blob: d401a72653a654ec34e97ca9f0d8f76b559d5fdb [file] [log] [blame]
djm@openbsd.orgbe02d7c2019-09-06 04:53:27 +00001/* $OpenBSD: sshbuf-getput-basic.c,v 1.9 2019/09/06 04:53:27 djm Exp $ */
Damien Miller05e82c32014-05-15 14:33:43 +10002/*
3 * Copyright (c) 2011 Damien Miller
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
Damien Millere5b9f0f2014-05-15 14:58:07 +100018#define SSHBUF_INTERNAL
Damien Miller05e82c32014-05-15 14:33:43 +100019#include "includes.h"
20
21#include <sys/types.h>
dtucker@openbsd.org9816fc52016-06-16 11:00:17 +000022
23#include <stdarg.h>
Damien Miller05e82c32014-05-15 14:33:43 +100024#include <stdlib.h>
25#include <stdio.h>
26#include <string.h>
Damien Millercfc18972019-10-09 09:06:35 +110027#ifdef HAVE_STDINT_H
28# include <stdint.h>
29#endif
Damien Miller05e82c32014-05-15 14:33:43 +100030
31#include "ssherr.h"
Damien Miller05e82c32014-05-15 14:33:43 +100032#include "sshbuf.h"
33
34int
35sshbuf_get(struct sshbuf *buf, void *v, size_t len)
36{
37 const u_char *p = sshbuf_ptr(buf);
38 int r;
39
40 if ((r = sshbuf_consume(buf, len)) < 0)
41 return r;
djm@openbsd.orga7f49dc2015-01-12 15:18:07 +000042 if (v != NULL && len != 0)
Damien Miller05e82c32014-05-15 14:33:43 +100043 memcpy(v, p, len);
44 return 0;
45}
46
47int
48sshbuf_get_u64(struct sshbuf *buf, u_int64_t *valp)
49{
50 const u_char *p = sshbuf_ptr(buf);
51 int r;
52
53 if ((r = sshbuf_consume(buf, 8)) < 0)
54 return r;
55 if (valp != NULL)
56 *valp = PEEK_U64(p);
57 return 0;
58}
59
60int
61sshbuf_get_u32(struct sshbuf *buf, u_int32_t *valp)
62{
63 const u_char *p = sshbuf_ptr(buf);
64 int r;
65
66 if ((r = sshbuf_consume(buf, 4)) < 0)
67 return r;
68 if (valp != NULL)
69 *valp = PEEK_U32(p);
70 return 0;
71}
72
73int
74sshbuf_get_u16(struct sshbuf *buf, u_int16_t *valp)
75{
76 const u_char *p = sshbuf_ptr(buf);
77 int r;
78
79 if ((r = sshbuf_consume(buf, 2)) < 0)
80 return r;
81 if (valp != NULL)
82 *valp = PEEK_U16(p);
83 return 0;
84}
85
86int
87sshbuf_get_u8(struct sshbuf *buf, u_char *valp)
88{
89 const u_char *p = sshbuf_ptr(buf);
90 int r;
91
92 if ((r = sshbuf_consume(buf, 1)) < 0)
93 return r;
94 if (valp != NULL)
95 *valp = (u_int8_t)*p;
96 return 0;
97}
98
djm@openbsd.org101d1642019-07-14 23:32:27 +000099static int
100check_offset(const struct sshbuf *buf, int wr, size_t offset, size_t len)
101{
102 if (sshbuf_ptr(buf) == NULL) /* calls sshbuf_check_sanity() */
103 return SSH_ERR_INTERNAL_ERROR;
104 if (offset >= SIZE_MAX - len)
105 return SSH_ERR_INVALID_ARGUMENT;
106 if (offset + len > sshbuf_len(buf)) {
107 return wr ?
