bufaux.c revision 294666
1/* $OpenBSD: bufaux.c,v 1.57 2014/04/16 23:22:45 djm Exp $ */ 2/* 3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5 * All rights reserved 6 * Auxiliary functions for storing and retrieving various data types to/from 7 * Buffers. 8 * 9 * As far as I am concerned, the code I have written for this software 10 * can be used freely for any purpose. Any derived versions of this 11 * software must be clearly marked as such, and if the derived work is 12 * incompatible with the protocol description in the RFC file, it must be 13 * called by a name other than "ssh" or "Secure Shell". 14 * 15 * 16 * SSH2 packet format added by Markus Friedl 17 * Copyright (c) 2000 Markus Friedl. All rights reserved. 18 * 19 * Redistribution and use in source and binary forms, with or without 20 * modification, are permitted provided that the following conditions 21 * are met: 22 * 1. Redistributions of source code must retain the above copyright 23 * notice, this list of conditions and the following disclaimer. 24 * 2. Redistributions in binary form must reproduce the above copyright 25 * notice, this list of conditions and the following disclaimer in the 26 * documentation and/or other materials provided with the distribution. 27 * 28 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 29 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 30 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 31 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 32 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 33 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 34 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 35 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 36 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 37 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 38 */ 39 40#include "includes.h" 41__RCSID("$FreeBSD: stable/10/crypto/openssh/bufaux.c 294666 2016-01-24 15:44:57Z des $"); 42 43#include <sys/types.h> 44 45#include <openssl/bn.h> 46 47#include <string.h> 48#include <stdarg.h> 49#include <stdlib.h> 50 51#include "xmalloc.h" 52#include "buffer.h" 53#include "log.h" 54#include "misc.h" 55 56/* 57 * Returns integers from the buffer (msb first). 58 */ 59 60int 61buffer_get_short_ret(u_short *ret, Buffer *buffer) 62{ 63 u_char buf[2]; 64 65 if (buffer_get_ret(buffer, (char *) buf, 2) == -1) 66 return (-1); 67 *ret = get_u16(buf); 68 return (0); 69} 70 71u_short 72buffer_get_short(Buffer *buffer) 73{ 74 u_short ret; 75 76 if (buffer_get_short_ret(&ret, buffer) == -1) 77 fatal("buffer_get_short: buffer error"); 78 79 return (ret); 80} 81 82int 83buffer_get_int_ret(u_int *ret, Buffer *buffer) 84{ 85 u_char buf[4]; 86 87 if (buffer_get_ret(buffer, (char *) buf, 4) == -1) 88 return (-1); 89 if (ret != NULL) 90 *ret = get_u32(buf); 91 return (0); 92} 93 94u_int 95buffer_get_int(Buffer *buffer) 96{ 97 u_int ret; 98 99 if (buffer_get_int_ret(&ret, buffer) == -1) 100 fatal("buffer_get_int: buffer error"); 101 102 return (ret); 103} 104 105int 106buffer_get_int64_ret(u_int64_t *ret, Buffer *buffer) 107{ 108 u_char buf[8]; 109 110 if (buffer_get_ret(buffer, (char *) buf, 8) == -1) 111 return (-1); 112 if (ret != NULL) 113 *ret = get_u64(buf); 114 return (0); 115} 116 117u_int64_t 118buffer_get_int64(Buffer *buffer) 119{ 120 u_int64_t ret; 121 122 if (buffer_get_int64_ret(&ret, buffer) == -1) 123 fatal("buffer_get_int: buffer error"); 124 125 return (ret); 126} 127 128/* 129 * Stores integers in the buffer, msb first. 130 */ 131void 132buffer_put_short(Buffer *buffer, u_short value) 133{ 134 char buf[2]; 135 136 put_u16(buf, value); 137 buffer_append(buffer, buf, 2); 138} 139 140void 141buffer_put_int(Buffer *buffer, u_int value) 142{ 143 char buf[4]; 144 145 put_u32(buf, value); 146 buffer_append(buffer, buf, 4); 147} 148 149void 150buffer_put_int64(Buffer *buffer, u_int64_t value) 151{ 152 char buf[8]; 153 154 put_u64(buf, value); 155 buffer_append(buffer, buf, 8); 156} 157 158/* 159 * Returns an arbitrary binary string from the buffer. The string cannot 160 * be longer than 256k. The returned value points to memory allocated 161 * with xmalloc; it is the responsibility of the calling function to free 162 * the data. If length_ptr is non-NULL, the length of the returned data 163 * will be stored there. A null character will be automatically appended 164 * to the returned string, and is not counted in length. 