irmd: Harden OAP client KEM completion

do_client_kex_complete_kem() filled key_buf in the server-encap
branch and returned early in the client-encap branch; any other
mode value would fall through and memcpy an uninitialized stack
buffer into the session key. The client only ever sets the two
known modes today, but nothing local enforces that and the server
derives its mode from a wire bit. Give each mode an explicit path
with no fall-through.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

1 files changed, 18 insertions, 19 deletions

diff --git a/src/irmd/oap/cli.c b/src/irmd/oap/cli.c
index 3518b4d1..d54eb26b 100644
--- a/src/irmd/oap/cli.c
+++ b/src/irmd/oap/cli.c
@@ -385,26 +385,9 @@ static int do_client_kex_complete_kem(struct oap_cli_ctx *   s,
         struct sec_config * scfg    = &s->scfg;
         uint8_t *           id      = s->id.data;
         uint8_t             key_buf[SYMMKEYSZ];
+        buffer_t            ct;
 
-        if (scfg->x.mode == KEM_MODE_SERVER_ENCAP) {
-                buffer_t ct;
-
-                if (peer_hdr->kex.len == 0) {
-                        log_err_id(id, "Server did not send KEM CT.");
-                        return -ECRYPT;
-                }
-
-                ct.data = peer_hdr->kex.data;
-                ct.len  = peer_hdr->kex.len;
-
-                if (kex_kem_decap(s->pkp, ct, scfg->k.nid, key_buf) < 0) {
-                        log_err_id(id, "Failed to decapsulate KEM.");
-                        return -ECRYPT;
-                }
-
-                log_dbg_id(id, "Client decapsulated server CT.");
-
-        } else if (scfg->x.mode == KEM_MODE_CLIENT_ENCAP) {
+        if (scfg->x.mode == KEM_MODE_CLIENT_ENCAP) {
                 /* Key already derived during prepare */
                 memcpy(sk->key, s->key, SYMMKEYSZ);
                 sk->nid = scfg->c.nid;
@@ -413,6 +396,22 @@ static int do_client_kex_complete_kem(struct oap_cli_ctx *   s,
                 return 0;
         }
 
+        /* KEM_MODE_SERVER_ENCAP */
+        if (peer_hdr->kex.len == 0) {
+                log_err_id(id, "Server did not send KEM CT.");
+                return -ECRYPT;
+        }
+
+        ct.data = peer_hdr->kex.data;
+        ct.len  = peer_hdr->kex.len;
+
+        if (kex_kem_decap(s->pkp, ct, scfg->k.nid, key_buf) < 0) {
+                log_err_id(id, "Failed to decapsulate KEM.");
+                return -ECRYPT;
+        }
+
+        log_dbg_id(id, "Client decapsulated server CT.");
+
         memcpy(sk->key, key_buf, SYMMKEYSZ);
         sk->nid = scfg->c.nid;
         crypt_secure_clear(key_buf, SYMMKEYSZ);