/src/openssh/sshbuf-misc.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* $OpenBSD: sshbuf-misc.c,v 1.20 2025/06/16 09:02:19 dtucker Exp $ */ |
2 | | /* |
3 | | * Copyright (c) 2011 Damien Miller |
4 | | * |
5 | | * Permission to use, copy, modify, and distribute this software for any |
6 | | * purpose with or without fee is hereby granted, provided that the above |
7 | | * copyright notice and this permission notice appear in all copies. |
8 | | * |
9 | | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
10 | | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
11 | | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR |
12 | | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
13 | | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN |
14 | | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF |
15 | | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
16 | | */ |
17 | | |
18 | | #include "includes.h" |
19 | | |
20 | | #include <sys/types.h> |
21 | | #include <sys/socket.h> |
22 | | #include <netinet/in.h> |
23 | | #include <errno.h> |
24 | | #include <stdlib.h> |
25 | | #ifdef HAVE_STDINT_H |
26 | | # include <stdint.h> |
27 | | #endif |
28 | | #include <stdio.h> |
29 | | #include <limits.h> |
30 | | #include <string.h> |
31 | | #include <resolv.h> |
32 | | #include <ctype.h> |
33 | | #include <unistd.h> |
34 | | |
35 | | #include "ssherr.h" |
36 | | #define SSHBUF_INTERNAL |
37 | | #include "sshbuf.h" |
38 | | |
39 | | void |
40 | | sshbuf_dump_data(const void *s, size_t len, FILE *f) |
41 | 0 | { |
42 | 0 | size_t i, j; |
43 | 0 | const u_char *p = (const u_char *)s; |
44 | |
|
45 | 0 | for (i = 0; i < len; i += 16) { |
46 | 0 | fprintf(f, "%.4zu: ", i); |
47 | 0 | for (j = i; j < i + 16; j++) { |
48 | 0 | if (j < len) |
49 | 0 | fprintf(f, "%02x ", p[j]); |
50 | 0 | else |
51 | 0 | fprintf(f, " "); |
52 | 0 | } |
53 | 0 | fprintf(f, " "); |
54 | 0 | for (j = i; j < i + 16; j++) { |
55 | 0 | if (j < len) { |
56 | 0 | if (isascii(p[j]) && isprint(p[j])) |
57 | 0 | fprintf(f, "%c", p[j]); |
58 | 0 | else |
59 | 0 | fprintf(f, "."); |
60 | 0 | } |
61 | 0 | } |
62 | 0 | fprintf(f, "\n"); |
63 | 0 | } |
64 | 0 | } |
65 | | |
66 | | void |
67 | | sshbuf_dump(const struct sshbuf *buf, FILE *f) |
68 | 0 | { |
69 | 0 | fprintf(f, "buffer len = %zu\n", sshbuf_len(buf)); |
70 | 0 | sshbuf_dump_data(sshbuf_ptr(buf), sshbuf_len(buf), f); |
71 | 0 | } |
72 | | |
73 | | char * |
74 | | sshbuf_dtob16(const struct sshbuf *buf) |
75 | 0 | { |
76 | 0 | size_t i, j, len = sshbuf_len(buf); |
77 | 0 | const u_char *p = sshbuf_ptr(buf); |
78 | 0 | char *ret; |
79 | 0 | const char hex[] = "0123456789abcdef"; |
80 | |
|
81 | 0 | if (len == 0) |
82 | 0 | return strdup(""); |
83 | 0 | if (SIZE_MAX / 2 <= len || (ret = malloc(len * 2 + 1)) == NULL) |