108 SSH_ERR_NO_BUFFER_SPACE : SSH_ERR_MESSAGE_INCOMPLETE;
109 }
110 return 0;
111}
112
113static int
114check_roffset(const struct sshbuf *buf, size_t offset, size_t len,
115 const u_char **p)
116{
117 int r;
118
119 *p = NULL;
120 if ((r = check_offset(buf, 0, offset, len)) != 0)
121 return r;
122 *p = sshbuf_ptr(buf) + offset;
123 return 0;
124}
125
126int
127sshbuf_peek_u64(const struct sshbuf *buf, size_t offset, u_int64_t *valp)
128{
129 const u_char *p = NULL;
130 int r;
131
132 if (valp != NULL)
133 *valp = 0;
134 if ((r = check_roffset(buf, offset, 8, &p)) != 0)
135 return r;
136 if (valp != NULL)
137 *valp = PEEK_U64(p);
138 return 0;
139}
140
141int
142sshbuf_peek_u32(const struct sshbuf *buf, size_t offset, u_int32_t *valp)
143{
144 const u_char *p = NULL;
145 int r;
146
147 if (valp != NULL)
148 *valp = 0;
149 if ((r = check_roffset(buf, offset, 4, &p)) != 0)
150 return r;
151 if (valp != NULL)
152 *valp = PEEK_U32(p);
153 return 0;
154}
155
156int
157sshbuf_peek_u16(const struct sshbuf *buf, size_t offset, u_int16_t *valp)
158{
159 const u_char *p = NULL;
160 int r;
161
162 if (valp != NULL)
163 *valp = 0;
164 if ((r = check_roffset(buf, offset, 2, &p)) != 0)
165 return r;
166 if (valp != NULL)
167 *valp = PEEK_U16(p);
168 return 0;
169}
170
171int
172sshbuf_peek_u8(const struct sshbuf *buf, size_t offset, u_char *valp)
173{
174 const u_char *p = NULL;
175 int r;
176
177 if (valp != NULL)
178 *valp = 0;
179 if ((r = check_roffset(buf, offset, 1, &p)) != 0)
180 return r;
181 if (valp != NULL)
182 *valp = *p;
183 return 0;
184}
185
Damien Miller05e82c32014-05-15 14:33:43 +1000186int
187sshbuf_get_string(struct sshbuf *buf, u_char **valp, size_t *lenp)
188{
189 const u_char *val;
190 size_t len;
191 int r;
192
193 if (valp != NULL)
194 *valp = NULL;
195 if (lenp != NULL)
196 *lenp = 0;
197 if ((r = sshbuf_get_string_direct(buf, &val, &len)) < 0)
198 return r;
199 if (valp != NULL) {
200 if ((*valp = malloc(len + 1)) == NULL) {
201 SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
202 return SSH_ERR_ALLOC_FAIL;
203 }
djm@openbsd.orga7f49dc2015-01-12 15:18:07 +0000204 if (len != 0)
205 memcpy(*valp, val, len);
Damien Miller05e82c32014-05-15 14:33:43 +1000206 (*valp)[len] = '\0';
207 }
208 if (lenp != NULL)
209 *lenp = len;
210 return 0;
211}
212
213int
214sshbuf_get_string_direct(struct sshbuf *buf, const u_char **valp, size_t *lenp)
215{
216 size_t len;
217 const u_char *p;
218 int r;
219
220 if (valp != NULL)
221 *valp = NULL;
222 if (lenp != NULL)
223 *lenp = 0;
224 if ((r = sshbuf_peek_string_direct(buf, &p, &len)) < 0)
225 return r;
mmcc@openbsd.org7d6c0362015-10-20 23:24:25 +0000226 if (valp != NULL)
Damien Miller05e82c32014-05-15 14:33:43 +1000227 *valp = p;
228 if (lenp != NULL)
229 *lenp = len;
230 if (sshbuf_consume(buf, len + 4) != 0) {
231 /* Shouldn't happen */
232 SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
233 SSHBUF_ABORT();
