From 64f19fe3dbe723eb2c4a74b31401cb0e022e7a68 Mon Sep 17 00:00:00 2001 From: Mark Atwood Date: Thu, 9 Jul 2026 16:47:34 -0700 Subject: [PATCH] fix: send SSH_MSG_DISCONNECT on KEX failure --- src/internal.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/internal.c b/src/internal.c index 8b7fd28cc..960742e88 100644 --- a/src/internal.c +++ b/src/internal.c @@ -5332,6 +5332,11 @@ static int DoKexInit(WOLFSSH* ssh, byte* buf, word32 len, word32* idx) ret = ssh->error; } } + /* RFC 4253 11.1: best-effort SSH_MSG_DISCONNECT on negotiation failure. */ + if (ret == WS_MATCH_KEX_ALGO_E || ret == WS_MATCH_KEY_ALGO_E || + ret == WS_MATCH_ENC_ALGO_E || ret == WS_MATCH_MAC_ALGO_E) { + (void)SendDisconnect(ssh, WOLFSSH_DISCONNECT_KEY_EXCHANGE_FAILED); + } WLOG(WS_LOG_DEBUG, "Leaving DoKexInit(), ret = %d", ret); return ret; }