1 /* $OpenBSD: sshbuf-misc.c,v 1.18 2022/01/22 00:43:43 djm Exp $ */
2 /*
3 * Copyright (c) 2011 Damien Miller
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18 #include "includes.h"
19
20 #include <sys/types.h>
21 #include <sys/socket.h>
22 #include <netinet/in.h>
23 #include <errno.h>
24 #include <stdlib.h>
25 #ifdef HAVE_STDINT_H
26 # include <stdint.h>
27 #endif
28 #include <stdio.h>
29 #include <limits.h>
30 #include <string.h>
31 #include <resolv.h>
32 #include <ctype.h>
33 #include <unistd.h>
34
35 #include "ssherr.h"
36 #define SSHBUF_INTERNAL
37 #include "sshbuf.h"
38
39 void
sshbuf_dump_data(const void * s,size_t len,FILE * f)40 sshbuf_dump_data(const void *s, size_t len, FILE *f)
41 {
42 size_t i, j;
43 const u_char *p = (const u_char *)s;
44
45 for (i = 0; i < len; i += 16) {
46 fprintf(f, "%.4zu: ", i);
47 for (j = i; j < i + 16; j++) {
48 if (j < len)
49 fprintf(f, "%02x ", p[j]);
50 else
51 fprintf(f, " ");
52 }
53 fprintf(f, " ");
54 for (j = i; j < i + 16; j++) {
55 if (j < len) {
56 if (isascii(p[j]) && isprint(p[j]))
57 fprintf(f, "%c", p[j]);
58 else
59 fprintf(f, ".");
60 }
61 }
62 fprintf(f, "\n");
63 }
64 }
65
66 void
sshbuf_dump(const struct sshbuf * buf,FILE * f)67 sshbuf_dump(const struct sshbuf *buf, FILE *f)
68 {
69 fprintf(f, "buffer len = %zu\n", sshbuf_len(buf));
70 sshbuf_dump_data(sshbuf_ptr(buf), sshbuf_len(buf), f);
71 }
72
73 char *
sshbuf_dtob16(struct sshbuf * buf)74 sshbuf_dtob16(struct sshbuf *buf)
75 {
76 size_t i, j, len = sshbuf_len(buf);
77 const u_char *p = sshbuf_ptr(buf);
78 char *ret;
79 const char hex[] = "0123456789abcdef";
80
81 if (len == 0)
82 return strdup("");
83 if (SIZE_MAX / 2 <= len || (ret = malloc(len * 2 + 1)) == NULL)
84 return NULL;
85 for (i = j = 0; i < len; i++) {
86 ret[j++] = hex[(p[i] >> 4) & 0xf];
87 ret[j++] = hex[p[i] & 0xf];
88 }
89 ret[j] = '\0';
90 return ret;
91 }
92
93 int
sshbuf_dtob64(const struct sshbuf * d,struct sshbuf * b64,int wrap)94 sshbuf_dtob64(const struct sshbuf *d, struct sshbuf *b64, int wrap)
95 {
96 size_t i, slen = 0;
97 char *s = NULL;
98 int r;
99
100 if (d == NULL || b64 == NULL || sshbuf_len(d) >= SIZE_MAX / 2)
101 return SSH_ERR_INVALID_ARGUMENT;
102 if (sshbuf_len(d) == 0)
103 return 0;
104 slen = ((sshbuf_len(d) + 2) / 3) * 4 + 1;
105 if ((s = malloc(slen)) == NULL)
106 return SSH_ERR_ALLOC_FAIL;
107 if (b64_ntop(sshbuf_ptr(d), sshbuf_len(d), s, slen) == -1) {
108 r = SSH_ERR_INTERNAL_ERROR;
109 goto fail;
110 }
111 if (wrap) {
112 for (i = 0; s[i] != '\0'; i++) {
113 if ((r = sshbuf_put_u8(b64, s[i])) != 0)
114 goto fail;
115 if (i % 70 == 69 && (r = sshbuf_put_u8(b64, '\n')) != 0)
