From fee337529da2d2b386b241812e176852bd5d4c4c Mon Sep 17 00:00:00 2001 From: Dimitri Staessens Date: Sat, 29 Aug 2026 12:06:20 +0200 Subject: irmd: Reject client encap without configured KEX A client asking for client-side encapsulation against a server that has no kex= configured left scfg->x.str NULL, crashing the handshake inside strstr(). Client encapsulation decapsulates with the server's configured static key, so a server without the configured key exchange cannot serve the request. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders --- src/irmd/oap/srv.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src/irmd/oap/srv.c') diff --git a/src/irmd/oap/srv.c b/src/irmd/oap/srv.c index d78fc8d4..f78e0874 100644 --- a/src/irmd/oap/srv.c +++ b/src/irmd/oap/srv.c @@ -363,6 +363,10 @@ int do_server_kex(const struct name_info * info, scfg->x.str); return -ECRYPT; } + } else if (!IS_KEX_ALGO_SET(scfg)) { + /* Client encap decaps with the configured static key */ + log_err_id(id, "Client encap without configured KEX."); + return -ECRYPT; } /* Dispatch based on algorithm type */ -- cgit v1.2.3