fix(security): validate DH-GEX group parameters from server

A malicious server could send SSH_MSG_KEX_DH_GEX_GROUP with a weak or
degenerate prime (e.g., 16-bit p, g=1, or an even p) to trivially break
the key exchange. Enforce that p falls within the client-requested
[min, max] bit range, that p is odd, and that g satisfies 1 < g < p-1.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: kruton

sshlib/src/main/kotlin/org/connectbot/sshlib/crypto/DiffieHellmanGroupExchange.kt

@@ -44,6 +44,21 @@ internal class DiffieHellmanGroupExchange(override val hashAlgorithm: String) :
     private var privateKey: BigInteger? = null
 
     fun setGroup(p: BigInteger, g: BigInteger) {
+        val pBits = p.bitLength()
+        if (pBits < min) {
+            throw SshException("DH group prime too small: $pBits bits < $min bits minimum")
+        }
+        if (pBits > max) {
+            throw SshException("DH group prime too large: $pBits bits > $max bits maximum")
+        }
+        // p must be odd (a basic primality sanity check: all primes > 2 are odd)
+        if (!p.testBit(0)) {
+            throw SshException("DH group prime is even")
+        }
+        // g must satisfy 1 < g < p-1 to be a valid generator candidate
+        if (g <= BigInteger.ONE || g >= p - BigInteger.ONE) {
+            throw SshException("DH group generator g is out of range: must be 1 < g < p-1")
+        }
         this.p = p
         this.g = g
     }

sshlib/src/test/kotlin/org/connectbot/sshlib/crypto/DiffieHellmanGroupExchangeTest.kt

@@ -1,6 +1,6 @@
 /*
  * ConnectBot SSH Library
- * Copyright 2025 Kenny Root
+ * Copyright 2025-2026 Kenny Root
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -34,6 +34,80 @@ import kotlin.test.assertTrue
 
 class DiffieHellmanGroupExchangeTest {
 
+    // A tiny 16-bit prime — far below the min=2048 requested by the client
+    private val tinyPrime = BigInteger("65537")
+
+    // A 2048-bit composite (GROUP14_P with the last bit flipped) — not a safe prime
+    private val compositeLikePrime = DhGroups.GROUP14_P.subtract(BigInteger.ONE)
+
+    @Test
+    fun `setGroup rejects p smaller than min bits`() {
+        val gex = DiffieHellmanGroupExchange("SHA-256")
+        assertFailsWith<SshException> {
+            gex.setGroup(tinyPrime, DhGroups.GENERATOR)
+        }
+    }
+
+    @Test
+    fun `setGroup rejects p larger than max bits`() {
+        // Construct a number just over 8192 bits
+        val tooBig = BigInteger.ONE.shiftLeft(8193)
+        val gex = DiffieHellmanGroupExchange("SHA-256")
+        assertFailsWith<SshException> {
+            gex.setGroup(tooBig, DhGroups.GENERATOR)
+        }
+    }
+
+    @Test
+    fun `setGroup rejects g equal to 1`() {
+        val gex = DiffieHellmanGroupExchange("SHA-256")
+        assertFailsWith<SshException> {
+            gex.setGroup(DhGroups.GROUP14_P, BigInteger.ONE)
+        }
+    }
+
+    @Test
+    fun `setGroup rejects g equal to 0`() {
+        val gex = DiffieHellmanGroupExchange("SHA-256")
+        assertFailsWith<SshException> {
+            gex.setGroup(DhGroups.GROUP14_P, BigInteger.ZERO)
+        }
+    }
+
+    @Test
+    fun `setGroup rejects g greater than or equal to p minus 1`() {
+        val gex = DiffieHellmanGroupExchange("SHA-256")
+        assertFailsWith<SshException> {
+            gex.setGroup(DhGroups.GROUP14_P, DhGroups.GROUP14_P - BigInteger.ONE)
+        }
+    }
+
+    @Test
+    fun `setGroup rejects even p`() {
+        val evenP = DhGroups.GROUP14_P.subtract(BigInteger.ONE) // make it even
+        val gex = DiffieHellmanGroupExchange("SHA-256")
+        assertFailsWith<SshException> {
+            gex.setGroup(evenP, DhGroups.GENERATOR)
+        }
+    }
+
+    @Test
+    fun `setGroup accepts valid group 14 parameters`() {
+        val gex = DiffieHellmanGroupExchange("SHA-256")
+        gex.setGroup(DhGroups.GROUP14_P, DhGroups.GENERATOR)
+        // Should not throw; verify we can generate keys
+        val e = gex.generateClientKeys()
+        assertTrue(e.isNotEmpty())
+    }
+
+    @Test
+    fun `setGroup accepts valid group 16 parameters`() {
+        val gex = DiffieHellmanGroupExchange("SHA-256")
+        gex.setGroup(DhGroups.GROUP16_P, DhGroups.GENERATOR)
+        val e = gex.generateClientKeys()
+        assertTrue(e.isNotEmpty())
+    }
+
     @Test
     fun `generateClientKeys throws if group not set`() {
         val gex = DiffieHellmanGroupExchange("SHA-256")