puressh 0.2.1

//! SSH cipher suite adapters over [`purecrypto::cipher`].
//!
//! Three families of suites are surfaced:
//!
//! - **`aes*-ctr`** (RFC 4344) — paired with a separate HMAC, possibly in EtM mode.
//! - **`aes*-gcm@openssh.com`** (RFC 5647) — AEAD with implicit 12-byte nonce.
//! - **`aes*-cbc`, `3des-cbc`** (RFC 4253) — legacy, never offered unless
//!   configured; paired with a separate HMAC like CTR.
//! - **`chacha20-poly1305@openssh.com`** — AEAD with two ChaCha20 keys (one
//!   for the length field, one for the payload) and a Poly1305 tag.

mod cbc;
mod chachapoly;
mod ctr;
mod gcm;

use cbc::CbcState;
use chachapoly::ChaChaPoly;
use ctr::AesCtr;
use gcm::GcmState;

use crate::error::{Error, Result};

/// SSH-side identifier and key/iv/block geometry for a cipher suite.
#[derive(Debug, Clone, Copy)]
#[non_exhaustive]
pub struct CipherSpec {
    /// On-the-wire SSH name (e.g. `"aes256-ctr"`).
    pub name: &'static str,
    /// Key length in bytes.
    pub key_len: usize,
    /// IV (or nonce) length in bytes — 16 for CTR, 12 for GCM, 8 for ChaCha20.
    pub iv_len: usize,
    /// Block size in bytes (for length-field rounding); 16 for AES, 8 for ChaCha20 stream.
    pub block_size: usize,
    /// Whether this suite is AEAD (integrity built in — no separate MAC).
    pub aead: bool,
    /// AEAD tag length in bytes (0 if non-AEAD).
    pub tag_len: usize,
}

/// Catalogue of suites this build supports.
pub const ALL: &[CipherSpec] = &[
    CipherSpec {
        name: "chacha20-poly1305@openssh.com",
        key_len: 64,
        iv_len: 0,
        block_size: 8,
        aead: true,
        tag_len: 16,
    },
    CipherSpec {
        name: "aes256-gcm@openssh.com",
        key_len: 32,
        iv_len: 12,
        block_size: 16,
        aead: true,
        tag_len: 16,
    },
    CipherSpec {
        name: "aes128-gcm@openssh.com",
        key_len: 16,
        iv_len: 12,
        block_size: 16,
        aead: true,
        tag_len: 16,
    },
    CipherSpec {
        name: "aes256-ctr",
        key_len: 32,
        iv_len: 16,
        block_size: 16,
        aead: false,
        tag_len: 0,
    },
    CipherSpec {
        name: "aes192-ctr",
        key_len: 24,
        iv_len: 16,
        block_size: 16,
        aead: false,
        tag_len: 0,
    },
    CipherSpec {
        name: "aes128-ctr",
        key_len: 16,
        iv_len: 16,
        block_size: 16,
        aead: false,
        tag_len: 0,
    },
    CipherSpec {
        name: "aes128-cbc",
        key_len: 16,
        iv_len: 16,
        block_size: 16,
        aead: false,
        tag_len: 0,
    },
    CipherSpec {
        name: "aes192-cbc",
        key_len: 24,
        iv_len: 16,
        block_size: 16,
        aead: false,
        tag_len: 0,
    },
    CipherSpec {
        name: "aes256-cbc",
        key_len: 32,
        iv_len: 16,
        block_size: 16,
        aead: false,
        tag_len: 0,
    },
    CipherSpec {
        name: "3des-cbc",
        key_len: 24,
        iv_len: 8,
        block_size: 8,
        aead: false,
        tag_len: 0,
    },
];

/// Look up a [`CipherSpec`] by SSH name.
pub fn by_name(name: &str) -> Option<&'static CipherSpec> {
    ALL.iter().find(|c| c.name == name)
}

