Fix problem in BVFS with concurrent queries

[bacula/bacula] / bacula / src / dird / authenticate.c

diff --git a/bacula/src/dird/authenticate.c b/bacula/src/dird/authenticate.c
index f18e0a4e53ce9cd93730e5f832fe341ca3e148db..a69b2779dc8996412e9a4a161f5dd621ba1ab20a 100644 (file)
--- a/bacula/src/dird/authenticate.c
+++ b/bacula/src/dird/authenticate.c
@@ -1,3 +1,30 @@
+/*
+   Bacula® - The Network Backup Solution
+
+   Copyright (C) 2001-2008 Free Software Foundation Europe e.V.
+
+   The main author of Bacula is Kern Sibbald, with contributions from
+   many others, a complete list can be found in the file AUTHORS.
+   This program is Free Software; you can redistribute it and/or
+   modify it under the terms of version three of the GNU Affero General Public
+   License as published by the Free Software Foundation and included
+   in the file LICENSE.
+
+   This program is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+   General Public License for more details.
+
+   You should have received a copy of the GNU Affero General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+   02110-1301, USA.
+
+   Bacula® is a registered trademark of Kern Sibbald.
+   The licensor of Bacula is the Free Software Foundation Europe
+   (FSFE), Fiduciary Program, Sumatrastrasse 25, 8006 Zürich,
+   Switzerland, email:ftf@fsfeurope.org.
+*/

 /*
  *
  *   Bacula Director -- authorize.c -- handles authorization of
 /*
  *
  *   Bacula Director -- authorize.c -- handles authorization of


@@ -10,34 +37,22 @@
  *   Version $Id$
  *
  */
  *   Version $Id$
  *
  */

-/*
-   Copyright (C) 2001-2005 Kern Sibbald
-
-   This program is free software; you can redistribute it and/or
-   modify it under the terms of the GNU General Public License
-   version 2 as amended with additional clauses defined in the
-   file LICENSE in the main source directory.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 
-   the file LICENSE for additional details.
-
- */

 
 #include "bacula.h"
 #include "dird.h"
 
 
 #include "bacula.h"
 #include "dird.h"
 

+static const int dbglvl = 50;
+

 extern DIRRES *director;
 extern DIRRES *director;

-extern char my_name[];

 
 /* Commands sent to Storage daemon and File daemon and received
  *  from the User Agent */
 static char hello[]    = "Hello Director %s calling\n";
 
 /* Response from Storage daemon */
 
 /* Commands sent to Storage daemon and File daemon and received
  *  from the User Agent */
 static char hello[]    = "Hello Director %s calling\n";
 
 /* Response from Storage daemon */

-static char OKhello[]   = "3000 OK Hello\n";
-static char FDOKhello[] = "2000 OK Hello\n";
+static char OKhello[]      = "3000 OK Hello\n";
+static char FDOKhello[]    = "2000 OK Hello\n";
+static char FDOKnewHello[] = "2000 OK Hello %d\n";

 
 /* Sent to User Agent */
 static char Dir_sorry[]  = "1999 You are not authorized.\n";
 
 /* Sent to User Agent */
 static char Dir_sorry[]  = "1999 You are not authorized.\n";


@@ -53,6 +68,7 @@ bool authenticate_storage_daemon(JCR *jcr, STORE *store)
    char dirname[MAX_NAME_LENGTH];
    int tls_local_need = BNET_TLS_NONE;
    int tls_remote_need = BNET_TLS_NONE;
    char dirname[MAX_NAME_LENGTH];
    int tls_local_need = BNET_TLS_NONE;
    int tls_remote_need = BNET_TLS_NONE;

+   int compatible = true;

    bool auth_success = false;
 
    /*
    bool auth_success = false;
 
    /*


@@ -62,9 +78,9 @@ bool authenticate_storage_daemon(JCR *jcr, STORE *store)
    bash_spaces(dirname);
    /* Timeout Hello after 1 min */
    btimer_t *tid = start_bsock_timer(sd, AUTH_TIMEOUT);
    bash_spaces(dirname);
    /* Timeout Hello after 1 min */
    btimer_t *tid = start_bsock_timer(sd, AUTH_TIMEOUT);

-   if (!bnet_fsend(sd, hello, dirname)) {
+   if (!sd->fsend(hello, dirname)) {

       stop_bsock_timer(tid);
       stop_bsock_timer(tid);

