
                        LIBSSH2_SESSION_BLOCK_INBOUND;
                    return LIBSSH2_ERROR_EAGAIN;
                }
                ssh2_deb((session, LIBSSH2_TRACE_SOCKET,
                          "Error recving %ld bytes (got %ld)",
                          (long)(PACKETBUFSIZE - remainbuf), (long)-nread));
                return LIBSSH2_ERROR_SOCKET_RECV;
            }
            ssh2_deb((session, LIBSSH2_TRACE_SOCKET,
                      "Recved %ld/%ld bytes to %p+%ld", (long)nread,
                      (long)(PACKETBUFSIZE - remainbuf), (void *)p->buf,
                      (long)remainbuf));

            transport_debugdump(session, "ssh2_transport_read() raw",
                                &p->buf[remainbuf], nread);
            /* advance write pointer */
            p->writeidx += nread;

            /* update remainbuf counter */
            remainbuf = p->writeidx - p->readidx;
        }

        /* how much data to deal with from the buffer */
        numbytes = remainbuf;

        if(!p->total_num) {
            size_t total_num; /* the number of bytes following the initial
                                 (5 bytes) packet length and padding length
                                 fields */

            /* packet length is not encrypted in encode-then-mac mode
               and we do not need to decrypt first block */
            ssize_t required_size = etm ? 4 : blocksize;

            /* No payload package area allocated yet. To know the
               size of this payload, we need enough to decrypt the first
               blocksize data. */

            if(numbytes < required_size) {
                /* we cannot act on anything less than blocksize, but this
                   check is only done for the initial block since once we have
                   got the start of a block we can in fact deal with fractions
                 */
                session->socket_block_directions |=
                    LIBSSH2_SESSION_BLOCK_INBOUND;
                return LIBSSH2_ERROR_EAGAIN;
            }

            if(etm) {
                /* etm size field is not encrypted */
                memcpy(block, &p->buf[p->readidx], 4);
                memcpy(p->init, &p->buf[p->readidx], 4);
            }
            else if(encrypted && session->remote.crypt->get_len) {
                unsigned int len = 0;
                unsigned char *ptr = NULL;

                rc = session->remote.crypt->get_len(session,
                                            session->remote.seqno,
                                            &p->buf[p->readidx],
                                            numbytes,
                                            &len,
                                            &session->remote.crypt_abstract);

                if(rc != LIBSSH2_ERROR_NONE) {
                    p->total_num = 0; /* no packet buffer available */
                    if(p->payload)
                        SSH2_SAFEFREE(session, p->payload);
                    return rc;
                }

                /* store size in buffers for use below */
                ptr = &block[0];
                ssh2_store_u32(&ptr, len);

                ptr = &p->init[0];
                ssh2_store_u32(&ptr, len);
            }
            else {
                if(encrypted) {
                    /* first decrypted block */
                    rc = transport_decrypt(session, &p->buf[p->readidx],
                                           block, blocksize, FIRST_BLOCK);
                    if(rc != LIBSSH2_ERROR_NONE)
                        return rc;
                    /* Save the first 5 bytes of the decrypted package, to be
                       used in the hash calculation later down.
                       This is ignored in the INTEGRATED_MAC case. */
                    memcpy(p->init, block, 5);
                }
                else {
                    /* the data is plain, copy it verbatim to
                       the working block buffer */
                    memcpy(block, &p->buf[p->readidx], blocksize);
                }

                /* advance the read pointer */
                p->readidx += blocksize;

                /* we now have the initial blocksize bytes decrypted,
                 * and we can extract packet and padding length from it
                 */
                p->packet_length = ssh2_ntohu32(block);
            }

            if(!encrypted || !CRYPT_FLAG_R(session, REQUIRES_FULL_PACKET)) {
                if(p->packet_length < 1)
                    return LIBSSH2_ERROR_DECRYPT;
                else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD)
                    return LIBSSH2_ERROR_OUT_OF_BOUNDARY;

                if(etm) {
                    /* do not know what padding is until we decrypt the full
                     packet */
                    p->padding_length = 0;

