jcs.org
jcs's openbsd hax
openbsd
1/* $OpenBSD: sshbuf-misc.c,v 1.22 2025/09/04 00:32:31 djm Exp $ */
2/*
3 * Copyright (c) 2011 Damien Miller
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#include <sys/types.h>
19#include <sys/socket.h>
20#include <netinet/in.h>
21#include <errno.h>
22#include <stdlib.h>
23#include <stdint.h>
24#include <stdio.h>
25#include <limits.h>
26#include <string.h>
27#include <resolv.h>
28#include <ctype.h>
29#include <unistd.h>
30
31#include "ssherr.h"
32#define SSHBUF_INTERNAL
33#include "sshbuf.h"
34
35void
36sshbuf_dump_data(const void *s, size_t len, FILE *f)
37{
38 size_t i, j;
39 const u_char *p = (const u_char *)s;
40
41 for (i = 0; i < len; i += 16) {
42 fprintf(f, "%.4zu: ", i);
43 for (j = i; j < i + 16; j++) {
44 if (j < len)
45 fprintf(f, "%02x ", p[j]);
46 else
47 fprintf(f, " ");
48 }
49 fprintf(f, " ");
50 for (j = i; j < i + 16; j++) {
51 if (j < len) {
52 if (isascii(p[j]) && isprint(p[j]))
53 fprintf(f, "%c", p[j]);
54 else
55 fprintf(f, ".");
56 }
57 }
58 fprintf(f, "\n");
59 }
60}
61
62void
63sshbuf_dump(const struct sshbuf *buf, FILE *f)
64{
65 fprintf(f, "buffer len = %zu\n", sshbuf_len(buf));
66 sshbuf_dump_data(sshbuf_ptr(buf), sshbuf_len(buf), f);
67}
68
69char *
70sshbuf_dtob16(const struct sshbuf *buf)
71{
72 size_t i, j, len = sshbuf_len(buf);
73 const u_char *p = sshbuf_ptr(buf);
74 char *ret;
75 const char hex[] = "0123456789abcdef";
76
77 if (len == 0)
78 return strdup("");
79 if (SIZE_MAX / 2 <= len || (ret = malloc(len * 2 + 1)) == NULL)
80 return NULL;
81 for (i = j = 0; i < len; i++) {
82 ret[j++] = hex[(p[i] >> 4) & 0xf];
83 ret[j++] = hex[p[i] & 0xf];
84 }
85 ret[j] = '\0';
86 return ret;
87}
88
89static int
90b16tod(const char v)
91{
92 if (v >= '0' && v <= '9')
93 return v - '0';
94 if (v >= 'a' && v <= 'f')
95 return 10 + v - 'a';
96 if (v >= 'A' && v <= 'A')
97 return 10 + v - 'A';
98 return -1;
99}
100
101struct sshbuf *
102sshbuf_b16tod(const char *b16)
103{
104 struct sshbuf *ret;
105 size_t o;
106 int r, v1, v2;
107
108 if ((ret = sshbuf_new()) == NULL)
109 return NULL;
110 for (o = 0; b16[o] != '\0'; o += 2) {
111 if ((v1 = b16tod(b16[o])) == -1 ||
112 (v2 = b16tod(b16[o + 1])) == -1) {
113 sshbuf_free(ret);
114 return NULL;
115 }
116 if ((r = sshbuf_put_u8(ret, (u_char)((v1 << 4) | v2))) != 0) {
117 sshbuf_free(ret);
118 return NULL;
119 }
120 }
121 /* success */
122 return ret;
123}
124
125int
126sshbuf_dtob64(const struct sshbuf *d, struct sshbuf *b64, int wrap)
127{
128 size_t i, slen = 0;
129 char *s = NULL;
130 int r;
131
132 if (d == NULL || b64 == NULL || sshbuf_len(d) >= SIZE_MAX / 2)
133 return SSH_ERR_INVALID_ARGUMENT;
134 if (sshbuf_len(d) == 0)
135 return 0;
136 slen = ((sshbuf_len(d) + 2) / 3) * 4 + 1;
137 if ((s = malloc(slen)) == NULL)