-      Dmsg1(50, _("Error sending Hello to Storage daemon. ERR=%s\n"), bnet_strerror(sd));
+      Dmsg1(dbglvl, _("Error sending Hello to Storage daemon. ERR=%s\n"), bnet_strerror(sd));

       Jmsg(jcr, M_FATAL, 0, _("Error sending Hello to Storage daemon. ERR=%s\n"), bnet_strerror(sd));
       return 0;
    }
       Jmsg(jcr, M_FATAL, 0, _("Error sending Hello to Storage daemon. ERR=%s\n"), bnet_strerror(sd));
       return 0;
    }


@@ -78,25 +94,30 @@ bool authenticate_storage_daemon(JCR *jcr, STORE *store)
      }
    }
 
      }
    }
 

-   auth_success = cram_md5_get_auth(sd, store->password, &tls_remote_need);
+   if (store->tls_authenticate) {
+      tls_local_need = BNET_TLS_REQUIRED;
+   }
+
+   auth_success = cram_md5_respond(sd, store->password, &tls_remote_need, &compatible);

    if (auth_success) {
    if (auth_success) {

-      auth_success = cram_md5_auth(sd, store->password, tls_local_need);
+      auth_success = cram_md5_challenge(sd, store->password, tls_local_need, compatible);

       if (!auth_success) {
       if (!auth_success) {

-         Dmsg1(50, "cram_auth failed for %s\n", sd->who);
+         Dmsg1(dbglvl, "cram_challenge failed for %s\n", sd->who());

       }
    } else {
       }
    } else {

-      Dmsg1(50, "cram_get_auth failed for %s\n", sd->who);
+      Dmsg1(dbglvl, "cram_respond failed for %s\n", sd->who());

    }
 
    if (!auth_success) {
       stop_bsock_timer(tid);
    }
 
    if (!auth_success) {
       stop_bsock_timer(tid);

-      Dmsg0(50, _("Director and Storage daemon passwords or names not the same.\n"));
-      Jmsg0(jcr, M_FATAL, 0,
-            _("Unable to authenticate with Storage daemon. Possible causes:\n"
+      Dmsg0(dbglvl, _("Director and Storage daemon passwords or names not the same.\n"));
+      Jmsg2(jcr, M_FATAL, 0,
+            _("Director unable to authenticate with Storage daemon at \"%s:%d\". Possible causes:\n"

             "Passwords or names not the same or\n"
             "Maximum Concurrent Jobs exceeded on the SD or\n"
             "SD networking messed up (restart daemon).\n"
             "Passwords or names not the same or\n"
             "Maximum Concurrent Jobs exceeded on the SD or\n"
             "SD networking messed up (restart daemon).\n"

-            "Please see http://www.bacula.org/rel-manual/faq.html#AuthorizationErrors for help.\n"));
+            "Please see " MANUAL_AUTH_URL " for help.\n"),
+            sd->host(), sd->port());

       return 0;
    }
 
       return 0;
    }
 


@@ -114,30 +135,33 @@ bool authenticate_storage_daemon(JCR *jcr, STORE *store)
       return 0;
    }
 
       return 0;
    }
 

-#ifdef HAVE_TLS

    /* Is TLS Enabled? */
    if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) {
       /* Engage TLS! Full Speed Ahead! */
    /* Is TLS Enabled? */
    if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) {
       /* Engage TLS! Full Speed Ahead! */

-      if (!bnet_tls_client(store->tls_ctx, sd)) {
+      if (!bnet_tls_client(store->tls_ctx, sd, NULL)) {

          stop_bsock_timer(tid);
          stop_bsock_timer(tid);

-         Jmsg(jcr, M_FATAL, 0, _("TLS negotiation failed.\n"));
+         Jmsg(jcr, M_FATAL, 0, _("TLS negotiation failed with SD at \"%s:%d\"\n"),
+            sd->host(), sd->port());

          return 0;
       }
          return 0;
       }

+      if (store->tls_authenticate) {       /* authentication only? */
+         sd->free_tls();                   /* yes, stop tls */
+      }

    }
    }

-#endif

 
    Dmsg1(116, ">stored: %s", sd->msg);
 
    Dmsg1(116, ">stored: %s", sd->msg);

-   if (bnet_recv(sd) <= 0) {
+   if (sd->recv() <= 0) {

       stop_bsock_timer(tid);
       stop_bsock_timer(tid);

