; sshlib_transport.inc - SSH transport layer
;
; Copyright (C) 2016-2024 Jeffrey Amelynck
;
; This program is free software: you can redistribute it and/or modify
; it under the terms of the GNU General Public License as published by
; the Free Software Foundation, either version 3 of the License, or
; (at your option) any later version.
;
; This program is distributed in the hope that it will be useful,
; but WITHOUT ANY WARRANTY; without even the implied warranty of
; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
; GNU General Public License for more details.
;
; You should have received a copy of the GNU General Public License
; along with this program. If not, see <http://www.gnu.org/licenses/>.
iglobal
align 16
null_bytes: times 64 db 0
endg
align 16
proc sshlib_recv_packet_poly1305chacha20 con_ptr, flags
locals
data_length dd ? ; Total length of packet without MAC
mac_otk rb 64 ;256/8
iv rd 4
endl
DEBUGF 3, "> "
; Receive first block (Read length)
mov ebx, [con_ptr]
mov ecx, [ebx+sshlib_connection.socketnum]
mov esi, 4
lea edx, [ebx+sshlib_connection.rx_buffer]
mov edi, [flags]
mcall recv
cmp eax, 0
jle .sock_fail
sub [ssh_chan.rcv_wnd], eax ;;; FIXME
DEBUGF 1, "chunk = %u ", eax
mov ebx, [con_ptr]
cmp eax, 4
jne .proto_fail ; TODO: handle receives of 1, 2, and 3 bytes correctly
; Decrypt data length
mov ebx, [con_ptr]
lea eax, [iv]
mov dword[eax+0], 0
mov dword[eax+4], 0
mov dword[eax+8], 0
push [ebx+sshlib_connection.rx_mac_seqnr]
pop dword[eax+12]
lea ecx, [ebx+sshlib_connection.rx_crypt_ctx]
lea edx, [ebx+sshlib_connection.rx_enc_key+256/8]
lea esi, [ebx+sshlib_connection.rx_buffer]
lea edi, [data_length]
invoke chacha20.oneshot, ecx, edx, eax, 0, esi, 4, edi
mov eax, [data_length]
bswap eax
mov [data_length], eax
DEBUGF 2, "decrypted packet length=%u\n", [data_length]
cmp eax, BUFFERSIZE-4-128/8
ja .proto_fail
; Receive remaining data
lea edx, [ebx+sshlib_connection.rx_buffer+4]
mov ecx, [ebx+sshlib_connection.socketnum]
mov edi, [flags]
lea esi, [eax + 128/8] ; We already got 4 bytes but they are not counted, MAC is also not counted so add that
.recv_loop:
DEBUGF 3, "want %u bytes.. ", esi
mcall recv
cmp eax, 0
jle .sock_fail
sub [ssh_chan.rcv_wnd], eax ;;; FIXME
DEBUGF 3, "got %u bytes\n", eax
add edx, eax
sub esi, eax
jnz .recv_loop
; Calculate the OTK
mov ebx, [con_ptr]
lea eax, [ebx+sshlib_connection.rx_crypt_ctx]
lea esi, [ebx+sshlib_connection.rx_enc_key]
lea edx, [mac_otk]
lea ecx, [iv]
invoke chacha20.oneshot, eax, esi, ecx, 0, null_bytes, 64, edx
; Calculate the MAC
lea esi, [ebx+sshlib_connection.rx_mac_ctx]
lea edi, [ebx+sshlib_connection.rx_buffer]
mov ecx, [data_length]
add ecx, 4
lea edx, [mac_otk]
push ecx
invoke poly1305.oneshot, esi, edi, ecx, edx, 256/8
pop ecx
; Compare in constant time
add edi, ecx
cmpsd
lahf
mov edx, eax
cmpsd
lahf
and edx, eax
cmpsd
lahf
and edx, eax
cmpsd
lahf
and eax, edx
sahf
jne .mac_fail
; Decrypt the payload
lea eax, [ebx+sshlib_connection.rx_crypt_ctx]
lea edi, [ebx+sshlib_connection.rx_buffer+4]
invoke chacha20.update, eax, edi, [data_length], edi
; Put decrypted length in rx buffer
push [data_length]
pop dword[ebx+sshlib_connection.rx_buffer]
; Update sequence counter
add byte[ebx+sshlib_connection.rx_mac_seqnr+3], 1
adc byte[ebx+sshlib_connection.rx_mac_seqnr+2], 0
adc byte[ebx+sshlib_connection.rx_mac_seqnr+1], 0
adc byte[ebx+sshlib_connection.rx_mac_seqnr+0], 0
; Return useful data length to the caller via eax register
;;; .packet_complete:
mov eax, [ebx+sshlib_connection.rx_buffer.packet_length]
movzx ebx, [ebx+sshlib_connection.rx_buffer.padding_length]
sub eax, ebx
DEBUGF 1, "useful data length=%u\n", eax
ret
.sock_fail:
DEBUGF 3, "ssh_recv_packet failed!\n"
mov eax, SSHLIB_ERR_SOCKET
ret
.mac_fail:
DEBUGF 3, "ssh_recv_packet message authentication failed!\n"
mov eax, SSHLIB_ERR_MAC_VERIFY_FAIL
xor ebx, ebx
ret
.proto_fail:
DEBUGF 3, "ssh_recv_packet protocol failure!\n"
mov eax, SSHLIB_ERR_PROTOCOL
xor ebx, ebx
ret
endp
align 16
proc sshlib_send_packet_poly1305chacha20 con_ptr, buf, payload_size, flags
locals
packet_size dd ?
