From 4c836008dcac27e0a8258b07270a8a529b2d9167 Mon Sep 17 00:00:00 2001 From: Dimitri Staessens Date: Thu, 2 Jul 2026 01:06:33 +0200 Subject: irmd: Fix OAP re-key header encode The oap_hdr_encode() function validated its own output by re-decoding with rekey hardcoded false. The case where the client signs a re-key failed its own self-check because the cert is not sent again. Now uses a flag on the encode() to signal the signed re-key without certificate. Also fixes a double free after a failed self-decode check. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders --- src/irmd/oap/hdr.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) (limited to 'src/irmd/oap/hdr.c') diff --git a/src/irmd/oap/hdr.c b/src/irmd/oap/hdr.c index f8400b46..6f355133 100644 --- a/src/irmd/oap/hdr.c +++ b/src/irmd/oap/hdr.c @@ -397,7 +397,8 @@ static int oap_hdr_encode_sealed(struct oap_hdr * hdr, struct sec_config * scfg, buffer_t rsp_tag, int req_md_nid, - const uint8_t * seal_key) + const uint8_t * seal_key, + int flags) { struct timespec now; uint64_t stamp; @@ -449,7 +450,8 @@ static int oap_hdr_encode_sealed(struct oap_hdr * hdr, free(prefix.data); freebuf(der); - if (oap_hdr_decode(hdr, hdr->hdr, req_md_nid, false) < 0) + if (oap_hdr_decode(hdr, hdr->hdr, req_md_nid, + flags & OAP_ENC_REKEY) < 0) goto fail_decode; return 0; @@ -472,7 +474,8 @@ int oap_hdr_encode(struct oap_hdr * hdr, struct sec_config * scfg, buffer_t rsp_tag, int req_md_nid, - const uint8_t * seal_key) + const uint8_t * seal_key, + int flags) { struct timespec now; uint64_t stamp; @@ -488,7 +491,7 @@ int oap_hdr_encode(struct oap_hdr * hdr, if (seal_key != NULL) return oap_hdr_encode_sealed(hdr, pkp, crt, scfg, rsp_tag, - req_md_nid, seal_key); + req_md_nid, seal_key, flags); clock_gettime(CLOCK_REALTIME, &now); stamp = hton64(TS_TO_UINT64(now)); @@ -550,10 +553,13 @@ int oap_hdr_encode(struct oap_hdr * hdr, goto fail_realloc; memcpy(hdr->hdr.data + offset, sig.data, sig.len); - clrbuf(out); } - if (oap_hdr_decode(hdr, hdr->hdr, req_md_nid, false) < 0) + /* Ownership moved to hdr->hdr; drop the alias to avoid double-free. */ + clrbuf(out); + + if (oap_hdr_decode(hdr, hdr->hdr, req_md_nid, + flags & OAP_ENC_REKEY) < 0) goto fail_decode; freebuf(der); -- cgit v1.2.3