1 /*	$OpenBSD: sshbuf-getput-basic.c,v 1.1 2014/04/30 05:29:56 djm Exp $	*/
2 /*
3  * Copyright (c) 2011 Damien Miller
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #define SSHBUF_INTERNAL
19 #include "includes.h"
20 
21 #include <sys/types.h>
22 #include <stdlib.h>
23 #include <stdio.h>
24 #include <string.h>
25 
26 #include "ssherr.h"
27 #include "sshbuf.h"
28 
29 int
30 sshbuf_get(struct sshbuf *buf, void *v, size_t len)
31 {
32 	const u_char *p = sshbuf_ptr(buf);
33 	int r;
34 
35 	if ((r = sshbuf_consume(buf, len)) < 0)
36 		return r;
37 	if (v != NULL)
38 		memcpy(v, p, len);
39 	return 0;
40 }
41 
42 int
43 sshbuf_get_u64(struct sshbuf *buf, u_int64_t *valp)
44 {
45 	const u_char *p = sshbuf_ptr(buf);
46 	int r;
47 
48 	if ((r = sshbuf_consume(buf, 8)) < 0)
49 		return r;
50 	if (valp != NULL)
51 		*valp = PEEK_U64(p);
52 	return 0;
53 }
54 
55 int
56 sshbuf_get_u32(struct sshbuf *buf, u_int32_t *valp)
57 {
58 	const u_char *p = sshbuf_ptr(buf);
59 	int r;
60 
61 	if ((r = sshbuf_consume(buf, 4)) < 0)
62 		return r;
63 	if (valp != NULL)
64 		*valp = PEEK_U32(p);
65 	return 0;
66 }
67 
68 int
69 sshbuf_get_u16(struct sshbuf *buf, u_int16_t *valp)
70 {
71 	const u_char *p = sshbuf_ptr(buf);
72 	int r;
73 
74 	if ((r = sshbuf_consume(buf, 2)) < 0)
75 		return r;
76 	if (valp != NULL)
77 		*valp = PEEK_U16(p);
78 	return 0;
79 }
80 
81 int
82 sshbuf_get_u8(struct sshbuf *buf, u_char *valp)
83 {
84 	const u_char *p = sshbuf_ptr(buf);
85 	int r;
86 
87 	if ((r = sshbuf_consume(buf, 1)) < 0)
88 		return r;
89 	if (valp != NULL)
90 		*valp = (u_int8_t)*p;
91 	return 0;
92 }
93 
94 int
95 sshbuf_get_string(struct sshbuf *buf, u_char **valp, size_t *lenp)
96 {
97 	const u_char *val;
98 	size_t len;
99 	int r;
100 
101 	if (valp != NULL)
102 		*valp = NULL;
103 	if (lenp != NULL)
104 		*lenp = 0;
105 	if ((r = sshbuf_get_string_direct(buf, &val, &len)) < 0)
106 		return r;
107 	if (valp != NULL) {
108 		if ((*valp = malloc(len + 1)) == NULL) {
109 			SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
110 			return SSH_ERR_ALLOC_FAIL;
111 		}
112 		memcpy(*valp, val, len);
113 		(*valp)[len] = '\0';
114 	}
115 	if (lenp != NULL)
116 		*lenp = len;
117 	return 0;
118 }
119 
120 int
121 sshbuf_get_string_direct(struct sshbuf *buf, const u_char **valp, size_t *lenp)
122 {
123 	size_t len;
124 	const u_char *p;
125 	int r;
126 
127 	if (valp != NULL)
128 		*valp = NULL;
129 	if (lenp != NULL)
130 		*lenp = 0;
131 	if ((r = sshbuf_peek_string_direct(buf, &p, &len)) < 0)
132 		return r;
133 	if (valp != 0)
134 		*valp = p;
135 	if (lenp != NULL)
136 		*lenp = len;
137 	if (sshbuf_consume(buf, len + 4) != 0) {
138 		/* Shouldn't happen */
139 		SSHBUF_DBG(("SSH_ERR_INTERNAL_ERROR"));
140 		SSHBUF_ABORT();