165 */ 166void * 167buffer_get_string_ret(Buffer *buffer, u_int *length_ptr) 168{ 169 u_char *value; 170 u_int len; 171 172 /* Get the length. */ 173 if (buffer_get_int_ret(&len, buffer) != 0) { 174 error("buffer_get_string_ret: cannot extract length"); 175 return (NULL); 176 } 177 if (len > 256 * 1024) { 178 error("buffer_get_string_ret: bad string length %u", len); 179 return (NULL); 180 } 181 /* Allocate space for the string. Add one byte for a null character. */ 182 value = xmalloc(len + 1); 183 /* Get the string. */ 184 if (buffer_get_ret(buffer, value, len) == -1) { 185 error("buffer_get_string_ret: buffer_get failed"); 186 free(value); 187 return (NULL); 188 } 189 /* Append a null character to make processing easier. */ 190 value[len] = '\0'; 191 /* Optionally return the length of the string. */ 192 if (length_ptr) 193 *length_ptr = len; 194 return (value); 195} 196 197void * 198buffer_get_string(Buffer *buffer, u_int *length_ptr) 199{ 200 void *ret; 201 202 if ((ret = buffer_get_string_ret(buffer, length_ptr)) == NULL) 203 fatal("buffer_get_string: buffer error"); 204 return (ret); 205} 206 207char * 208buffer_get_cstring_ret(Buffer *buffer, u_int *length_ptr) 209{ 210 u_int length; 211 char *cp, *ret = buffer_get_string_ret(buffer, &length); 212 213 if (ret == NULL) 214 return NULL; 215 if ((cp = memchr(ret, '\0', length)) != NULL) { 216 /* XXX allow \0 at end-of-string for a while, remove later */ 217 if (cp == ret + length - 1) 218 error("buffer_get_cstring_ret: string contains \\0"); 219 else { 220 explicit_bzero(ret, length); 221 free(ret); 222 return NULL; 223 } 224 } 225 if (length_ptr != NULL) 226 *length_ptr = length; 227 return ret; 228} 229 230char * 231buffer_get_cstring(Buffer *buffer, u_int *length_ptr) 232{ 233 char *ret; 234 235 if ((ret = buffer_get_cstring_ret(buffer, length_ptr)) == NULL) 236 fatal("buffer_get_cstring: buffer error"); 237 return ret; 238} 239 240void * 241buffer_get_string_ptr_ret(Buffer *buffer, u_int *length_ptr) 242{ 243 void *ptr; 244 u_int len; 245 246 if (buffer_get_int_ret(&len, buffer) != 0) 247 return NULL; 248 if (len > 256 * 1024) { 249 error("buffer_get_string_ptr: bad string length %u", len); 250 return NULL; 251 } 252 ptr = buffer_ptr(buffer); 253 buffer_consume(buffer, len); 254 if (length_ptr) 255 *length_ptr = len; 256 return (ptr); 257} 258 259void * 260buffer_get_string_ptr(Buffer *buffer, u_int *length_ptr) 261{ 262 void *ret; 263 264 if ((ret = buffer_get_string_ptr_ret(buffer, length_ptr)) == NULL) 265 fatal("buffer_get_string_ptr: buffer error"); 266 return (ret); 267} 268 269/* 270 * Stores and arbitrary binary string in the buffer. 271 */ 272void 273buffer_put_string(Buffer *buffer, const void *buf, u_int len) 274{ 275 buffer_put_int(buffer, len); 276 buffer_append(buffer, buf, len); 277} 278void 279buffer_put_cstring(Buffer *buffer, const char *s) 280{ 281 if (s == NULL) 282 fatal("buffer_put_cstring: s == NULL"); 283 buffer_put_string(buffer, s, strlen(s)); 284} 285 286/* 287 * Returns a character from the buffer (0 - 255). 288 */ 289int 290buffer_get_char_ret(u_char *ret, Buffer *buffer) 291{ 292 if (buffer_get_ret(buffer, ret, 1) == -1) { 293 error("buffer_get_char_ret: buffer_get_ret failed"); 294 return (-1); 295 } 296 return (0); 297} 298 299int 300buffer_get_char(Buffer *buffer) 301{ 302 u_char ch; 303 304 if (buffer_get_char_ret(&ch, buffer) == -1) 305 fatal("buffer_get_char: buffer error"); 306 return ch; 307} 308 309/* 310 * Stores a character in the buffer. 311 */ 312void 313buffer_put_char(Buffer *buffer, int value) 314{ 315 char ch = value; 316 317 buffer_append(buffer, &ch, 1); 318} 319 320/* Pseudo bignum functions */ 321 322void * 323buffer_get_bignum2_as_string_ret(Buffer *buffer, u_int *length_ptr) 324{ 325 u_int len; 326 u_char *bin, *p, *ret; 327 328 if ((p = bin = buffer_get_string_ret(buffer, &len)) == NULL) { 329 error("%s: invalid bignum", __func__); 330 return NULL; 331 } 332 333 if (len > 0 && (bin[0] & 0x80)) { 334 error("%s: negative numbers not supported", __func__); 335 free(bin); 336 return NULL; 337 } 338 if (len > 8 * 1024) { 339 error("%s: cannot handle BN of size %d", __func__, len); 340 free(bin); 341 return NULL; 342 } 343 /* Skip zero prefix on numbers with the MSB set */ 344 if (len > 1 && bin[0] == 0x00 && (bin[1] & 0x80) != 0) { 345 p++; 346 len--; 347 } 348 ret = xmalloc(len); 349 memcpy(ret, p, len); 350 explicit_bzero(p, len); 351 free(bin); 352 return ret; 353} 354 355void * 356buffer_get_bignum2_as_string(Buffer *buffer, u_int *l) 357{ 358 void *ret = buffer_get_bignum2_as_string_ret(buffer, l); 359 360 if (ret == NULL) 361 fatal("%s: buffer error", __func__); 362 return ret; 363} 364 365/* 366 * Stores a string using the bignum encoding rules (\0 pad if MSB set). 367 */ 368void 369buffer_put_bignum2_from_string(Buffer *buffer, const u_char *s, u_int l) 370{ 371 u_char *buf, *p; 372 int pad = 0; 373 374 if (l > 8 * 1024) 375 fatal("%s: length %u too long", __func__, l); 376 /* Skip leading zero bytes */ 377 for (; l > 0 && *s == 0; l--, s++) 378 ; 379 p = buf = xmalloc(l + 1); 380 /* 381 * If most significant bit is set then prepend a zero byte to 382 * avoid interpretation as a negative number. 383 */ 384 if (l > 0 && (s[0] & 0x80) != 0) { 385 *p++ = '\0'; 386 pad = 1; 387 } 388 memcpy(p, s, l); 389 buffer_put_string(buffer, buf, l + pad); 390 explicit_bzero(buf, l + pad); 391 free(buf); 392} 393 394 395