irmd: Add issuer and digest pinning to OAP

A peer certificate that verifies against the CA store could have
been issued by any trusted CA, and a peer could pick any supported
digest for its signature. Tighten the authentication contract with
two local policies.

cacert= pins the issuing CA: a peer certificate, if presented, must
chain through the pinned CA. Whether a certificate is mandatory at
all remains controlled by auth= alone.

digest= now also pins the signature digest: a classical peer must sign
with the locally configured digest, and may not omit the digest NID to
fall back to the key's default digest. PQC signatures (ML-DSA,
SLH-DSA) have an intrinsic digest and may be NID_undef.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

1 files changed, 1 insertions, 6 deletions

diff --git a/src/irmd/oap/srv.c b/src/irmd/oap/srv.c
index 08b4d9d2..b92c1946 100644
--- a/src/irmd/oap/srv.c
+++ b/src/irmd/oap/srv.c
@@ -439,16 +439,11 @@ int oap_srv_process(const struct name_info * info,
 
         oap_hdr_init(&local_hdr, peer_hdr.id, kex_buf, *data, NID_undef);
 
-        if (oap_auth_peer(cli_name, &local_hdr, &peer_hdr) < 0) {
+        if (oap_auth_peer(cli_name, &kcfg, &local_hdr, &peer_hdr) < 0) {
                 log_err_id(id, "Failed to authenticate client.");
                 goto fail_auth;
         }
 
-        if (kcfg.req_auth && peer_hdr.crt.len == 0) {
-                log_err_id(id, "Client did not provide a certificate.");
-                goto fail_auth;
-        }
-
         if (do_server_kex(info, &peer_hdr, &kcfg, &local_hdr.kex, sk) < 0)
                 goto fail_kex;