                    /* we collect entire undecrypted packet including the
                       packet length field that we run MAC over */
                    p->packet_length = ssh2_ntohu32(block);
                    total_num = 4 + p->packet_length + remote_mac->mac_len;
                }
                else {
                    /* padding_length has not been authenticated yet, but it
                       is not actually used (except for the sanity check
                       immediately following) until after the entire packet is
                       authenticated, so this is safe. */
                    p->padding_length = block[4];
                    if(p->padding_length > p->packet_length - 1)
                        return LIBSSH2_ERROR_DECRYPT;

                    /* total_num is the number of bytes following the initial
                       (5 bytes) packet length and padding length fields */
                    total_num = p->packet_length - 1 +
                        (encrypted && remote_mac ? remote_mac->mac_len : 0);
                }
            }
            else {
                /* advance the read pointer past size field if the packet
                   length is not required for decryption */

                /* add size field to be included in total packet size
                 * calculation so it does not get dropped off on subsequent
                 * partial reads
                 */
                total_num = 4;

                p->packet_length = ssh2_ntohu32(block);
                if(p->packet_length < 1)
                    return LIBSSH2_ERROR_DECRYPT;
                else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD)
                    return LIBSSH2_ERROR_OUT_OF_BOUNDARY;

                /* total_num may include size field, however due to existing
                 * logic it needs to be removed after the entire packet is read
                 */

                total_num += p->packet_length +
                    (remote_mac ? remote_mac->mac_len : 0) + auth_len;

                /* do not know what padding is until we decrypt the full
                   packet */
                p->padding_length = 0;
            }

            /* RFC4253 section 6.1 Maximum Packet Length says:
             *
             * "All implementations MUST be able to process
             * packets with uncompressed payload length of 32768
             * bytes or less and total packet size of 35000 bytes
             * or less (including length, padding length, payload,
             * padding, and MAC.)."
             */
            if(total_num > LIBSSH2_PACKET_MAXPAYLOAD || total_num == 0)
                return LIBSSH2_ERROR_OUT_OF_BOUNDARY;

            /* Get a packet handle put data into. We get one to
               hold all data, including padding and MAC. */
            p->payload = SSH2_ALLOC(session, total_num);
            if(!p->payload)
                return LIBSSH2_ERROR_ALLOC;
            p->total_num = total_num;
            /* init write pointer to start of payload buffer */
            p->wptr = p->payload;

            if(!encrypted || !CRYPT_FLAG_R(session, REQUIRES_FULL_PACKET)) {
                if(!etm && blocksize > 5) {
                    /* copy the data from index 5 to the end of
                       the blocksize from the temporary buffer to
                       the start of the decrypted buffer */
                    if(blocksize - 5 <= (int)total_num) {
                        memcpy(p->wptr, &block[5], blocksize - 5);
                        p->wptr += blocksize - 5; /* advance write pointer */
                    }
                    else {
                        if(p->payload)
                            SSH2_SAFEFREE(session, p->payload);
                        return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
                    }
                }

                /* init the data_num field to the number of bytes of
                   the package read so far */
                p->data_num = p->wptr - p->payload;

                /* we already dealt with a blocksize worth of data */
                if(!etm)
                    numbytes -= blocksize;
            }
            else {
                /* have not started reading payload yet */
                p->data_num = 0;

                /* we already dealt with packet size worth of data */
                if(!encrypted)
                    numbytes -= 4;
            }
        }

        /* how much there is left to add to the current payload
           package */
        remainpack = p->total_num - p->data_num;

        if(numbytes > remainpack)
            /* if we have more data in the buffer than what is going into this
               particular packet, we limit this round to this packet only */
            numbytes = remainpack;

        if(encrypted && CRYPT_FLAG_R(session, REQUIRES_FULL_PACKET)) {
            if(numbytes < remainpack) {
                /* need a full packet before checking MAC */
                session->socket_block_directions |=
                    LIBSSH2_SESSION_BLOCK_INBOUND;
                return LIBSSH2_ERROR_EAGAIN;
            }

            /* we have a full packet, now remove the size field from numbytes
               and total_num to process only the packet data */
            numbytes -= 4;
            p->total_num -= 4;
        }

        if(encrypted && !etm) {
            /* At the end of the incoming stream, there is a MAC,
               and we do not want to decrypt that since we need it
               "raw". We MUST however decrypt the padding data
               since it is used for the hash later on. */
            int skip = (remote_mac ? remote_mac->mac_len : 0) + auth_len;

            if(CRYPT_FLAG_R(session, INTEGRATED_MAC))
                /* This crypto method DOES need the MAC to go through
                   decryption so it can be authenticated. */
                skip = 0;

