xref: /openbsd-src/usr.bin/ssh/sshbuf.h (revision fcde59b201a29a2b4570b00b71e7aa25d61cb5c1)
1 /*	$OpenBSD: sshbuf.h,v 1.23 2020/06/22 05:54:10 djm Exp $	*/
2 /*
3  * Copyright (c) 2011 Damien Miller
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #ifndef _SSHBUF_H
19 #define _SSHBUF_H
20 
21 #include <sys/types.h>
22 #include <stdarg.h>
23 #include <stdio.h>
24 
25 #ifdef WITH_OPENSSL
26 #include <openssl/bn.h>
27 #include <openssl/ec.h>
28 #include <openssl/ecdsa.h>
29 #else /* OPENSSL */
30 #define BIGNUM		void
31 #define EC_KEY		void
32 #define EC_GROUP	void
33 #define EC_POINT	void
34 #endif /* WITH_OPENSSL */
35 
36 #define SSHBUF_SIZE_MAX		0x8000000	/* Hard maximum size */
37 #define SSHBUF_REFS_MAX		0x100000	/* Max child buffers */
38 #define SSHBUF_MAX_BIGNUM	(16384 / 8)	/* Max bignum *bytes* */
39 #define SSHBUF_MAX_ECPOINT	((528 * 2 / 8) + 1) /* Max EC point *bytes* */
40 
41 /*
42  * NB. do not depend on the internals of this. It will be made opaque
43  * one day.
44  */
45 struct sshbuf {
46 	u_char *d;		/* Data */
47 	const u_char *cd;	/* Const data */
48 	size_t off;		/* First available byte is buf->d + buf->off */
49 	size_t size;		/* Last byte is buf->d + buf->size - 1 */
50 	size_t max_size;	/* Maximum size of buffer */
51 	size_t alloc;		/* Total bytes allocated to buf->d */
52 	int readonly;		/* Refers to external, const data */
53 	int dont_free;		/* Kludge to support sshbuf_init */
54 	u_int refcount;		/* Tracks self and number of child buffers */
55 	struct sshbuf *parent;	/* If child, pointer to parent */
56 };
57 
58 /*
59  * Create a new sshbuf buffer.
60  * Returns pointer to buffer on success, or NULL on allocation failure.
61  */
62 struct sshbuf *sshbuf_new(void);
63 
64 /*
65  * Create a new, read-only sshbuf buffer from existing data.
66  * Returns pointer to buffer on success, or NULL on allocation failure.
67  */
68 struct sshbuf *sshbuf_from(const void *blob, size_t len);
69 
70 /*
71  * Create a new, read-only sshbuf buffer from the contents of an existing
72  * buffer. The contents of "buf" must not change in the lifetime of the
73  * resultant buffer.
74  * Returns pointer to buffer on success, or NULL on allocation failure.
75  */
76 struct sshbuf *sshbuf_fromb(struct sshbuf *buf);
77 
78 /*
79  * Create a new, read-only sshbuf buffer from the contents of a string in
80  * an existing buffer (the string is consumed in the process).
81  * The contents of "buf" must not change in the lifetime of the resultant
82  * buffer.
83  * Returns pointer to buffer on success, or NULL on allocation failure.
84  */
85 int	sshbuf_froms(struct sshbuf *buf, struct sshbuf **bufp);
86 
87 /*
88  * Clear and free buf
89  */
90 void	sshbuf_free(struct sshbuf *buf);
91 
92 /*
93  * Reset buf, clearing its contents. NB. max_size is preserved.
94  */
95 void	sshbuf_reset(struct sshbuf *buf);
96 
97 /*
98  * Return the maximum size of buf
99  */
100 size_t	sshbuf_max_size(const struct sshbuf *buf);
101 
102 /*
103  * Set the maximum size of buf
104  * Returns 0 on success, or a negative SSH_ERR_* error code on failure.
105  */
106 int	sshbuf_set_max_size(struct sshbuf *buf, size_t max_size);
107 
108 /*
109  * Returns the length of data in buf
110  */
111 size_t	sshbuf_len(const struct sshbuf *buf);
112 
113 /*
114  * Returns number of bytes left in buffer before hitting max_size.
115  */
116 size_t	sshbuf_avail(const struct sshbuf *buf);
117 
118 /*
119  * Returns a read-only pointer to the start of the data in buf
120  */
121 const u_char *sshbuf_ptr(const struct sshbuf *buf);
122 
123 /*
124  * Returns a mutable pointer to the start of the data in buf, or
125  * NULL if the buffer is read-only.
126  */
127 u_char *sshbuf_mutable_ptr(const struct sshbuf *buf);
128 
129 /*
130  * Check whether a reservation of size len will succeed in buf
131  * Safer to use than direct comparisons again sshbuf_avail as it copes
132  * with unsigned overflows correctly.