-      Jmsg1(jcr, M_FATAL, 0, _("bdird<stored: bad response to Hello command: ERR=%s\n"),
-         bnet_strerror(sd));
+      Jmsg3(jcr, M_FATAL, 0, _("bdird<stored: \"%s:%s\" bad response to Hello command: ERR=%s\n"),
+         sd->who(), sd->host(), sd->bstrerror());

       return 0;
    }
    Dmsg1(110, "<stored: %s", sd->msg);
    stop_bsock_timer(tid);
    if (strncmp(sd->msg, OKhello, sizeof(OKhello)) != 0) {
       return 0;
    }
    Dmsg1(110, "<stored: %s", sd->msg);
    stop_bsock_timer(tid);
    if (strncmp(sd->msg, OKhello, sizeof(OKhello)) != 0) {

-      Dmsg0(50, _("Storage daemon rejected Hello command\n"));
-      Jmsg0(jcr, M_FATAL, 0, _("Storage daemon rejected Hello command\n"));
+      Dmsg0(dbglvl, _("Storage daemon rejected Hello command\n"));
+      Jmsg2(jcr, M_FATAL, 0, _("Storage daemon at \"%s:%d\" rejected Hello command\n"),
+         sd->host(), sd->port());

       return 0;
    }
    return 1;
       return 0;
    }
    return 1;


@@ -153,22 +177,24 @@ int authenticate_file_daemon(JCR *jcr)
    char dirname[MAX_NAME_LENGTH];
    int tls_local_need = BNET_TLS_NONE;
    int tls_remote_need = BNET_TLS_NONE;
    char dirname[MAX_NAME_LENGTH];
    int tls_local_need = BNET_TLS_NONE;
    int tls_remote_need = BNET_TLS_NONE;

+   int compatible = true;

    bool auth_success = false;
 
    /*
     * Send my name to the File daemon then do authentication
     */
    bool auth_success = false;
 
    /*
     * Send my name to the File daemon then do authentication
     */

-   bstrncpy(dirname, director->hdr.name, sizeof(dirname));
+   bstrncpy(dirname, director->name(), sizeof(dirname));

    bash_spaces(dirname);
    bash_spaces(dirname);

-   /* Timeout Hello after 10 mins */
+   /* Timeout Hello after 1 min */

    btimer_t *tid = start_bsock_timer(fd, AUTH_TIMEOUT);
    btimer_t *tid = start_bsock_timer(fd, AUTH_TIMEOUT);

-   if (!bnet_fsend(fd, hello, dirname)) {
+   if (!fd->fsend(hello, dirname)) {

       stop_bsock_timer(tid);
       stop_bsock_timer(tid);

-      Jmsg(jcr, M_FATAL, 0, _("Error sending Hello to File daemon. ERR=%s\n"), bnet_strerror(fd));
+      Jmsg(jcr, M_FATAL, 0, _("Error sending Hello to File daemon at \"%s:%d\". ERR=%s\n"), 
+           fd->host(), fd->port(), fd->bstrerror());

       return 0;
    }
       return 0;
    }

+   Dmsg1(dbglvl, "Sent: %s", fd->msg);

 
 

-#ifdef HAVE_TLS

    /* TLS Requirement */
    if (client->tls_enable) {
      if (client->tls_require) {
    /* TLS Requirement */
    if (client->tls_enable) {
      if (client->tls_require) {


@@ -177,69 +203,80 @@ int authenticate_file_daemon(JCR *jcr)
         tls_local_need = BNET_TLS_OK;
      }
    }
         tls_local_need = BNET_TLS_OK;
      }
    }

-#endif

 
 

-   auth_success = cram_md5_get_auth(fd, client->password, &tls_remote_need);
+   if (client->tls_authenticate) {
+      tls_local_need = BNET_TLS_REQUIRED;
+   }
+
+   auth_success = cram_md5_respond(fd, client->password, &tls_remote_need, &compatible);

    if (auth_success) {
    if (auth_success) {

-      auth_success = cram_md5_auth(fd, client->password, tls_local_need);
+      auth_success = cram_md5_challenge(fd, client->password, tls_local_need, compatible);

       if (!auth_success) {
       if (!auth_success) {

-         Dmsg1(50, "cram_auth failed for %s\n", fd->who);
+         Dmsg1(dbglvl, "cram_auth failed for %s\n", fd->who());

       }
    } else {
       }
    } else {

-      Dmsg1(50, "cram_get_auth failed for %s\n", fd->who);
+      Dmsg1(dbglvl, "cram_get_auth failed for %s\n", fd->who());

    }
    if (!auth_success) {
       stop_bsock_timer(tid);
    }
    if (!auth_success) {
       stop_bsock_timer(tid);

