irmd: Fix OAP re-key header encode

The oap_hdr_encode() function validated its own output by re-decoding
with rekey hardcoded false. The case where the client signs a re-key
failed its own self-check because the cert is not sent again. Now uses
a flag on the encode() to signal the signed re-key without
certificate.

Also fixes a double free after a failed self-decode check.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

1 files changed, 5 insertions, 1 deletions

diff --git a/src/irmd/oap/cli.c b/src/irmd/oap/cli.c
index 689d67ca..3518b4d1 100644
--- a/src/irmd/oap/cli.c
+++ b/src/irmd/oap/cli.c
@@ -250,6 +250,7 @@ int oap_cli_prepare(void **                  ctx,
         void *               crt = NULL;
         buffer_t             no_tag = BUF_INIT;
         ssize_t              ret;
+        int                  enc_flags = 0;
 
         assert(ctx != NULL);
         assert(info != NULL);
@@ -302,6 +303,9 @@ int oap_cli_prepare(void **                  ctx,
                 crt = NULL;
         }
 
+        if (rekey)
+                enc_flags = OAP_ENC_REKEY;
+
         oap_hdr_init(&s->local_hdr, s->id, s->kex_buf, data, s->scfg.c.nid);
 
         if (do_client_kex_prepare(info->name, s) < 0) {
@@ -310,7 +314,7 @@ int oap_cli_prepare(void **                  ctx,
         }
 
         if (oap_hdr_encode(&s->local_hdr, pkp, crt, &s->scfg,
-                           no_tag, NID_undef, NULL)) {
+                           no_tag, NID_undef, NULL, enc_flags)) {
                 log_err_id(s->id.data, "Failed to create OAP request header.");
                 goto fail_hdr;
         }