Commit 5e44b1d381 for strongswan.org

commit 5e44b1d381f90e3efaa09fd356be4843881c4253
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Fri Aug 28 11:06:23 2026 +0200

    pubkey-authenticator: Add helper to parse information from AUTH payload

diff --git a/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c b/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
index 392a61d9d9..bf63bda96b 100644
--- a/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
+++ b/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.c
@@ -92,11 +92,60 @@ static bool parse_signature_auth_data(chunk_t *auth_data, key_type_t *key_type,
 	{
 		return FALSE;
 	}
-	*key_type = key_type_from_signature_scheme(params->scheme);
+	if (key_type)
+	{
+		*key_type = key_type_from_signature_scheme(params->scheme);
+	}
 	*auth_data = chunk_skip(*auth_data, len);
 	return TRUE;
 }

+/*
+ * Described in header
+ */
+signature_params_t *pubkey_authenticator_parse_auth_data(auth_method_t method,
+														 key_type_t *key_type,
+														 chunk_t *data)
+{
+	signature_params_t *params;
+
+	if (key_type)
+	{
+		*key_type = KEY_ECDSA;
+	}
+
+	INIT(params);
+	switch (method)
+	{
+		case AUTH_RSA:
+			params->scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
+			if (key_type)
+			{
+				*key_type = KEY_RSA;
+			}
+			break;
+		case AUTH_ECDSA_256:
+			params->scheme = SIGN_ECDSA_256;
+			break;
+		case AUTH_ECDSA_384:
+			params->scheme = SIGN_ECDSA_384;
+			break;
+		case AUTH_ECDSA_521:
+			params->scheme = SIGN_ECDSA_521;
+			break;
+		case AUTH_DS:
+			if (parse_signature_auth_data(data, key_type, params))
+			{
+				break;
+			}
+			/* fall-through */
+		default:
+			signature_params_destroy(params);
+			return NULL;
+	}
+	return params;
+}
+
 /**
  * Build authentication data used for Signature Authentication as per RFC 7427
  */
@@ -579,7 +628,7 @@ METHOD(authenticator_t, process, status_t,
 	identification_t *id;
 	auth_cfg_t *auth, *current_auth;
 	enumerator_t *enumerator;
-	key_type_t key_type = KEY_ECDSA;
+	key_type_t key_type;
 	signature_params_t *params;
 	status_t status = NOT_FOUND;
 	const char *reason DBG_UNUSED = "unsupported";
@@ -604,35 +653,19 @@ METHOD(authenticator_t, process, status_t,
 		}
 	}

-	INIT(params);
-	switch (auth_method)
+	params = pubkey_authenticator_parse_auth_data(auth_method, &key_type,
+												  &auth_data);
+	if (!params)
 	{
-		case AUTH_RSA:
-			key_type = KEY_RSA;
-			params->scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
-			break;
-		case AUTH_ECDSA_256:
-			params->scheme = SIGN_ECDSA_256;
-			break;
-		case AUTH_ECDSA_384:
-			params->scheme = SIGN_ECDSA_384;
-			break;
-		case AUTH_ECDSA_521:
-			params->scheme = SIGN_ECDSA_521;
-			break;
-		case AUTH_DS:
-			if (parse_signature_auth_data(&auth_data, &key_type, params))
-			{
-				break;
-			}
+		if (auth_method == AUTH_DS)
+		{
 			reason = "payload invalid";
-			/* fall-through */
-		default:
-			DBG1(DBG_IKE, "%N authentication %s", auth_method_names,
-				 auth_method, reason);
-			signature_params_destroy(params);
-			return FAILED;
+		}
+		DBG1(DBG_IKE, "%N authentication %s", auth_method_names,
+			 auth_method, reason);
+		return FAILED;
 	}
+
 	id = this->ike_sa->get_other_id(this->ike_sa);
 	if (!get_auth_octets_scheme(this, TRUE, id, this->ppk, &octets, &params))
 	{
diff --git a/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.h b/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.h
index 19e2a28626..871e48ec53 100644
--- a/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.h
+++ b/src/libcharon/sa/ikev2/authenticators/pubkey_authenticator.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Tobias Brunner
+ * Copyright (C) 2008-2026 Tobias Brunner
  * Copyright (C) 2006-2009 Martin Willi
  *
  * Copyright (C) secunet Security Networks AG
@@ -38,6 +38,23 @@ struct pubkey_authenticator_t {
 	authenticator_t authenticator;
 };

+/**
+ * Determine the signature scheme and key type and parse the authentication data
+ * if necessary.
+ *
+ * @note The \p data pointer might get modified so it points into the original
+ * data.
+ *
+ * @param method			authentication method from AUTH payload
+ * @param[out] type			key type determined from the method/data (optional)
+ * @param[in,out] data		authentication data from AUTH payload
+ * @return					allocated signature parameters, NULL if not
+ *							supported or an error occurred
+ */
+signature_params_t *pubkey_authenticator_parse_auth_data(auth_method_t method,
+														 key_type_t *type,
+														 chunk_t *data);
+
 /**
  * Create an authenticator to build public key signatures.
  *