234 return SSH_ERR_INTERNAL_ERROR;
235 }
236 return 0;
237}
238
239int
240sshbuf_peek_string_direct(const struct sshbuf *buf, const u_char **valp,
241 size_t *lenp)
242{
243 u_int32_t len;
244 const u_char *p = sshbuf_ptr(buf);
245
246 if (valp != NULL)
247 *valp = NULL;
248 if (lenp != NULL)
249 *lenp = 0;
250 if (sshbuf_len(buf) < 4) {
251 SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
252 return SSH_ERR_MESSAGE_INCOMPLETE;
253 }
254 len = PEEK_U32(p);
255 if (len > SSHBUF_SIZE_MAX - 4) {
256 SSHBUF_DBG(("SSH_ERR_STRING_TOO_LARGE"));
257 return SSH_ERR_STRING_TOO_LARGE;
258 }
259 if (sshbuf_len(buf) - 4 < len) {
260 SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
261 return SSH_ERR_MESSAGE_INCOMPLETE;
262 }
mmcc@openbsd.org7d6c0362015-10-20 23:24:25 +0000263 if (valp != NULL)
Damien Miller05e82c32014-05-15 14:33:43 +1000264 *valp = p + 4;
265 if (lenp != NULL)
266 *lenp = len;
267 return 0;
268}
269
270int
271sshbuf_get_cstring(struct sshbuf *buf, char **valp, size_t *lenp)
272{
273 size_t len;
274 const u_char *p, *z;
275 int r;
276
277 if (valp != NULL)
278 *valp = NULL;
279 if (lenp != NULL)
280 *lenp = 0;
281 if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
282 return r;
283 /* Allow a \0 only at the end of the string */
284 if (len > 0 &&
285 (z = memchr(p , '\0', len)) != NULL && z < p + len - 1) {
286 SSHBUF_DBG(("SSH_ERR_INVALID_FORMAT"));
287 return SSH_ERR_INVALID_FORMAT;
288 }
289 if ((r = sshbuf_skip_string(buf)) != 0)
290 return -1;
291 if (valp != NULL) {
292 if ((*valp = malloc(len + 1)) == NULL) {
293 SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
294 return SSH_ERR_ALLOC_FAIL;
295 }
djm@openbsd.orga7f49dc2015-01-12 15:18:07 +0000296 if (len != 0)
297 memcpy(*valp, p, len);
Damien Miller05e82c32014-05-15 14:33:43 +1000298 (*valp)[len] = '\0';
299 }
300 if (lenp != NULL)
301 *lenp = (size_t)len;
302 return 0;
303}
304
305int
306sshbuf_get_stringb(struct sshbuf *buf, struct sshbuf *v)
307{
308 u_int32_t len;
309 u_char *p;
310 int r;
311
312 /*
313 * Use sshbuf_peek_string_direct() to figure out if there is
314 * a complete string in 'buf' and copy the string directly
315 * into 'v'.
316 */
317 if ((r = sshbuf_peek_string_direct(buf, NULL, NULL)) != 0 ||
318 (r = sshbuf_get_u32(buf, &len)) != 0 ||
319 (r = sshbuf_reserve(v, len, &p)) != 0 ||
320 (r = sshbuf_get(buf, p, len)) != 0)
321 return r;
322 return 0;
323}
324
325int
326sshbuf_put(struct sshbuf *buf, const void *v, size_t len)
327{
328 u_char *p;
329 int r;
330
331 if ((r = sshbuf_reserve(buf, len, &p)) < 0)
332 return r;
djm@openbsd.orga7f49dc2015-01-12 15:18:07 +0000333 if (len != 0)
334 memcpy(p, v, len);
Damien Miller05e82c32014-05-15 14:33:43 +1000335 return 0;
336}
337
338int
339sshbuf_putb(struct sshbuf *buf, const struct sshbuf *v)
340{
341 return sshbuf_put(buf, sshbuf_ptr(v), sshbuf_len(v));
342}
343
344int
345sshbuf_putf(struct sshbuf *buf, const char *fmt, ...)
