ouroboros/src/irmd/oap/cli.c, branch 0.24.0

irmd: Reject rekey without KEX config

2026-07-19T09:44:35+00:00

A rekey without KEX config should be rejected rather than downgrading to plaintext. Tests added. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

irmd: Harden OAP client KEM completion

2026-07-19T09:44:35+00:00

do_client_kex_complete_kem() filled key_buf in the server-encap branch and returned early in the client-encap branch; any other mode value would fall through and memcpy an uninitialized stack buffer into the session key. The client only ever sets the two known modes today, but nothing local enforces that and the server derives its mode from a wire bit. Give each mode an explicit path with no fall-through. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

irmd: Fix OAP re-key header encode

2026-07-08T09:02:23+00:00

The oap_hdr_encode() function validated its own output by re-decoding with rekey hardcoded false. The case where the client signs a re-key failed its own self-check because the cert is not sent again. Now uses a flag on the encode() to signal the signed re-key without certificate. Also fixes a double free after a failed self-decode check. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

oap: Rename kex_config loaders to sec_config

2026-06-29T06:33:00+00:00

Leftover from the kex_config->enc_config->sec_config rename. Finished by renames load_kex_config and the cli/srv variants to load_sec_config, the kcfg variables to scfg, and fixes the "KEX config"/"encryption config" comments. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

irmd: Harden OAP handshake and add cert-less re-key

2026-06-29T06:33:00+00:00

Adds support for: Server key confirmation: the session key is bound to the negotiated algorithm via the HKDF info. The server returns a key-confirmation tag (rsp_tag, replacing the bare request-hash echo), so a cipher downgrade or key desync is detected. The cleartext path keeps a request echo, compared in constant time. Sealed server identity: AEAD-seal the certificate, signature and piggybacked data in the encrypted response (kex and rsp_tag move ahead as AAD), hiding the server identity and response sizes. Cert-less re-key: let the client omit its certificate, verifying the peer against the cached certificate. On PQC flows, ephemeral server-encap KEX (preserving forward secrecy) is used, even if the original flow allocation was client-encap. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Group sec_config authentication fields

2026-06-29T06:32:59+00:00

Nest the flat req_auth and cacert members of struct sec_config into a sub-struct a { req; cacert; }, keeping the authentication settings together. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

config: Rename enc.conf to sec.conf

2026-06-29T06:32:59+00:00

The per-name config file holds more than encryption settings (KEX, cipher, KDF, peer authentication), so renamed it from enc.conf to sec.conf and the code internals to match. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

irmd: Add issuer and digest pinning to OAP

2026-06-29T06:32:58+00:00

A peer certificate that verifies against the CA store could have been issued by any trusted CA, and a peer could pick any supported digest for its signature. Tighten the authentication contract with two local policies. cacert= pins the issuing CA: a peer certificate, if presented, must chain through the pinned CA. Whether a certificate is mandatory at all remains controlled by auth= alone. digest= now also pins the signature digest: a classical peer must sign with the locally configured digest, and may not omit the digest NID to fall back to the key's default digest. PQC signatures (ML-DSA, SLH-DSA) have an intrinsic digest and may be NID_undef. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

irmd: Specify peer authentication contract

2026-06-29T06:32:58+00:00

OAP accepted requests and responses without a certificate even when the peer was expected to authenticate. An on-path attacker could strip the certificate and signature from a flow allocation response and substitute its own key exchange, silently downgrading the handshake to unauthenticated. Add an auth=required|optional policy to enc.conf, enforced per role: a client config requires the server to present a valid certificate, a server config requires the same from the client. Default is required for client side (https), optional server side. The client side default can be changed via OAP_CLIENT_AUTH_DEFAULT for testing. Replace the bare 'none' keyword with encryption=none, which disables encryption only: the digest and the authentication policy are kept, so authenticated but unencrypted flows can be configured. Configs using bare 'none' are now rejected. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Fix certificate DER encoding and key buffers

2026-03-14T10:23:59+00:00

i2d_X509() allocated buf->data via OPENSSL_malloc(), but callers free it with freebuf() which uses free(). Fix by allocating with malloc() and encoding directly into the buffer. Also replaces MSGBUFSZ with CRYPT_KEY_BUFSZ (4096) for key material buffers and removes leftover debug logging. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders