+ int tls_local_need = BNET_TLS_NONE;
+ int tls_remote_need = BNET_TLS_NONE;
+ bool auth_success = false;
+
+#ifdef HAVE_TLS
+ /* TLS Requirement */
+ if (me->tls_enable) {
+ if (me->tls_require) {
+ tls_local_need = BNET_TLS_REQUIRED;
+ } else {
+ tls_local_need = BNET_TLS_OK;
+ }
+ }
+#endif /* HAVE_TLS */
+
+ btimer_t *tid = start_bsock_timer(sd, AUTH_TIMEOUT);
+ auth_success = cram_md5_get_auth(sd, jcr->sd_auth_key, &tls_remote_need);
+ if (!auth_success) {
+ Dmsg1(50, "cram_get_auth failed for %s\n", sd->who);
+ } else {
+ auth_success = cram_md5_auth(sd, jcr->sd_auth_key, tls_local_need);
+ if (!auth_success) {
+ Dmsg1(50, "cram_auth failed for %s\n", sd->who);
+ }
+ }
+
+ /* Destroy session key */
+ memset(jcr->sd_auth_key, 0, strlen(jcr->sd_auth_key));
+
+ if (!auth_success) {
+ Jmsg(jcr, M_FATAL, 0, _("Authorization key rejected by Storage daemon.\n"
+ "Please see http://www.bacula.org/rel-manual/faq.html#AuthorizationErrors for help.\n"));
+ goto auth_fatal;
+ }
+
+ /* Verify that the remote host is willing to meet our TLS requirements */
+ if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
+ Jmsg(jcr, M_FATAL, 0, _("Authorization problem: Remote server did not"
+ " advertise required TLS support.\n"));
+ auth_success = false;
+ goto auth_fatal;
+ }
+
+ /* Verify that we are willing to meet the remote host's requirements */
+ if (tls_remote_need > tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
+ Jmsg(jcr, M_FATAL, 0, _("Authorization problem: Remote server requires TLS.\n"));
+ auth_success = false;
+ goto auth_fatal;
+ }
+
+#ifdef HAVE_TLS
+ if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) {
+ /* Engage TLS! Full Speed Ahead! */
+ if (!bnet_tls_client(me->tls_ctx, sd)) {
+ Jmsg(jcr, M_FATAL, 0, _("TLS negotiation failed.\n"));
+ auth_success = false;
+ goto auth_fatal;
+ }
+ }
+#endif /* HAVE_TLS */