-      Dmsg0(50, _("Director and File daemon passwords or names not the same.\n"));
+      Dmsg0(dbglvl, _("Director and File daemon passwords or names not the same.\n"));

       Jmsg(jcr, M_FATAL, 0,
       Jmsg(jcr, M_FATAL, 0,

-            _("Unable to authenticate with File daemon. Possible causes:\n"
+            _("Unable to authenticate with File daemon at \"%s:%d\". Possible causes:\n"

             "Passwords or names not the same or\n"
             "Maximum Concurrent Jobs exceeded on the FD or\n"
             "FD networking messed up (restart daemon).\n"
             "Passwords or names not the same or\n"
             "Maximum Concurrent Jobs exceeded on the FD or\n"
             "FD networking messed up (restart daemon).\n"

-            "Please see http://www.bacula.org/rel-manual/faq.html#AuthorizationErrors for help.\n"));
+            "Please see " MANUAL_AUTH_URL " for help.\n"),
+            fd->host(), fd->port());

       return 0;
    }
 
    /* Verify that the remote host is willing to meet our TLS requirements */
    if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
       stop_bsock_timer(tid);
       return 0;
    }
 
    /* Verify that the remote host is willing to meet our TLS requirements */
    if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
       stop_bsock_timer(tid);

-      Jmsg(jcr, M_FATAL, 0, _("Authorization problem: Remote server did not advertise required TLS support.\n"));
+      Jmsg(jcr, M_FATAL, 0, _("Authorization problem: FD \"%s:%s\" did not advertise required TLS support.\n"),
+           fd->who(), fd->host());

       return 0;
    }
 
    /* Verify that we are willing to meet the remote host's requirements */
    if (tls_remote_need > tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
       stop_bsock_timer(tid);
       return 0;
    }
 
    /* Verify that we are willing to meet the remote host's requirements */
    if (tls_remote_need > tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
       stop_bsock_timer(tid);

-      Jmsg(jcr, M_FATAL, 0, _("Authorization problem: Remote server requires TLS.\n"));
+      Jmsg(jcr, M_FATAL, 0, _("Authorization problem: FD at \"%s:%d\" requires TLS.\n"),
+           fd->host(), fd->port());

       return 0;
    }
 
       return 0;
    }
 

-#ifdef HAVE_TLS

    /* Is TLS Enabled? */
    if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) {
       /* Engage TLS! Full Speed Ahead! */
    /* Is TLS Enabled? */
    if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) {
       /* Engage TLS! Full Speed Ahead! */

-      if (!bnet_tls_client(client->tls_ctx, fd)) {
+      if (!bnet_tls_client(client->tls_ctx, fd, client->tls_allowed_cns)) {

          stop_bsock_timer(tid);
          stop_bsock_timer(tid);

-         Jmsg(jcr, M_FATAL, 0, _("TLS negotiation failed.\n"));
+         Jmsg(jcr, M_FATAL, 0, _("TLS negotiation failed with FD at \"%s:%d\".\n"),
+              fd->host(), fd->port());

          return 0;
       }
          return 0;
       }

+      if (client->tls_authenticate) {        /* tls authentication only? */
+         fd->free_tls();                     /* yes, shutdown tls */
+      }

    }
    }

-#endif

 
    Dmsg1(116, ">filed: %s", fd->msg);
 
    Dmsg1(116, ">filed: %s", fd->msg);

-   if (bnet_recv(fd) <= 0) {
+   if (fd->recv() <= 0) {

       stop_bsock_timer(tid);
       stop_bsock_timer(tid);

-      Dmsg1(50, _("Bad response from File daemon to Hello command: ERR=%s\n"),
-         bnet_strerror(fd));
-      Jmsg(jcr, M_FATAL, 0, _("Bad response from File daemon to Hello command: ERR=%s\n"),
+      Dmsg1(dbglvl, _("Bad response from File daemon to Hello command: ERR=%s\n"),

          bnet_strerror(fd));
          bnet_strerror(fd));

+      Jmsg(jcr, M_FATAL, 0, _("Bad response from File daemon at \"%s:%d\" to Hello command: ERR=%s\n"),
+         fd->host(), fd->port(), fd->bstrerror());

       return 0;
    }
       return 0;
    }

-   Dmsg1(110, "<stored: %s", fd->msg);
+   Dmsg1(110, "<filed: %s", fd->msg);

    stop_bsock_timer(tid);
    stop_bsock_timer(tid);

