internal: skip guessed GEX requests without GEX

With WOLFSSH_NO_DH_GEX_SHA256 a guessed KEXDH_GEX_REQUEST was answered
with UNIMPLEMENTED and left the skip armed, so the server then dropped
the real KEXDH_INIT and stalled. DoPacket() now dispatches the message
in every build, and a stub DoKexDhGexRequest() skips only a guess.

- tests: a guessed GEX request through DoReceive is skipped silently
- tests: the GEX request skip case runs without GEX support

Author: ejohnstown

src/internal.c

@@ -9408,6 +9408,26 @@ static int DoNewKeys(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
 }
 
 
+#ifdef WOLFSSH_NO_DH_GEX_SHA256
+/* Without GEX, a KEXDH_GEX_REQUEST is only the guessed packet of a client
+ * that listed GEX first; skip that one and refuse any other. */
+static int DoKexDhGexRequest(WOLFSSH* ssh,
+                             byte* buf, word32 len, word32* idx)
+{
+    if (ssh == NULL || ssh->handshake == NULL || buf == NULL || len == 0 ||
+            idx == NULL)
+        return WS_BAD_ARGUMENT;
+
+    if (SkipGuessedKexMsg(ssh, "client's KEXDH_GEX_REQUEST message",
+            len, idx))
+        return WS_SUCCESS;
+
+    WLOG(WS_LOG_DEBUG, "KEXDH_GEX_REQUEST without GEX support");
+    return WS_MSGID_NOT_ALLOWED_E;
+}
+#endif /* WOLFSSH_NO_DH_GEX_SHA256 */
+
+
 #ifndef WOLFSSH_NO_DH_GEX_SHA256
 static int DoKexDhGexRequest(WOLFSSH* ssh,
                              byte* buf, word32 len, word32* idx)
@@ -14194,9 +14214,7 @@ INLINE static int MsgIdKnown(byte msg)
         case MSGID_NEWKEYS:
         case MSGID_KEXDH_INIT:
         case MSGID_KEXDH_REPLY:
-#ifndef WOLFSSH_NO_DH_GEX_SHA256
         case MSGID_KEXDH_GEX_REQUEST:
-#endif
         case MSGID_KEXDH_GEX_INIT:
         case MSGID_KEXDH_GEX_REPLY:
         case MSGID_SERVICE_REQUEST:
@@ -14413,12 +14431,10 @@ static int DoPacket(WOLFSSH* ssh, byte* bufferConsumed)
             }
             break;
 
-#ifndef WOLFSSH_NO_DH_GEX_SHA256
         case MSGID_KEXDH_GEX_REQUEST:
             WLOG(WS_LOG_DEBUG, "Decoding MSGID_KEXDH_GEX_REQUEST");
             ret = DoKexDhGexRequest(ssh, buf + idx, payloadSz, &payloadIdx);
             break;
-#endif
 
         case MSGID_KEXDH_GEX_INIT:
             WLOG(WS_LOG_DEBUG, "Decoding MSGID_KEXDH_GEX_INIT");
@@ -26517,6 +26533,12 @@ int wolfSSH_TestDoKexDhReply(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
     return DoKexDhReply(ssh, buf, len, idx);
 }
 
+int wolfSSH_TestDoKexDhGexRequest(WOLFSSH* ssh, byte* buf, word32 len,
+        word32* idx)
+{
+    return DoKexDhGexRequest(ssh, buf, len, idx);
+}
+
 int wolfSSH_TestChannelPutData(WOLFSSH_CHANNEL* channel, byte* data,
         word32 dataSz)
 {
@@ -26703,12 +26725,6 @@ int wolfSSH_TestSendKexDhGexRequest(WOLFSSH* ssh)
     return SendKexDhGexRequest(ssh);
 }
 
-int wolfSSH_TestDoKexDhGexRequest(WOLFSSH* ssh, byte* buf, word32 len,
-        word32* idx)
-{
-    return DoKexDhGexRequest(ssh, buf, len, idx);
-}
-
 int wolfSSH_TestDoKexDhGexGroup(WOLFSSH* ssh, byte* buf, word32 len,
         word32* idx)
 {

tests/regress.c

@@ -17780,12 +17780,49 @@ static void RunFirstPacketFollowsCrossBoundaryCase(FirstPacketFollowsSkipFn fn,
 }
 #endif /* WOLFSSH_NO_DH_GEX_SHA256 && NO_WOLFSSH_SERVER */
 
