internal: send a disconnect when key exchange fails

- Send SSH_MSG_DISCONNECT with KEY_EXCHANGE_FAILED from DoKexDhInit(),
  DoKexDhReply() and DoKexDhGexGroup() when the key exchange fails.
- Add KEXDH_REPLY f-truncation and KEXDH_INIT e-truncation and e-empty
  mutator modes to the regression harness.
- Record outbound disconnects on the duplex endpoints and assert the
  reason code in the truncated-key and host-key rejection tests.
- Scan only plaintext records for the disconnect, validate minimum
  packet framing, and bound the reason code against the payload.
- Assert no disconnect is seen on a successful handshake.

Issue: F-8838

Author: yosuke-wolfssl

src/internal.c

@@ -5708,6 +5708,12 @@ static int DoKexDhInit(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
         ret = SendKexDhReply(ssh);
     }
 
+    /* RFC 4253 7.1: tell the peer the key exchange failed. Both codes are
+     * fatal, never a would-block. */
+    if (ret == WS_CRYPTO_FAILED || ret == WS_PUBKEY_REJECTED_E) {
+        (void)SendDisconnect(ssh, WOLFSSH_DISCONNECT_KEY_EXCHANGE_FAILED);
+    }
+
     return ret;
 }
 
@@ -7391,6 +7397,11 @@ static int DoKexDhReply(WOLFSSH* ssh, byte* buf, word32 len, word32* idx)
 
     if (sigKeyBlock_ptr)
         WFREE(sigKeyBlock_ptr, ssh->ctx->heap, DYNTYPE_PRIVKEY);
+    /* RFC 4253 7.1: tell the peer the key exchange failed. Both codes are
+     * fatal, never a would-block. */
+    if (ret == WS_CRYPTO_FAILED || ret == WS_PUBKEY_REJECTED_E) {
+        (void)SendDisconnect(ssh, WOLFSSH_DISCONNECT_KEY_EXCHANGE_FAILED);
+    }
     WLOG(WS_LOG_DEBUG, "Leaving DoKexDhReply(), ret = %d", ret);
     return ret;
 }
@@ -7791,6 +7802,12 @@ static int DoKexDhGexGroup(WOLFSSH* ssh,
         ret = SendKexDhInit(ssh);
     }
 
+    /* RFC 4253 7.1: tell the peer the key exchange failed. Both codes are
+     * fatal, never a would-block. */
+    if (ret == WS_CRYPTO_FAILED || ret == WS_PUBKEY_REJECTED_E) {
+        (void)SendDisconnect(ssh, WOLFSSH_DISCONNECT_KEY_EXCHANGE_FAILED);
+    }
+
     return ret;
 }