Kludge joblist to include all jobs

[bacula/bacula] / bacula / src / dird / authenticate.c

diff --git a/bacula/src/dird/authenticate.c b/bacula/src/dird/authenticate.c
index 4ad863a3eac2c5b89e540747427f311be4ff03c6..23b5d5f4f570005e6b78f6e049a52f6f9419fc78 100644 (file)
--- a/bacula/src/dird/authenticate.c
+++ b/bacula/src/dird/authenticate.c
@@ -11,30 +11,37 @@
  *
  */
 /*
  *
  */
 /*

-   Copyright (C) 2001-2004 Kern Sibbald and John Walker
+   Bacula® - The Network Backup Solution

 
 

-   This program is free software; you can redistribute it and/or
-   modify it under the terms of the GNU General Public License as
-   published by the Free Software Foundation; either version 2 of
-   the License, or (at your option) any later version.
+   Copyright (C) 2001-2006 Free Software Foundation Europe e.V.

 
 

-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   The main author of Bacula is Kern Sibbald, with contributions from
+   many others, a complete list can be found in the file AUTHORS.
+   This program is Free Software; you can redistribute it and/or
+   modify it under the terms of version two of the GNU General Public
+   License as published by the Free Software Foundation plus additions
+   that are listed in the file LICENSE.
+
+   This program is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of

    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    General Public License for more details.
 
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    General Public License for more details.
 

-   You should have received a copy of the GNU General Public
-   License along with this program; if not, write to the Free
-   Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
-   MA 02111-1307, USA.
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+   02110-1301, USA.

 
 

- */
+   Bacula® is a registered trademark of John Walker.
+   The licensor of Bacula is the Free Software Foundation Europe
+   (FSFE), Fiduciary Program, Sumatrastrasse 25, 8006 Zürich,
+   Switzerland, email:ftf@fsfeurope.org.
+*/

 
 #include "bacula.h"
 #include "dird.h"
 
 extern DIRRES *director;
 
 #include "bacula.h"
 #include "dird.h"
 
 extern DIRRES *director;

-extern char my_name[];

 
 /* Commands sent to Storage daemon and File daemon and received
  *  from the User Agent */
 
 /* Commands sent to Storage daemon and File daemon and received
  *  from the User Agent */


@@ -52,14 +59,16 @@ static char Dir_sorry[]  = "1999 You are not authorized.\n";
 /*
  * Authenticate Storage daemon connection
  */
 /*
  * Authenticate Storage daemon connection
  */

-bool authenticate_storage_daemon(JCR *jcr, STORE *store) 
+bool authenticate_storage_daemon(JCR *jcr, STORE *store)

 {
    BSOCK *sd = jcr->store_bsock;
    char dirname[MAX_NAME_LENGTH];
 {
    BSOCK *sd = jcr->store_bsock;
    char dirname[MAX_NAME_LENGTH];

-   int ssl_need = BNET_SSL_NONE;
-   bool get_auth, auth = false;
+   int tls_local_need = BNET_TLS_NONE;
+   int tls_remote_need = BNET_TLS_NONE;
+   int compatible = true;
+   bool auth_success = false;

 
 

-   /* 
+   /*

     * Send my name to the Storage daemon then do authentication
     */
    bstrncpy(dirname, director->hdr.name, sizeof(dirname));
     * Send my name to the Storage daemon then do authentication
     */
    bstrncpy(dirname, director->hdr.name, sizeof(dirname));


@@ -72,38 +81,77 @@ bool authenticate_storage_daemon(JCR *jcr, STORE *store)
       Jmsg(jcr, M_FATAL, 0, _("Error sending Hello to Storage daemon. ERR=%s\n"), bnet_strerror(sd));
       return 0;
    }
       Jmsg(jcr, M_FATAL, 0, _("Error sending Hello to Storage daemon. ERR=%s\n"), bnet_strerror(sd));
       return 0;
    }

-   get_auth = cram_md5_get_auth(sd, store->password, ssl_need);   
-   if (get_auth) {
-      auth = cram_md5_auth(sd, store->password, ssl_need);  
-      if (!auth) {
-         Dmsg1(50, "cram_auth failed for %s\n", sd->who);
+
+   /* TLS Requirement */
+   if (store->tls_enable) {
+     if (store->tls_require) {
+        tls_local_need = BNET_TLS_REQUIRED;
+     } else {
+        tls_local_need = BNET_TLS_OK;
+     }
+   }
+
+   auth_success = cram_md5_respond(sd, store->password, &tls_remote_need, &compatible);
+   if (auth_success) {
+      auth_success = cram_md5_challenge(sd, store->password, tls_local_need, compatible);
+      if (!auth_success) {
+         Dmsg1(50, "cram_challenge failed for %s\n", sd->who());

