pki: Unify parsing of RSA padding scheme and fix disabling PSS

If PSS padding is enabled by default, not all commands allowed disabling
it explicitly.

src/pki/commands/acert.c

@@ -64,11 +64,7 @@ static int acert()
 				}
 				continue;
 			case 'R':
-				if (streq(arg, "pss"))
+				if (!parse_rsa_padding(arg, &pss))
-				{
-					pss = TRUE;
-				}
-				else if (!streq(arg, "pkcs1"))
 				{
 					error = "invalid RSA padding";
 					goto usage;

src/pki/commands/issue.c

@@ -185,11 +185,7 @@ static int issue()
 				}
 				continue;
 			case 'R':
-				if (streq(arg, "pss"))
+				if (!parse_rsa_padding(arg, &pss))
-				{
-					pss = TRUE;
-				}
-				else if (!streq(arg, "pkcs1"))
 				{
 					error = "invalid RSA padding";
 					goto usage;

src/pki/commands/req.c

@@ -105,12 +105,7 @@ static int req()
 				}
 				continue;
 			case 'R':       /* --rsa-padding */
-				if (streq(arg, "pss"))
+				if (!parse_rsa_padding(arg, &pss))
-				{
-
-					pss = TRUE;
-				}
-				else if (!streq(arg, "pkcs1"))
 				{
 					error = "invalid RSA padding";
 					goto usage;

src/pki/commands/scep.c

@@ -162,15 +162,7 @@ static int scep()
 				}
 				continue;
 			case 'R':       /* --rsa-padding */
-				if (streq(arg, "pss"))
+				if (!parse_rsa_padding(arg, &pss))
-				{
-					pss = TRUE;
-				}
-				else if (streq(arg, "pkcs1"))
-				{
-					pss = FALSE;
-				}
-				else
 				{
 					error = "invalid RSA padding";
 					goto usage;

src/pki/commands/self.c

@@ -129,11 +129,7 @@ static int self()
 				}
 				continue;
 			case 'R':
-				if (streq(arg, "pss"))
+				if (!parse_rsa_padding(arg, &pss))
-				{
-					pss = TRUE;
-				}
-				else if (!streq(arg, "pkcs1"))
 				{
 					error = "invalid RSA padding";
 					goto usage;

src/pki/commands/signcrl.c

@@ -146,11 +146,7 @@ static int sign_crl()
 				}
 				continue;
 			case 'R':
-				if (streq(arg, "pss"))
+				if (!parse_rsa_padding(arg, &pss))
-				{
-					pss = TRUE;
-				}
-				else if (!streq(arg, "pkcs1"))
 				{
 					error = "invalid RSA padding";
 					goto usage;

src/pki/pki.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012-2018 Tobias Brunner
+ * Copyright (C) 2012-2023 Tobias Brunner
  * Copyright (C) 2009 Martin Willi
  *
  * Copyright (C) secunet Security Networks AG
@@ -238,6 +238,26 @@ void set_file_mode(FILE *stream, cred_encoding_type_t enc)
 #endif
 }
 
+/*
+ * Described in header
+ */
+bool parse_rsa_padding(char *padding, bool *pss)
+{
+	if (streq(padding, "pss"))
+	{
+		*pss = TRUE;
+	}
+	else if (streq(padding, "pkcs1"))
+	{
+		*pss = FALSE;
+	}
+	else
+	{
+		return FALSE;
+	}
+	return TRUE;
+}
+
 /**
  * Determine a default hash algorithm for the given key
  */

src/pki/pki.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015-2017 Tobias Brunner
+ * Copyright (C) 2015-2023 Tobias Brunner
  * Copyright (C) 2009 Martin Willi
  *
  * Copyright (C) secunet Security Networks AG
@@ -58,6 +58,15 @@ bool calculate_lifetime(char *format, char *nbstr, char *nastr, time_t span,
  */
 void set_file_mode(FILE *stream, cred_encoding_type_t enc);
 
+/**
+ * Parse RSA padding configuration.
+ *
+ * @param padding	input string to parse
+ * @param pss		set to TRUE if PSS padding should be used, FALSE otherwise
+ * @return			TRUE if successfully parsed
+ */
+bool parse_rsa_padding(char *padding, bool *pss);
+
 /**
  * Determine the signature scheme and parameters for the given private key and
  * hash algorithm and whether to use PSS padding for RSA.