Don't end strict kex until receiving newkeys

Previously non-strict packets would be allowed once Dropbear's own
SSH_MSG_NEWKEYS had been sent, but for correctness it should only be
allowed once receiving the SSH_MSG_NEWKEYS from the peer.

Reported by Fabian Bäumer

Author: mkj

src/common-kex.c

@@ -197,6 +197,7 @@ void recv_msg_newkeys() {
 	if (ses.kexstate.strict_kex) {
 		ses.recvseq = 0;
 	}
+	ses.kexstate.recvfirstnewkeys = 1;
 
 	TRACE(("leave recv_msg_newkeys"))
 }

src/kex.h

@@ -91,6 +91,7 @@ struct KEXState {
 	unsigned int donefirstkex; /* Set to 1 after the first kex has completed,
 								  ie the transport layer has been set up */
 	unsigned int donesecondkex; /* Set to 1 after the second kex has completed */
+	unsigned int recvfirstnewkeys; /* Set to 1 after the first valid newkeys has been received */
 
 	unsigned our_first_follows_matches : 1;
 

src/process-packet.c

@@ -44,7 +44,7 @@ void process_packet() {
 
 	unsigned char type;
 	unsigned int i;
-	unsigned int first_strict_kex = ses.kexstate.strict_kex && !ses.kexstate.donefirstkex;
+	unsigned int first_strict_kex = ses.kexstate.strict_kex && !ses.kexstate.recvfirstnewkeys;
 	time_t now;
 
 	TRACE2(("enter process_packet"))