            /* if what we have plus numbytes is bigger than the
               total minus the skip margin, we should lower the
               amount to decrypt even more */
            if((p->data_num + numbytes) >= (p->total_num - skip)) {
                /* decrypt the entire rest of the package */
                numdecrypt = SSH2_MAX(0,
                    (int)(p->total_num - skip) - (int)p->data_num);
                firstlast = LAST_BLOCK;
            }
            else {
                ssize_t frac;
                numdecrypt = numbytes;
                frac = numdecrypt % blocksize;
                if(frac) {
                    /* not an aligned amount of blocks, align it by reducing
                       the number of bytes processed this loop */
                    numdecrypt -= frac;
                    /* and make it no unencrypted data
                       after it */
                    numbytes = 0;
                }
                if(CRYPT_FLAG_R(session, INTEGRATED_MAC)) {
                    /* Make sure that we save enough bytes to make the last
                     * block large enough to hold the entire integrated MAC */
                    numdecrypt = SSH2_MIN(numdecrypt,
                        (int)(p->total_num - skip - blocksize - p->data_num));
                    numbytes = 0;
                }
                firstlast = MIDDLE_BLOCK;
            }
        }
        else /* unencrypted data should not be decrypted at all */
            numdecrypt = 0;

        assert(numdecrypt >= 0);

        /* if there are bytes to decrypt, do that */
        if(numdecrypt > 0) {
            /* now decrypt the lot */
            if(CRYPT_FLAG_R(session, REQUIRES_FULL_PACKET)) {
                rc = session->remote.crypt->crypt(session,
                                               session->remote.seqno,
                                               &p->buf[p->readidx],
                                               numdecrypt,
                                               &session->remote.crypt_abstract,
                                               0);

                if(rc != LIBSSH2_ERROR_NONE) {
                    p->total_num = 0; /* no packet buffer available */
                    return rc;
                }

                memcpy(p->wptr, &p->buf[p->readidx], numbytes);

                /* advance read index past size field now that we have
                   decrypted full packet */
                p->readidx += 4;

                /* include auth tag in bytes decrypted */
                numdecrypt += auth_len;

                /* set padding now that the packet has been verified and
                   decrypted */
                p->padding_length = p->wptr[0];

                if(p->padding_length > p->packet_length - 1)
                    return LIBSSH2_ERROR_DECRYPT;
            }
            else {
                rc = transport_decrypt(session, &p->buf[p->readidx], p->wptr,
                                       numdecrypt, firstlast);

                if(rc != LIBSSH2_ERROR_NONE) {
                    p->total_num = 0; /* no packet buffer available */
                    return rc;
                }
            }

            /* advance the read pointer */
            p->readidx += numdecrypt;
            /* advance write pointer */
            p->wptr += numdecrypt;
            /* increase data_num */
            p->data_num += numdecrypt;

            /* bytes left to take care of without decryption */
            numbytes -= numdecrypt;
        }

        /* if there are bytes to copy that are not decrypted,
           copy them as-is to the target buffer */
        if(numbytes > 0) {

            if((size_t)numbytes <= (p->total_num - (p->wptr - p->payload)))
                memcpy(p->wptr, &p->buf[p->readidx], numbytes);
            else {
                if(p->payload)
                    SSH2_SAFEFREE(session, p->payload);
                return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
            }

            /* advance the read pointer */
            p->readidx += numbytes;
            /* advance write pointer */
            p->wptr += numbytes;
            /* increase data_num */
            p->data_num += numbytes;
        }