84 | 0 | return NULL; |
85 | 0 | for (i = j = 0; i < len; i++) { |
86 | 0 | ret[j++] = hex[(p[i] >> 4) & 0xf]; |
87 | 0 | ret[j++] = hex[p[i] & 0xf]; |
88 | 0 | } |
89 | 0 | ret[j] = '\0'; |
90 | 0 | return ret; |
91 | 0 | } |
92 | | |
93 | | static int |
94 | | b16tod(const char v) |
95 | 0 | { |
96 | 0 | if (v >= '0' && v <= '9') |
97 | 0 | return v - '0'; |
98 | 0 | if (v >= 'a' && v <= 'f') |
99 | 0 | return 10 + v - 'a'; |
100 | 0 | if (v >= 'A' && v <= 'A') |
101 | 0 | return 10 + v - 'A'; |
102 | 0 | return -1; |
103 | 0 | } |
104 | | |
105 | | struct sshbuf * |
106 | | sshbuf_b16tod(const char *b16) |
107 | 0 | { |
108 | 0 | struct sshbuf *ret; |
109 | 0 | size_t o; |
110 | 0 | int r, v1, v2; |
111 | |
|
112 | 0 | if ((ret = sshbuf_new()) == NULL) |
113 | 0 | return NULL; |
114 | 0 | for (o = 0; b16[o] != '\0'; o += 2) { |
115 | 0 | if ((v1 = b16tod(b16[o])) == -1 || |
116 | 0 | (v2 = b16tod(b16[o + 1])) == -1) { |
117 | 0 | sshbuf_free(ret); |
118 | 0 | return NULL; |
119 | 0 | } |
120 | 0 | if ((r = sshbuf_put_u8(ret, (u_char)((v1 << 4) | v2))) != 0) { |
121 | 0 | sshbuf_free(ret); |
122 | 0 | return NULL; |
123 | 0 | } |
124 | 0 | } |
125 | | /* success */ |
126 | 0 | return ret; |
127 | 0 | } |
128 | | |
129 | | int |
130 | | sshbuf_dtob64(const struct sshbuf *d, struct sshbuf *b64, int wrap) |
131 | 0 | { |
132 | 0 | size_t i, slen = 0; |
133 | 0 | char *s = NULL; |
134 | 0 | int r; |
135 | |
|
136 | 0 | if (d == NULL || b64 == NULL || sshbuf_len(d) >= SIZE_MAX / 2) |
137 | 0 | return SSH_ERR_INVALID_ARGUMENT; |
138 | 0 | if (sshbuf_len(d) == 0) |
139 | 0 | return 0; |
140 | 0 | slen = ((sshbuf_len(d) + 2) / 3) * 4 + 1; |
141 | 0 | if ((s = malloc(slen)) == NULL) |
142 | 0 | return SSH_ERR_ALLOC_FAIL; |
143 | 0 | if (b64_ntop(sshbuf_ptr(d), sshbuf_len(d), s, slen) == -1) { |
144 | 0 | r = SSH_ERR_INTERNAL_ERROR; |
145 | 0 | goto fail; |
146 | 0 | } |
147 | 0 | if (wrap) { |
148 | 0 | for (i = 0; s[i] != '\0'; i++) { |
149 | 0 | if ((r = sshbuf_put_u8(b64, s[i])) != 0) |
150 | 0 | goto fail; |
151 | 0 | if (i % 70 == 69 && (r = sshbuf_put_u8(b64, '\n')) != 0) |
152 | 0 | goto fail; |
153 | 0 | } |
154 | 0 | if ((i - 1) % 70 != 69 && (r = sshbuf_put_u8(b64, '\n')) != 0) |
155 | 0 | goto fail; |
156 | 0 | } else { |
157 | 0 | if ((r = sshbuf_put(b64, s, strlen(s))) != 0) |
158 | 0 | goto fail; |
159 | 0 | } |
160 | | /* Success */ |
161 | 0 | r = 0; |
162 | 0 | fail: |
163 | 0 | freezero(s, slen); |
164 | 0 | return r; |
165 | 0 | } |
166 | | |
167 | | char * |
168 | | sshbuf_dtob64_string(const struct sshbuf *buf, int wrap) |
169 | 0 | { |
170 | 0 | struct sshbuf *tmp; |
171 | 0 | char *ret; |
172 | |
|
173 | 0 | if ((tmp = sshbuf_new()) == NULL) |
174 | 0 | return NULL; |
175 | 0 | if (sshbuf_dtob64(buf, tmp, wrap) != 0) { |