/// Direction-agnostic SSH cipher state.
///
/// Each suite exposes only the operations the packet codec actually drives:
///
/// - CTR ciphers are stream ciphers, so the codec uses [`SshCipher::stream`]
///   for both encrypt and decrypt and pairs it with a separate MAC.
/// - AES-GCM is AEAD; the packet length is transmitted in cleartext and bound
///   to the tag as AAD. The codec drives [`SshCipher::aead_seal_len_aad`] /
///   [`SshCipher::aead_open_len_aad`].
/// - `chacha20-poly1305@openssh.com` encrypts the length field separately with
///   a second ChaCha20 key. The codec drives [`SshCipher::cp_xor_length`] for
///   the length field, [`SshCipher::cp_tag`] / [`SshCipher::cp_verify_tag`] to
///   produce or check the Poly1305 tag, and [`SshCipher::cp_xor_payload`] to
///   apply the payload keystream once the tag has been verified.
#[non_exhaustive]
pub enum SshCipher {
    /// `aes128-ctr` / `aes192-ctr` / `aes256-ctr`.
    Ctr(AesCtr),
    /// `aes128-gcm@openssh.com` / `aes256-gcm@openssh.com`.
    Gcm(GcmState),
    /// `aes*-cbc` / `3des-cbc` (legacy, configured only).
    Cbc(CbcState),
    /// `chacha20-poly1305@openssh.com`.
    ChaChaPoly(ChaChaPoly),
}

impl SshCipher {
    /// Constructs a cipher state from its SSH name, key, and IV. The lengths
    /// of `key` and `iv` must match the corresponding [`CipherSpec`].
    pub fn new(name: &str, key: &[u8], iv: &[u8]) -> Result<Self> {
        match name {
            "aes128-ctr" => Ok(SshCipher::Ctr(AesCtr::new_128(key, iv)?)),
            "aes192-ctr" => Ok(SshCipher::Ctr(AesCtr::new_192(key, iv)?)),
            "aes256-ctr" => Ok(SshCipher::Ctr(AesCtr::new_256(key, iv)?)),
            "aes128-gcm@openssh.com" => Ok(SshCipher::Gcm(GcmState::new_128(key, iv)?)),
            "aes256-gcm@openssh.com" => Ok(SshCipher::Gcm(GcmState::new_256(key, iv)?)),
            "chacha20-poly1305@openssh.com" => Ok(SshCipher::ChaChaPoly(ChaChaPoly::new(key)?)),
            "aes128-cbc" | "aes192-cbc" | "aes256-cbc" | "3des-cbc" => {
                Ok(SshCipher::Cbc(CbcState::new(name, key, iv)?))
            }
            _ => Err(Error::Unsupported("cipher")),
        }
    }

    /// Whether this suite is an AEAD (no separate MAC).
    pub fn is_aead(&self) -> bool {
        !matches!(self, SshCipher::Ctr(_) | SshCipher::Cbc(_))
    }

    /// The block size the packet length and padding are aligned to, for the
    /// non-AEAD suites (8 for 3DES, 16 otherwise).
    pub fn block_size(&self) -> usize {
        match self {
            SshCipher::Cbc(c) => c.block_size(),
            _ => 16,
        }
    }

    /// Encrypt whole blocks in place (a non-AEAD suite: CTR or CBC).
    ///
    /// # Errors
    /// [`Error::Unsupported`] on an AEAD suite; [`Error::Protocol`] if a CBC
    /// input is not block-aligned.
    pub fn encrypt_blocks(&mut self, buf: &mut [u8]) -> Result<()> {
        match self {
            SshCipher::Cbc(c) => c.encrypt(buf),
            _ => self.stream(buf),
        }
    }

    /// Decrypt whole blocks in place (a non-AEAD suite: CTR or CBC).
    ///
    /// # Errors
    /// As [`Self::encrypt_blocks`].
    pub fn decrypt_blocks(&mut self, buf: &mut [u8]) -> Result<()> {
        match self {
            SshCipher::Cbc(c) => c.decrypt(buf),
            _ => self.stream(buf),
        }
    }

