Fix native ChaCha nonce corruption during nested writes

lib/protocol/crypto.js

@@ -194,6 +194,8 @@ class ChaChaPolyCipherNative {
     if (this._dead)
       return;
 
+    // Isolate nonce from synchronous nested forwardOut encryption.
+    const POLY1305_OUT_COMPUTE = Buffer.alloc(16);
     // Generate Poly1305 key
     POLY1305_OUT_COMPUTE[0] = 0; // Set counter to 0 (little endian)
     writeUInt32BE(POLY1305_OUT_COMPUTE, this.outSeqno, 12);

test/test-protocol-chacha-reentrancy.js

@@ -0,0 +1,77 @@
+'use strict';
+
+const assert = require('assert');
+const {
+  CIPHER_INFO,
+  createCipher,
+  createDecipher,
+  init: cryptoInit,
+} = require('../lib/protocol/crypto.js');
+
+(async () => {
+  await cryptoInit;
+  const cipherInfo = CIPHER_INFO['chacha20-poly1305@openssh.com'];
+  const key = Buffer.alloc(64, 0x42);
+  const payload = Buffer.concat([
+    Buffer.from([5, 0, 0, 0, 12]),
+    Buffer.from('ssh-userauth'),
+  ]);
+
+  for (const nested of [false, true]) {
+    for (const seqno of [0, 3, 0xFFFFFFFF]) {
+      const chunks = [];
+      const received = [];
+      const outer = createCipher({
+        outbound: {
+          cipherInfo,
+          cipherKey: Buffer.alloc(64, 0x23),
+          seqno: 9,
+          forceNative: true,
+          onWrite() {},
+        },
+      });
+      const inner = createCipher({
+        outbound: {
+          cipherInfo,
+          cipherKey: key,
+          seqno,
+          forceNative: true,
+          onWrite(data) {
+            chunks.push(Buffer.from(data));
+            if (nested) {
+              const packet = outer.allocPacket(1);
+              packet[5] = 2;
+              outer.encrypt(packet);
+            }
+          },
+        },
+      });
+      const decipher = createDecipher({
+        inbound: {
+          decipherInfo: cipherInfo,
+          decipherKey: key,
+          seqno,
+          forceNative: true,
+          onPayload(data) {
+            received.push(Buffer.from(data));
+          },
+        },
+      });
+
+      const packet = inner.allocPacket(payload.length);
+      payload.copy(packet, 5);
+      inner.encrypt(packet);
+      const wire = Buffer.concat(chunks);
+      decipher.decrypt(wire, 0, wire.length);
+      assert.deepStrictEqual(received, [payload],
+                             `nested=${nested}, seqno=${seqno}`);
+      inner.free();
+      outer.free();
+      decipher.free();
+    }
+  }
+  console.log('Native ChaCha nested-write regression passed (6 cases)');
+})().catch((err) => {
+  console.error(err);
+  process.exitCode = 1;
+});