        /* now check how much data there is left to read to finish the
           current packet */
        remainpack = p->total_num - p->data_num;

        if(!remainpack) {
            /* we have a full packet */
ssh2_transport_read_point1:
            rc = transport_fullpacket(session, encrypted);
            if(rc == LIBSSH2_ERROR_EAGAIN) {

                if(session->packAdd_state != ssh2_NB_state_idle) {
                    /* transport_fullpacket() only returns LIBSSH2_ERROR_EAGAIN
                     * if ssh2_packet_add() returns LIBSSH2_ERROR_EAGAIN. If
                     * that returns LIBSSH2_ERROR_EAGAIN but the packAdd_state
                     * is idle, then the packet has been added to the brigade,
                     * but some immediate action that was taken based on the
                     * packet type (such as key re-exchange) is not yet
                     * complete.  Clear the way for a new packet to be read
                     * in.
                     */
                    session->readPack_encrypted = encrypted;
                    session->readPack_state = ssh2_NB_state_jump1;
                }

                return rc;
            }

            p->total_num = 0; /* no packet buffer available */

            return rc;
        }
    } while(1); /* loop */

    return LIBSSH2_ERROR_SOCKET_RECV; /* we never reach this point */
}

static int transport_send_existing(LIBSSH2_SESSION *session,
                                   const unsigned char *data,
                                   size_t data_len, ssize_t *ret)
{
    ssize_t rc;
    ssize_t length;
    struct transportpacket *p = &session->packet;

    if(!p->olen) {
        *ret = 0;
        return LIBSSH2_ERROR_NONE;
    }

    /* send as much as possible of the existing packet */
    if(data != p->odata || data_len != p->olen) {
        /* When we are about to complete the sending of a packet, it is vital
           that the caller does not try to send a new/different packet since
           we do not add this one up until the previous one has been sent. To
           make the caller really notice his/hers flaw, we return error for
           this case */
        ssh2_deb((session, LIBSSH2_TRACE_SOCKET,
                  "Address is different, returning EAGAIN"));
        return LIBSSH2_ERROR_EAGAIN;
    }

    *ret = 1; /* set to make our parent return */

    /* number of bytes left to send */
    length = p->ototal_num - p->osent;

    rc = SSH2_SEND(session, &p->outbuf[p->osent], length,
                   SSH2_SOCKET_SEND_FLAGS(session));
    if(rc < 0)
        ssh2_deb((session, LIBSSH2_TRACE_SOCKET,
                  "Error sending %ld bytes: %ld", (long)length, (long)-rc));
    else {
        ssh2_deb((session, LIBSSH2_TRACE_SOCKET,
                  "Sent %ld/%ld bytes at %p+%lu", (long)rc, (long)length,
                  (void *)p->outbuf, (unsigned long)p->osent));
        transport_debugdump(session, "ssh2_transport_send()",
                            &p->outbuf[p->osent], rc);
    }

    if(rc == length) {
        /* the remainder of the package was sent */
        p->ototal_num = 0;
        p->olen = 0;
        /* we leave *ret set so that the parent returns as we MUST return back
           a send success now, so that we do not risk sending EAGAIN later
           which then would confuse the parent function */
        return LIBSSH2_ERROR_NONE;
    }
    else if(rc < 0) {
        /* nothing was sent */
        if(rc != -EAGAIN)
            /* send failure! */
            return LIBSSH2_ERROR_SOCKET_SEND;

        session->socket_block_directions |= LIBSSH2_SESSION_BLOCK_OUTBOUND;
        return LIBSSH2_ERROR_EAGAIN;
    }

    p->osent += rc; /* we sent away this much data */

    return rc < length ? LIBSSH2_ERROR_EAGAIN : LIBSSH2_ERROR_NONE;
}

/*
 * Send a packet, encrypting it and adding a MAC code if necessary
 * Returns 0 on success, non-zero on failure.
 *
 * The data is provided as _two_ data areas that are combined by this
 * function.  The 'data' part is sent immediately before 'data2'. 'data2' may
 * be set to NULL to only use a single part.
 *
 * Returns LIBSSH2_ERROR_EAGAIN if it would block or if the whole packet was
 * not sent yet. If it does so, the caller should call this function again as
 * soon as it is likely that more data can be sent, and this function MUST
 * then be called with the same argument set (same data pointer and same
 * data_len) until ERROR_NONE or failure is returned.
 *
 * This function DOES NOT call ssh2_err() on any errors.
 */
int ssh2_transport_send(LIBSSH2_SESSION *session,
                        const unsigned char *data, size_t data_len,
                        const unsigned char *data2, size_t data2_len)
{
    int blocksize =
        (session->state & SSH2_STATE_NEWKEYS) ?
        session->local.crypt->blocksize : 8;
    ssize_t padding_length;
    size_t packet_length;
    ssize_t total_length;
#ifdef LIBSSH2_RANDOM_PADDING
    int rand_max;
    int seed = data[0]; /* FIXME: make this random */
#endif
    struct transportpacket *p = &session->packet;
    int encrypted;
    int compressed;
    int etm;
    ssize_t ret;
    int rc;
    const unsigned char *orgdata = data;
    const struct mac_method *local_mac = NULL;
    unsigned int auth_len = 0;
    size_t orgdata_len = data_len;
    size_t crypt_offset, etm_crypt_offset;

