irmd: Reject rekey without KEX config

A rekey without KEX config should be rejected rather than downgrading
to plaintext. Tests added.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

3 files changed, 87 insertions, 0 deletions

diff --git a/src/irmd/oap/cli.c b/src/irmd/oap/cli.c
index d54eb26b..ebfcd71f 100644
--- a/src/irmd/oap/cli.c
+++ b/src/irmd/oap/cli.c
@@ -291,6 +291,13 @@ int oap_cli_prepare(void **                  ctx,
                 goto fail_kex;
         }
 
+        /* A re-keyed flow is encrypted; absent config must fail closed. */
+        if (rekey && !IS_KEX_ALGO_SET(&s->scfg)) {
+                log_err_id(s->id.data, "Refusing re-key without KEX for %s.",
+                           info->name);
+                goto fail_kex;
+        }
+
         /* Re-key forces server-encap: client-encap forfeits FS/PCS. */
         if (rekey && s->scfg.x.mode == KEM_MODE_CLIENT_ENCAP) {
                 s->scfg.x.mode = KEM_MODE_SERVER_ENCAP;
diff --git a/src/irmd/oap/srv.c b/src/irmd/oap/srv.c
index cc3dec5b..d78fc8d4 100644
--- a/src/irmd/oap/srv.c
+++ b/src/irmd/oap/srv.c
@@ -473,6 +473,12 @@ int oap_srv_process(const struct name_info * info,
                 peer_crt->len = peer_hdr.crt.len;
         }
 
+        /* A re-keyed flow is encrypted; refuse a plaintext re-key. */
+        if (rekey && peer_hdr.kex.len == 0) {
+                log_err_id(id, "Re-key request without KEX.");
+                goto fail_kex;
+        }
+
         if (do_server_kex(info, &peer_hdr, &scfg, &local_hdr.kex, sk) < 0)
                 goto fail_kex;
 
diff --git a/src/irmd/oap/tests/oap_test.c b/src/irmd/oap/tests/oap_test.c
index 2e5c975a..b24bb786 100644
--- a/src/irmd/oap/tests/oap_test.c
+++ b/src/irmd/oap/tests/oap_test.c
@@ -269,6 +269,76 @@ static int test_oap_rekey_badcache_all(void)
         return ret;
 }
 
+/* Absent sec config (ENOENT) clears the KEX; a re-key must fail closed. */
+static int test_oap_cli_rejects_rekey_no_kex(void)
+{
+        struct oap_test_ctx ctx;
+
+        TEST_START();
+
+        test_enc_noauth_cfg();
+        test_cfg.cli.kex = NID_undef;
+
+        if (oap_test_setup(&ctx, root_ca_crt_ec, im_ca_crt_ec) < 0)
+                goto fail;
+
+        ctx.rekey = true;
+
+        if (oap_cli_prepare_ctx(&ctx) == 0) {
+                printf("Client prepared a re-key without KEX.\n");
+                goto fail_cleanup;
+        }
+
+        oap_test_teardown(&ctx);
+
+        TEST_SUCCESS();
+
+        return TEST_RC_SUCCESS;
+ fail_cleanup:
+        oap_test_teardown(&ctx);
+ fail:
+        TEST_FAIL();
+        return TEST_RC_FAIL;
+}
+
+static int test_oap_srv_rejects_rekey_no_kex(void)
+{
+        struct oap_test_ctx ctx;
+
+        TEST_START();
+
+        test_enc_noauth_cfg();
+        test_cfg.cli.kex = NID_undef;
+        test_cfg.srv.kex = NID_undef;
+
+        if (oap_test_setup(&ctx, root_ca_crt_ec, im_ca_crt_ec) < 0)
+                goto fail;
+
+        /* First-contact plaintext request, replayed as a re-key. */
+        if (oap_cli_prepare_ctx(&ctx) < 0) {
+                printf("Client prepare failed.\n");
+                goto fail_cleanup;
+        }
+
+        ctx.rekey = true;
+
+        if (oap_srv_process_ctx(&ctx) == 0) {
+                printf("Server accepted a re-key without KEX.\n");
+                goto fail_cleanup;
+        }
+
+        oap_test_teardown(&ctx);
+
+        TEST_SUCCESS();
+
+        return TEST_RC_SUCCESS;
+ fail_cleanup:
+        oap_test_teardown(&ctx);
+ fail:
+        TEST_FAIL();
+        return TEST_RC_FAIL;
+}
+
 static int test_oap_roundtrip_kex_only(void)
 {
         test_enc_noauth_cfg();
@@ -1945,6 +2015,8 @@ int oap_test(int    argc,
         ret |= test_oap_rekey_all();
         ret |= test_oap_rekey_badcache_all();
         ret |= test_oap_rekey_srv_badcache_all();
+        ret |= test_oap_cli_rejects_rekey_no_kex();
+        ret |= test_oap_srv_rejects_rekey_no_kex();
 
         ret |= test_oap_roundtrip_all();
         ret |= test_oap_roundtrip_md_all();
@@ -1990,6 +2062,8 @@ int oap_test(int    argc,
         (void) test_oap_rekey_all;
         (void) test_oap_rekey_badcache_all;
         (void) test_oap_rekey_srv_badcache_all;
+        (void) test_oap_cli_rejects_rekey_no_kex;
+        (void) test_oap_srv_rejects_rekey_no_kex;
         (void) test_oap_roundtrip;
         (void) test_oap_roundtrip_all;
         (void) test_oap_roundtrip_md;