ike-auth: Enforce PPK required constraint on the initiator

Fixes: a9e60c96dc ("ike-auth: Add basic PPK support")
2026-07-24 08:47:38 +02:00
parent c40e8214ed
commit 50177b4004
1 changed files with 6 additions and 0 deletions
@@ -1693,6 +1693,12 @@ METHOD(task_t, process_i, status_t,
 				goto local_auth_failed;
 			}
 		}
+		else if (this->peer_cfg->has_option(this->peer_cfg, OPT_PPK_REQUIRED))
+		{
+			DBG1(DBG_CFG, "PPK required but peer didn't use PPK for PPK_ID "
+				 "'%Y'", this->ppk_id);
+			goto peer_auth_failed;
+		}
 		else
 		{
 			DBG1(DBG_CFG, "peer didn't use PPK for PPK_ID '%Y'", this->ppk_id);