tomaswolf opened a new pull request, #924: URL: https://github.com/apache/mina-sshd/pull/924
If both peers initiate a new key exchange at about the same time, the following sequence is possible: The other peer's SSH_MSG_KEX_INIT arrives. Create a new "initialized" future and queues up performKexNegotiation (which is badly named, it initializes KeyExchange, which needs both peers' data) as a listener. sendKex() sends this peer's SSH_MSG_KEX_INIT and fulfills the "initialized" future, which triggers running performKexNegotiation. The other peer receives this KEX_INIT message, and sends its first KEX message. This peer receives this first KEX message and and passes it to the KeyExchange. However, the performKexNegotiation() running in a sending thread has not yet initialized the KeyExchange. The KEX fails with an IllegalStateException: not initialized. Fix this by adding yet another future that is fulfilled once the KeyExchange is fully prepared and ready to be used. In handleKexMessage(), queue up calling kex.next() as a listener on this future to ensure it gets run only after kex.init() has been done. And greatly simplify AbstractClientSession.switchToNoneCipher(). This method formerly duplicated some parts of the internal key exchange logic, but missed a couple of crucial things. Just let that method determine whether to use the "none" cipher, and then make it request a new key exchange right away, overriding the client's proposal to include only the none cipher. That way this implementation doesn't depend on key exchange internals at all anymore. (This change in AbstractClientSession is backported from the 3.0 stream.) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