+#ifndef NO_WOLFSSH_SERVER
+/* A client that lists GEX first may guess a KEXDH_GEX_REQUEST. DoReceive must
+ * discard it, with GEX compiled out too, rather than answer UNIMPLEMENTED and
+ * leave the skip armed for the real KEXDH_INIT. */
+static void TestFirstPacketFollowsGexRequestDispatch(void)
+{
+    ChannelOpenHarness harness;
+    byte payload[3 * UINT32_SZ];
+    byte in[64];
+    word32 payloadSz = 0;
+    word32 inSz;
+
+    payloadSz = AppendUint32(payload, sizeof(payload), payloadSz, 2048);
+    payloadSz = AppendUint32(payload, sizeof(payload), payloadSz, 3072);
+    payloadSz = AppendUint32(payload, sizeof(payload), payloadSz, 8192);
+    inSz = WrapPacket(MSGID_KEXDH_GEX_REQUEST, payload, payloadSz,
+            in, sizeof(in));
+
+    InitChannelOpenHarness(&harness, in, inSz);
+    harness.ssh->acceptState = ACCEPT_SERVER_KEXINIT_SENT;
+    harness.ssh->isKeying |= WOLFSSH_PEER_IS_KEYING;
+    AssertNotNull(harness.ssh->handshake);
+    harness.ssh->handshake->kexId = ID_DH_GROUP14_SHA256;
+    harness.ssh->handshake->expectMsgId = MSGID_NONE;
+    harness.ssh->handshake->ignoreNextKexMsg = 1;
+
+    AssertIntEQ(ReplyToPacket(&harness, in, inSz), 0);
+    AssertIntEQ(harness.ssh->handshake->ignoreNextKexMsg, 0);
+    AssertIntEQ(harness.ssh->handshake->expectMsgId, MSGID_KEXDH_INIT);
+
+    FreeChannelOpenHarness(&harness);
+}
+#endif /* !NO_WOLFSSH_SERVER */
+
 static void TestFirstPacketFollowsSkipped(void)
 {
     RunFirstPacketFollowsSkipCase(wolfSSH_TestDoKexDhInit, "DoKexDhInit");
-#ifndef WOLFSSH_NO_DH_GEX_SHA256
     RunFirstPacketFollowsSkipCase(wolfSSH_TestDoKexDhGexRequest,
             "DoKexDhGexRequest");
+#ifndef NO_WOLFSSH_SERVER
+    TestFirstPacketFollowsGexRequestDispatch();
+#endif
+#ifndef WOLFSSH_NO_DH_GEX_SHA256
     /* Guess/negotiation straddling the GEX boundary, both directions. */
 #ifndef NO_WOLFSSH_SERVER
     RunFirstPacketFollowsCrossBoundaryCase(wolfSSH_TestDoKexDhInit,

wolfssh/internal.h

@@ -2159,6 +2159,8 @@ enum WS_MessageIdLimits {
             word32 len, word32* idx);
     WOLFSSH_API int wolfSSH_TestDoKexDhReply(WOLFSSH* ssh, byte* buf,
             word32 len, word32* idx);
+    WOLFSSH_API int wolfSSH_TestDoKexDhGexRequest(WOLFSSH* ssh, byte* buf,
+            word32 len, word32* idx);
     WOLFSSH_API int wolfSSH_TestChannelPutData(WOLFSSH_CHANNEL* channel,
             byte* data, word32 dataSz);
     WOLFSSH_API int wolfSSH_TestCreateMpint(byte* buf, word32* sz, byte* pad);
@@ -2212,8 +2214,6 @@ enum WS_MessageIdLimits {
 #endif
 #ifndef WOLFSSH_NO_DH_GEX_SHA256
     WOLFSSH_API int wolfSSH_TestSendKexDhGexRequest(WOLFSSH* ssh);
-    WOLFSSH_API int wolfSSH_TestDoKexDhGexRequest(WOLFSSH* ssh, byte* buf,
-            word32 len, word32* idx);
     WOLFSSH_API int wolfSSH_TestDoKexDhGexGroup(WOLFSSH* ssh, byte* buf,
             word32 len, word32* idx);
     WOLFSSH_API int wolfSSH_TestValidateKexDhGexGroup(const byte* primeGroup,