1264377Sdes/* $OpenBSD: bufbn.c,v 1.11 2014/02/27 08:25:09 djm Exp $*/ 2162852Sdes/* 3162852Sdes * Author: Tatu Ylonen <ylo@cs.hut.fi> 4162852Sdes * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5162852Sdes * All rights reserved 6162852Sdes * Auxiliary functions for storing and retrieving various data types to/from 7162852Sdes * Buffers. 8162852Sdes * 9162852Sdes * As far as I am concerned, the code I have written for this software 10162852Sdes * can be used freely for any purpose. Any derived versions of this 11162852Sdes * software must be clearly marked as such, and if the derived work is 12162852Sdes * incompatible with the protocol description in the RFC file, it must be 13162852Sdes * called by a name other than "ssh" or "Secure Shell". 14162852Sdes * 15162852Sdes * 16162852Sdes * SSH2 packet format added by Markus Friedl 17162852Sdes * Copyright (c) 2000 Markus Friedl. All rights reserved. 18162852Sdes * 19162852Sdes * Redistribution and use in source and binary forms, with or without 20162852Sdes * modification, are permitted provided that the following conditions 21162852Sdes * are met: 22162852Sdes * 1. Redistributions of source code must retain the above copyright 23162852Sdes * notice, this list of conditions and the following disclaimer. 24162852Sdes * 2. Redistributions in binary form must reproduce the above copyright 25162852Sdes * notice, this list of conditions and the following disclaimer in the 26162852Sdes * documentation and/or other materials provided with the distribution. 27162852Sdes * 28162852Sdes * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 29162852Sdes * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 30162852Sdes * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 31162852Sdes * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 32162852Sdes * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 33162852Sdes * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 34162852Sdes * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 35162852Sdes * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 36162852Sdes * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 37162852Sdes * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 38162852Sdes */ 39162852Sdes 40162852Sdes#include "includes.h" 41162852Sdes 42162852Sdes#include <sys/types.h> 43162852Sdes 44162852Sdes#include <openssl/bn.h> 45162852Sdes 46162852Sdes#include <string.h> 47162852Sdes#include <stdarg.h> 48262566Sdes#include <stdlib.h> 49162852Sdes 50162852Sdes#include "xmalloc.h" 51162852Sdes#include "buffer.h" 52162852Sdes#include "log.h" 53162852Sdes#include "misc.h" 54162852Sdes 55162852Sdes/* 56162852Sdes * Stores an BIGNUM in the buffer with a 2-byte msb first bit count, followed 57162852Sdes * by (bits+7)/8 bytes of binary data, msb first. 58162852Sdes */ 59162852Sdesint 60162852Sdesbuffer_put_bignum_ret(Buffer *buffer, const BIGNUM *value) 61162852Sdes{ 62162852Sdes int bits = BN_num_bits(value); 63162852Sdes int bin_size = (bits + 7) / 8; 64162852Sdes u_char *buf = xmalloc(bin_size); 65162852Sdes int oi; 66162852Sdes char msg[2]; 67162852Sdes 68162852Sdes /* Get the value of in binary */ 69162852Sdes oi = BN_bn2bin(value, buf); 70162852Sdes if (oi != bin_size) { 71162852Sdes error("buffer_put_bignum_ret: BN_bn2bin() failed: oi %d != bin_size %d", 72162852Sdes oi, bin_size); 73255767Sdes free(buf); 74162852Sdes return (-1); 75162852Sdes } 76162852Sdes 77162852Sdes /* Store the number of bits in the buffer in two bytes, msb first. */ 78162852Sdes put_u16(msg, bits); 79162852Sdes buffer_append(buffer, msg, 2); 80162852Sdes /* Store the binary data. */ 81162852Sdes buffer_append(buffer, buf, oi); 82162852Sdes 83264377Sdes explicit_bzero(buf, bin_size); 84255767Sdes free(buf); 85162852Sdes 86162852Sdes return (0); 87162852Sdes} 88162852Sdes 89162852Sdesvoid 90162852Sdesbuffer_put_bignum(Buffer *buffer, const BIGNUM *value) 91162852Sdes{ 92162852Sdes if (buffer_put_bignum_ret(buffer, value) == -1) 93162852Sdes fatal("buffer_put_bignum: buffer error"); 94162852Sdes} 95162852Sdes 96162852Sdes/* 97181111Sdes * Retrieves a BIGNUM from the buffer. 