Commit 1169b50029 for strongswan.org

commit 1169b50029cbd114072f92e5e51818516b98bdee
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Thu Aug 27 14:06:09 2026 +0200

    charon-tkm: Pass IKE_SA_INIT message(s) as blobs

    Also adds a static signature scheme identifier to the calls (proper
    mapping follows later).

diff --git a/src/charon-tkm/src/tkm/tkm_listener.c b/src/charon-tkm/src/tkm/tkm_listener.c
index d679c1492b..7e4a0ecf0d 100644
--- a/src/charon-tkm/src/tkm/tkm_listener.c
+++ b/src/charon-tkm/src/tkm/tkm_listener.c
@@ -283,7 +283,7 @@ METHOD(listener_t, authorize, bool,
 	cc_id_type cc_id;
 	chunk_t *auth, *other_init_msg;
 	signature_type signature;
-	init_message_type init_msg;
+	blob_id_type init_message_id = 0;

 	if (!final)
 	{
@@ -322,10 +322,21 @@ METHOD(listener_t, authorize, bool,
 		goto cc_reset;
 	}

-	chunk_to_sequence(auth, &signature, sizeof(signature_type));
-	chunk_to_sequence(other_init_msg, &init_msg, sizeof(init_message_type));
+	init_message_id = tkm->idmgr->acquire_id(tkm->idmgr, TKM_CTX_BLOB);
+	if (!init_message_id)
+	{
+		DBG1(DBG_IKE, "unable to acquire blob context id for peer's init message");
+		goto cc_reset;
+	}

-	if (ike_isa_auth(isa_id, cc_id, init_msg, signature) != TKM_OK)
+	if (!chunk_to_blob(init_message_id, other_init_msg))
+	{
+		DBG1(DBG_IKE, "unable to convert peer's init message to blob");
+		goto cc_reset;
+	}
+
+	chunk_to_sequence(auth, &signature, sizeof(signature_type));
+	if (ike_isa_auth(isa_id, cc_id, init_message_id, 1, signature) != TKM_OK)
 	{
 		DBG1(DBG_IKE, "TKM based authentication failed"
 			 " for ISA context %llu", isa_id);
@@ -344,6 +355,10 @@ cc_reset:
 		DBG1(DBG_IKE, "unable to reset CC context %llu", cc_id);
 	}
 	tkm->idmgr->release_id(tkm->idmgr, TKM_CTX_CC, cc_id);
+	if (init_message_id)
+	{
+		tkm->idmgr->release_id(tkm->idmgr, TKM_CTX_BLOB, init_message_id);
+	}
 	return TRUE; /* stay registered */
 }

diff --git a/src/charon-tkm/src/tkm/tkm_private_key.c b/src/charon-tkm/src/tkm/tkm_private_key.c
index 29e8b9750d..78adc38ad3 100644
--- a/src/charon-tkm/src/tkm/tkm_private_key.c
+++ b/src/charon-tkm/src/tkm/tkm_private_key.c
@@ -20,6 +20,7 @@
 #include <tkm/constants.h>
 #include <tkm/client.h>

+#include "tkm.h"
 #include "tkm_utils.h"
 #include "tkm_types.h"
 #include "tkm_private_key.h"
@@ -64,29 +65,41 @@ METHOD(private_key_t, sign, bool,
 	chunk_t data, chunk_t *signature)
 {
 	signature_type sig;
-	init_message_type msg;
+	blob_id_type msg_id;
 	sign_info_t sign;
 	isa_id_type isa_id;
+	bool success = FALSE;

 	if (data.ptr == NULL)
 	{
 		DBG1(DBG_LIB, "unable to get signature information");
 		return FALSE;
 	}
-	sign = *(sign_info_t *)(data.ptr);
+	sign = *(sign_info_t*)(data.ptr);

-	chunk_to_sequence(&sign.init_message, &msg, sizeof(init_message_type));
-	isa_id = sign.isa_id;
-	chunk_free(&sign.init_message);
+	msg_id = tkm->idmgr->acquire_id(tkm->idmgr, TKM_CTX_BLOB);
+	if (!msg_id)
+	{
+		DBG1(DBG_LIB, "unable to acquire blob context id for init message");
+		chunk_free(&sign.init_message);
+		return FALSE;
+	}

-	if (ike_isa_sign(isa_id, 1, msg, &sig) != TKM_OK)
+	isa_id = sign.isa_id;
+	if (chunk_to_blob(msg_id, &sign.init_message) &&
+		ike_isa_sign(isa_id, 1, msg_id, 1, &sig) == TKM_OK)
+	{
+		sequence_to_chunk(sig.data, sig.size, signature);
+		success = TRUE;
+	}
+	else
 	{
 		DBG1(DBG_LIB, "signature operation failed");
-		return FALSE;
 	}

-	sequence_to_chunk(sig.data, sig.size, signature);
-	return TRUE;
+	tkm->idmgr->release_id(tkm->idmgr, TKM_CTX_BLOB, msg_id);
+	chunk_free(&sign.init_message);
+	return success;
 }

 METHOD(private_key_t, decrypt, bool,