141 		return SSH_ERR_INTERNAL_ERROR;
142 	}
143 	return 0;
144 }
145 
146 int
147 sshbuf_peek_string_direct(const struct sshbuf *buf, const u_char **valp,
148     size_t *lenp)
149 {
150 	u_int32_t len;
151 	const u_char *p = sshbuf_ptr(buf);
152 
153 	if (valp != NULL)
154 		*valp = NULL;
155 	if (lenp != NULL)
156 		*lenp = 0;
157 	if (sshbuf_len(buf) < 4) {
158 		SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
159 		return SSH_ERR_MESSAGE_INCOMPLETE;
160 	}
161 	len = PEEK_U32(p);
162 	if (len > SSHBUF_SIZE_MAX - 4) {
163 		SSHBUF_DBG(("SSH_ERR_STRING_TOO_LARGE"));
164 		return SSH_ERR_STRING_TOO_LARGE;
165 	}
166 	if (sshbuf_len(buf) - 4 < len) {
167 		SSHBUF_DBG(("SSH_ERR_MESSAGE_INCOMPLETE"));
168 		return SSH_ERR_MESSAGE_INCOMPLETE;
169 	}
170 	if (valp != 0)
171 		*valp = p + 4;
172 	if (lenp != NULL)
173 		*lenp = len;
174 	return 0;
175 }
176 
177 int
178 sshbuf_get_cstring(struct sshbuf *buf, char **valp, size_t *lenp)
179 {
180 	size_t len;
181 	const u_char *p, *z;
182 	int r;
183 
184 	if (valp != NULL)
185 		*valp = NULL;
186 	if (lenp != NULL)
187 		*lenp = 0;
188 	if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
189 		return r;
190 	/* Allow a \0 only at the end of the string */
191 	if (len > 0 &&
192 	    (z = memchr(p , '\0', len)) != NULL && z < p + len - 1) {
193 		SSHBUF_DBG(("SSH_ERR_INVALID_FORMAT"));
194 		return SSH_ERR_INVALID_FORMAT;
195 	}
196 	if ((r = sshbuf_skip_string(buf)) != 0)
197 		return -1;
198 	if (valp != NULL) {
199 		if ((*valp = malloc(len + 1)) == NULL) {
200 			SSHBUF_DBG(("SSH_ERR_ALLOC_FAIL"));
201 			return SSH_ERR_ALLOC_FAIL;
202 		}
203 		memcpy(*valp, p, len);
204 		(*valp)[len] = '\0';
205 	}
206 	if (lenp != NULL)
207 		*lenp = (size_t)len;
208 	return 0;
209 }
210 
211 int
212 sshbuf_get_stringb(struct sshbuf *buf, struct sshbuf *v)
213 {
214 	u_int32_t len;
215 	u_char *p;
216 	int r;
217 
218 	/*
219 	 * Use sshbuf_peek_string_direct() to figure out if there is
220 	 * a complete string in 'buf' and copy the string directly
221 	 * into 'v'.
222 	 */
223 	if ((r = sshbuf_peek_string_direct(buf, NULL, NULL)) != 0 ||
224 	    (r = sshbuf_get_u32(buf, &len)) != 0 ||
225 	    (r = sshbuf_reserve(v, len, &p)) != 0 ||
226 	    (r = sshbuf_get(buf, p, len)) != 0)
227 		return r;
228 	return 0;
229 }
230 
231 int
232 sshbuf_put(struct sshbuf *buf, const void *v, size_t len)
233 {
234 	u_char *p;
235 	int r;
236 
237 	if ((r = sshbuf_reserve(buf, len, &p)) < 0)
238 		return r;
239 	memcpy(p, v, len);
240 	return 0;
241 }
242 
243 int
244 sshbuf_putb(struct sshbuf *buf, const struct sshbuf *v)
245 {
246 	return sshbuf_put(buf, sshbuf_ptr(v), sshbuf_len(v));
247 }
248 
249 int
250 sshbuf_putf(struct sshbuf *buf, const char *fmt, ...)
