SSH binary packet framing, encryption, MAC, and receive reassembly. More...

#include "network_drivers/presentation/ssh/transport/ssh_packet.h"
#include "crypto/aead/aesgcm.h"
#include "crypto/aead/chachapoly.h"
#include "crypto/mac/hmac_sha256.h"
#include "crypto/mac/hmac_sha512.h"
#include "network_drivers/presentation/ssh/transport/ssh_keymat.h"
#include "server/mmgr/scratch.h"
#include "server/mmgr/secure.h"
#include <string.h>
#include <Arduino.h>

Functions
void	ssh_pkt_init (uint8_t i)
	Initialize the packet state for SSH connection slot `i`.

void	ssh_pkt_set_client (uint8_t i)
	Mark slot `i` as the SSH client role (call once, right after ssh_pkt_init).

int	ssh_pkt_send (uint8_t i, const uint8_t payload, size_t payload_len, uint8_t out, size_t *out_len, size_t out_cap)
	Build and send one SSH binary packet.

int	ssh_pkt_recv (uint8_t i, const uint8_t *data, size_t len, ssh_msg_handler_t handler)
	Receive and process one or more SSH binary packets from `data`.

int	ssh_pkt_disconnect (uint8_t i, uint32_t reason_code, uint8_t out, size_t out_len, size_t out_cap)
	Send SSH_MSG_DISCONNECT with reason `reason_code`.

Variables
SshPacketState	ssh_pkt [MAX_SSH_CONNS]
	Static packet state pool (BSS). One entry per SSH slot.

Detailed Description

SSH binary packet framing, encryption, MAC, and receive reassembly.

Definition in file ssh_packet.cpp.

Function Documentation

◆ ssh_pkt_init()

void ssh_pkt_init ( uint8_t i )

Initialize the packet state for SSH connection slot i.

Zeroes seq numbers; sets encrypted=false, kex_active=true.

Parameters

i	SSH slot index.

Definition at line 106 of file ssh_packet.cpp.

References SshPacketState::enc_in, SshPacketState::enc_out, SshPacketState::kex_active, MAX_SSH_CONNS, and ssh_pkt.

Referenced by pc_ssh_conn_accept(), and ssh_pkt_disconnect().

◆ ssh_pkt_set_client()

void ssh_pkt_set_client ( uint8_t i )

Mark slot i as the SSH client role (call once, right after ssh_pkt_init).

Flips the send/receive key direction: the client encrypts with the c2s key set and decrypts with the s2c one, the mirror of the server. Without this a slot defaults to the server role.

Definition at line 119 of file ssh_packet.cpp.

References SshPacketState::is_client, MAX_SSH_CONNS, and ssh_pkt.

◆ ssh_pkt_send()

int ssh_pkt_send	(	uint8_t	i,
		const uint8_t *	payload,
		size_t	payload_len,
		uint8_t *	out,
		size_t *	out_len,
		size_t	out_cap
	)

Build and send one SSH binary packet.

Frames payload according to RFC 4253 §6:

Adds random padding to align to 16-byte boundary.
If encrypted: encrypts with AES-256-CTR, appends HMAC-SHA2-256 MAC.
Increments seq_no_send; closes connection if threshold reached.

The serialized packet is written into out. *out_len is set to the number of bytes written. out must be at least (4 + 1 + payload_len + 16 + 32) bytes.

Parameters

i	SSH slot index.
payload	Plaintext SSH message payload.
payload_len	Length of `payload`.
out	Output buffer for the wire packet.
out_len	Set to the number of bytes written into `out`.
out_cap	Capacity of `out`.

Returns: 0 on success, -1 on overflow or sequence-number exhaustion.

Definition at line 181 of file ssh_packet.cpp.

References SshKeyMat::cipher_mode, SshPacketState::enc_out, SshPacketState::is_client, SshKeyMat::mac_mode, MAX_SSH_CONNS, pc_aes256ctr_crypt(), pc_aesgcm_iv_increment(), pc_aesgcm_seal(), PC_AESGCM_TAG_LEN, pc_chachapoly_encrypt(), PC_CHACHAPOLY_TAG_LEN, scratch_alloc(), SshPacketState::seq_no_send, SSH_CIPHER_AES256CTR, SSH_CIPHER_AES256GCM, SSH_CIPHER_CHACHA20POLY1305, ssh_keys, ssh_pkt, and SSH_SEQ_CLOSE_THRESHOLD.

Referenced by pc_ssh_conn_close_channel(), pc_ssh_conn_open_forwarded(), pc_ssh_conn_send(), and ssh_pkt_disconnect().

◆ ssh_pkt_recv()

int ssh_pkt_recv	(	uint8_t	i,
		const uint8_t *	data,
		size_t	len,
		ssh_msg_handler_t	handler
	)

Receive and process one or more SSH binary packets from data.

Appends len bytes from data to the receive buffer for slot i, then extracts complete packets. For each complete packet:

If encrypted: decrypts with AES-256-CTR, verifies HMAC-SHA2-256. Closes connection (returns -1) on MAC failure without processing payload.
Increments seq_no_recv; closes connection if threshold reached.
Calls handler(slot, msg_type, payload, payload_len) for the payload.

Parameters

i	SSH slot index.
data	Received bytes (from TCP).
len	Number of bytes in `data`.
handler	Callback invoked once per complete, verified packet.

Returns: 0 on success, -1 on MAC failure or sequence-number exhaustion (caller must close the TCP connection).

Definition at line 693 of file ssh_packet.cpp.

References SshKeyMat::cipher_mode, SshPacketState::enc_in, SshKeyMat::mac_mode, MAX_SSH_CONNS, SshPacketState::rx_buf, SshPacketState::rx_len, SSH_CIPHER_AES256GCM, SSH_CIPHER_CHACHA20POLY1305, ssh_keys, ssh_pkt, and SSH_PKT_BUF_SIZE.

Referenced by pc_ssh_conn_rx().

◆ ssh_pkt_disconnect()

int ssh_pkt_disconnect	(	uint8_t	i,
		uint32_t	reason_code,
		uint8_t *	out,
		size_t *	out_len,
		size_t	out_cap
	)

Send SSH_MSG_DISCONNECT with reason reason_code.

Sends the packet, then zeroes the packet state and key material for slot i.

Parameters

i	SSH slot index.
reason_code	One of SSH_DISCONNECT_* constants.
out	Output buffer for the wire packet.
out_len	Set to the number of bytes written.
out_cap	Capacity of `out`.