DH GEX group selection hardening

[ejohnstown]

This fixes the server-side Diffie-Hellman Group Exchange (RFC 4419) group selection, which previously ignored the client's requested size window and always sent group 14, and adds a 2048-bit floor to prevent downgrade.

• Discard a guessed KEX packet in DoKexDhGexGroup: honor ignoreNextKexMsg so a wrong first_kex_packet_follows guess is silently discarded rather than parsed as a real group and errored, matching DoKexDhReply / DoKexDhInit (RFC 4253 7.1). (Issue: F-2866)
• Select the DH GEX group from the client's [min, preferred, max] size window instead of always sending group 14: add SelectKexDhGexGroup() to pick the closest fitting built-in group, reject with WS_DH_SIZE_E when none fits, and thread the WOLFSSH through GetDHPrimeGroup() so the sent group, exchange hash, and shared secret stay consistent. (Issue: F-55)
• Enforce a 2048-bit floor (WOLFSSH_DH_GEX_MIN_BITS) on group selection: clamp the client's lower bound up before the scan, reject windows whose max is below the floor, cap the window to MAX_KEX_KEY_SZ, and extend the unit tests for the rejection, clamp-up, and cache-miss fallback paths. (Issue: F-55)

[Copilot]

Pull request overview

Hardens server-side Diffie-Hellman Group Exchange (DH-GEX, RFC 4419/8270) by selecting a built-in DH group that actually matches the client’s requested size window (with a 2048-bit minimum floor), and ensures consistency between the group sent on the wire and the group used for exchange-hash / shared-secret computation. It also aligns DH-GEX message handlers with existing first_packet_follows skip behavior.

Changes:

• Add server-side DH-GEX group selection (SelectKexDhGexGroup) honoring the client’s [min, preferred, max] window, with a 2048-bit floor and rejection when no built-in group fits.
• Cache and reuse the exact selected DH group via the handshake to keep wire-group, exchange hash, and key agreement consistent (updates GetDHPrimeGroup to take WOLFSSH*).
• Extend internal/regression/unit tests to cover selection, skip-on-first_packet_follows, send-vs-hash consistency, and cache-miss fallback.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
wolfssh/internal.h	Exposes new internal-test wrappers for DH-GEX group selection, group handler, and DH prime-group retrieval.
src/internal.c	Implements DH-GEX group selection + 2048-bit floor, caches selected group for consistency, updates GetDHPrimeGroup signature, and adds ignoreNextKexMsg handling for DoKexDhGexGroup.
tests/unit.c	Adds unit tests for selection behavior, wire-vs-hash consistency, and cache-miss fallback.
tests/regress.c	Extends first_packet_follows skip regression coverage to include DoKexDhGexGroup.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.