       }
    } else {
       }
    } else {

-      Dmsg1(50, "cram_get_auth failed for %s\n", sd->who);
+      Dmsg1(50, "cram_respond failed for %s\n", sd->who());

    }
    }

-   if (!get_auth || !auth) {
+
+   if (!auth_success) {

       stop_bsock_timer(tid);
       Dmsg0(50, _("Director and Storage daemon passwords or names not the same.\n"));
       stop_bsock_timer(tid);
       Dmsg0(50, _("Director and Storage daemon passwords or names not the same.\n"));

-      Jmsg0(jcr, M_FATAL, 0,
-            _("Unable to authenticate with Storage daemon. Possible causes:\n"
+      Jmsg2(jcr, M_FATAL, 0,
+            _("Director unable to authenticate with Storage daemon on \"%s:%d\". Possible causes:\n"

             "Passwords or names not the same or\n"
             "Maximum Concurrent Jobs exceeded on the SD or\n"
             "SD networking messed up (restart daemon).\n"
             "Passwords or names not the same or\n"
             "Maximum Concurrent Jobs exceeded on the SD or\n"
             "SD networking messed up (restart daemon).\n"

-            "Please see http://www.bacula.org/html-manual/faq.html#AuthorizationErrors for help.\n"));
+            "Please see http://www.bacula.org/rel-manual/faq.html#AuthorizationErrors for help.\n"),
+            sd->host(), sd->port());
+      return 0;
+   }
+
+   /* Verify that the remote host is willing to meet our TLS requirements */
+   if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
+      stop_bsock_timer(tid);
+      Jmsg(jcr, M_FATAL, 0, _("Authorization problem: Remote server did not advertise required TLS support.\n"));
+      return 0;
+   }
+
+   /* Verify that we are willing to meet the remote host's requirements */
+   if (tls_remote_need > tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
+      stop_bsock_timer(tid);
+      Jmsg(jcr, M_FATAL, 0, _("Authorization problem: Remote server requires TLS.\n"));

       return 0;
    }
       return 0;
    }

+
+   /* Is TLS Enabled? */
+   if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) {
+      /* Engage TLS! Full Speed Ahead! */
+      if (!bnet_tls_client(store->tls_ctx, sd, NULL)) {
+         stop_bsock_timer(tid);
+         Jmsg(jcr, M_FATAL, 0, _("TLS negotiation failed with SD on \"%s:%d\"\n"),
+            sd->host(), sd->port());
+         return 0;
+      }
+   }
+

    Dmsg1(116, ">stored: %s", sd->msg);
    if (bnet_recv(sd) <= 0) {
       stop_bsock_timer(tid);
    Dmsg1(116, ">stored: %s", sd->msg);
    if (bnet_recv(sd) <= 0) {
       stop_bsock_timer(tid);

-      Jmsg1(jcr, M_FATAL, 0, _("bdird<stored: bad response to Hello command: ERR=%s\n"),
-        bnet_strerror(sd));
+      Jmsg3(jcr, M_FATAL, 0, _("bdird<stored: \"%s:%s\" bad response to Hello command: ERR=%s\n"),
+         sd->who(), sd->host(), bnet_strerror(sd));

       return 0;
    }
    Dmsg1(110, "<stored: %s", sd->msg);
    stop_bsock_timer(tid);
    if (strncmp(sd->msg, OKhello, sizeof(OKhello)) != 0) {
       Dmsg0(50, _("Storage daemon rejected Hello command\n"));
       return 0;
    }
    Dmsg1(110, "<stored: %s", sd->msg);
    stop_bsock_timer(tid);
    if (strncmp(sd->msg, OKhello, sizeof(OKhello)) != 0) {
       Dmsg0(50, _("Storage daemon rejected Hello command\n"));

-      Jmsg0(jcr, M_FATAL, 0, _("Storage daemon rejected Hello command\n"));
+      Jmsg2(jcr, M_FATAL, 0, _("Storage daemon on \"%s:%d\" rejected Hello command\n"),
+         sd->host(), sd->port());

       return 0;
    }
    return 1;
       return 0;
    }
    return 1;


@@ -115,11 +163,14 @@ bool authenticate_storage_daemon(JCR *jcr, STORE *store)
 int authenticate_file_daemon(JCR *jcr)
 {
    BSOCK *fd = jcr->file_bsock;
 int authenticate_file_daemon(JCR *jcr)
 {
    BSOCK *fd = jcr->file_bsock;

