Commit 84d51caef6 for strongswan.org

commit 84d51caef6d69f6011c986539264d852895e3080
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Fri Aug 28 15:43:03 2026 +0200

    ikev2: Get supported hash algorithms from keymat

    This allows alternative implementations like that of the TKM to override
    this.

diff --git a/src/charon-tkm/src/tkm/tkm_keymat.c b/src/charon-tkm/src/tkm/tkm_keymat.c
index 11bc62e97d..f52c05d48f 100644
--- a/src/charon-tkm/src/tkm/tkm_keymat.c
+++ b/src/charon-tkm/src/tkm/tkm_keymat.c
@@ -744,6 +744,7 @@ tkm_keymat_t *tkm_keymat_create(bool initiator)
 				.get_psk_sig = _get_psk_sig,
 				.add_hash_algorithm = _add_hash_algorithm,
 				.hash_algorithm_supported = _hash_algorithm_supported,
+				.hash_algorithm_enumerator_create = (void*)enumerator_create_empty,
 			},
 			.get_isa_id = _get_isa_id,
 			.set_auth_payload = _set_auth_payload,
diff --git a/src/libcharon/sa/ikev2/keymat_v2.c b/src/libcharon/sa/ikev2/keymat_v2.c
index 91c40ab3cc..56321e6f46 100644
--- a/src/libcharon/sa/ikev2/keymat_v2.c
+++ b/src/libcharon/sa/ikev2/keymat_v2.c
@@ -806,6 +806,33 @@ METHOD(keymat_v2_t, add_hash_algorithm, void,
 	this->hash_algorithms->add(this->hash_algorithms, hash);
 }

+CALLBACK(hash_algorithm_filter, bool,
+	void *ctx, enumerator_t *orig, va_list args)
+{
+	hash_algorithm_t hash, *out;
+	char *plugin_name;
+
+	VA_ARGS_VGET(args, out);
+
+	while (orig->enumerate(orig, &hash, &plugin_name))
+	{
+		if (hasher_algorithm_for_ikev2(hash))
+		{
+			*out = hash;
+			return TRUE;
+		}
+	}
+	return FALSE;
+}
+
+METHOD(keymat_v2_t, hash_algorithm_enumerator_create, enumerator_t*,
+	private_keymat_v2_t *this)
+{
+	return enumerator_create_filter(
+							lib->crypto->create_hasher_enumerator(lib->crypto),
+							hash_algorithm_filter, NULL, NULL);
+}
+
 METHOD(keymat_t, destroy, void,
 	private_keymat_v2_t *this)
 {
@@ -844,6 +871,7 @@ keymat_v2_t *keymat_v2_create(bool initiator)
 			.get_psk_sig = _get_psk_sig,
 			.add_hash_algorithm = _add_hash_algorithm,
 			.hash_algorithm_supported = _hash_algorithm_supported,
+			.hash_algorithm_enumerator_create = _hash_algorithm_enumerator_create,

 		},
 		.initiator = initiator,
diff --git a/src/libcharon/sa/ikev2/keymat_v2.h b/src/libcharon/sa/ikev2/keymat_v2.h
index 4fcc20d589..2c246aae8a 100644
--- a/src/libcharon/sa/ikev2/keymat_v2.h
+++ b/src/libcharon/sa/ikev2/keymat_v2.h
@@ -179,6 +179,13 @@ struct keymat_v2_t {
 	 * @return				TRUE if supported, FALSE otherwise
 	 */
 	bool (*hash_algorithm_supported)(keymat_v2_t *this, hash_algorithm_t hash);
+
+	/**
+	 * Get supported hash algorithms for signature authentication.
+	 *
+	 * @return				enumerator over supported hash_algorithm_t
+	 */
+	enumerator_t *(*hash_algorithm_enumerator_create)(keymat_v2_t *this);
 };

 /**
diff --git a/src/libcharon/sa/ikev2/tasks/ike_init.c b/src/libcharon/sa/ikev2/tasks/ike_init.c
index 64344fed50..dfb0d5ca08 100644
--- a/src/libcharon/sa/ikev2/tasks/ike_init.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_init.c
@@ -192,7 +192,6 @@ static void send_supported_hash_algorithms(private_ike_init_t *this,
 	size_t len = BUF_LEN;
 	char buf[len];
 	char *pos = buf;
-	char *plugin_name;

 	algos = hash_algorithm_set_create();
 	peer = this->ike_sa->get_peer_cfg(this->ike_sa);
@@ -221,13 +220,10 @@ static void send_supported_hash_algorithms(private_ike_init_t *this,

 	if (!algos->count(algos))
 	{
-		enumerator = lib->crypto->create_hasher_enumerator(lib->crypto);
-		while (enumerator->enumerate(enumerator, &hash, &plugin_name))
+		enumerator = this->keymat->hash_algorithm_enumerator_create(this->keymat);
+		while (enumerator->enumerate(enumerator, &hash))
 		{
-			if (hasher_algorithm_for_ikev2(hash))
-			{
-				algos->add(algos, hash);
-			}
+			algos->add(algos, hash);
 		}
 		enumerator->destroy(enumerator);
 	}