From 50177b4004d1fec4299cd7bed4a3c7fb0f4208d7 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 10 Jul 2026 20:32:59 +0200 Subject: [PATCH] ike-auth: Enforce PPK required constraint on the initiator Fixes: a9e60c96dc88 ("ike-auth: Add basic PPK support") --- src/libcharon/sa/ikev2/tasks/ike_auth.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/libcharon/sa/ikev2/tasks/ike_auth.c b/src/libcharon/sa/ikev2/tasks/ike_auth.c index 19ecad922..e998b902b 100644 --- a/src/libcharon/sa/ikev2/tasks/ike_auth.c +++ b/src/libcharon/sa/ikev2/tasks/ike_auth.c @@ -1693,6 +1693,12 @@ METHOD(task_t, process_i, status_t, goto local_auth_failed; } } + else if (this->peer_cfg->has_option(this->peer_cfg, OPT_PPK_REQUIRED)) + { + DBG1(DBG_CFG, "PPK required but peer didn't use PPK for PPK_ID " + "'%Y'", this->ppk_id); + goto peer_auth_failed; + } else { DBG1(DBG_CFG, "peer didn't use PPK for PPK_ID '%Y'", this->ppk_id);