The whole reason SSL and SSH were defined was precisely to prevent passive and active attacks from whatever lies between the two end points. In particular, your routers R1 and R2:
- cannot learn the data which is transfered from A to B (confidentiality);
- cannot alter the transfered data (integrity);
- cannot impersonate either A or B (authenticity).
In the specific case of inserting new data within the tunnel, let's see how it is avoided in the case of SSL (SSH is similar): in SSL/TLS, data is sent as successive records. Each record contains up to 16 kB of data. Once the initial handshake has taken place (this is where the certificates and asymmetric cryptography take place), both end points share a session key K (called "master key" in SSL terminology), from which they compute a few keys which are used to encrypt and authenticate record. In particular, for each record is computed a message authentication code, which can be viewed as a kind of keyed hash; the sender computes the MAC, and the receiver recomputes it. The cryptographic property of the MAC is that, without knowledge of the MAC key, it is not feasible to forge a pair (d,m) such that m is the MAC for data d.
The MAC is computed over the concatenation of the record data and, crucially, a record sequence number. Due to the MAC, attackers cannot insert extra records, replay old records, remove records or alter the order of records, because this would require recomputing the MAC for the new data or sequence number -- and, without the key, that's a no go.
Note that your routers R1 and R2 can still modify the data or block it; alterations are reliably detected by the receiver, but if the attacker wants to simply cut the wires, well, he can. Nothing in SSL (or SSH) tries to recover from alterations.