133  * Returns 0 on success, or a negative SSH_ERR_* error code on failure.
134  */
135 int	sshbuf_check_reserve(const struct sshbuf *buf, size_t len);
136 
137 /*
138  * Preallocates len additional bytes in buf.
139  * Useful for cases where the caller knows how many bytes will ultimately be
140  * required to avoid realloc in the buffer code.
141  * Returns 0 on success, or a negative SSH_ERR_* error code on failure.
142  */
143 int	sshbuf_allocate(struct sshbuf *buf, size_t len);
144 
145 /*
146  * Reserve len bytes in buf.
147  * Returns 0 on success and a pointer to the first reserved byte via the
148  * optional dpp parameter or a negative SSH_ERR_* error code on failure.
149  */
150 int	sshbuf_reserve(struct sshbuf *buf, size_t len, u_char **dpp);
151 
152 /*
153  * Consume len bytes from the start of buf
154  * Returns 0 on success, or a negative SSH_ERR_* error code on failure.
155  */
156 int	sshbuf_consume(struct sshbuf *buf, size_t len);
157 
158 /*
159  * Consume len bytes from the end of buf
160  * Returns 0 on success, or a negative SSH_ERR_* error code on failure.
161  */
162 int	sshbuf_consume_end(struct sshbuf *buf, size_t len);
163 
164 /* Extract or deposit some bytes */
165 int	sshbuf_get(struct sshbuf *buf, void *v, size_t len);
166 int	sshbuf_put(struct sshbuf *buf, const void *v, size_t len);
167 int	sshbuf_putb(struct sshbuf *buf, const struct sshbuf *v);
168 
169 /* Append using a printf(3) format */
170 int	sshbuf_putf(struct sshbuf *buf, const char *fmt, ...)
171 	    __attribute__((format(printf, 2, 3)));
172 int	sshbuf_putfv(struct sshbuf *buf, const char *fmt, va_list ap);
173 
174 /* Functions to extract or store big-endian words of various sizes */
175 int	sshbuf_get_u64(struct sshbuf *buf, u_int64_t *valp);
176 int	sshbuf_get_u32(struct sshbuf *buf, u_int32_t *valp);
177 int	sshbuf_get_u16(struct sshbuf *buf, u_int16_t *valp);
178 int	sshbuf_get_u8(struct sshbuf *buf, u_char *valp);
179 int	sshbuf_put_u64(struct sshbuf *buf, u_int64_t val);
180 int	sshbuf_put_u32(struct sshbuf *buf, u_int32_t val);
181 int	sshbuf_put_u16(struct sshbuf *buf, u_int16_t val);
182 int	sshbuf_put_u8(struct sshbuf *buf, u_char val);
183 
184 /* Functions to peek at the contents of a buffer without modifying it. */
185 int	sshbuf_peek_u64(const struct sshbuf *buf, size_t offset,
186     u_int64_t *valp);
187 int	sshbuf_peek_u32(const struct sshbuf *buf, size_t offset,
188     u_int32_t *valp);
189 int	sshbuf_peek_u16(const struct sshbuf *buf, size_t offset,
190     u_int16_t *valp);
191 int	sshbuf_peek_u8(const struct sshbuf *buf, size_t offset,
192     u_char *valp);
193 
194 /*
195  * Functions to poke values into an existing buffer (e.g. a length header
196  * to a packet). The destination bytes must already exist in the buffer.
197  */
198 int sshbuf_poke_u64(struct sshbuf *buf, size_t offset, u_int64_t val);
199 int sshbuf_poke_u32(struct sshbuf *buf, size_t offset, u_int32_t val);
200 int sshbuf_poke_u16(struct sshbuf *buf, size_t offset, u_int16_t val);
201 int sshbuf_poke_u8(struct sshbuf *buf, size_t offset, u_char val);
202 int sshbuf_poke(struct sshbuf *buf, size_t offset, void *v, size_t len);
203 
204 /*
205  * Functions to extract or store SSH wire encoded strings (u32 len || data)
206  * The "cstring" variants admit no \0 characters in the string contents.
207  * Caller must free *valp.
208  */
209 int	sshbuf_get_string(struct sshbuf *buf, u_char **valp, size_t *lenp);
210 int	sshbuf_get_cstring(struct sshbuf *buf, char **valp, size_t *lenp);
211 int	sshbuf_get_stringb(struct sshbuf *buf, struct sshbuf *v);
212 int	sshbuf_put_string(struct sshbuf *buf, const void *v, size_t len);
213 int	sshbuf_put_cstring(struct sshbuf *buf, const char *v);
214 int	sshbuf_put_stringb(struct sshbuf *buf, const struct sshbuf *v);
215 
216 /*
217  * "Direct" variant of sshbuf_get_string, returns pointer into the sshbuf to
218  * avoid an malloc+memcpy. The pointer is guaranteed to be valid until the
219  * next sshbuf-modifying function call. Caller does not free.
