Implement changes required to avert terrapin attack.

sshtools · Dec 15, 2023 · aadec4c · aadec4c
1 parent b5f7eb6
commit aadec4c
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/maverick-synergy-client/src/main/java/com/sshtools/client/TransportProtocolClient.java b/maverick-synergy-client/src/main/java/com/sshtools/client/TransportProtocolClient.java
@@ -262,5 +262,4 @@ protected boolean isExtensionNegotiationSupported() {
 	protected boolean isServerMode() {
 		return false;
 	}
-
 }
diff --git a/maverick-synergy-common/src/main/java/com/sshtools/synergy/ssh/TransportProtocol.java b/maverick-synergy-common/src/main/java/com/sshtools/synergy/ssh/TransportProtocol.java
@@ -2009,7 +2009,7 @@ public void run() {
 		case SSH_MSG_EXT_INFO:
 
 			checkStrictKex();
-			
+
 			if(Log.isDebugEnabled())
 				Log.debug("Received SSH_MSG_EXT_INFO");
 
@@ -2258,6 +2258,13 @@ protected void generateNewKeysServerOut() {
 					outgoingSequence = 0L;
 				}
 
+				if(isKexStrict) {
+					if(Log.isDebugEnabled()) {
+						Log.debug("Resetting OUTGOING sequence from {} to zero for strict transport protocol requirements", outgoingSequence);
+					}
+					outgoingSequence = 0L;
+				}
+
 				if (keyExchange.hasReceivedNewKeys()) {
 					completeKeyExchange(keyExchange);
 				}
@@ -2505,6 +2512,8 @@ public void messageSent(Long sequenceNo) {
 
 	}
 
+	protected abstract boolean isServerMode();
+
 	private void processExtensionInfo(byte[] msg) throws IOException {
 		 ByteArrayReader reader = new ByteArrayReader(msg);