346{
347 va_list ap;
348 int r;
349
350 va_start(ap, fmt);
351 r = sshbuf_putfv(buf, fmt, ap);
352 va_end(ap);
353 return r;
354}
355
356int
357sshbuf_putfv(struct sshbuf *buf, const char *fmt, va_list ap)
358{
359 va_list ap2;
360 int r, len;
361 u_char *p;
362
Darren Tucker5abfb152016-07-15 14:48:30 +1000363 VA_COPY(ap2, ap);
Damien Miller05e82c32014-05-15 14:33:43 +1000364 if ((len = vsnprintf(NULL, 0, fmt, ap2)) < 0) {
365 r = SSH_ERR_INVALID_ARGUMENT;
366 goto out;
367 }
368 if (len == 0) {
369 r = 0;
370 goto out; /* Nothing to do */
371 }
372 va_end(ap2);
Darren Tucker5abfb152016-07-15 14:48:30 +1000373 VA_COPY(ap2, ap);
Damien Miller05e82c32014-05-15 14:33:43 +1000374 if ((r = sshbuf_reserve(buf, (size_t)len + 1, &p)) < 0)
375 goto out;
376 if ((r = vsnprintf((char *)p, len + 1, fmt, ap2)) != len) {
377 r = SSH_ERR_INTERNAL_ERROR;
378 goto out; /* Shouldn't happen */
379 }
380 /* Consume terminating \0 */
381 if ((r = sshbuf_consume_end(buf, 1)) != 0)
382 goto out;
383 r = 0;
384 out:
385 va_end(ap2);
386 return r;
387}
388
389int
390sshbuf_put_u64(struct sshbuf *buf, u_int64_t val)
391{
392 u_char *p;
393 int r;
394
395 if ((r = sshbuf_reserve(buf, 8, &p)) < 0)
396 return r;
397 POKE_U64(p, val);
398 return 0;
399}
400
401int
402sshbuf_put_u32(struct sshbuf *buf, u_int32_t val)
403{
404 u_char *p;
405 int r;
406
407 if ((r = sshbuf_reserve(buf, 4, &p)) < 0)
408 return r;
409 POKE_U32(p, val);
410 return 0;
411}
412
413int
414sshbuf_put_u16(struct sshbuf *buf, u_int16_t val)
415{
416 u_char *p;
417 int r;
418
419 if ((r = sshbuf_reserve(buf, 2, &p)) < 0)
420 return r;
421 POKE_U16(p, val);
422 return 0;
423}
424
425int
426sshbuf_put_u8(struct sshbuf *buf, u_char val)
427{
428 u_char *p;
429 int r;
430
431 if ((r = sshbuf_reserve(buf, 1, &p)) < 0)
432 return r;
433 p[0] = val;
434 return 0;
435}
436
djm@openbsd.org101d1642019-07-14 23:32:27 +0000437static int
438check_woffset(struct sshbuf *buf, size_t offset, size_t len, u_char **p)
439{
440 int r;
441
442 *p = NULL;
443 if ((r = check_offset(buf, 1, offset, len)) != 0)
444 return r;
445 if (sshbuf_mutable_ptr(buf) == NULL)
446 return SSH_ERR_BUFFER_READ_ONLY;
447 *p = sshbuf_mutable_ptr(buf) + offset;
448 return 0;
449}
450
451int
452sshbuf_poke_u64(struct sshbuf *buf, size_t offset, u_int64_t val)
453{
454 u_char *p = NULL;
455 int r;
456
457 if ((r = check_woffset(buf, offset, 8, &p)) != 0)
458 return r;
459 POKE_U64(p, val);
460 return 0;
461}
462
463int
464sshbuf_poke_u32(struct sshbuf *buf, size_t offset, u_int32_t val)
465{
466 u_char *p = NULL;
467 int r;
468
469 if ((r = check_woffset(buf, offset, 4, &p)) != 0)
470 return r;
471 POKE_U32(p, val);
472 return 0;
473}
474
475int
476sshbuf_poke_u16(struct sshbuf *buf, size_t offset, u_int16_t val)
477{
478 u_char *p = NULL;
479 int r;
480
481 if ((r = check_woffset(buf, offset, 2, &p)) != 0)
482 return r;
483 POKE_U16(p, val);
484 return 0;
485}
486
487int
488sshbuf_poke_u8(struct sshbuf *buf, size_t offset, u_char val)
489{
490 u_char *p = NULL;
491 int r;
492
493 if ((r = check_woffset(buf, offset, 1, &p)) != 0)
494 return r;
495 *p = val;
496 return 0;
497}
498
499int
500sshbuf_poke(struct sshbuf *buf, size_t offset, void *v, size_t len)
501{
502 u_char *p = NULL;
503 int r;
504
505 if ((r = check_woffset(buf, offset, len, &p)) != 0)
506 return r;
507 memcpy(p, v, len);
508 return 0;
509}
510
Damien Miller05e82c32014-05-15 14:33:43 +1000511int