138 return SSH_ERR_ALLOC_FAIL;
139 if (b64_ntop(sshbuf_ptr(d), sshbuf_len(d), s, slen) == -1) {
140 r = SSH_ERR_INTERNAL_ERROR;
141 goto fail;
142 }
143 if (wrap) {
144 for (i = 0; s[i] != '\0'; i++) {
145 if ((r = sshbuf_put_u8(b64, s[i])) != 0)
146 goto fail;
147 if (i % 70 == 69 && (r = sshbuf_put_u8(b64, '\n')) != 0)
148 goto fail;
149 }
150 if ((i - 1) % 70 != 69 && (r = sshbuf_put_u8(b64, '\n')) != 0)
151 goto fail;
152 } else {
153 if ((r = sshbuf_put(b64, s, strlen(s))) != 0)
154 goto fail;
155 }
156 /* Success */
157 r = 0;
158 fail:
159 freezero(s, slen);
160 return r;
161}
162
163char *
164sshbuf_dtob64_string(const struct sshbuf *buf, int wrap)
165{
166 struct sshbuf *tmp;
167 char *ret;
168
169 if ((tmp = sshbuf_new()) == NULL)
170 return NULL;
171 if (sshbuf_dtob64(buf, tmp, wrap) != 0) {
172 sshbuf_free(tmp);
173 return NULL;
174 }
175 ret = sshbuf_dup_string(tmp);
176 sshbuf_free(tmp);
177 return ret;
178}
179
180int
181sshbuf_b64tod(struct sshbuf *buf, const char *b64)
182{
183 size_t plen = strlen(b64);
184 int nlen, r;
185 u_char *p;
186
187 if (plen == 0)
188 return 0;
189 if ((p = malloc(plen)) == NULL)
190 return SSH_ERR_ALLOC_FAIL;
191 if ((nlen = b64_pton(b64, p, plen)) < 0) {
192 freezero(p, plen);
193 return SSH_ERR_INVALID_FORMAT;
194 }
195 if ((r = sshbuf_put(buf, p, nlen)) < 0) {
196 freezero(p, plen);
197 return r;
198 }
199 freezero(p, plen);
200 return 0;
201}
202
203int
204sshbuf_dtourlb64(const struct sshbuf *d, struct sshbuf *b64, int wrap)
205{
206 int r = SSH_ERR_INTERNAL_ERROR;
207 u_char *p;
208 struct sshbuf *b = NULL;
209 size_t i, l;
210
211 if (sshbuf_len(d) == 0)
212 return 0;
213
214 if ((b = sshbuf_new()) == NULL)
215 return SSH_ERR_ALLOC_FAIL;
216 /* Encode using regular base64; we'll transform it once done */
217 if ((r = sshbuf_dtob64(d, b, wrap)) != 0)
218 goto out;
219 /* remove padding from end of encoded string*/
220 for (;;) {
221 l = sshbuf_len(b);
222 if (l <= 1 || sshbuf_ptr(b) == NULL) {
223 r = SSH_ERR_INTERNAL_ERROR;
224 goto out;
225 }
226 if (sshbuf_ptr(b)[l - 1] != '=')
227 break;
228 if ((r = sshbuf_consume_end(b, 1)) != 0)
229 goto out;
230 }
231 /* Replace characters with rfc4648 equivalents */
232 l = sshbuf_len(b);
233 if ((p = sshbuf_mutable_ptr(b)) == NULL) {
234 r = SSH_ERR_INTERNAL_ERROR;
235 goto out;
236 }
237 for (i = 0; i < l; i++) {
238 if (p[i] == '+')
239 p[i] = '-';
240 else if (p[i] == '/')
241 p[i] = '_';
242 }
243 r = sshbuf_putb(b64, b);
244 out:
245 sshbuf_free(b);
246 return r;
247}
248
249char *
250sshbuf_dup_string(struct sshbuf *buf)
251{
252 const u_char *p = NULL, *s = sshbuf_ptr(buf);
253 size_t l = sshbuf_len(buf);
254 char *r;
255
256 if (s == NULL || l >= SIZE_MAX)
257 return NULL;
258 /* accept a nul only as the last character in the buffer */
