1 files changed, 28 insertions, 8 deletions

diff --git a/src/irmd/oap/io.c b/src/irmd/oap/io.c
index c2c91b91..845723fa 100644
--- a/src/irmd/oap/io.c
+++ b/src/irmd/oap/io.c
@@ -50,11 +50,17 @@ static bool file_exists(const char * path)
 {
         struct stat s;
 
-        if (stat(path, &s) < 0 && errno == ENOENT) {
+        if (stat(path, &s) == 0)
+                return true;
+
+        if (errno == ENOENT) {
                 log_dbg("File %s does not exist.", path);
                 return false;
         }
 
+        /* Can't stat for another reason; assume present, fail on load */
+        log_warn("Failed to stat %s: %s.", path, strerror(errno));
+
         return true;
 }
 
@@ -96,16 +102,16 @@ int load_credentials(const char *                  name,
         return -EAUTH;
 }
 
-int load_kex_config(const char *        name,
+int load_sec_config(const char *        name,
                     const char *        path,
                     struct sec_config * cfg)
 {
+        void * pin;
+
         assert(name != NULL);
         assert(cfg != NULL);
 
-        memset(cfg, 0, sizeof(*cfg));
-
-        /* Load encryption config */
+        /* Load security config */
         if (!file_exists(path))
                 log_dbg("No encryption %s for %s.", path, name);
 
@@ -114,19 +120,33 @@ int load_kex_config(const char *        name,
                 return -1;
         }
 
+        if (cfg->a.cacert[0] != '\0') {
+                if (crypt_load_crt_file(cfg->a.cacert, &pin) < 0) {
+                        log_err("Failed to load pinned CA %s for %s.",
+                                cfg->a.cacert, name);
+                        return -EAUTH;
+                }
+                crypt_free_crt(pin);
+        }
+
         if (!IS_KEX_ALGO_SET(cfg)) {
                 log_info("Key exchange not configured for %s.", name);
                 return 0;
         }
-#ifndef HAVE_OPENSSL_ML_KEM
+#ifndef HAVE_ML
         if (IS_KEM_ALGORITHM(cfg->x.str)) {
                 log_err("PQC not available, can't use %s for %s.",
                         cfg->x.str, name);
                 return -ENOTSUP;
         }
 #endif
-        if (cfg->c.nid == NID_undef) {
-                log_err("Invalid cipher for %s.", name);
+        if (crypt_kex_rank(cfg->x.nid) < 1) {
+                log_err("Key exchange not supported for %s.", name);
+                return -ENOTSUP;
+        }
+
+        if (crypt_cipher_rank(cfg->c.nid) < 1) {
+                log_err("Cipher not supported for %s.", name);
                 return -ECRYPT;
         }