From 977bcac2d56a8793ed93b4aac7016ef36b51a07f Mon Sep 17 00:00:00 2001 From: Dimitri Staessens Date: Fri, 12 Jun 2026 19:34:27 +0200 Subject: irmd: Add issuer and digest pinning to OAP A peer certificate that verifies against the CA store could have been issued by any trusted CA, and a peer could pick any supported digest for its signature. Tighten the authentication contract with two local policies. cacert= pins the issuing CA: a peer certificate, if presented, must chain through the pinned CA. Whether a certificate is mandatory at all remains controlled by auth= alone. digest= now also pins the signature digest: a classical peer must sign with the locally configured digest, and may not omit the digest NID to fall back to the key's default digest. PQC signatures (ML-DSA, SLH-DSA) have an intrinsic digest and may be NID_undef. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders --- src/irmd/oap/srv.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) (limited to 'src/irmd/oap/srv.c') diff --git a/src/irmd/oap/srv.c b/src/irmd/oap/srv.c index 08b4d9d2..b92c1946 100644 --- a/src/irmd/oap/srv.c +++ b/src/irmd/oap/srv.c @@ -439,16 +439,11 @@ int oap_srv_process(const struct name_info * info, oap_hdr_init(&local_hdr, peer_hdr.id, kex_buf, *data, NID_undef); - if (oap_auth_peer(cli_name, &local_hdr, &peer_hdr) < 0) { + if (oap_auth_peer(cli_name, &kcfg, &local_hdr, &peer_hdr) < 0) { log_err_id(id, "Failed to authenticate client."); goto fail_auth; } - if (kcfg.req_auth && peer_hdr.crt.len == 0) { - log_err_id(id, "Client did not provide a certificate."); - goto fail_auth; - } - if (do_server_kex(info, &peer_hdr, &kcfg, &local_hdr.kex, sk) < 0) goto fail_kex; -- cgit v1.2.3