irmd: Add issuer and digest pinning to OAP

A peer certificate that verifies against the CA store could have
been issued by any trusted CA, and a peer could pick any supported
digest for its signature. Tighten the authentication contract with
two local policies.

cacert= pins the issuing CA: a peer certificate, if presented, must
chain through the pinned CA. Whether a certificate is mandatory at
all remains controlled by auth= alone.

digest= now also pins the signature digest: a classical peer must sign
with the locally configured digest, and may not omit the digest NID to
fall back to the key's default digest. PQC signatures (ML-DSA,
SLH-DSA) have an intrinsic digest and may be NID_undef.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

1 files changed, 15 insertions, 0 deletions

diff --git a/src/lib/crypt/openssl.h b/src/lib/crypt/openssl.h
index af285232..2578a0d2 100644
--- a/src/lib/crypt/openssl.h
+++ b/src/lib/crypt/openssl.h
@@ -136,9 +136,24 @@ void    openssl_auth_destroy_store(void * store);
 int     openssl_auth_add_crt_to_store(void * store,
                                       void * crt);
 
+void *  openssl_auth_create_chain(void);
+
+void    openssl_auth_destroy_chain(void * chain);
+
+int     openssl_auth_add_crt_to_chain(void * chain,
+                                      void * crt);
+
 int     openssl_verify_crt(void * store,
+                           void * untrusted,
                            void * crt);
 
+int     openssl_verify_crt_pin(void * store,
+                               void * untrusted,
+                               void * crt,
+                               void * pin);
+
+bool    openssl_pk_requires_md(const EVP_PKEY * pk);
+
 int     openssl_sign(EVP_PKEY * pkp,
                      int        md_nid,
                      buffer_t   msg,