Centralize AES cipher lifecycle

[ejohnstown]

The encrypt/decrypt Aes contexts were keyed and freed without ever calling wc_AesInit. Centralize the lifecycle instead of sprinkling init calls:

• Add CipherSetKey() (init + key) and CipherClear() (free only if inited).
• Use them in DoNewKeys(), SendNewKeys(), and SshResourceFree(), replacing the duplicated per-cipher switch blocks.
• Add cipherType/isInit to Ciphers so init is lazy per cipher type and wc_AesFree is never called on an uninitialized context.

[Copilot]

Pull request overview

This PR updates wolfSSH session initialization to properly initialize the AES cipher contexts in SshInit() before they are configured and later freed, aligning usage with wolfCrypt’s wc_AesInit()/wc_AesFree() lifecycle expectations.

Changes:

• Add wc_AesInit() calls for ssh->encryptCipher.aes and ssh->decryptCipher.aes during SshInit().
• Add an early failure path when cipher initialization fails.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1043

Scan targets checked: wolfssh-bugs, wolfssh-src

No new issues found in the changed files. ✅

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[aidangarske]

Skoll Multi-Scan Review

Modes: review + review-security + bugsOverall recommendation: COMMENT
Findings: 4 total — 4 posted, 0 skipped
4 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Medium] [review+review-security] New cipher lifecycle state and error/cleanup paths in CipherSetKey/CipherClear lack regression coverage — src/internal.c:1202-1344
• [Low] [review+review-security] New code uses truthiness pointer checks instead of explicit != NULL — src/internal.c:1204,1272,1293
• [Info] [review+review-security] Missing space around assignment operator — src/internal.c:1233
• [Info] [review+review-security] DoNewKeys now errors on unknown peer cipher instead of silently succeeding — src/internal.c:6668

Review generated by Skoll

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #1043

Scan targets checked: wolfssh-bugs, wolfssh-src

No new issues found in the changed files. ✅