+   CLIENT *client = jcr->client;

    char dirname[MAX_NAME_LENGTH];
    char dirname[MAX_NAME_LENGTH];

-   int ssl_need = BNET_SSL_NONE;
-   bool get_auth, auth = false;
+   int tls_local_need = BNET_TLS_NONE;
+   int tls_remote_need = BNET_TLS_NONE;
+   int compatible = true;
+   bool auth_success = false;

 
 

-   /* 
+   /*

     * Send my name to the File daemon then do authentication
     */
    bstrncpy(dirname, director->hdr.name, sizeof(dirname));
     * Send my name to the File daemon then do authentication
     */
    bstrncpy(dirname, director->hdr.name, sizeof(dirname));


@@ -128,96 +179,211 @@ int authenticate_file_daemon(JCR *jcr)
    btimer_t *tid = start_bsock_timer(fd, AUTH_TIMEOUT);
    if (!bnet_fsend(fd, hello, dirname)) {
       stop_bsock_timer(tid);
    btimer_t *tid = start_bsock_timer(fd, AUTH_TIMEOUT);
    if (!bnet_fsend(fd, hello, dirname)) {
       stop_bsock_timer(tid);

-      Jmsg(jcr, M_FATAL, 0, _("Error sending Hello to File daemon. ERR=%s\n"), bnet_strerror(fd));
+      Jmsg(jcr, M_FATAL, 0, _("Error sending Hello to File daemon on \"%s:%d\". ERR=%s\n"), 
+           fd->host(), fd->port(), bnet_strerror(fd));

       return 0;
    }
       return 0;
    }

-   get_auth = cram_md5_get_auth(fd, jcr->client->password, ssl_need);  
-   if (get_auth) {
-      auth = cram_md5_auth(fd, jcr->client->password, ssl_need);  
-      if (!auth) {
-         Dmsg1(50, "cram_auth failed for %s\n", fd->who);
+   Dmsg1(50, "Sent: %s", fd->msg);
+
+   /* TLS Requirement */
+   if (client->tls_enable) {
+     if (client->tls_require) {
+        tls_local_need = BNET_TLS_REQUIRED;
+     } else {
+        tls_local_need = BNET_TLS_OK;
+     }
+   }
+
+   auth_success = cram_md5_respond(fd, client->password, &tls_remote_need, &compatible);
+   if (auth_success) {
+      auth_success = cram_md5_challenge(fd, client->password, tls_local_need, compatible);
+      if (!auth_success) {
+         Dmsg1(50, "cram_auth failed for %s\n", fd->who());

       }
    } else {
       }
    } else {

-      Dmsg1(50, "cram_get_auth failed for %s\n", fd->who);
+      Dmsg1(50, "cram_get_auth failed for %s\n", fd->who());

    }
    }

-   if (!get_auth || !auth) {
+   if (!auth_success) {

       stop_bsock_timer(tid);
       Dmsg0(50, _("Director and File daemon passwords or names not the same.\n"));
       Jmsg(jcr, M_FATAL, 0,
       stop_bsock_timer(tid);
       Dmsg0(50, _("Director and File daemon passwords or names not the same.\n"));
       Jmsg(jcr, M_FATAL, 0,

-            _("Unable to authenticate with File daemon. Possible causes:\n"
+            _("Unable to authenticate with File daemon on \"%s:%d\". Possible causes:\n"

             "Passwords or names not the same or\n"
             "Maximum Concurrent Jobs exceeded on the FD or\n"
             "FD networking messed up (restart daemon).\n"
             "Passwords or names not the same or\n"
             "Maximum Concurrent Jobs exceeded on the FD or\n"
             "FD networking messed up (restart daemon).\n"

-            "Please see http://www.bacula.org/html-manual/faq.html#AuthorizationErrors for help.\n"));
+            "Please see http://www.bacula.org/rel-manual/faq.html#AuthorizationErrors for help.\n"),
+            fd->host(), fd->port());

       return 0;
    }
       return 0;
    }

+
+   /* Verify that the remote host is willing to meet our TLS requirements */
+   if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
+      stop_bsock_timer(tid);
+      Jmsg(jcr, M_FATAL, 0, _("Authorization problem: FD \"%s:%s\" did not advertise required TLS support.\n"),
+           fd->who(), fd->host());
+      return 0;
+   }
+
+   /* Verify that we are willing to meet the remote host's requirements */
+   if (tls_remote_need > tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
+      stop_bsock_timer(tid);
+      Jmsg(jcr, M_FATAL, 0, _("Authorization problem: FD on \"%s:%d\" requires TLS.\n"),
+           fd->host(), fd->port());
+      return 0;
+   }
+
+   /* Is TLS Enabled? */
+   if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) {
+      /* Engage TLS! Full Speed Ahead! */
+      if (!bnet_tls_client(client->tls_ctx, fd, client->tls_allowed_cns)) {
+
+         stop_bsock_timer(tid);
+         Jmsg(jcr, M_FATAL, 0, _("TLS negotiation failed with FD on \"%s:%d\".\n"),
+              fd->host(), fd->port());
+         return 0;
+      }
+   }
+

