irmd: Add issuer and digest pinning to OAP

A peer certificate that verifies against the CA store could have
been issued by any trusted CA, and a peer could pick any supported
digest for its signature. Tighten the authentication contract with
two local policies.

cacert= pins the issuing CA: a peer certificate, if presented, must
chain through the pinned CA. Whether a certificate is mandatory at
all remains controlled by auth= alone.

digest= now also pins the signature digest: a classical peer must sign
with the locally configured digest, and may not omit the digest NID to
fall back to the key's default digest. PQC signatures (ML-DSA,
SLH-DSA) have an intrinsic digest and may be NID_undef.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

1 files changed, 6 insertions, 3 deletions

diff --git a/src/irmd/oap/auth.h b/src/irmd/oap/auth.h
index 4f748750..be8d2cae 100644
--- a/src/irmd/oap/auth.h
+++ b/src/irmd/oap/auth.h
@@ -23,13 +23,16 @@
 #ifndef OUROBOROS_IRMD_OAP_AUTH_H
 #define OUROBOROS_IRMD_OAP_AUTH_H
 
+#include <ouroboros/crypt.h>
+
 #include "hdr.h"
 
 int  oap_check_hdr(const struct oap_hdr * hdr);
 
 /* name is updated with the peer's certificate name if available */
-int  oap_auth_peer(char *                 name,
-                   const struct oap_hdr * local_hdr,
-                   const struct oap_hdr * peer_hdr);
+int  oap_auth_peer(char *                    name,
+                   const struct sec_config * cfg,
+                   const struct oap_hdr *    local_hdr,
+                   const struct oap_hdr *    peer_hdr);
 
 #endif /* OUROBOROS_IRMD_OAP_AUTH_H */