From 43b770320ad5b38e9d1c97ebc1200a28ecdbe1b0 Mon Sep 17 00:00:00 2001
From: Michael Rash <mbr@cipherdyne.org>
Date: Sun, 29 Jun 2014 18:46:19 -0400
Subject: [PATCH] [server] Require sig ID's or fingerprints when sigs are
 validated

When validating access.conf stanzas make sure that one of
GPG_REMOTE_ID or GPG_FINGERPRINT_ID is specified whenever GnuPG
signatures are to be verified for incoming SPA packets. Signature
verification is the default, and can only be disabled with
GPG_DISABLE_SIG but this is NOT recommended.
---
 ChangeLog                              |  6 ++++++
 Makefile.am                            |  1 +
 server/access.c                        | 14 ++++++++++++++
 test/conf/gpg_no_pw_no_fpr_access.conf |  5 +++++
 test/test-fwknop.pl                    |  1 +
 test/tests/basic_operations.pl         | 10 ++++++++++
 6 files changed, 37 insertions(+)
 create mode 100644 test/conf/gpg_no_pw_no_fpr_access.conf

diff --git a/ChangeLog b/ChangeLog
index a72fde11..694a0145 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -14,6 +14,12 @@ fwknop-2.6.3 (05//2014):
 
       GPG_FINGERPRINT_ID            00CC95F05BC146B6AC4038C9E36F443C6A3FAD56
 
+    - [server] When validating access.conf stanzas make sure that one of
+      GPG_REMOTE_ID or GPG_FINGERPRINT_ID is specified whenever GnuPG
+      signatures are to be verified for incoming SPA packets. Signature
+      verification is the default, and can only be disabled with
+      GPG_DISABLE_SIG but this is NOT recommended.
+
 fwknop-2.6.2 (04/28/2014):
     - [libfko] fix double free bug in SPA parser discovered with the new
       python SPA payload fuzzer (see the 'spa_encoding_fuzzing' branch which
diff --git a/Makefile.am b/Makefile.am
index 8229cc67..29529255 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -163,6 +163,7 @@ EXTRA_DIST = \
     test/conf/gpg_no_pw_hmac_serverdir_access.conf \
     test/conf/gpg_no_pw_fpr_access.conf \
     test/conf/gpg_no_pw_bad_fpr_access.conf \
+    test/conf/gpg_no_pw_no_fpr_access.conf \
     test/conf/fwknoprc_gpg_invalid_exe \
     test/conf/fwknoprc_hmac_defaults \
     test/conf/fwknoprc_hmac_time_offset_mins \
diff --git a/server/access.c b/server/access.c
index 265cc705..d0145d5d 100644
--- a/server/access.c
+++ b/server/access.c
@@ -1015,6 +1015,19 @@ set_acc_defaults(fko_srv_options_t *opts)
                     );
                 }
             }
+
+            /* If signature checking is enabled, make sure we either have sig ID's or
+             * fingerprint ID's to check
+            */
+            if(! acc->gpg_disable_sig
+                    && (acc->gpg_remote_id == NULL && acc->gpg_remote_fpr == NULL))
+            {
+                log_msg(LOG_INFO,
+                    "Warning: Must have either sig ID's or fingerprints to check via GPG_REMOTE_ID or GPG_FINGERPRINT_ID (stanza source: '%s' #%d)",
+                    acc->source, i
+                );
+                clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
+            }
         }
 
         if(acc->encryption_mode == FKO_ENC_MODE_UNKNOWN)
@@ -1033,6 +1046,7 @@ set_acc_defaults(fko_srv_options_t *opts)
         acc = acc->next;
         i++;
     }
+    return;
 }
 
 /* Perform some sanity checks on an acc stanza data.
diff --git a/test/conf/gpg_no_pw_no_fpr_access.conf b/test/conf/gpg_no_pw_no_fpr_access.conf
new file mode 100644
index 00000000..6c31b63c
--- /dev/null
+++ b/test/conf/gpg_no_pw_no_fpr_access.conf
@@ -0,0 +1,5 @@
+SOURCE                      ANY
+FW_ACCESS_TIMEOUT           3
+GPG_HOME_DIR                conf/server-gpg-no-pw
+GPG_DECRYPT_ID              361BBAD4
+GPG_ALLOW_NO_PW             Y
diff --git a/test/test-fwknop.pl b/test/test-fwknop.pl
index a5a0079b..98e9c2a9 100755
--- a/test/test-fwknop.pl
+++ b/test/test-fwknop.pl
@@ -112,6 +112,7 @@ our %cf = (
     'gpg_no_pw_access'             => "$conf_dir/gpg_no_pw_access.conf",
     'gpg_no_pw_fpr_access'         => "$conf_dir/gpg_no_pw_fpr_access.conf",
     'gpg_no_pw_bad_fpr_access'     => "$conf_dir/gpg_no_pw_bad_fpr_access.conf",
+    'gpg_no_pw_no_fpr_access'      => "$conf_dir/gpg_no_pw_no_fpr_access.conf",
     'gpg_no_pw_hmac_access'        => "$conf_dir/gpg_no_pw_hmac_access.conf",
     'gpg_no_pw_hmac_clientdir_access' => "$conf_dir/gpg_no_pw_hmac_clientdir_access.conf",
     'gpg_no_pw_hmac_serverdir_access' => "$conf_dir/gpg_no_pw_hmac_serverdir_access.conf",
diff --git a/test/tests/basic_operations.pl b/test/tests/basic_operations.pl
index 22d7abc6..4320b451 100644
--- a/test/tests/basic_operations.pl
+++ b/test/tests/basic_operations.pl
@@ -2145,6 +2145,16 @@
         'exec_err' => $YES,
         'cmdline' => "$fwknopdCmd $default_server_conf_args -f --gpg-home-dir " . 'A'x1200
     },
+    {
+        'category' => 'basic operations',
+        'subcategory' => 'server',
+        'detail'   => 'GPG require sig ID or fingerprint',
+        'function' => \&generic_exec,
+        'exec_err' => $YES,
+        'cmdline' => "$fwknopdCmd -c $cf{'def'} -a $cf{'gpg_no_pw_no_fpr_access'} " .
+            "-d $default_digest_file -p $default_pid_file -f",
+        'positive_output_matches' => [qr/Must have either sig/],
+    },
 
 
     {