Refactor block-cipher packet-length probing to avoid unsafe state duplication - #706

diff --git a/russh/src/cipher/block.rs b/russh/src/cipher/block.rs
index dc9c02e542649ae30bd9b4df51a792a7ce32cda1..fe2debeb6258f83f9a916489638894731bf01a90 100644
--- a/russh/src/cipher/block.rs
+++ b/russh/src/cipher/block.rs
@@ -228,9 +228,50 @@ impl<T: StreamCipher> BlockStreamCipher for T {
     }
 }
 
-impl<T: StreamCipher + Clone> PacketLengthProbe for T {
+pub(crate) struct ProbeableStreamCipher<C: StreamCipher + KeyIvInit + KeySizeUser + IvSizeUser> {
+    cipher: C,
+    key: GenericArray_0_14<u8, C::KeySize>,
+    iv: GenericArray_0_14<u8, C::IvSize>,
+}
+
+impl<C: StreamCipher + KeyIvInit + KeySizeUser + IvSizeUser> KeySizeUser for ProbeableStreamCipher<C> {
+    type KeySize = C::KeySize;
+}
+
+impl<C: StreamCipher + KeyIvInit + KeySizeUser + IvSizeUser> IvSizeUser for ProbeableStreamCipher<C> {
+    type IvSize = C::IvSize;
+}
+
+impl<C: StreamCipher + KeyIvInit + KeySizeUser + IvSizeUser> KeyIvInit for ProbeableStreamCipher<C> {
+    fn new(
+        key: &GenericArray_0_14<u8, Self::KeySize>,
+        iv: &GenericArray_0_14<u8, Self::IvSize>,
+    ) -> Self {
+        Self {
+            cipher: C::new(key, iv),
+            key: key.clone(),
+            iv: iv.clone(),
+        }
+    }
+}
+
+impl<C: StreamCipher + KeyIvInit + KeySizeUser + IvSizeUser> BlockStreamCipher
+    for ProbeableStreamCipher<C>
+{
+    fn encrypt_data(&mut self, data: &mut [u8]) {
+        self.cipher.apply_keystream(data);
+    }
+
+    fn decrypt_data(&mut self, data: &mut [u8]) {
+        self.cipher.apply_keystream(data);
+    }
+}
+
+impl<C: StreamCipher + KeyIvInit + KeySizeUser + IvSizeUser> PacketLengthProbe
+    for ProbeableStreamCipher<C>
+{
     fn decrypt_packet_length_block(&self, first_block: &mut [u8; 16]) {
-        let mut cipher = self.clone();
+        let mut cipher = C::new(&self.key, &self.iv);
         cipher.apply_keystream(first_block);
     }
 }
@@ -245,7 +286,7 @@ mod tests {
     use digest::typenum::U16;
     use tokio::io::AsyncWriteExt;
 
-    use super::{BlockStreamCipher, OpeningKey, PacketLengthProbe};
+    use super::{BlockStreamCipher, OpeningKey, PacketLengthProbe, ProbeableStreamCipher};
     use crate::mac::MacAlgorithm;
     use crate::sshbuffer::SSHBuffer;
 
@@ -259,7 +300,7 @@ mod tests {
         let mut ciphertext = plaintext;
         encryptor.apply_keystream(&mut ciphertext);
 
-        let cipher = Ctr128BE::<Aes128>::new(&key.into(), &iv.into());
+        let cipher = ProbeableStreamCipher::<Ctr128BE<Aes128>>::new(&key.into(), &iv.into());
         let mut probed_block = ciphertext;
         cipher.decrypt_packet_length_block(&mut probed_block);
         assert_eq!(probed_block, plaintext);
diff --git a/russh/src/cipher/mod.rs b/russh/src/cipher/mod.rs
index 1b10055b8b165e70e6f94bab201885266150502b..1fd4e7b7e11ce394ccf9fd0e4853874e830b0e3a 100644
--- a/russh/src/cipher/mod.rs
+++ b/russh/src/cipher/mod.rs
@@ -45,7 +45,7 @@ pub(crate) mod chacha20poly1305;
 pub(crate) mod clear;
 pub(crate) mod gcm;
 
-use block::SshBlockCipher;
+use block::{ProbeableStreamCipher, SshBlockCipher};
 use chacha20poly1305::SshChacha20Poly1305Cipher;
 use clear::Clear;
 use gcm::GcmCipher;
@@ -103,9 +103,12 @@ pub const NONE: Name = Name("none");
 pub(crate) static _CLEAR: Clear = Clear {};
 #[cfg(feature = "des")]
 static _3DES_CBC: SshBlockCipher<CbcWrapper<des::TdesEde3>> = SshBlockCipher(PhantomData);
-static _AES_128_CTR: SshBlockCipher<Ctr128BE<Aes128>> = SshBlockCipher(PhantomData);
-static _AES_192_CTR: SshBlockCipher<Ctr128BE<Aes192>> = SshBlockCipher(PhantomData);
-static _AES_256_CTR: SshBlockCipher<Ctr128BE<Aes256>> = SshBlockCipher(PhantomData);
+static _AES_128_CTR: SshBlockCipher<ProbeableStreamCipher<Ctr128BE<Aes128>>> =
+    SshBlockCipher(PhantomData);
+static _AES_192_CTR: SshBlockCipher<ProbeableStreamCipher<Ctr128BE<Aes192>>> =
+    SshBlockCipher(PhantomData);
+static _AES_256_CTR: SshBlockCipher<ProbeableStreamCipher<Ctr128BE<Aes256>>> =
+    SshBlockCipher(PhantomData);
 static _AES_128_GCM: GcmCipher = GcmCipher(&ALGORITHM_AES_128_GCM);
 static _AES_256_GCM: GcmCipher = GcmCipher(&ALGORITHM_AES_256_GCM);
 static _AES_128_CBC: SshBlockCipher<CbcWrapper<Aes128>> = SshBlockCipher(PhantomData);