512sshbuf_put_string(struct sshbuf *buf, const void *v, size_t len)
513{
514 u_char *d;
515 int r;
516
517 if (len > SSHBUF_SIZE_MAX - 4) {
518 SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
519 return SSH_ERR_NO_BUFFER_SPACE;
520 }
521 if ((r = sshbuf_reserve(buf, len + 4, &d)) < 0)
522 return r;
523 POKE_U32(d, len);
djm@openbsd.orga7f49dc2015-01-12 15:18:07 +0000524 if (len != 0)
525 memcpy(d + 4, v, len);
Damien Miller05e82c32014-05-15 14:33:43 +1000526 return 0;
527}
528
529int
530sshbuf_put_cstring(struct sshbuf *buf, const char *v)
531{
djm@openbsd.org4b2e2d32017-06-01 04:51:58 +0000532 return sshbuf_put_string(buf, v, v == NULL ? 0 : strlen(v));
Damien Miller05e82c32014-05-15 14:33:43 +1000533}
534
535int
536sshbuf_put_stringb(struct sshbuf *buf, const struct sshbuf *v)
537{
538 return sshbuf_put_string(buf, sshbuf_ptr(v), sshbuf_len(v));
539}
540
541int
542sshbuf_froms(struct sshbuf *buf, struct sshbuf **bufp)
543{
544 const u_char *p;
545 size_t len;
546 struct sshbuf *ret;
547 int r;
548
549 if (buf == NULL || bufp == NULL)
550 return SSH_ERR_INVALID_ARGUMENT;
551 *bufp = NULL;
552 if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
553 return r;
554 if ((ret = sshbuf_from(p, len)) == NULL)
555 return SSH_ERR_ALLOC_FAIL;
556 if ((r = sshbuf_consume(buf, len + 4)) != 0 || /* Shouldn't happen */
557 (r = sshbuf_set_parent(ret, buf)) != 0) {
558 sshbuf_free(ret);
559 return r;
560 }
561 *bufp = ret;
562 return 0;
563}
564
565int
566sshbuf_put_bignum2_bytes(struct sshbuf *buf, const void *v, size_t len)
567{
568 u_char *d;
569 const u_char *s = (const u_char *)v;
570 int r, prepend;
571
572 if (len > SSHBUF_SIZE_MAX - 5) {
573 SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
574 return SSH_ERR_NO_BUFFER_SPACE;
575 }
576 /* Skip leading zero bytes */
577 for (; len > 0 && *s == 0; len--, s++)
578 ;
579 /*
580 * If most significant bit is set then prepend a zero byte to
581 * avoid interpretation as a negative number.
582 */
583 prepend = len > 0 && (s[0] & 0x80) != 0;
584 if ((r = sshbuf_reserve(buf, len + 4 + prepend, &d)) < 0)
585 return r;
586 POKE_U32(d, len + prepend);
587 if (prepend)
588 d[4] = 0;
djm@openbsd.orga7f49dc2015-01-12 15:18:07 +0000589 if (len != 0)
590 memcpy(d + 4 + prepend, s, len);
Damien Miller05e82c32014-05-15 14:33:43 +1000591 return 0;
592}
djm@openbsd.orga165bab2015-01-14 15:02:39 +0000593
594int
595sshbuf_get_bignum2_bytes_direct(struct sshbuf *buf,
596 const u_char **valp, size_t *lenp)
597{
598 const u_char *d;
599 size_t len, olen;
600 int r;
601
602 if ((r = sshbuf_peek_string_direct(buf, &d, &olen)) < 0)
603 return r;
604 len = olen;
605 /* Refuse negative (MSB set) bignums */
606 if ((len != 0 && (*d & 0x80) != 0))
607 return SSH_ERR_BIGNUM_IS_NEGATIVE;
608 /* Refuse overlong bignums, allow prepended \0 to avoid MSB set */
609 if (len > SSHBUF_MAX_BIGNUM + 1 ||
610 (len == SSHBUF_MAX_BIGNUM + 1 && *d != 0))
611 return SSH_ERR_BIGNUM_TOO_LARGE;
612 /* Trim leading zeros */
613 while (len > 0 && *d == 0x00) {
614 d++;
615 len--;
616 }
mmcc@openbsd.org7d6c0362015-10-20 23:24:25 +0000617 if (valp != NULL)
djm@openbsd.orga165bab2015-01-14 15:02:39 +0000618 *valp = d;
619 if (lenp != NULL)
620 *lenp = len;
621 if (sshbuf_consume(buf, olen + 4) != 0) {
622 /* Shouldn't happen */
623 SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
624 SSHBUF_ABORT();
625 return SSH_ERR_INTERNAL_ERROR;
626 }
627 return 0;
628}