116 goto fail;
117 }
118 if ((i - 1) % 70 != 69 && (r = sshbuf_put_u8(b64, '\n')) != 0)
119 goto fail;
120 } else {
121 if ((r = sshbuf_put(b64, s, strlen(s))) != 0)
122 goto fail;
123 }
124 /* Success */
125 r = 0;
126 fail:
127 freezero(s, slen);
128 return r;
129 }
130
131 char *
sshbuf_dtob64_string(const struct sshbuf * buf,int wrap)132 sshbuf_dtob64_string(const struct sshbuf *buf, int wrap)
133 {
134 struct sshbuf *tmp;
135 char *ret;
136
137 if ((tmp = sshbuf_new()) == NULL)
138 return NULL;
139 if (sshbuf_dtob64(buf, tmp, wrap) != 0) {
140 sshbuf_free(tmp);
141 return NULL;
142 }
143 ret = sshbuf_dup_string(tmp);
144 sshbuf_free(tmp);
145 return ret;
146 }
147
148 int
sshbuf_b64tod(struct sshbuf * buf,const char * b64)149 sshbuf_b64tod(struct sshbuf *buf, const char *b64)
150 {
151 size_t plen = strlen(b64);
152 int nlen, r;
153 u_char *p;
154
155 if (plen == 0)
156 return 0;
157 if ((p = malloc(plen)) == NULL)
158 return SSH_ERR_ALLOC_FAIL;
159 if ((nlen = b64_pton(b64, p, plen)) < 0) {
160 freezero(p, plen);
161 return SSH_ERR_INVALID_FORMAT;
162 }
163 if ((r = sshbuf_put(buf, p, nlen)) < 0) {
164 freezero(p, plen);
165 return r;
166 }
167 freezero(p, plen);
168 return 0;
169 }
170
171 int
sshbuf_dtourlb64(const struct sshbuf * d,struct sshbuf * b64,int wrap)172 sshbuf_dtourlb64(const struct sshbuf *d, struct sshbuf *b64, int wrap)
173 {
174 int r = SSH_ERR_INTERNAL_ERROR;
175 u_char *p;
176 struct sshbuf *b = NULL;
177 size_t i, l;
178
179 if ((b = sshbuf_new()) == NULL)
180 return SSH_ERR_ALLOC_FAIL;
181 /* Encode using regular base64; we'll transform it once done */
182 if ((r = sshbuf_dtob64(d, b, wrap)) != 0)
183 goto out;
184 /* remove padding from end of encoded string*/
185 for (;;) {
186 l = sshbuf_len(b);
187 if (l <= 1 || sshbuf_ptr(b) == NULL) {
188 r = SSH_ERR_INTERNAL_ERROR;
189 goto out;
190 }
191 if (sshbuf_ptr(b)[l - 1] != '=')
192 break;
193 if ((r = sshbuf_consume_end(b, 1)) != 0)
194 goto out;
195 }
196 /* Replace characters with rfc4648 equivalents */
197 l = sshbuf_len(b);
198 if ((p = sshbuf_mutable_ptr(b)) == NULL) {
199 r = SSH_ERR_INTERNAL_ERROR;
200 goto out;
201 }
202 for (i = 0; i < l; i++) {
203 if (p[i] == '+')
204 p[i] = '-';
205 else if (p[i] == '/')
206 p[i] = '_';
207 }
208 r = sshbuf_putb(b64, b);
209 out:
210 sshbuf_free(b);
211 return r;
212 }
213
214 char *
sshbuf_dup_string(struct sshbuf * buf)215 sshbuf_dup_string(struct sshbuf *buf)
216 {
217 const u_char *p = NULL, *s = sshbuf_ptr(buf);
218 size_t l = sshbuf_len(buf);
219 char *r;
220
221 if (s == NULL || l > SIZE_MAX)
222 return NULL;
