From 8bebdf2e3e3a4ead8a728f0a594e8592457660b7 Mon Sep 17 00:00:00 2001 From: Dimitri Staessens Date: Fri, 10 Jul 2026 21:27:15 +0200 Subject: irmd: Reject rekey without KEX config A rekey without KEX config should be rejected rather than downgrading to plaintext. Tests added. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders --- src/irmd/oap/cli.c | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'src/irmd/oap/cli.c') diff --git a/src/irmd/oap/cli.c b/src/irmd/oap/cli.c index d54eb26b..ebfcd71f 100644 --- a/src/irmd/oap/cli.c +++ b/src/irmd/oap/cli.c @@ -291,6 +291,13 @@ int oap_cli_prepare(void ** ctx, goto fail_kex; } + /* A re-keyed flow is encrypted; absent config must fail closed. */ + if (rekey && !IS_KEX_ALGO_SET(&s->scfg)) { + log_err_id(s->id.data, "Refusing re-key without KEX for %s.", + info->name); + goto fail_kex; + } + /* Re-key forces server-encap: client-encap forfeits FS/PCS. */ if (rekey && s->scfg.x.mode == KEM_MODE_CLIENT_ENCAP) { s->scfg.x.mode = KEM_MODE_SERVER_ENCAP; -- cgit v1.2.3