ssh_packet.cpp File Reference

SSH binary packet framing, encryption, MAC, and receive reassembly. More...

#include "network_drivers/presentation/ssh/transport/ssh_packet.h"
#include "network_drivers/presentation/ssh/crypto/ssh_aesgcm.h"
#include "network_drivers/presentation/ssh/crypto/ssh_chachapoly.h"
#include "network_drivers/presentation/ssh/crypto/ssh_hmac_sha256.h"
#include "network_drivers/presentation/ssh/crypto/ssh_hmac_sha512.h"
#include "network_drivers/presentation/ssh/transport/ssh_keymat.h"
#include "network_drivers/session/scratch.h"
#include <string.h>
#include <Arduino.h>

Go to the source code of this file.

Functions
void	ssh_pkt_init (uint8_t i)
	Initialize the packet state for SSH connection slot i.
int	ssh_pkt_send (uint8_t i, const uint8_t *payload, size_t payload_len, uint8_t *out, size_t *out_len, size_t out_cap)
	Build and send one SSH binary packet.
int	ssh_pkt_recv (uint8_t i, const uint8_t *data, size_t len, ssh_msg_handler_t handler)
	Receive and process one or more SSH binary packets from data.
int	ssh_pkt_disconnect (uint8_t i, uint32_t reason_code, uint8_t *out, size_t *out_len, size_t out_cap)
	Send SSH_MSG_DISCONNECT with reason reason_code.

Variables
SshPacketState	ssh_pkt [MAX_SSH_CONNS]
	Static packet state pool (BSS). One entry per SSH slot.

Detailed Description

SSH binary packet framing, encryption, MAC, and receive reassembly.

Definition in file ssh_packet.cpp.

Function Documentation

ssh_pkt_init()

void ssh_pkt_init

(

uint8_t

i

)

Initialize the packet state for SSH connection slot i.

Zeroes seq numbers; sets encrypted=false, kex_active=true.

Parameters

i	SSH slot index.

Definition at line 101 of file ssh_packet.cpp.

References SshPacketState::enc_in, SshPacketState::enc_out, SshPacketState::kex_active, MAX_SSH_CONNS, and ssh_pkt.

Referenced by ssh_conn_accept(), and ssh_pkt_disconnect().

ssh_pkt_send()

int ssh_pkt_send	(	uint8_t	i,
		const uint8_t *	payload,
		size_t	payload_len,
		uint8_t *	out,
		size_t *	out_len,
		size_t	out_cap
	)

Build and send one SSH binary packet.

Frames payload according to RFC 4253 §6:

• Adds random padding to align to 16-byte boundary.
• If encrypted: encrypts with AES-256-CTR, appends HMAC-SHA2-256 MAC.
• Increments seq_no_send; closes connection if threshold reached.

The serialized packet is written into out. *out_len is set to the number of bytes written. out must be at least (4 + 1 + payload_len + 16 + 32) bytes.

Parameters

i	SSH slot index.
payload	Plaintext SSH message payload.
payload_len	Length of payload.
out	Output buffer for the wire packet.
out_len	Set to the number of bytes written into out.
out_cap	Capacity of out.

Returns

0 on success, -1 on overflow or sequence-number exhaustion.

Definition at line 116 of file ssh_packet.cpp.

References SshKeyMat::chacha_key_s2c, SshKeyMat::cipher_mode, SshPacketState::enc_out, SshKeyMat::gcm_s2c, SshKeyMat::mac_key_s2c, SshKeyMat::mac_mode, MAX_SSH_CONNS, SshKeyMat::s2c_ctx, scratch_alloc(), SshPacketState::seq_no_send, ssh_aes256ctr_crypt(), ssh_aesgcm_seal(), ssh_chachapoly_encrypt(), SSH_CHACHAPOLY_TAG_LEN, SSH_CIPHER_AES256CTR, SSH_CIPHER_AES256GCM, SSH_CIPHER_CHACHA20POLY1305, ssh_keys, ssh_pkt, and SSH_SEQ_CLOSE_THRESHOLD.

Referenced by ssh_conn_close_channel(), ssh_conn_open_forwarded(), ssh_conn_send(), and ssh_pkt_disconnect().

ssh_pkt_recv()

int ssh_pkt_recv	(	uint8_t	i,
		const uint8_t *	data,
		size_t	len,
		ssh_msg_handler_t	handler
	)

Receive and process one or more SSH binary packets from data.

Appends len bytes from data to the receive buffer for slot i, then extracts complete packets. For each complete packet:

• If encrypted: decrypts with AES-256-CTR, verifies HMAC-SHA2-256. Closes connection (returns -1) on MAC failure without processing payload.
• Increments seq_no_recv; closes connection if threshold reached.
• Calls handler(slot, msg_type, payload, payload_len) for the payload.

Parameters

i	SSH slot index.
data	Received bytes (from TCP).
len	Number of bytes in data.
handler	Callback invoked once per complete, verified packet.

Returns

0 on success, -1 on MAC failure or sequence-number exhaustion (caller must close the TCP connection).

Definition at line 233 of file ssh_packet.cpp.

References SshKeyMat::c2s_ctx, SshKeyMat::chacha_key_c2s, SshKeyMat::cipher_mode, SshAesCtrCtx::counter, SshPacketState::enc_in, SshKeyMat::gcm_c2s, SshAesCtrCtx::keystream, SshKeyMat::mac_key_c2s, SshKeyMat::mac_mode, MAX_SSH_CONNS, SshAesCtrCtx::pos, SshPacketState::rx_buf, SshPacketState::rx_len, scratch_alloc(), SshPacketState::seq_no_recv, ssh_aes256ctr_crypt(), ssh_aesgcm_open(), ssh_chachapoly_decrypt(), ssh_chachapoly_get_length(), SSH_CHACHAPOLY_TAG_LEN, SSH_CIPHER_AES256GCM, SSH_CIPHER_CHACHA20POLY1305, ssh_keys, ssh_pkt, SSH_PKT_BUF_SIZE, and SSH_SEQ_CLOSE_THRESHOLD.

Referenced by ssh_conn_rx().

ssh_pkt_disconnect()

int ssh_pkt_disconnect	(	uint8_t	i,
		uint32_t	reason_code,
		uint8_t *	out,
		size_t *	out_len,
		size_t	out_cap
	)

Send SSH_MSG_DISCONNECT with reason reason_code.

Sends the packet, then zeroes the packet state and key material for slot i.

Parameters

i	SSH slot index.
reason_code	One of SSH_DISCONNECT_* constants.
out	Output buffer for the wire packet.
out_len	Set to the number of bytes written.
out_cap	Capacity of out.

Returns

0 on success, -1 on error.

Definition at line 584 of file ssh_packet.cpp.

References MAX_SSH_CONNS, SSH_MSG_DISCONNECT, ssh_pkt_init(), and ssh_pkt_send().

Variable Documentation

ssh_pkt

SshPacketState ssh_pkt[MAX_SSH_CONNS]

Static packet state pool (BSS). One entry per SSH slot.

Definition at line 32 of file ssh_packet.cpp.

Referenced by ssh_conn_poll(), ssh_newkeys_complete(), ssh_newkeys_sent(), ssh_pkt_init(), ssh_pkt_recv(), ssh_pkt_send(), ssh_rekey_needed(), and ssh_server_dispatch().