    transport_debugdump(session, "ssh2_transport_send() plain",
                        data, data_len);
    if(data2)
        transport_debugdump(session, "ssh2_transport_send() plain2",
                            data2, data2_len);

    /* Finish flushing any partially-sent packet BEFORE redirecting into a key
     * re-exchange. A packet already in transmission can only be completed by
     * a transport_send call with that same packet (transport_send_existing()
     * rejects a different data pointer with EAGAIN). If rekey runs first,
     * a packet caught mid-send when rekey starts can never be flushed and
     * the session deadlocks. RFC 4253 7.1 requires completing the in-flight
     * packet; only NEW packets are withheld, which the rekey redirect (reached
     * only once nothing is pending) still does.
     *
     * transport_send_existing() only sanity-checks data and data_len, not
     * data2/data2_len.
     */
    rc = transport_send_existing(session, data, data_len, &ret);
    if(rc)
        return rc;

    session->socket_block_directions &= ~LIBSSH2_SESSION_BLOCK_OUTBOUND;

    if(ret)
        /* set by transport_send_existing() if data was sent */
        return rc;

    /*
     * If the last read operation was interrupted in the middle of a key
     * exchange, we must complete that key exchange before writing further
     * *new* data. See the similar block in ssh2_transport_read().
     */
    if(session->state & SSH2_STATE_EXCHANGING_KEYS &&
       !(session->state & SSH2_STATE_KEX_ACTIVE)) {
        /* Do not write any new packets if we are still in the middle of a key
         * exchange. */
        ssh2_deb((session, LIBSSH2_TRACE_TRANS, "Redirecting into the"
                  " key re-exchange from ssh2_transport_send()"));
        rc = ssh2_kex_exchange(session, 1, &session->startup_key_state);
        if(rc)
            return rc;
    }

    encrypted = (session->state & SSH2_STATE_NEWKEYS) ? 1 : 0;

    if(encrypted && session->local.crypt &&
       CRYPT_FLAG_L(session, REQUIRES_FULL_PACKET))
        auth_len = session->local.crypt->auth_len;
    else
        local_mac = session->local.mac;

    etm = encrypted && local_mac ? local_mac->etm : 0;

    compressed = session->local.comp &&
                 session->local.comp->compress &&
                 ((session->state & SSH2_STATE_AUTHENTICATED) ||
                  session->local.comp->use_in_auth);

    if(encrypted && compressed && session->local.comp_abstract) {
        /* the idea here is that these function must fail if the output gets
           larger than what fits in the assigned buffer so thus they do not
           check the input size as we do not know how much it compresses */
        size_t dest_len = MAX_SSH_PACKET_LEN - 5 - 256;
        size_t dest2_len = dest_len;

        /* compress directly to the target buffer */
        rc = session->local.comp->comp(session,
                                       &p->outbuf[5], &dest_len,
                                       data, data_len,
                                       &session->local.comp_abstract);
        if(rc)
            return rc; /* compression failure */

        if(data2 && data2_len) {
            /* compress directly to the target buffer right after where the
               previous call put data */
            dest2_len -= dest_len;

            rc = session->local.comp->comp(session,
                                           &p->outbuf[5 + dest_len],
                                           &dest2_len,
                                           data2, data2_len,
                                           &session->local.comp_abstract);
        }
        else
            dest2_len = 0;
        if(rc)
            return rc; /* compression failure */

        data_len = dest_len + dest2_len; /* use the combined length */
    }
    else {
        if((data_len + data2_len) >= (MAX_SSH_PACKET_LEN - 0x100))
            /* too large packet, return error for this until we make this
               function split it up and send multiple SSH packets */
            return LIBSSH2_ERROR_INVAL;

