SSH can not decrypt when KEX is curve25519-sha256@libssh.org

Summary

ssh can not decrypt when kex is curve25519-sha256@libssh.org

(Summarize the bug encountered concisely)

Sample capture file

(For non-trivial issues a capture file is essential to reproduce and fix the bug. Screenshots are not enough)

(You can attach a capture file using the paper clip button in the editor menu bar. Ensure your capture file does not contain private or sensitive information that cannot be shared publicly)

Steps to reproduce

Using python paramiko to connet to centos7.2009

(How one can reproduce the issue - this is very important)

What is the current bug behavior?

Set the right cookie and key, the wireshark can not decrypt ssh packet

(What actually happens. Include detailed information like logs and screenshots if possible)

What is the expected correct behavior?

Set the right cookie and key, the wireshark can decrypt ssh packet

(What you should see instead)

Build information

(In Wireshark, select Help->About Wireshark from the main menu and use the button "Copy To Clipboard".
Please paste the complete output here. Or from the command line, run `tshark -v` or `wireshark -v`)

wireshark 4.0.7

Problem reason

The kex string is curve25519-sha256@libssh.org. The function ssh_kex_hash_type does not take this type into account. The function ssh_set_kex_specific_dissector take this type in account. The code of the release version is followed.

static guint
ssh_kex_hash_type(gchar *type_string)
{
    if (type_string && g_str_has_suffix(type_string, "sha1")) {
        return SSH_KEX_HASH_SHA1;
    }else if (type_string && g_str_has_suffix(type_string, "sha256")) {
        return SSH_KEX_HASH_SHA256;
    }else if (type_string && g_str_has_suffix(type_string, "sha512")) {
        return SSH_KEX_HASH_SHA512;
    } else {
        ws_debug("hash type %s not supported", type_string);
        return SSH_KEX_HASH_SHA256;
    }
}


static void ssh_set_kex_specific_dissector(struct ssh_flow_data *global_data)
{
    const char *kex_name = global_data->kex;

    if (!kex_name) return;

    if (strcmp(kex_name, "diffie-hellman-group-exchange-sha1") == 0 ||
        strcmp(kex_name, "diffie-hellman-group-exchange-sha256") == 0)
    {
        global_data->kex_specific_dissector = ssh_dissect_kex_dh_gex;
    }
    else if (g_str_has_prefix(kex_name, "ecdh-sha2-") ||
        strcmp(kex_name, "curve25519-sha256@libssh.org") == 0 ||
        strcmp(kex_name, "curve25519-sha256") == 0 ||
        strcmp(kex_name, "curve448-sha512") == 0)
    {
        global_data->kex_specific_dissector = ssh_dissect_kex_ecdh;
    }
    else if (strcmp(kex_name, "diffie-hellman-group14-sha256") == 0 ||
        strcmp(kex_name, "diffie-hellman-group16-sha512") == 0 ||
        strcmp(kex_name, "diffie-hellman-group18-sha512") == 0 ||
        strcmp(kex_name, "diffie-hellman-group1-sha1") == 0 ||
        strcmp(kex_name, "diffie-hellman-group14-sha1") == 0)
    {
        global_data->kex_specific_dissector = ssh_dissect_kex_dh;
    }
}