-   if (strncmp(fd->msg, FDOKhello, sizeof(FDOKhello)) != 0) {
-      Dmsg0(50, _("File daemon rejected Hello command\n"));
-      Jmsg(jcr, M_FATAL, 0, _("File daemon rejected Hello command\n"));
+   jcr->FDVersion = 0;
+   if (strncmp(fd->msg, FDOKhello, sizeof(FDOKhello)) != 0 &&
+       sscanf(fd->msg, FDOKnewHello, &jcr->FDVersion) != 1) {
+      Dmsg0(dbglvl, _("File daemon rejected Hello command\n"));
+      Jmsg(jcr, M_FATAL, 0, _("File daemon at \"%s:%d\" rejected Hello command\n"),
+           fd->host(), fd->port());

       return 0;
    }
    return 1;
       return 0;
    }
    return 1;


@@ -253,33 +290,29 @@ int authenticate_user_agent(UAContext *uac)
    char name[MAX_NAME_LENGTH];
    int tls_local_need = BNET_TLS_NONE;
    int tls_remote_need = BNET_TLS_NONE;
    char name[MAX_NAME_LENGTH];
    int tls_local_need = BNET_TLS_NONE;
    int tls_remote_need = BNET_TLS_NONE;

+   bool tls_authenticate;
+   int compatible = true;

    CONRES *cons = NULL;
    BSOCK *ua = uac->UA_sock;
    bool auth_success = false;
    CONRES *cons = NULL;
    BSOCK *ua = uac->UA_sock;
    bool auth_success = false;

-#ifdef HAVE_TLS

    TLS_CONTEXT *tls_ctx = NULL;
    alist *verify_list = NULL;
    TLS_CONTEXT *tls_ctx = NULL;
    alist *verify_list = NULL;

-#endif /* HAVE_TLS */

  
  

-
-//  Emsg4(M_INFO, 0, _("UA Hello from %s:%s:%d is invalid. Len=%d\n"), ua->who,
-//          ua->host, ua->port, ua->msglen);

    if (ua->msglen < 16 || ua->msglen >= MAX_NAME_LENGTH + 15) {
    if (ua->msglen < 16 || ua->msglen >= MAX_NAME_LENGTH + 15) {

-      Emsg4(M_ERROR, 0, _("UA Hello from %s:%s:%d is invalid. Len=%d\n"), ua->who,
-            ua->host, ua->port, ua->msglen);
+      Emsg4(M_ERROR, 0, _("UA Hello from %s:%s:%d is invalid. Len=%d\n"), ua->who(),
+            ua->host(), ua->port(), ua->msglen);

       return 0;
    }
 
    if (sscanf(ua->msg, "Hello %127s calling\n", name) != 1) {
       ua->msg[100] = 0;               /* terminate string */
       return 0;
    }
 
    if (sscanf(ua->msg, "Hello %127s calling\n", name) != 1) {
       ua->msg[100] = 0;               /* terminate string */

-      Emsg4(M_ERROR, 0, _("UA Hello from %s:%s:%d is invalid. Got: %s\n"), ua->who,
-            ua->host, ua->port, ua->msg);
+      Emsg4(M_ERROR, 0, _("UA Hello from %s:%s:%d is invalid. Got: %s\n"), ua->who(),
+            ua->host(), ua->port(), ua->msg);

       return 0;
    }
 
    name[sizeof(name)-1] = 0;             /* terminate name */
    if (strcmp(name, "*UserAgent*") == 0) {  /* default console */
       return 0;
    }
 
    name[sizeof(name)-1] = 0;             /* terminate name */
    if (strcmp(name, "*UserAgent*") == 0) {  /* default console */

-#ifdef HAVE_TLS

       /* TLS Requirement */
       if (director->tls_enable) {
          if (director->tls_require) {
       /* TLS Requirement */
       if (director->tls_enable) {
          if (director->tls_require) {


@@ -289,18 +322,23 @@ int authenticate_user_agent(UAContext *uac)
          }
       }
 
          }
       }
 

+      tls_authenticate = director->tls_authenticate;
+
+      if (tls_authenticate) {
+         tls_local_need = BNET_TLS_REQUIRED;
+      }
+

       if (director->tls_verify_peer) {
          verify_list = director->tls_allowed_cns;
       }
       if (director->tls_verify_peer) {
          verify_list = director->tls_allowed_cns;
       }

-#endif /* HAVE_TLS */

 
 