98162852Sdes */ 99162852Sdesint 100162852Sdesbuffer_get_bignum_ret(Buffer *buffer, BIGNUM *value) 101162852Sdes{ 102162852Sdes u_int bits, bytes; 103162852Sdes u_char buf[2], *bin; 104162852Sdes 105181111Sdes /* Get the number of bits. */ 106162852Sdes if (buffer_get_ret(buffer, (char *) buf, 2) == -1) { 107162852Sdes error("buffer_get_bignum_ret: invalid length"); 108162852Sdes return (-1); 109162852Sdes } 110162852Sdes bits = get_u16(buf); 111264377Sdes if (bits > 65535-7) { 112264377Sdes error("buffer_get_bignum_ret: cannot handle BN of size %d", 113264377Sdes bits); 114264377Sdes return (-1); 115264377Sdes } 116162852Sdes /* Compute the number of binary bytes that follow. */ 117162852Sdes bytes = (bits + 7) / 8; 118162852Sdes if (bytes > 8 * 1024) { 119162852Sdes error("buffer_get_bignum_ret: cannot handle BN of size %d", bytes); 120162852Sdes return (-1); 121162852Sdes } 122162852Sdes if (buffer_len(buffer) < bytes) { 123162852Sdes error("buffer_get_bignum_ret: input buffer too small"); 124162852Sdes return (-1); 125162852Sdes } 126162852Sdes bin = buffer_ptr(buffer); 127164146Sdes if (BN_bin2bn(bin, bytes, value) == NULL) { 128164146Sdes error("buffer_get_bignum_ret: BN_bin2bn failed"); 129164146Sdes return (-1); 130164146Sdes } 131162852Sdes if (buffer_consume_ret(buffer, bytes) == -1) { 132162852Sdes error("buffer_get_bignum_ret: buffer_consume failed"); 133162852Sdes return (-1); 134162852Sdes } 135162852Sdes return (0); 136162852Sdes} 137162852Sdes 138162852Sdesvoid 139162852Sdesbuffer_get_bignum(Buffer *buffer, BIGNUM *value) 140162852Sdes{ 141162852Sdes if (buffer_get_bignum_ret(buffer, value) == -1) 142162852Sdes fatal("buffer_get_bignum: buffer error"); 143162852Sdes} 144162852Sdes 145162852Sdes/* 146181111Sdes * Stores a BIGNUM in the buffer in SSH2 format. 147162852Sdes */ 148162852Sdesint 149162852Sdesbuffer_put_bignum2_ret(Buffer *buffer, const BIGNUM *value) 150162852Sdes{ 151162852Sdes u_int bytes; 152162852Sdes u_char *buf; 153162852Sdes int oi; 154162852Sdes u_int hasnohigh = 0; 155162852Sdes 156162852Sdes if (BN_is_zero(value)) { 157162852Sdes buffer_put_int(buffer, 0); 158162852Sdes return 0; 159162852Sdes } 160162852Sdes if (value->neg) { 161162852Sdes error("buffer_put_bignum2_ret: negative numbers not supported"); 162162852Sdes return (-1); 163162852Sdes } 164162852Sdes bytes = BN_num_bytes(value) + 1; /* extra padding byte */ 165162852Sdes if (bytes < 2) { 166162852Sdes error("buffer_put_bignum2_ret: BN too small"); 167162852Sdes return (-1); 168162852Sdes } 169162852Sdes buf = xmalloc(bytes); 170162852Sdes buf[0] = 0x00; 171162852Sdes /* Get the value of in binary */ 172162852Sdes oi = BN_bn2bin(value, buf+1); 173162852Sdes if (oi < 0 || (u_int)oi != bytes - 1) { 174162852Sdes error("buffer_put_bignum2_ret: BN_bn2bin() failed: " 175162852Sdes "oi %d != bin_size %d", oi, bytes); 176255767Sdes free(buf); 177162852Sdes return (-1); 178162852Sdes } 179162852Sdes hasnohigh = (buf[1] & 0x80) ? 0 : 1; 180162852Sdes buffer_put_string(buffer, buf+hasnohigh, bytes-hasnohigh); 181264377Sdes explicit_bzero(buf, bytes); 182255767Sdes free(buf); 183162852Sdes return (0); 184162852Sdes} 185162852Sdes 186162852Sdesvoid 187162852Sdesbuffer_put_bignum2(Buffer *buffer, const BIGNUM *value) 188162852Sdes{ 189162852Sdes if (buffer_put_bignum2_ret(buffer, value) == -1) 190162852Sdes fatal("buffer_put_bignum2: buffer error"); 191162852Sdes} 192162852Sdes 193162852Sdesint 194162852Sdesbuffer_get_bignum2_ret(Buffer *buffer, BIGNUM *value) 195162852Sdes{ 196162852Sdes u_int len; 197162852Sdes u_char *bin; 198162852Sdes 199162852Sdes if ((bin = buffer_get_string_ret(buffer, &len)) == NULL) { 200162852Sdes error("buffer_get_bignum2_ret: invalid bignum"); 201162852Sdes return (-1); 202162852Sdes } 203162852Sdes 204162852Sdes if (len > 0 && (bin[0] & 0x80)) { 205162852Sdes error("buffer_get_bignum2_ret: negative numbers not supported"); 206255767Sdes free(bin); 207162852Sdes return (-1); 208162852Sdes } 209162852Sdes if (len > 8 * 1024) { 210181111Sdes error("buffer_get_bignum2_ret: cannot handle BN of size %d", 211181111Sdes len); 212255767Sdes free(bin); 213162852Sdes return (-1); 214162852Sdes } 215164146Sdes if (BN_bin2bn(bin, len, value) == NULL) { 216164146Sdes error("buffer_get_bignum2_ret: BN_bin2bn failed"); 217255767Sdes free(bin); 218164146Sdes return (-1); 219164146Sdes } 220255767Sdes free(bin); 221162852Sdes return (0); 222162852Sdes} 223162852Sdes 224162852Sdesvoid 225162852Sdesbuffer_get_bignum2(Buffer *buffer, BIGNUM *value) 226162852Sdes{ 227162852Sdes if (buffer_get_bignum2_ret(buffer, value) == -1) 228162852Sdes fatal("buffer_get_bignum2: buffer error"); 229162852Sdes} 230