irmd: Add issuer and digest pinning to OAP

A peer certificate that verifies against the CA store could have
been issued by any trusted CA, and a peer could pick any supported
digest for its signature. Tighten the authentication contract with
two local policies.

cacert= pins the issuing CA: a peer certificate, if presented, must
chain through the pinned CA. Whether a certificate is mandatory at
all remains controlled by auth= alone.

digest= now also pins the signature digest: a classical peer must sign
with the locally configured digest, and may not omit the digest NID to
fall back to the key's default digest. PQC signatures (ML-DSA,
SLH-DSA) have an intrinsic digest and may be NID_undef.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

1 files changed, 8 insertions, 4 deletions

diff --git a/src/irmd/main.c b/src/irmd/main.c
index f91e23fc..66f341eb 100644
--- a/src/irmd/main.c
+++ b/src/irmd/main.c
@@ -1895,12 +1895,14 @@ void * irm_sanitize(void * o)
         return (void *) 0;
 }
 
-static int irm_load_store(char * dpath)
+static int irm_load_store(char * dpath,
+                          bool   anchor)
 {
         struct stat     st;
         struct dirent * dent;
         DIR *           dir;
         void *          crt;
+        int             ret;
 
         if (stat(dpath, &st) == -1) {
                 log_dbg("Store directory %s not found.", dpath);
@@ -1944,7 +1946,9 @@ static int irm_load_store(char * dpath)
                         goto fail_file;
                 }
 
-                if (oap_auth_add_ca_crt(crt) < 0) {
+                ret = anchor ? oap_auth_add_ca_crt(crt)
+                             : oap_auth_add_chain_crt(crt);
+                if (ret < 0) {
                         log_err("Failed to add certificate from %s to store.",
                                 path);
                         goto fail_crt_add;
@@ -2088,12 +2092,12 @@ static int irm_init(void)
                 goto fail_oap;
         }
 
-        if (irm_load_store(OUROBOROS_CA_CRT_DIR) < 0) {
+        if (irm_load_store(OUROBOROS_CA_CRT_DIR, true) < 0) {
                 log_err("Failed to load CA certificates.");
                 goto fail_load_store;
         }
 
-        if (irm_load_store(OUROBOROS_CHAIN_DIR) < 0) {
+        if (irm_load_store(OUROBOROS_CHAIN_DIR, false) < 0) {
                 log_err("Failed to load intermediate certificates.");
                 goto fail_load_store;
         }