    /// Whether this suite encrypts the binary-packet length field on the wire.
    /// AES-GCM transmits the length in cleartext (as AAD); the others encrypt it.
    pub fn encrypts_length(&self) -> bool {
        !matches!(self, SshCipher::Gcm(_))
    }

    /// Streaming encrypt/decrypt for non-AEAD CTR ciphers. XORs the keystream
    /// into `buf` in place across arbitrary call chunks.
    ///
    /// # Errors
    /// Returns [`Error::Unsupported`] when called on an AEAD suite.
    pub fn stream(&mut self, buf: &mut [u8]) -> Result<()> {
        match self {
            SshCipher::Ctr(c) => {
                c.apply_keystream(buf);
                Ok(())
            }
            _ => Err(Error::Unsupported("stream op on AEAD cipher")),
        }
    }

    /// AES-GCM seal: encrypts `payload` in place with the 4-byte unencrypted
    /// length field bound as AAD, and returns the 16-byte tag. The internal
    /// invocation counter advances on success.
    ///
    /// # Errors
    /// Returns [`Error::Unsupported`] when called on a non-GCM suite.
    pub fn aead_seal_len_aad(&mut self, length: &[u8], payload: &mut [u8]) -> Result<[u8; 16]> {
        match self {
            SshCipher::Gcm(g) => g.seal(length, payload),
            _ => Err(Error::Unsupported("GCM seal on non-GCM cipher")),
        }
    }

    /// AES-GCM open: verifies `tag` against `length || ciphertext` and
    /// decrypts `payload` in place on success. On tag mismatch the buffer is
    /// left as ciphertext and the invocation counter is not advanced.
    ///
    /// # Errors
    /// - [`Error::BadTag`] if the tag does not match.
    /// - [`Error::Unsupported`] when called on a non-GCM suite.
    pub fn aead_open_len_aad(
        &mut self,
        length: &[u8],
        payload: &mut [u8],
        tag: &[u8],
    ) -> Result<()> {
        match self {
            SshCipher::Gcm(g) => g.open(length, payload, tag),
            _ => Err(Error::Unsupported("GCM open on non-GCM cipher")),
        }
    }

    /// chacha20-poly1305: XOR the 4-byte length-field keystream into `buf`.
    /// Symmetric — works for both encrypt and decrypt.
    pub fn cp_xor_length(&self, seq: u64, buf: &mut [u8]) -> Result<()> {
        match self {
            SshCipher::ChaChaPoly(c) => {
                c.xor_length(seq, buf);
                Ok(())
            }
            _ => Err(Error::Unsupported("chacha20-poly1305 op on other cipher")),
        }
    }

    /// chacha20-poly1305: XOR the payload keystream into `buf`. Counter starts
    /// at 1; counter 0 is consumed by the Poly1305 OTK derivation.
    pub fn cp_xor_payload(&self, seq: u64, buf: &mut [u8]) -> Result<()> {
        match self {
            SshCipher::ChaChaPoly(c) => {
                c.xor_payload(seq, buf);
                Ok(())
            }
            _ => Err(Error::Unsupported("chacha20-poly1305 op on other cipher")),
        }
    }

    /// chacha20-poly1305: compute the Poly1305 tag over
    /// `encrypted_length || encrypted_payload`.
    pub fn cp_tag(&self, seq: u64, enc_len: &[u8], enc_payload: &[u8]) -> Result<[u8; 16]> {
        match self {
            SshCipher::ChaChaPoly(c) => Ok(c.tag(seq, enc_len, enc_payload)),
            _ => Err(Error::Unsupported("chacha20-poly1305 op on other cipher")),
        }
    }

    /// chacha20-poly1305: verify the Poly1305 tag in constant time.
    pub fn cp_verify_tag(
        &self,
        seq: u64,
        enc_len: &[u8],
        enc_payload: &[u8],
        tag: &[u8],
    ) -> Result<()> {
        match self {
            SshCipher::ChaChaPoly(c) => c.verify_tag(seq, enc_len, enc_payload, tag),
            _ => Err(Error::Unsupported("chacha20-poly1305 op on other cipher")),
        }
    }
}