mac_otk rb 64 ;256/8
iv rd 4
endl
DEBUGF 2, "< "
; Check how many bytes we should pad
mov eax, [payload_size]
inc eax ; padding length byte
lea edx, [eax+4] ; total packet size without padding and MAC
mov [packet_size], edx
mov ecx, [con_ptr]
mov edx, eax
mov ebx, [ecx+sshlib_connection.tx_pad_size]
dec ebx
and edx, ebx
neg edx
add edx, [ecx+sshlib_connection.tx_pad_size]
add edx, [ecx+sshlib_connection.tx_pad_size]
DEBUGF 2, "padding %u bytes ", edx
add [packet_size], edx ; total packet size with padding, without MAC
; Start building the packet
; First comes the packet length, in network byte order ofcourse.
add eax, edx
DEBUGF 2, "total size: %u ", eax
bswap eax
lea edi, [ecx+sshlib_connection.tx_buffer]
stosd
; Then the padding length
mov al, dl
stosb
;;; And the actual payload bytes
mov esi, [buf]
mov ecx, [payload_size]
rep movsb
; Append the packet with #edx padding bytes.
; Since we must pad at least 8 bytes, we can always use DWORD writes.
; First do an (unaligned) write exactly following the data
dec edx
mov esi, edx
shr esi, 2 ; number dwords
mov ebx, edx
and ebx, 3
inc ebx ; number bytes in first write (1-4)
mov edx, [con_ptr]
call MBRandom
mov dword[edi], eax
add edi, ebx
; Then, do as many aligned writes as nescessary
mov ebx, [con_ptr]
@@:
call MBRandom
stosd
dec esi
jnz @r
; Encrypt data length
lea eax, [iv]
mov dword[eax+0], 0
mov dword[eax+4], 0
mov dword[eax+8], 0
push [ebx+sshlib_connection.tx_mac_seqnr]
pop dword[eax+12]
lea esi, [ebx+sshlib_connection.tx_crypt_ctx]
lea edx, [ebx+sshlib_connection.tx_enc_key+256/8]
lea edi, [ebx+sshlib_connection.tx_buffer]
invoke chacha20.oneshot, esi, edx, eax, 0, edi, 4, edi
; Calculate the OTK
lea eax, [iv]
lea edx, [ebx+sshlib_connection.tx_enc_key]
lea edi, [mac_otk]
invoke chacha20.oneshot, esi, edx, eax, 0, null_bytes, 64, edi
; Encrypt the payload
lea edi, [ebx+sshlib_connection.tx_buffer+4]
mov eax, [packet_size]
sub eax, 4
invoke chacha20.update, esi, edi, eax, edi
; Calculate the MAC
lea esi, [ebx+sshlib_connection.tx_mac_ctx]
lea edi, [ebx+sshlib_connection.tx_buffer]
lea edx, [mac_otk]
invoke poly1305.oneshot, esi, edi, [packet_size], edx, 256/8
; Write it to the send buffer
add edi, [packet_size]
movsd
movsd
movsd
movsd
; Update sequence counter
add byte[ebx+sshlib_connection.tx_mac_seqnr+3], 1
adc byte[ebx+sshlib_connection.tx_mac_seqnr+2], 0
adc byte[ebx+sshlib_connection.tx_mac_seqnr+1], 0
adc byte[ebx+sshlib_connection.tx_mac_seqnr+0], 0
; Send the packet
; mov ebx, [con_ptr]
mov ecx, [ebx+sshlib_connection.socketnum]
lea edx, [ebx+sshlib_connection.tx_buffer]
mov esi, [packet_size]
add esi, 16 ;[ebx+sshlib_connection.tx_mac_length]
mov edi, [flags]
mcall send
DEBUGF 2, "\n"
ret
endp