From 8bebdf2e3e3a4ead8a728f0a594e8592457660b7 Mon Sep 17 00:00:00 2001 From: Dimitri Staessens Date: Fri, 10 Jul 2026 21:27:15 +0200 Subject: irmd: Reject rekey without KEX config A rekey without KEX config should be rejected rather than downgrading to plaintext. Tests added. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders --- src/irmd/oap/srv.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'src/irmd/oap/srv.c') diff --git a/src/irmd/oap/srv.c b/src/irmd/oap/srv.c index cc3dec5b..d78fc8d4 100644 --- a/src/irmd/oap/srv.c +++ b/src/irmd/oap/srv.c @@ -473,6 +473,12 @@ int oap_srv_process(const struct name_info * info, peer_crt->len = peer_hdr.crt.len; } + /* A re-keyed flow is encrypted; refuse a plaintext re-key. */ + if (rekey && peer_hdr.kex.len == 0) { + log_err_id(id, "Re-key request without KEX."); + goto fail_kex; + } + if (do_server_kex(info, &peer_hdr, &scfg, &local_hdr.kex, sk) < 0) goto fail_kex; -- cgit v1.2.3