diff options
| author | Dimitri Staessens <dimitri@ouroboros.rocks> | 2026-07-10 21:27:15 +0200 |
|---|---|---|
| committer | Sander Vrijders <sander@ouroboros.rocks> | 2026-07-19 11:44:35 +0200 |
| commit | 8bebdf2e3e3a4ead8a728f0a594e8592457660b7 (patch) | |
| tree | 86ddc0d377dab78da9b2aefb83b3f1924ddbc249 /src/irmd/oap/cli.c | |
| parent | 17263ccd93ba07fb32de12cfd540bd531f23bef2 (diff) | |
| download | ouroboros-8bebdf2e3e3a4ead8a728f0a594e8592457660b7.tar.gz ouroboros-8bebdf2e3e3a4ead8a728f0a594e8592457660b7.zip | |
irmd: Reject rekey without KEX config
A rekey without KEX config should be rejected rather than downgrading
to plaintext. Tests added.
Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
Diffstat (limited to 'src/irmd/oap/cli.c')
| -rw-r--r-- | src/irmd/oap/cli.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/irmd/oap/cli.c b/src/irmd/oap/cli.c index d54eb26b..ebfcd71f 100644 --- a/src/irmd/oap/cli.c +++ b/src/irmd/oap/cli.c @@ -291,6 +291,13 @@ int oap_cli_prepare(void ** ctx, goto fail_kex; } + /* A re-keyed flow is encrypted; absent config must fail closed. */ + if (rekey && !IS_KEX_ALGO_SET(&s->scfg)) { + log_err_id(s->id.data, "Refusing re-key without KEX for %s.", + info->name); + goto fail_kex; + } + /* Re-key forces server-encap: client-encap forfeits FS/PCS. */ if (rekey && s->scfg.x.mode == KEM_MODE_CLIENT_ENCAP) { s->scfg.x.mode = KEM_MODE_SERVER_ENCAP; |