        /* copy the payload data */
        memcpy(&p->outbuf[5], data, data_len);
        if(data2 && data2_len)
            memcpy(&p->outbuf[5 + data_len], data2, data2_len);
        data_len += data2_len; /* use the combined length */
    }

    /* RFC4253 says: Note that the length of the concatenation of
       'packet_length', 'padding_length', 'payload', and 'random padding'
       MUST be a multiple of the cipher block size or 8, whichever is
       larger. */

    /* Plain math: (4 + 1 + packet_length + padding_length) % blocksize == 0 */

    packet_length = data_len + 1 + 4; /* 1 is for padding_length field
                                         4 for the packet_length field */
    /* subtract 4 bytes of the packet_length field when padding AES-GCM
       or with ETM */
    crypt_offset = (etm || auth_len ||
                    (encrypted && CRYPT_FLAG_L(session, PKTLEN_AAD)))
                   ? 4 : 0;
    etm_crypt_offset = etm ? 4 : 0;

    /* at this point we have it all except the padding */

    /* first figure out our minimum padding amount to make it an even
       block size */
    padding_length = blocksize - ((packet_length - crypt_offset) % blocksize);

    /* if the padding becomes too small we add another blocksize worth
       of it (taken from the original libssh2 where it did not have any
       real explanation) */
    if(padding_length < 4)
        padding_length += blocksize;
#ifdef LIBSSH2_RANDOM_PADDING
    /* FIXME: we can add padding here, but that also makes the packets
       bigger etc */

    /* now we can add 'blocksize' to the padding_length N number of times
       (to "help thwart traffic analysis") but it must be less than 255 in
       total */
    rand_max = (255 - padding_length) / blocksize + 1;
    padding_length += blocksize * (seed % rand_max);
#endif

    packet_length += padding_length;

    /* append the MAC length to the total_length size */
    total_length =
        packet_length + (encrypted && local_mac ? local_mac->mac_len : 0);

    total_length += auth_len;

    /* store packet_length, which is the size of the whole packet except
       the MAC and the packet_length field itself */
    ssh2_htonu32(p->outbuf, (uint32_t)(packet_length - 4));
    /* store padding_length */
    p->outbuf[4] = (unsigned char)padding_length;

    /* fill the padding area with random junk */
    if(ssh2_random(p->outbuf + 5 + data_len, padding_length))
        return ssh2_err(session, LIBSSH2_ERROR_RANDGEN,
                        "Unable to get random bytes for packet padding");

    if(encrypted) {
        size_t i;

        /* Calculate MAC hash. Put the output at index packet_length,
           since that size includes the whole packet. The MAC is
           calculated on the entire unencrypted packet, including all
           fields except the MAC field itself. This is skipped in the
           INTEGRATED_MAC case, where the crypto algorithm also does its
           own hash. */
        if(!etm && local_mac && !CRYPT_FLAG_L(session, INTEGRATED_MAC)) {
            if(local_mac->hash(session, p->outbuf + packet_length,
                               session->local.seqno, p->outbuf,
                               packet_length, NULL, 0,
                               &session->local.mac_abstract))
                return ssh2_err(session, LIBSSH2_ERROR_MAC_FAILURE,
                                "Failed to calculate MAC");
        }