    Dmsg1(116, ">filed: %s", fd->msg);
    if (bnet_recv(fd) <= 0) {
       stop_bsock_timer(tid);
       Dmsg1(50, _("Bad response from File daemon to Hello command: ERR=%s\n"),
    Dmsg1(116, ">filed: %s", fd->msg);
    if (bnet_recv(fd) <= 0) {
       stop_bsock_timer(tid);
       Dmsg1(50, _("Bad response from File daemon to Hello command: ERR=%s\n"),

-        bnet_strerror(fd));
-      Jmsg(jcr, M_FATAL, 0, _("Bad response from File daemon to Hello command: ERR=%s\n"),
-        bnet_strerror(fd));
+         bnet_strerror(fd));
+      Jmsg(jcr, M_FATAL, 0, _("Bad response from File daemon on \"%s:%d\" to Hello command: ERR=%s\n"),
+         fd->host(), fd->port(), bnet_strerror(fd));

       return 0;
    }
    Dmsg1(110, "<stored: %s", fd->msg);
    stop_bsock_timer(tid);
    if (strncmp(fd->msg, FDOKhello, sizeof(FDOKhello)) != 0) {
       Dmsg0(50, _("File daemon rejected Hello command\n"));
       return 0;
    }
    Dmsg1(110, "<stored: %s", fd->msg);
    stop_bsock_timer(tid);
    if (strncmp(fd->msg, FDOKhello, sizeof(FDOKhello)) != 0) {
       Dmsg0(50, _("File daemon rejected Hello command\n"));

-      Jmsg(jcr, M_FATAL, 0, _("File daemon rejected Hello command\n"));
+      Jmsg(jcr, M_FATAL, 0, _("File daemon on \"%s:%d\" rejected Hello command\n"),
+           fd->host(), fd->port());

       return 0;
    }
    return 1;
 }
 
       return 0;
    }
    return 1;
 }
 

-/********************************************************************* 
+/*********************************************************************

  *
  */
  *
  */

-int authenticate_user_agent(UAContext *uac) 
+int authenticate_user_agent(UAContext *uac)

 {
    char name[MAX_NAME_LENGTH];
 {
    char name[MAX_NAME_LENGTH];

-   int ssl_need = BNET_SSL_NONE;
-   bool ok;    
+   int tls_local_need = BNET_TLS_NONE;
+   int tls_remote_need = BNET_TLS_NONE;
+   int compatible = true;
+   CONRES *cons = NULL;

    BSOCK *ua = uac->UA_sock;
    BSOCK *ua = uac->UA_sock;

+   bool auth_success = false;
+   TLS_CONTEXT *tls_ctx = NULL;
+   alist *verify_list = NULL;
+ 

 
 

-//  Emsg4(M_INFO, 0, _("UA Hello from %s:%s:%d is invalid. Len=%d\n"), ua->who,
-//         ua->host, ua->port, ua->msglen);
+//  Emsg4(M_INFO, 0, _("UA Hello from %s:%s:%d is invalid. Len=%d\n"), ua->who(),
+//          ua->host(), ua->port(), ua->msglen);

    if (ua->msglen < 16 || ua->msglen >= MAX_NAME_LENGTH + 15) {
    if (ua->msglen < 16 || ua->msglen >= MAX_NAME_LENGTH + 15) {

-      Emsg4(M_ERROR, 0, _("UA Hello from %s:%s:%d is invalid. Len=%d\n"), ua->who,
-           ua->host, ua->port, ua->msglen);
+      Emsg4(M_ERROR, 0, _("UA Hello from %s:%s:%d is invalid. Len=%d\n"), ua->who(),
+            ua->host(), ua->port(), ua->msglen);

       return 0;
    }
 
    if (sscanf(ua->msg, "Hello %127s calling\n", name) != 1) {
       return 0;
    }
 
    if (sscanf(ua->msg, "Hello %127s calling\n", name) != 1) {

-      ua->msg[100] = 0;              /* terminate string */
-      Emsg4(M_ERROR, 0, _("UA Hello from %s:%s:%d is invalid. Got: %s\n"), ua->who,
-           ua->host, ua->port, ua->msg);
+      ua->msg[100] = 0;               /* terminate string */
+      Emsg4(M_ERROR, 0, _("UA Hello from %s:%s:%d is invalid. Got: %s\n"), ua->who(),
+            ua->host(), ua->port(), ua->msg);

       return 0;
    }
       return 0;
    }

-   name[sizeof(name)-1] = 0;            /* terminate name */
+
+   name[sizeof(name)-1] = 0;             /* terminate name */

    if (strcmp(name, "*UserAgent*") == 0) {  /* default console */
    if (strcmp(name, "*UserAgent*") == 0) {  /* default console */

