internal: reject inbound packets that are not block aligned

- DoReceive() validates the peeked packet_length in
  PROCESS_PACKET_LENGTH: UINT32_SZ plus curSz for non-AEAD, curSz
  alone for AEAD, against peerBlockSz floored at MIN_BLOCK_SZ. A
  non-zero remainder sets ssh->error to WS_BUFFER_E and returns
  WS_FATAL_ERROR.
- BuildMacTestPacketPrefix() in unit.c takes padLen from the caller
  and pads to a block-aligned total; test_DoReceive_VerifyMacFailure,
  test_DoReceive_AeadTagFailure, and
  test_DoReceive_RejectsShortPadding follow.
- BuildPacket() in regress.c pads to 16.
- test_DoReceive_RejectsMisalignedPacket,
  test_DoReceive_RejectsMisalignedCtr, and
  test_DoReceive_RejectsMisalignedAead cover the cleartext, AES-CTR,
  and AES-GCM paths.

Issue: F-8834

Author: yosuke-wolfssl

src/internal.c

@@ -12810,10 +12810,12 @@ int DoReceive(WOLFSSH* ssh)
     int ret = WS_SUCCESS;
     int verifyResult;
     word32 readSz;
+    word32 alignSz;
     byte peerBlockSz = ssh->peerBlockSz;
     byte peerMacSz = ssh->peerMacSz;
     byte aeadMode = ssh->peerAeadMode;
     byte bufferConsumed = 0;
+    byte alignBlockSz;
 
     switch (ssh->processReplyState) {
         case PROCESS_INIT:
@@ -12852,6 +12854,21 @@ int DoReceive(WOLFSSH* ssh)
                 ssh->error = WS_OVERFLOW_E;
                 return WS_FATAL_ERROR;
             }
+
+            /* RFC 4253 section 6 aligns packet_length through the padding
+             * on the block size, or 8, whichever is larger. Under AES-GCM
+             * the length is AAD, so RFC 5647 section 7.2 aligns the body. */
+            alignBlockSz = peerBlockSz < MIN_BLOCK_SZ ?
+                    MIN_BLOCK_SZ : peerBlockSz;
+            alignSz = aeadMode ? ssh->curSz : UINT32_SZ + ssh->curSz;
+            if (alignSz % alignBlockSz != 0) {
+                WLOG(WS_LOG_DEBUG,
+                        "Packet not block aligned: aligned size = %u, "
+                        "block = %u, aead = %u",
+                        alignSz, (word32)alignBlockSz, (word32)aeadMode);
+                ssh->error = WS_BUFFER_E;
+                return WS_FATAL_ERROR;
+            }
             ssh->processReplyState = PROCESS_PACKET_FINISH;
             FALL_THROUGH;
 

tests/regress.c

@@ -107,11 +107,10 @@ static HandshakeInfo* AllocHandshake(WOLFSSH* ssh)
 }
 
 /* Build a minimal SSH binary packet carrying only a message ID.
- * Layout: uint32 packetLen, byte padLen, payload[msgId], pad[padLen].
- * Choose padLen so total is 8-byte aligned for the clear transport case. */
+ * Layout: uint32 packetLen, byte padLen, payload[msgId], pad[padLen]. */
 static word32 BuildPacket(byte msgId, byte* out, word32 outSz)
 {
-    byte padLen = 6; /* 1 (msgId) +1 (padLen) +6 = 8 */
+    byte padLen = 10; /* 4 (len) +1 (padLen) +1 (msgId) +10 = 16 */
     word32 packetLen = 1 + 1 + padLen; /* payload + padLen field + pad */
     word32 need = 4 + packetLen;