Jakub Jelen 08386d4787 CVE-2023-1667:kex: Add support for sending first_kex_packet_follows flag ...

This is not completely straightforward as it requires us to do some state
shuffling.

We introduce internal flag that can turn this on in client side, so far for
testing only as we do not want to universally enable this. We also repurpose the
server flag indicating the guess was wrong also for the client to make desired
decisions.

If we found out our guess was wrong, we need to hope the server was able to
figure out this much, we need to revert the DH FSM state, drop the callbacks
from the "wrong" key exchange method and initiate the right one.

The server side is already tested by the pkd_hello_i1, which is executing tests
against dropbrear clients, which is using this flag by default out of the box.

Tested manually also with the pkd_hello --rekey to make sure the server is able
to handle the rekeying with all key exchange methods.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Norbert Pocs <npocs@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>

2023-05-04 11:51:17 +02:00

..

libssh

CVE-2023-1667:kex: Add support for sending first_kex_packet_follows flag

2023-05-04 11:51:17 +02:00

CMakeLists.txt

cmake: Do not use CMAKE_(SOURCE|BINARY)_DIR

2015-06-24 18:17:05 +02:00