251 {
252 	va_list ap;
253 	int r;
254 
255 	va_start(ap, fmt);
256 	r = sshbuf_putfv(buf, fmt, ap);
257 	va_end(ap);
258 	return r;
259 }
260 
261 int
262 sshbuf_putfv(struct sshbuf *buf, const char *fmt, va_list ap)
263 {
264 	va_list ap2;
265 	int r, len;
266 	u_char *p;
267 
268 	va_copy(ap2, ap);
269 	if ((len = vsnprintf(NULL, 0, fmt, ap2)) < 0) {
270 		r = SSH_ERR_INVALID_ARGUMENT;
271 		goto out;
272 	}
273 	if (len == 0) {
274 		r = 0;
275 		goto out; /* Nothing to do */
276 	}
277 	va_end(ap2);
278 	va_copy(ap2, ap);
279 	if ((r = sshbuf_reserve(buf, (size_t)len + 1, &p)) < 0)
280 		goto out;
281 	if ((r = vsnprintf((char *)p, len + 1, fmt, ap2)) != len) {
282 		r = SSH_ERR_INTERNAL_ERROR;
283 		goto out; /* Shouldn't happen */
284 	}
285 	/* Consume terminating \0 */
286 	if ((r = sshbuf_consume_end(buf, 1)) != 0)
287 		goto out;
288 	r = 0;
289  out:
290 	va_end(ap2);
291 	return r;
292 }
293 
294 int
295 sshbuf_put_u64(struct sshbuf *buf, u_int64_t val)
296 {
297 	u_char *p;
298 	int r;
299 
300 	if ((r = sshbuf_reserve(buf, 8, &p)) < 0)
301 		return r;
302 	POKE_U64(p, val);
303 	return 0;
304 }
305 
306 int
307 sshbuf_put_u32(struct sshbuf *buf, u_int32_t val)
308 {
309 	u_char *p;
310 	int r;
311 
312 	if ((r = sshbuf_reserve(buf, 4, &p)) < 0)
313 		return r;
314 	POKE_U32(p, val);
315 	return 0;
316 }
317 
318 int
319 sshbuf_put_u16(struct sshbuf *buf, u_int16_t val)
320 {
321 	u_char *p;
322 	int r;
323 
324 	if ((r = sshbuf_reserve(buf, 2, &p)) < 0)
325 		return r;
326 	POKE_U16(p, val);
327 	return 0;
328 }
329 
330 int
331 sshbuf_put_u8(struct sshbuf *buf, u_char val)
332 {
333 	u_char *p;
334 	int r;
335 
336 	if ((r = sshbuf_reserve(buf, 1, &p)) < 0)
337 		return r;
338 	p[0] = val;
339 	return 0;
340 }
341 
342 int
343 sshbuf_put_string(struct sshbuf *buf, const void *v, size_t len)
344 {
345 	u_char *d;
346 	int r;
347 
348 	if (len > SSHBUF_SIZE_MAX - 4) {
349 		SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
350 		return SSH_ERR_NO_BUFFER_SPACE;
351 	}
352 	if ((r = sshbuf_reserve(buf, len + 4, &d)) < 0)
353 		return r;
354 	POKE_U32(d, len);
355 	memcpy(d + 4, v, len);
356 	return 0;
357 }
358 
359 int
360 sshbuf_put_cstring(struct sshbuf *buf, const char *v)
361 {
362 	return sshbuf_put_string(buf, (u_char *)v, strlen(v));
363 }
364 
365 int
366 sshbuf_put_stringb(struct sshbuf *buf, const struct sshbuf *v)
367 {
368 	return sshbuf_put_string(buf, sshbuf_ptr(v), sshbuf_len(v));
369 }
370 
371 int
372 sshbuf_froms(struct sshbuf *buf, struct sshbuf **bufp)
373 {
374 	const u_char *p;
375 	size_t len;
376 	struct sshbuf *ret;
377 	int r;
378 
379 	if (buf == NULL || bufp == NULL)
380 		return SSH_ERR_INVALID_ARGUMENT;
381 	*bufp = NULL;
382 	if ((r = sshbuf_peek_string_direct(buf, &p, &len)) != 0)
383 		return r;
384 	if ((ret = sshbuf_from(p, len)) == NULL)
385 		return SSH_ERR_ALLOC_FAIL;
386 	if ((r = sshbuf_consume(buf, len + 4)) != 0 ||  /* Shouldn't happen */
387 	    (r = sshbuf_set_parent(ret, buf)) != 0) {
388 		sshbuf_free(ret);
389 		return r;
390 	}
391 	*bufp = ret;
392 	return 0;
393 }
394 
395 int
396 sshbuf_put_bignum2_bytes(struct sshbuf *buf, const void *v, size_t len)
397 {
398 	u_char *d;
399 	const u_char *s = (const u_char *)v;
400 	int r, prepend;
401 
402 	if (len > SSHBUF_SIZE_MAX - 5) {
403 		SSHBUF_DBG(("SSH_ERR_NO_BUFFER_SPACE"));
404 		return SSH_ERR_NO_BUFFER_SPACE;
405 	}
406 	/* Skip leading zero bytes */
407 	for (; len > 0 && *s == 0; len--, s++)
408 		;
409 	/*
410 	 * If most significant bit is set then prepend a zero byte to
411 	 * avoid interpretation as a negative number.
412 	 */
413 	prepend = len > 0 && (s[0] & 0x80) != 0;
414 	if ((r = sshbuf_reserve(buf, len + 4 + prepend, &d)) < 0)
415 		return r;
416 	POKE_U32(d, len + prepend);
417 	if (prepend)
418 		d[4] = 0;
419 	memcpy(d + 4 + prepend, s, len);
420 	return 0;
421 }
422