        if(CRYPT_FLAG_L(session, REQUIRES_FULL_PACKET)) {
            if(session->local.crypt->crypt(session,
                                           session->local.seqno,
                                           p->outbuf,
                                           packet_length,
                                           &session->local.crypt_abstract,
                                           0))
                return LIBSSH2_ERROR_ENCRYPT;
        }
        else {
            /* Encrypt the whole packet data, one block size at a time.
               The MAC field is not encrypted unless INTEGRATED_MAC. */
            /* Some crypto back-ends could handle a single crypt() call for
               encryption, but (presumably) others cannot, so break it up
               into blocksize-sized chunks to satisfy them all. */
            for(i = etm_crypt_offset; i < packet_length;
                i += session->local.crypt->blocksize) {
                unsigned char *ptr = &p->outbuf[i];
                size_t bsize = SSH2_MIN(session->local.crypt->blocksize,
                                        (int)(packet_length - i));
                /* The INTEGRATED_MAC case always has an extra call below, so
                   it never is LAST_BLOCK up here. */
                int firstlast = i == 0 ? FIRST_BLOCK :
                    (!CRYPT_FLAG_L(session, INTEGRATED_MAC) &&
                     (i == packet_length - session->local.crypt->blocksize)
                     ? LAST_BLOCK : MIDDLE_BLOCK);
                /* In the AAD case, the last block would be only 4 bytes
                   because everything is offset by 4 since the initial
                   packet_length is not encrypted. In this case, combine that
                   last short packet with the previous one since AES-GCM
                   crypt() assumes that the entire MAC is available in that
                   packet so it can set that to the authentication tag. */
                if(!CRYPT_FLAG_L(session, INTEGRATED_MAC) &&
                   i > packet_length - 2 * bsize) {
                    /* increase the final block size */
                    bsize = packet_length - i;
                    /* advance the loop counter by the extra amount */
                    i += bsize - session->local.crypt->blocksize;
                }
                ssh2_deb((session, LIBSSH2_TRACE_SOCKET,
                          "crypting bytes %lu-%lu", (unsigned long)i,
                          (unsigned long)(i + bsize - 1)));
                if(session->local.crypt->crypt(session, 0, ptr, bsize,
                                               &session->local.crypt_abstract,
                                               firstlast))
                    return LIBSSH2_ERROR_ENCRYPT; /* encryption failure */
            }

            /* Call crypt() one last time so it can be filled in with the
               MAC */
            if(CRYPT_FLAG_L(session, INTEGRATED_MAC)) {
                int authlen = local_mac ? local_mac->mac_len : 0;
                assert((size_t)total_length <=
                       packet_length + session->local.crypt->blocksize);
                if(session->local.crypt->crypt(session, 0,
                                               &p->outbuf[packet_length],
                                               authlen,
                                               &session->local.crypt_abstract,
                                               LAST_BLOCK))
                    return LIBSSH2_ERROR_ENCRYPT; /* encryption failure */
            }
        }

        if(etm) {
            /* Calculate MAC hash. Put the output at index packet_length,
               since that size includes the whole packet. The MAC is
               calculated on the entire packet (length plain the rest
               encrypted), including all fields except the MAC field
               itself. */
            if(local_mac->hash(session, p->outbuf + packet_length,
                               session->local.seqno, p->outbuf,
                               packet_length, NULL, 0,
                               &session->local.mac_abstract))
                return ssh2_err(session, LIBSSH2_ERROR_MAC_FAILURE,
                                "Failed to calculate MAC");
        }
    }

    session->local.seqno++;

    if(session->kex_strict && data[0] == SSH_MSG_NEWKEYS)
        session->local.seqno = 0;

    ret = SSH2_SEND(session, p->outbuf, total_length,
                    SSH2_SOCKET_SEND_FLAGS(session));
    if(ret < 0)
        ssh2_deb((session, LIBSSH2_TRACE_SOCKET,
                  "Error sending %ld bytes: %ld",
                  (long)total_length, (long)-ret));
    else {
        ssh2_deb((session, LIBSSH2_TRACE_SOCKET,
                  "Sent %ld/%ld bytes at %p",
                  (long)ret, (long)total_length, (void *)p->outbuf));
        transport_debugdump(session, "ssh2_transport_send()", p->outbuf, ret);
    }

    if(ret != total_length) {
        if(ret >= 0 || ret == -EAGAIN) {
            /* the whole packet could not be sent, save the rest */
            session->socket_block_directions |= LIBSSH2_SESSION_BLOCK_OUTBOUND;
            p->odata = orgdata;
            p->olen = orgdata_len;
            p->osent = ret <= 0 ? 0 : ret;
            p->ototal_num = total_length;
            return LIBSSH2_ERROR_EAGAIN;
        }
        return LIBSSH2_ERROR_SOCKET_SEND;
    }

    /* the whole thing got sent away */
    p->odata = NULL;
    p->olen = 0;

    return LIBSSH2_ERROR_NONE; /* all is good */
}

Coverage Report

Created: 2026-07-10 06:37