259 if (l > 0 && (p = memchr(s, '\0', l)) != NULL) {
260 if (p != s + l - 1)
261 return NULL;
262 l--; /* the nul is put back below */
263 }
264 if ((r = malloc(l + 1)) == NULL)
265 return NULL;
266 if (l > 0)
267 memcpy(r, s, l);
268 r[l] = '\0';
269 return r;
270}
271
272int
273sshbuf_cmp(const struct sshbuf *b, size_t offset,
274 const void *s, size_t len)
275{
276 if (sshbuf_ptr(b) == NULL)
277 return SSH_ERR_INTERNAL_ERROR;
278 if (offset > SSHBUF_SIZE_MAX || len > SSHBUF_SIZE_MAX || len == 0)
279 return SSH_ERR_INVALID_ARGUMENT;
280 if (offset + len > sshbuf_len(b))
281 return SSH_ERR_MESSAGE_INCOMPLETE;
282 if (timingsafe_bcmp(sshbuf_ptr(b) + offset, s, len) != 0)
283 return SSH_ERR_INVALID_FORMAT;
284 return 0;
285}
286
287int
288sshbuf_equals(const struct sshbuf *a, const struct sshbuf *b)
289{
290 if (sshbuf_ptr(a) == NULL || sshbuf_ptr(b) == NULL)
291 return SSH_ERR_INTERNAL_ERROR;
292 if (sshbuf_len(a) != sshbuf_len(b))
293 return SSH_ERR_MESSAGE_INCOMPLETE;
294 if (sshbuf_len(a) == 0)
295 return 0;
296 if (memcmp(sshbuf_ptr(a), sshbuf_ptr(b), sshbuf_len(a)) != 0)
297 return SSH_ERR_INVALID_FORMAT;
298 return 0;
299}
300
301int
302sshbuf_find(const struct sshbuf *b, size_t start_offset,
303 const void *s, size_t len, size_t *offsetp)
304{
305 void *p;
306
307 if (offsetp != NULL)
308 *offsetp = 0;
309 if (sshbuf_ptr(b) == NULL)
310 return SSH_ERR_INTERNAL_ERROR;
311 if (start_offset > SSHBUF_SIZE_MAX || len > SSHBUF_SIZE_MAX || len == 0)
312 return SSH_ERR_INVALID_ARGUMENT;
313 if (start_offset > sshbuf_len(b) || start_offset + len > sshbuf_len(b))
314 return SSH_ERR_MESSAGE_INCOMPLETE;
315 if ((p = memmem(sshbuf_ptr(b) + start_offset,
316 sshbuf_len(b) - start_offset, s, len)) == NULL)
317 return SSH_ERR_INVALID_FORMAT;
318 if (offsetp != NULL)
319 *offsetp = (const u_char *)p - sshbuf_ptr(b);
320 return 0;
321}
322
323int
324sshbuf_read(int fd, struct sshbuf *buf, size_t maxlen, size_t *rlen)
325{
326 int r, oerrno;
327 size_t adjust;
328 ssize_t rr;
329 u_char *d;
330
331 if (rlen != NULL)
332 *rlen = 0;
333 if ((r = sshbuf_reserve(buf, maxlen, &d)) != 0)
334 return r;
335 rr = read(fd, d, maxlen);
336 oerrno = errno;
337
338 /* Adjust the buffer to include only what was actually read */
339 if ((adjust = maxlen - (rr > 0 ? rr : 0)) != 0) {
340 if ((r = sshbuf_consume_end(buf, adjust)) != 0) {
341 /* avoid returning uninitialised data to caller */
342 memset(d + rr, '\0', adjust);
343 return SSH_ERR_INTERNAL_ERROR; /* shouldn't happen */
344 }
345 }
346 if (rr < 0) {
347 errno = oerrno;
348 return SSH_ERR_SYSTEM_ERROR;
349 } else if (rr == 0) {
350 errno = EPIPE;
351 return SSH_ERR_SYSTEM_ERROR;
352 }
353 /* success */
354 if (rlen != NULL)
355 *rlen = (size_t)rr;
356 return 0;
357}