176 | 0 | sshbuf_free(tmp); |
177 | 0 | return NULL; |
178 | 0 | } |
179 | 0 | ret = sshbuf_dup_string(tmp); |
180 | 0 | sshbuf_free(tmp); |
181 | 0 | return ret; |
182 | 0 | } |
183 | | |
184 | | int |
185 | | sshbuf_b64tod(struct sshbuf *buf, const char *b64) |
186 | 0 | { |
187 | 0 | size_t plen = strlen(b64); |
188 | 0 | int nlen, r; |
189 | 0 | u_char *p; |
190 | |
|
191 | 0 | if (plen == 0) |
192 | 0 | return 0; |
193 | 0 | if ((p = malloc(plen)) == NULL) |
194 | 0 | return SSH_ERR_ALLOC_FAIL; |
195 | 0 | if ((nlen = b64_pton(b64, p, plen)) < 0) { |
196 | 0 | freezero(p, plen); |
197 | 0 | return SSH_ERR_INVALID_FORMAT; |
198 | 0 | } |
199 | 0 | if ((r = sshbuf_put(buf, p, nlen)) < 0) { |
200 | 0 | freezero(p, plen); |
201 | 0 | return r; |
202 | 0 | } |
203 | 0 | freezero(p, plen); |
204 | 0 | return 0; |
205 | 0 | } |
206 | | |
207 | | int |
208 | | sshbuf_dtourlb64(const struct sshbuf *d, struct sshbuf *b64, int wrap) |
209 | 0 | { |
210 | 0 | int r = SSH_ERR_INTERNAL_ERROR; |
211 | 0 | u_char *p; |
212 | 0 | struct sshbuf *b = NULL; |
213 | 0 | size_t i, l; |
214 | |
|
215 | 0 | if ((b = sshbuf_new()) == NULL) |
216 | 0 | return SSH_ERR_ALLOC_FAIL; |
217 | | /* Encode using regular base64; we'll transform it once done */ |
218 | 0 | if ((r = sshbuf_dtob64(d, b, wrap)) != 0) |
219 | 0 | goto out; |
220 | | /* remove padding from end of encoded string*/ |
221 | 0 | for (;;) { |
222 | 0 | l = sshbuf_len(b); |
223 | 0 | if (l <= 1 || sshbuf_ptr(b) == NULL) { |
224 | 0 | r = SSH_ERR_INTERNAL_ERROR; |
225 | 0 | goto out; |
226 | 0 | } |
227 | 0 | if (sshbuf_ptr(b)[l - 1] != '=') |
228 | 0 | break; |
229 | 0 | if ((r = sshbuf_consume_end(b, 1)) != 0) |
230 | 0 | goto out; |
231 | 0 | } |
232 | | /* Replace characters with rfc4648 equivalents */ |
233 | 0 | l = sshbuf_len(b); |
234 | 0 | if ((p = sshbuf_mutable_ptr(b)) == NULL) { |
235 | 0 | r = SSH_ERR_INTERNAL_ERROR; |
236 | 0 | goto out; |
237 | 0 | } |
238 | 0 | for (i = 0; i < l; i++) { |
239 | 0 | if (p[i] == '+') |
240 | 0 | p[i] = '-'; |
241 | 0 | else if (p[i] == '/') |
242 | 0 | p[i] = '_'; |
243 | 0 | } |
244 | 0 | r = sshbuf_putb(b64, b); |
245 | 0 | out: |
246 | 0 | sshbuf_free(b); |
247 | 0 | return r; |
248 | 0 | } |
249 | | |
250 | | char * |
251 | | sshbuf_dup_string(struct sshbuf *buf) |
252 | 0 | { |
253 | 0 | const u_char *p = NULL, *s = sshbuf_ptr(buf); |
254 | 0 | size_t l = sshbuf_len(buf); |
255 | 0 | char *r; |
256 | |
|
257 | 0 | if (s == NULL || l >= SIZE_MAX) |
258 | 0 | return NULL; |
259 | | /* accept a nul only as the last character in the buffer */ |
260 | 0 | if (l > 0 && (p = memchr(s, '\0', l)) != NULL) { |
261 | 0 | if (p != s + l - 1) |
262 | 0 | return NULL; |
263 | 0 | l--; /* the nul is put back below */ |
264 | 0 | } |
