[server] Require sig ID's or fingerprints when sigs are validated

When validating access.conf stanzas make sure that one of
GPG_REMOTE_ID or GPG_FINGERPRINT_ID is specified whenever GnuPG
signatures are to be verified for incoming SPA packets. Signature
verification is the default, and can only be disabled with
GPG_DISABLE_SIG but this is NOT recommended.

ChangeLog

@@ -14,6 +14,12 @@ fwknop-2.6.3 (05//2014):
 
       GPG_FINGERPRINT_ID            00CC95F05BC146B6AC4038C9E36F443C6A3FAD56
 
+    - [server] When validating access.conf stanzas make sure that one of
+      GPG_REMOTE_ID or GPG_FINGERPRINT_ID is specified whenever GnuPG
+      signatures are to be verified for incoming SPA packets. Signature
+      verification is the default, and can only be disabled with
+      GPG_DISABLE_SIG but this is NOT recommended.
+
 fwknop-2.6.2 (04/28/2014):
     - [libfko] fix double free bug in SPA parser discovered with the new
       python SPA payload fuzzer (see the 'spa_encoding_fuzzing' branch which

Makefile.am

@@ -163,6 +163,7 @@ EXTRA_DIST = \
     test/conf/gpg_no_pw_hmac_serverdir_access.conf \
     test/conf/gpg_no_pw_fpr_access.conf \
     test/conf/gpg_no_pw_bad_fpr_access.conf \
+    test/conf/gpg_no_pw_no_fpr_access.conf \
     test/conf/fwknoprc_gpg_invalid_exe \
     test/conf/fwknoprc_hmac_defaults \
     test/conf/fwknoprc_hmac_time_offset_mins \

server/access.c

@@ -1015,6 +1015,19 @@ set_acc_defaults(fko_srv_options_t *opts)
                     );
                 }
             }
+
+            /* If signature checking is enabled, make sure we either have sig ID's or
+             * fingerprint ID's to check
+            */
+            if(! acc->gpg_disable_sig
+                    && (acc->gpg_remote_id == NULL && acc->gpg_remote_fpr == NULL))
+            {
+                log_msg(LOG_INFO,
+                    "Warning: Must have either sig ID's or fingerprints to check via GPG_REMOTE_ID or GPG_FINGERPRINT_ID (stanza source: '%s' #%d)",
+                    acc->source, i
+                );
+                clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
+            }
         }
 
         if(acc->encryption_mode == FKO_ENC_MODE_UNKNOWN)
@@ -1033,6 +1046,7 @@ set_acc_defaults(fko_srv_options_t *opts)
         acc = acc->next;
         i++;
     }
+    return;
 }
 
 /* Perform some sanity checks on an acc stanza data.

test/conf/gpg_no_pw_no_fpr_access.conf

@@ -0,0 +1,5 @@
+SOURCE                      ANY
+FW_ACCESS_TIMEOUT           3
+GPG_HOME_DIR                conf/server-gpg-no-pw
+GPG_DECRYPT_ID              361BBAD4
+GPG_ALLOW_NO_PW             Y

test/test-fwknop.pl

@@ -112,6 +112,7 @@ our %cf = (
     'gpg_no_pw_access'             => "$conf_dir/gpg_no_pw_access.conf",
     'gpg_no_pw_fpr_access'         => "$conf_dir/gpg_no_pw_fpr_access.conf",
     'gpg_no_pw_bad_fpr_access'     => "$conf_dir/gpg_no_pw_bad_fpr_access.conf",
+    'gpg_no_pw_no_fpr_access'      => "$conf_dir/gpg_no_pw_no_fpr_access.conf",
     'gpg_no_pw_hmac_access'        => "$conf_dir/gpg_no_pw_hmac_access.conf",
     'gpg_no_pw_hmac_clientdir_access' => "$conf_dir/gpg_no_pw_hmac_clientdir_access.conf",
     'gpg_no_pw_hmac_serverdir_access' => "$conf_dir/gpg_no_pw_hmac_serverdir_access.conf",

test/tests/basic_operations.pl

@@ -2145,6 +2145,16 @@
         'exec_err' => $YES,
         'cmdline' => "$fwknopdCmd $default_server_conf_args -f --gpg-home-dir " . 'A'x1200
     },
+    {
+        'category' => 'basic operations',
+        'subcategory' => 'server',
+        'detail'   => 'GPG require sig ID or fingerprint',
+        'function' => \&generic_exec,
+        'exec_err' => $YES,
+        'cmdline' => "$fwknopdCmd -c $cf{'def'} -a $cf{'gpg_no_pw_no_fpr_access'} " .
+            "-d $default_digest_file -p $default_pid_file -f",
+        'positive_output_matches' => [qr/Must have either sig/],
+    },
 
 
     {