-      ok = cram_md5_auth(ua, director->password, ssl_need) &&
-          cram_md5_get_auth(ua, director->password, ssl_need);
+      /* TLS Requirement */
+      if (director->tls_enable) {
+         if (director->tls_require) {
+            tls_local_need = BNET_TLS_REQUIRED;
+         } else {
+            tls_local_need = BNET_TLS_OK;
+         }
+      }
+
+      if (director->tls_verify_peer) {
+         verify_list = director->tls_allowed_cns;
+      }
+
+      auth_success = cram_md5_challenge(ua, director->password, tls_local_need,
+                                        compatible) &&
+                     cram_md5_respond(ua, director->password, &tls_remote_need, &compatible);

    } else {
    } else {

-      unbash_spaces(name); 
-      CONRES *cons = (CONRES *)GetResWithName(R_CONSOLE, name);
+      unbash_spaces(name);
+      cons = (CONRES *)GetResWithName(R_CONSOLE, name);

       if (cons) {
       if (cons) {

-        ok = cram_md5_auth(ua, cons->password, ssl_need) &&
-             cram_md5_get_auth(ua, cons->password, ssl_need);
-        if (ok) {
-           uac->cons = cons;         /* save console resource pointer */
-        }
+         /* TLS Requirement */
+         if (cons->tls_enable) {
+            if (cons->tls_require) {
+               tls_local_need = BNET_TLS_REQUIRED;
+            } else {
+               tls_local_need = BNET_TLS_OK;
+            }
+         }
+
+         if (cons->tls_verify_peer) {
+            verify_list = cons->tls_allowed_cns;
+         }
+
+         auth_success = cram_md5_challenge(ua, cons->password, tls_local_need,
+                                           compatible) &&
+                     cram_md5_respond(ua, cons->password, &tls_remote_need, &compatible);
+
+         if (auth_success) {
+            uac->cons = cons;         /* save console resource pointer */
+         }

       } else {
       } else {

-        ok = false;
+         auth_success = false;
+         goto auth_done;

       }
    }
       }
    }

-   if (!ok) {
+
+   /* Verify that the remote peer is willing to meet our TLS requirements */
+   if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
+      Emsg0(M_FATAL, 0, _("Authorization problem:"
+            " Remote client did not advertise required TLS support.\n"));
+      auth_success = false;
+      goto auth_done;
+   }
+
+   /* Verify that we are willing to meet the peer's requirements */
+   if (tls_remote_need > tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
+      Emsg0(M_FATAL, 0, _("Authorization problem:"
+            " Remote client requires TLS.\n"));
+      auth_success = false;
+      goto auth_done;
+   }
+
+   if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) {
+      if (cons) {
+         tls_ctx = cons->tls_ctx;
+      } else {
+         tls_ctx = director->tls_ctx;
+      }
+
+      /* Engage TLS! Full Speed Ahead! */
+      if (!bnet_tls_server(tls_ctx, ua, verify_list)) {
+         Emsg0(M_ERROR, 0, _("TLS negotiation failed.\n"));
+         auth_success = false;
+         goto auth_done;
+      }
+   }
+
+
+/* Authorization Completed */
+auth_done:
+   if (!auth_success) {

       bnet_fsend(ua, "%s", _(Dir_sorry));
       Emsg4(M_ERROR, 0, _("Unable to authenticate console \"%s\" at %s:%s:%d.\n"),
       bnet_fsend(ua, "%s", _(Dir_sorry));
       Emsg4(M_ERROR, 0, _("Unable to authenticate console \"%s\" at %s:%s:%d.\n"),

-           name, ua->who, ua->host, ua->port);
+            name, ua->who(), ua->host(), ua->port());

       sleep(5);
       return 0;
    }
       sleep(5);
       return 0;
    }

-   bnet_fsend(ua, "1000 OK: %s Version: " VERSION " (" BDATE ")\n", my_name);
+   bnet_fsend(ua, _("1000 OK: %s Version: %s (%s)\n"), my_name, VERSION, BDATE);

    return 1;
 }
    return 1;
 }