265 | 0 | if ((r = malloc(l + 1)) == NULL) |
266 | 0 | return NULL; |
267 | 0 | if (l > 0) |
268 | 0 | memcpy(r, s, l); |
269 | 0 | r[l] = '\0'; |
270 | 0 | return r; |
271 | 0 | } |
272 | | |
273 | | int |
274 | | sshbuf_cmp(const struct sshbuf *b, size_t offset, |
275 | | const void *s, size_t len) |
276 | 0 | { |
277 | 0 | if (sshbuf_ptr(b) == NULL) |
278 | 0 | return SSH_ERR_INTERNAL_ERROR; |
279 | 0 | if (offset > SSHBUF_SIZE_MAX || len > SSHBUF_SIZE_MAX || len == 0) |
280 | 0 | return SSH_ERR_INVALID_ARGUMENT; |
281 | 0 | if (offset + len > sshbuf_len(b)) |
282 | 0 | return SSH_ERR_MESSAGE_INCOMPLETE; |
283 | 0 | if (timingsafe_bcmp(sshbuf_ptr(b) + offset, s, len) != 0) |
284 | 0 | return SSH_ERR_INVALID_FORMAT; |
285 | 0 | return 0; |
286 | 0 | } |
287 | | |
288 | | int |
289 | | sshbuf_find(const struct sshbuf *b, size_t start_offset, |
290 | | const void *s, size_t len, size_t *offsetp) |
291 | 0 | { |
292 | 0 | void *p; |
293 | |
|
294 | 0 | if (offsetp != NULL) |
295 | 0 | *offsetp = 0; |
296 | 0 | if (sshbuf_ptr(b) == NULL) |
297 | 0 | return SSH_ERR_INTERNAL_ERROR; |
298 | 0 | if (start_offset > SSHBUF_SIZE_MAX || len > SSHBUF_SIZE_MAX || len == 0) |
299 | 0 | return SSH_ERR_INVALID_ARGUMENT; |
300 | 0 | if (start_offset > sshbuf_len(b) || start_offset + len > sshbuf_len(b)) |
301 | 0 | return SSH_ERR_MESSAGE_INCOMPLETE; |
302 | 0 | if ((p = memmem(sshbuf_ptr(b) + start_offset, |
303 | 0 | sshbuf_len(b) - start_offset, s, len)) == NULL) |
304 | 0 | return SSH_ERR_INVALID_FORMAT; |
305 | 0 | if (offsetp != NULL) |
306 | 0 | *offsetp = (const u_char *)p - sshbuf_ptr(b); |
307 | 0 | return 0; |
308 | 0 | } |
309 | | |
310 | | int |
311 | | sshbuf_read(int fd, struct sshbuf *buf, size_t maxlen, size_t *rlen) |
312 | 0 | { |
313 | 0 | int r, oerrno; |
314 | 0 | size_t adjust; |
315 | 0 | ssize_t rr; |
316 | 0 | u_char *d; |
317 | |
|
318 | 0 | if (rlen != NULL) |
319 | 0 | *rlen = 0; |
320 | 0 | if ((r = sshbuf_reserve(buf, maxlen, &d)) != 0) |
321 | 0 | return r; |
322 | 0 | rr = read(fd, d, maxlen); |
323 | 0 | oerrno = errno; |
324 | | |
325 | | /* Adjust the buffer to include only what was actually read */ |
326 | 0 | if ((adjust = maxlen - (rr > 0 ? rr : 0)) != 0) { |
327 | 0 | if ((r = sshbuf_consume_end(buf, adjust)) != 0) { |
328 | | /* avoid returning uninitialised data to caller */ |
329 | 0 | memset(d + rr, '\0', adjust); |
330 | 0 | return SSH_ERR_INTERNAL_ERROR; /* shouldn't happen */ |
331 | 0 | } |
332 | 0 | } |
333 | 0 | if (rr < 0) { |
334 | 0 | errno = oerrno; |
335 | 0 | return SSH_ERR_SYSTEM_ERROR; |
336 | 0 | } else if (rr == 0) { |
337 | 0 | errno = EPIPE; |
338 | 0 | return SSH_ERR_SYSTEM_ERROR; |
339 | 0 | } |
340 | | /* success */ |
341 | 0 | if (rlen != NULL) |
342 | 0 | *rlen = (size_t)rr; |
343 | 0 | return 0; |
344 | 0 | } |