Commit 30bff8f84c for strongswan.org

commit 30bff8f84c4a9ae12f156e188a4cbf741c0fe0d6
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Fri Aug 28 15:50:16 2026 +0200

    charon-tkm: Return hash algorithms of mapped schemes for signature auth

diff --git a/src/charon-tkm/src/tkm/tkm_keymat.c b/src/charon-tkm/src/tkm/tkm_keymat.c
index f52c05d48f..62dd798484 100644
--- a/src/charon-tkm/src/tkm/tkm_keymat.c
+++ b/src/charon-tkm/src/tkm/tkm_keymat.c
@@ -469,6 +469,34 @@ METHOD(keymat_v2_t, add_hash_algorithm, void,
 	this->hash_algorithms->add(this->hash_algorithms, hash);
 }

+CALLBACK(hash_algorithm_filter, bool,
+	void *ctx, enumerator_t *orig, va_list args)
+{
+	signature_scheme_t *scheme_ptr;
+	hash_algorithm_t hash, *out;
+
+	VA_ARGS_VGET(args, out);
+
+	while (orig->enumerate(orig, &scheme_ptr, NULL))
+	{
+		hash = hasher_from_signature_scheme(*scheme_ptr, NULL);
+		if (hasher_algorithm_for_ikev2(hash))
+		{
+			*out = hash;
+			return TRUE;
+		}
+	}
+	return FALSE;
+}
+
+METHOD(keymat_v2_t, hash_algorithm_enumerator_create, enumerator_t*,
+	private_tkm_keymat_t *this)
+{
+	return enumerator_create_filter(
+							scheme_map->create_enumerator(scheme_map),
+							hash_algorithm_filter, NULL, NULL);
+}
+
 METHOD(keymat_t, destroy, void,
 	private_tkm_keymat_t *this)
 {
@@ -744,7 +772,7 @@ tkm_keymat_t *tkm_keymat_create(bool initiator)
 				.get_psk_sig = _get_psk_sig,
 				.add_hash_algorithm = _add_hash_algorithm,
 				.hash_algorithm_supported = _hash_algorithm_supported,
-				.hash_algorithm_enumerator_create = (void*)enumerator_create_empty,
+				.hash_algorithm_enumerator_create = _hash_algorithm_enumerator_create,
 			},
 			.get_isa_id = _get_isa_id,
 			.set_auth_payload = _set_auth_payload,
diff --git a/src/charon-tkm/tests/keymat_tests.c b/src/charon-tkm/tests/keymat_tests.c
index 54bfbefcf4..9871c805e3 100644
--- a/src/charon-tkm/tests/keymat_tests.c
+++ b/src/charon-tkm/tests/keymat_tests.c
@@ -36,6 +36,25 @@ START_TEST(test_siga_from_signature_scheme)
 }
 END_TEST

+START_TEST(test_hash_algorithm_enumerator)
+{
+	enumerator_t *enumerator;
+	hash_algorithm_t alg;
+
+	tkm_keymat_t *keymat = tkm_keymat_create(TRUE);
+	fail_if(!keymat, "Unable to create keymat");
+
+	enumerator = keymat->keymat_v2.hash_algorithm_enumerator_create(&keymat->keymat_v2);
+	/* only SHA-256 should get enumerated with the registered schemes as SHA-1
+	 * is filtered and not allowed for signature authentication */
+	fail_if(!enumerator->enumerate(enumerator, &alg), "No hash algorithms");
+	ck_assert_int_eq((hash_algorithm_t)HASH_SHA256, alg);
+	fail_if(enumerator->enumerate(enumerator, &alg), "Unexpected hash algorithm");
+	enumerator->destroy(enumerator);
+	keymat->keymat_v2.keymat.destroy(&keymat->keymat_v2.keymat);
+}
+END_TEST
+
 START_TEST(test_derive_ike_keys)
 {
 	proposal_t *proposal = proposal_create_from_string(PROTO_IKE,
@@ -360,6 +379,7 @@ Suite *make_keymat_tests()

 	tc = tcase_create("sig mapping");
 	tcase_add_test(tc, test_siga_from_signature_scheme);
+	tcase_add_test(tc, test_hash_algorithm_enumerator);
 	suite_add_tcase(s, tc);

 	tc = tcase_create("derive IKE keys");