From 4c836008dcac27e0a8258b07270a8a529b2d9167 Mon Sep 17 00:00:00 2001 From: Dimitri Staessens Date: Thu, 2 Jul 2026 01:06:33 +0200 Subject: irmd: Fix OAP re-key header encode The oap_hdr_encode() function validated its own output by re-decoding with rekey hardcoded false. The case where the client signs a re-key failed its own self-check because the cert is not sent again. Now uses a flag on the encode() to signal the signed re-key without certificate. Also fixes a double free after a failed self-decode check. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders --- src/irmd/oap/cli.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'src/irmd/oap/cli.c') diff --git a/src/irmd/oap/cli.c b/src/irmd/oap/cli.c index 689d67ca..3518b4d1 100644 --- a/src/irmd/oap/cli.c +++ b/src/irmd/oap/cli.c @@ -250,6 +250,7 @@ int oap_cli_prepare(void ** ctx, void * crt = NULL; buffer_t no_tag = BUF_INIT; ssize_t ret; + int enc_flags = 0; assert(ctx != NULL); assert(info != NULL); @@ -302,6 +303,9 @@ int oap_cli_prepare(void ** ctx, crt = NULL; } + if (rekey) + enc_flags = OAP_ENC_REKEY; + oap_hdr_init(&s->local_hdr, s->id, s->kex_buf, data, s->scfg.c.nid); if (do_client_kex_prepare(info->name, s) < 0) { @@ -310,7 +314,7 @@ int oap_cli_prepare(void ** ctx, } if (oap_hdr_encode(&s->local_hdr, pkp, crt, &s->scfg, - no_tag, NID_undef, NULL)) { + no_tag, NID_undef, NULL, enc_flags)) { log_err_id(s->id.data, "Failed to create OAP request header."); goto fail_hdr; } -- cgit v1.2.3