diff options
| author | Dimitri Staessens <dimitri@ouroboros.rocks> | 2026-07-10 21:27:15 +0200 |
|---|---|---|
| committer | Sander Vrijders <sander@ouroboros.rocks> | 2026-07-19 11:44:35 +0200 |
| commit | 8bebdf2e3e3a4ead8a728f0a594e8592457660b7 (patch) | |
| tree | 86ddc0d377dab78da9b2aefb83b3f1924ddbc249 /src/irmd/oap/srv.c | |
| parent | 17263ccd93ba07fb32de12cfd540bd531f23bef2 (diff) | |
| download | ouroboros-8bebdf2e3e3a4ead8a728f0a594e8592457660b7.tar.gz ouroboros-8bebdf2e3e3a4ead8a728f0a594e8592457660b7.zip | |
irmd: Reject rekey without KEX config
A rekey without KEX config should be rejected rather than downgrading
to plaintext. Tests added.
Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
Diffstat (limited to 'src/irmd/oap/srv.c')
| -rw-r--r-- | src/irmd/oap/srv.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/irmd/oap/srv.c b/src/irmd/oap/srv.c index cc3dec5b..d78fc8d4 100644 --- a/src/irmd/oap/srv.c +++ b/src/irmd/oap/srv.c @@ -473,6 +473,12 @@ int oap_srv_process(const struct name_info * info, peer_crt->len = peer_hdr.crt.len; } + /* A re-keyed flow is encrypted; refuse a plaintext re-key. */ + if (rekey && peer_hdr.kex.len == 0) { + log_err_id(id, "Re-key request without KEX."); + goto fail_kex; + } + if (do_server_kex(info, &peer_hdr, &scfg, &local_hdr.kex, sk) < 0) goto fail_kex; |