220  */
221 int	sshbuf_get_string_direct(struct sshbuf *buf, const u_char **valp,
222 	    size_t *lenp);
223 
224 /* Skip past a string */
225 #define sshbuf_skip_string(buf) sshbuf_get_string_direct(buf, NULL, NULL)
226 
227 /* Another variant: "peeks" into the buffer without modifying it */
228 int	sshbuf_peek_string_direct(const struct sshbuf *buf, const u_char **valp,
229 	    size_t *lenp);
230 
231 /*
232  * Functions to extract or store SSH wire encoded bignums and elliptic
233  * curve points.
234  */
235 int	sshbuf_get_bignum2(struct sshbuf *buf, BIGNUM **valp);
236 int	sshbuf_get_bignum2_bytes_direct(struct sshbuf *buf,
237 	    const u_char **valp, size_t *lenp);
238 int	sshbuf_put_bignum2(struct sshbuf *buf, const BIGNUM *v);
239 int	sshbuf_put_bignum2_bytes(struct sshbuf *buf, const void *v, size_t len);
240 int	sshbuf_get_ec(struct sshbuf *buf, EC_POINT *v, const EC_GROUP *g);
241 int	sshbuf_get_eckey(struct sshbuf *buf, EC_KEY *v);
242 int	sshbuf_put_ec(struct sshbuf *buf, const EC_POINT *v, const EC_GROUP *g);
243 int	sshbuf_put_eckey(struct sshbuf *buf, const EC_KEY *v);
244 
245 /* Dump the contents of the buffer in a human-readable format */
246 void	sshbuf_dump(const struct sshbuf *buf, FILE *f);
247 
248 /* Dump specified memory in a human-readable format */
249 void	sshbuf_dump_data(const void *s, size_t len, FILE *f);
250 
251 /* Return the hexadecimal representation of the contents of the buffer */
252 char	*sshbuf_dtob16(struct sshbuf *buf);
253 
254 /* Encode the contents of the buffer as base64 */
255 char	*sshbuf_dtob64_string(const struct sshbuf *buf, int wrap);
256 int	sshbuf_dtob64(const struct sshbuf *d, struct sshbuf *b64, int wrap);
257 /* RFC4648 "base64url" encoding variant */
258 int	sshbuf_dtourlb64(const struct sshbuf *d, struct sshbuf *b64, int wrap);
259 
260 /* Decode base64 data and append it to the buffer */
261 int	sshbuf_b64tod(struct sshbuf *buf, const char *b64);
262 
263 /*
264  * Tests whether the buffer contains the specified byte sequence at the
265  * specified offset. Returns 0 on successful match, or a ssherr.h code
266  * otherwise. SSH_ERR_INVALID_FORMAT indicates sufficient bytes were
267  * present but the buffer contents did not match those supplied. Zero-
268  * length comparisons are not allowed.
269  *
270  * If sufficient data is present to make a comparison, then it is
271  * performed with timing independent of the value of the data. If
272  * insufficient data is present then the comparison is not attempted at
273  * all.
274  */
275 int	sshbuf_cmp(const struct sshbuf *b, size_t offset,
276     const void *s, size_t len);
277 
278 /*
279  * Searches the buffer for the specified string. Returns 0 on success
280  * and updates *offsetp with the offset of the first match, relative to
281  * the start of the buffer. Otherwise sshbuf_find will return a ssherr.h
282  * error code. SSH_ERR_INVALID_FORMAT indicates sufficient bytes were
283  * present in the buffer for a match to be possible but none was found.
284  * Searches for zero-length data are not allowed.
285  */
286 int
287 sshbuf_find(const struct sshbuf *b, size_t start_offset,
288     const void *s, size_t len, size_t *offsetp);
289 
290 /*
291  * Duplicate the contents of a buffer to a string (caller to free).
292  * Returns NULL on buffer error, or if the buffer contains a premature
293  * nul character.
294  */
295 char *sshbuf_dup_string(struct sshbuf *buf);
296 
297 /*
298  * Fill a buffer from a file descriptor or filename. Both allocate the
299  * buffer for the caller.
300  */
301 int sshbuf_load_fd(int, struct sshbuf **)
302     __attribute__((__nonnull__ (2)));
303 int sshbuf_load_file(const char *, struct sshbuf **)
304     __attribute__((__nonnull__ (2)));
305 
306 /*
307  * Write a buffer to a path, creating/truncating as needed (mode 0644,
308  * subject to umask). The buffer contents are not modified.