/// Construct a cipher state for the named SSH suite. Returns `None` for
/// unknown names; lengths of `key` and `iv` are validated by the underlying
/// adapter.
pub fn cipher_by_name(name: &str, key: &[u8], iv: &[u8]) -> Option<Result<SshCipher>> {
    by_name(name).map(|_| SshCipher::new(name, key, iv))
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn factory_dispatches_known_names() {
        for spec in ALL {
            let key = vec![0u8; spec.key_len];
            let iv = vec![0u8; spec.iv_len];
            let r = cipher_by_name(spec.name, &key, &iv).expect("known");
            r.unwrap();
        }
    }

    #[test]
    fn factory_rejects_unknown() {
        assert!(cipher_by_name("nope", &[], &[]).is_none());
    }

    #[test]
    fn ctr_roundtrip_via_trait() {
        let key = [0x42u8; 16];
        let iv = [0x10u8; 16];
        let mut enc = SshCipher::new("aes128-ctr", &key, &iv).unwrap();
        let mut dec = SshCipher::new("aes128-ctr", &key, &iv).unwrap();
        let plain = b"hello ssh world!".to_vec();
        let mut buf = plain.clone();
        enc.stream(&mut buf).unwrap();
        assert_ne!(buf, plain);
        dec.stream(&mut buf).unwrap();
        assert_eq!(buf, plain);
    }

    #[test]
    fn gcm_roundtrip_via_trait() {
        let key = [0x01u8; 16];
        let iv = [0x02u8; 12];
        let mut enc = SshCipher::new("aes128-gcm@openssh.com", &key, &iv).unwrap();
        let mut dec = SshCipher::new("aes128-gcm@openssh.com", &key, &iv).unwrap();
        let aad = [0u8, 0, 0, 16];
        let plain = [0xabu8; 16];
        let mut buf = plain;
        let tag = enc.aead_seal_len_aad(&aad, &mut buf).unwrap();
        dec.aead_open_len_aad(&aad, &mut buf, &tag).unwrap();
        assert_eq!(buf, plain);
    }

    #[test]
    fn chachapoly_roundtrip_via_trait() {
        let mut key = [0u8; 64];
        for (i, b) in key.iter_mut().enumerate() {
            *b = i as u8;
        }
        let enc = SshCipher::new("chacha20-poly1305@openssh.com", &key, &[]).unwrap();
        let dec = SshCipher::new("chacha20-poly1305@openssh.com", &key, &[]).unwrap();

        let seq = 42u64;
        let mut len_buf = [0u8, 0, 0, 16];
        let plain_len = len_buf;
        enc.cp_xor_length(seq, &mut len_buf).unwrap();
        assert_ne!(len_buf, plain_len);

        let mut payload = [0xa5u8; 16];
        let plain_payload = payload;
        enc.cp_xor_payload(seq, &mut payload).unwrap();
        let tag = enc.cp_tag(seq, &len_buf, &payload).unwrap();

        dec.cp_verify_tag(seq, &len_buf, &payload, &tag).unwrap();
        dec.cp_xor_payload(seq, &mut payload).unwrap();
        assert_eq!(payload, plain_payload);
        dec.cp_xor_length(seq, &mut len_buf).unwrap();
        assert_eq!(len_buf, plain_len);
    }

    #[test]
    fn cross_kind_ops_return_unsupported() {
        let mut g = SshCipher::new("aes128-gcm@openssh.com", &[0u8; 16], &[0u8; 12]).unwrap();
        assert!(matches!(g.stream(&mut []), Err(Error::Unsupported(_))));
        let mut c = SshCipher::new("aes128-ctr", &[0u8; 16], &[0u8; 16]).unwrap();
        assert!(matches!(
            c.aead_seal_len_aad(&[], &mut []),
            Err(Error::Unsupported(_))
        ));
    }
}