223 /* accept a nul only as the last character in the buffer */
224 if (l > 0 && (p = memchr(s, '\0', l)) != NULL) {
225 if (p != s + l - 1)
226 return NULL;
227 l--; /* the nul is put back below */
228 }
229 if ((r = malloc(l + 1)) == NULL)
230 return NULL;
231 if (l > 0)
232 memcpy(r, s, l);
233 r[l] = '\0';
234 return r;
235 }
236
237 int
sshbuf_cmp(const struct sshbuf * b,size_t offset,const void * s,size_t len)238 sshbuf_cmp(const struct sshbuf *b, size_t offset,
239 const void *s, size_t len)
240 {
241 if (sshbuf_ptr(b) == NULL)
242 return SSH_ERR_INTERNAL_ERROR;
243 if (offset > SSHBUF_SIZE_MAX || len > SSHBUF_SIZE_MAX || len == 0)
244 return SSH_ERR_INVALID_ARGUMENT;
245 if (offset + len > sshbuf_len(b))
246 return SSH_ERR_MESSAGE_INCOMPLETE;
247 if (timingsafe_bcmp(sshbuf_ptr(b) + offset, s, len) != 0)
248 return SSH_ERR_INVALID_FORMAT;
249 return 0;
250 }
251
252 int
sshbuf_find(const struct sshbuf * b,size_t start_offset,const void * s,size_t len,size_t * offsetp)253 sshbuf_find(const struct sshbuf *b, size_t start_offset,
254 const void *s, size_t len, size_t *offsetp)
255 {
256 void *p;
257
258 if (offsetp != NULL)
259 *offsetp = 0;
260 if (sshbuf_ptr(b) == NULL)
261 return SSH_ERR_INTERNAL_ERROR;
262 if (start_offset > SSHBUF_SIZE_MAX || len > SSHBUF_SIZE_MAX || len == 0)
263 return SSH_ERR_INVALID_ARGUMENT;
264 if (start_offset > sshbuf_len(b) || start_offset + len > sshbuf_len(b))
265 return SSH_ERR_MESSAGE_INCOMPLETE;
266 if ((p = memmem(sshbuf_ptr(b) + start_offset,
267 sshbuf_len(b) - start_offset, s, len)) == NULL)
268 return SSH_ERR_INVALID_FORMAT;
269 if (offsetp != NULL)
270 *offsetp = (const u_char *)p - sshbuf_ptr(b);
271 return 0;
272 }
273
274 int
sshbuf_read(int fd,struct sshbuf * buf,size_t maxlen,size_t * rlen)275 sshbuf_read(int fd, struct sshbuf *buf, size_t maxlen, size_t *rlen)
276 {
277 int r, oerrno;
278 size_t adjust;
279 ssize_t rr;
280 u_char *d;
281
282 if (rlen != NULL)
283 *rlen = 0;
284 if ((r = sshbuf_reserve(buf, maxlen, &d)) != 0)
285 return r;
286 rr = read(fd, d, maxlen);
287 oerrno = errno;
288
289 /* Adjust the buffer to include only what was actually read */
290 if ((adjust = maxlen - (rr > 0 ? rr : 0)) != 0) {
291 if ((r = sshbuf_consume_end(buf, adjust)) != 0) {
292 /* avoid returning uninitialised data to caller */
293 memset(d + rr, '\0', adjust);
294 return SSH_ERR_INTERNAL_ERROR; /* shouldn't happen */
295 }
296 }
297 if (rr < 0) {
298 errno = oerrno;
299 return SSH_ERR_SYSTEM_ERROR;
300 } else if (rr == 0) {
301 errno = EPIPE;
302 return SSH_ERR_SYSTEM_ERROR;
303 }
304 /* success */
305 if (rlen != NULL)
306 *rlen = (size_t)rr;
307 return 0;
308 }
309