309  */
310 int sshbuf_write_file(const char *path, struct sshbuf *buf)
311     __attribute__((__nonnull__ (2)));
312 
313 /* Macros for decoding/encoding integers */
314 #define PEEK_U64(p) \
315 	(((u_int64_t)(((const u_char *)(p))[0]) << 56) | \
316 	 ((u_int64_t)(((const u_char *)(p))[1]) << 48) | \
317 	 ((u_int64_t)(((const u_char *)(p))[2]) << 40) | \
318 	 ((u_int64_t)(((const u_char *)(p))[3]) << 32) | \
319 	 ((u_int64_t)(((const u_char *)(p))[4]) << 24) | \
320 	 ((u_int64_t)(((const u_char *)(p))[5]) << 16) | \
321 	 ((u_int64_t)(((const u_char *)(p))[6]) << 8) | \
322 	  (u_int64_t)(((const u_char *)(p))[7]))
323 #define PEEK_U32(p) \
324 	(((u_int32_t)(((const u_char *)(p))[0]) << 24) | \
325 	 ((u_int32_t)(((const u_char *)(p))[1]) << 16) | \
326 	 ((u_int32_t)(((const u_char *)(p))[2]) << 8) | \
327 	  (u_int32_t)(((const u_char *)(p))[3]))
328 #define PEEK_U16(p) \
329 	(((u_int16_t)(((const u_char *)(p))[0]) << 8) | \
330 	  (u_int16_t)(((const u_char *)(p))[1]))
331 
332 #define POKE_U64(p, v) \
333 	do { \
334 		const u_int64_t __v = (v); \
335 		((u_char *)(p))[0] = (__v >> 56) & 0xff; \
336 		((u_char *)(p))[1] = (__v >> 48) & 0xff; \
337 		((u_char *)(p))[2] = (__v >> 40) & 0xff; \
338 		((u_char *)(p))[3] = (__v >> 32) & 0xff; \
339 		((u_char *)(p))[4] = (__v >> 24) & 0xff; \
340 		((u_char *)(p))[5] = (__v >> 16) & 0xff; \
341 		((u_char *)(p))[6] = (__v >> 8) & 0xff; \
342 		((u_char *)(p))[7] = __v & 0xff; \
343 	} while (0)
344 #define POKE_U32(p, v) \
345 	do { \
346 		const u_int32_t __v = (v); \
347 		((u_char *)(p))[0] = (__v >> 24) & 0xff; \
348 		((u_char *)(p))[1] = (__v >> 16) & 0xff; \
349 		((u_char *)(p))[2] = (__v >> 8) & 0xff; \
350 		((u_char *)(p))[3] = __v & 0xff; \
351 	} while (0)
352 #define POKE_U16(p, v) \
353 	do { \
354 		const u_int16_t __v = (v); \
355 		((u_char *)(p))[0] = (__v >> 8) & 0xff; \
356 		((u_char *)(p))[1] = __v & 0xff; \
357 	} while (0)
358 
359 /* Internal definitions follow. Exposed for regress tests */
360 #ifdef SSHBUF_INTERNAL
361 
362 /*
363  * Return the allocation size of buf
364  */
365 size_t	sshbuf_alloc(const struct sshbuf *buf);
366 
367 /*
368  * Increment the reference count of buf.
369  */
370 int	sshbuf_set_parent(struct sshbuf *child, struct sshbuf *parent);
371 
372 /*
373  * Return the parent buffer of buf, or NULL if it has no parent.
374  */
375 const struct sshbuf *sshbuf_parent(const struct sshbuf *buf);
376 
377 /*
378  * Return the reference count of buf
379  */
380 u_int	sshbuf_refcount(const struct sshbuf *buf);
381 
382 # define SSHBUF_SIZE_INIT	256		/* Initial allocation */
383 # define SSHBUF_SIZE_INC	256		/* Preferred increment length */
384 # define SSHBUF_PACK_MIN	8192		/* Minimim packable offset */
385 
386 /* # define SSHBUF_ABORT abort */
387 /* # define SSHBUF_DEBUG */
388 
389 # ifndef SSHBUF_ABORT
390 #  define SSHBUF_ABORT()
391 # endif
392 
393 # ifdef SSHBUF_DEBUG
394 #  define SSHBUF_TELL(what) do { \
395 		printf("%s:%d %s: %s size %zu alloc %zu off %zu max %zu\n", \
396 		    __FILE__, __LINE__, __func__, what, \
397 		    buf->size, buf->alloc, buf->off, buf->max_size); \
398 		fflush(stdout); \
399 	} while (0)
400 #  define SSHBUF_DBG(x) do { \
401 		printf("%s:%d %s: ", __FILE__, __LINE__, __func__); \
402 		printf x; \
403 		printf("\n"); \
404 		fflush(stdout); \
405 	} while (0)
406 # else
407 #  define SSHBUF_TELL(what)
408 #  define SSHBUF_DBG(x)
409 # endif
410 #endif /* SSHBUF_INTERNAL */
411 
412 #endif /* _SSHBUF_H */
413