-      auth_success = cram_md5_auth(ua, director->password, tls_local_need) &&
-           cram_md5_get_auth(ua, director->password, &tls_remote_need);
+      auth_success = cram_md5_challenge(ua, director->password, tls_local_need,
+                                        compatible) &&
+                     cram_md5_respond(ua, director->password, &tls_remote_need, &compatible);

    } else {
       unbash_spaces(name);
       cons = (CONRES *)GetResWithName(R_CONSOLE, name);
       if (cons) {
    } else {
       unbash_spaces(name);
       cons = (CONRES *)GetResWithName(R_CONSOLE, name);
       if (cons) {

-#ifdef HAVE_TLS

          /* TLS Requirement */
          if (cons->tls_enable) {
             if (cons->tls_require) {
          /* TLS Requirement */
          if (cons->tls_enable) {
             if (cons->tls_require) {


@@ -310,13 +348,19 @@ int authenticate_user_agent(UAContext *uac)
             }
          }
 
             }
          }
 

+         tls_authenticate = cons->tls_authenticate;
+
+         if (tls_authenticate) {
+            tls_local_need = BNET_TLS_REQUIRED;
+         }
+

          if (cons->tls_verify_peer) {
             verify_list = cons->tls_allowed_cns;
          }
          if (cons->tls_verify_peer) {
             verify_list = cons->tls_allowed_cns;
          }

-#endif /* HAVE_TLS */

 
 

-         auth_success = cram_md5_auth(ua, cons->password, tls_local_need) &&
-              cram_md5_get_auth(ua, cons->password, &tls_remote_need);
+         auth_success = cram_md5_challenge(ua, cons->password, tls_local_need,
+                                           compatible) &&
+                     cram_md5_respond(ua, cons->password, &tls_remote_need, &compatible);

 
          if (auth_success) {
             uac->cons = cons;         /* save console resource pointer */
 
          if (auth_success) {
             uac->cons = cons;         /* save console resource pointer */


@@ -327,6 +371,7 @@ int authenticate_user_agent(UAContext *uac)
       }
    }
 
       }
    }
 

+

    /* Verify that the remote peer is willing to meet our TLS requirements */
    if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
       Emsg0(M_FATAL, 0, _("Authorization problem:"
    /* Verify that the remote peer is willing to meet our TLS requirements */
    if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
       Emsg0(M_FATAL, 0, _("Authorization problem:"


@@ -343,7 +388,6 @@ int authenticate_user_agent(UAContext *uac)
       goto auth_done;
    }
 
       goto auth_done;
    }
 

-#ifdef HAVE_TLS

    if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) {
       if (cons) {
          tls_ctx = cons->tls_ctx;
    if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) {
       if (cons) {
          tls_ctx = cons->tls_ctx;


@@ -353,23 +397,25 @@ int authenticate_user_agent(UAContext *uac)
 
       /* Engage TLS! Full Speed Ahead! */
       if (!bnet_tls_server(tls_ctx, ua, verify_list)) {
 
       /* Engage TLS! Full Speed Ahead! */
       if (!bnet_tls_server(tls_ctx, ua, verify_list)) {

-         Emsg0(M_ERROR, 0, "TLS negotiation failed.\n");
+         Emsg0(M_ERROR, 0, _("TLS negotiation failed.\n"));

          auth_success = false;
          goto auth_done;
       }
          auth_success = false;
          goto auth_done;
       }

+      if (tls_authenticate) {            /* authentication only? */
+         ua->free_tls();                 /* stop tls */
+      }

    }
    }

-#endif /* HAVE_TLS */

 
 
 /* Authorization Completed */
 auth_done:
    if (!auth_success) {
 
 
 /* Authorization Completed */
 auth_done:
    if (!auth_success) {

-      bnet_fsend(ua, "%s", _(Dir_sorry));
+      ua->fsend("%s", _(Dir_sorry));

       Emsg4(M_ERROR, 0, _("Unable to authenticate console \"%s\" at %s:%s:%d.\n"),
       Emsg4(M_ERROR, 0, _("Unable to authenticate console \"%s\" at %s:%s:%d.\n"),

-            name, ua->who, ua->host, ua->port);
+            name, ua->who(), ua->host(), ua->port());

       sleep(5);
       return 0;
    }
       sleep(5);
       return 0;
    }

-   bnet_fsend(ua, "1000 OK: %s Version: " VERSION " (" BDATE ")\n", my_name);
+   ua->fsend(_("1000 OK: %s Version: %s (%s)\n"), my_name, VERSION, BDATE);

    return 1;
 }
    return 1;
 }