+ int tls_local_need = BNET_TLS_NONE;
+ int tls_remote_need = BNET_TLS_NONE;
+ int compatible = true; /* require md5 compatible FD */
+ bool auth_success = false;
+ alist *verify_list = NULL;
+
+ /* TLS Requirement */
+ if (me->tls_enable) {
+ if (me->tls_require) {
+ tls_local_need = BNET_TLS_REQUIRED;
+ } else {
+ tls_local_need = BNET_TLS_OK;
+ }
+ }
+
+ if (me->tls_authenticate) {
+ tls_local_need = BNET_TLS_REQUIRED;
+ }
+
+ if (me->tls_verify_peer) {
+ verify_list = me->tls_allowed_cns;
+ }
+
+ /* Timeout Hello after 5 mins */
+ btimer_t *tid = start_bsock_timer(fd, AUTH_TIMEOUT);
+ /* Challenge FD */
+ auth_success = cram_md5_challenge(fd, jcr->sd_auth_key, tls_local_need, compatible);
+ if (auth_success) {
+ /* Respond to his challenge */
+ auth_success = cram_md5_respond(fd, jcr->sd_auth_key, &tls_remote_need, &compatible);
+ if (!auth_success) {
+ Dmsg1(dbglvl, "cram-get-auth failed with %s\n", fd->who());
+ }
+ } else {
+ Dmsg1(dbglvl, "cram-auth failed with %s\n", fd->who());
+ }
+
+ if (!auth_success) {
+ Jmsg(jcr, M_FATAL, 0, _("Incorrect authorization key from File daemon at %s rejected.\n"
+ "Please see http://www.bacula.org/rel-manual/faq.html#AuthorizationErrors for help.\n"),
+ fd->who());
+ auth_success = false;
+ goto auth_fatal;
+ }
+
+ /* Verify that the remote host is willing to meet our TLS requirements */
+ if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
+ Jmsg(jcr, M_FATAL, 0, _("Authorization problem: Remote server did not"
+ " advertize required TLS support.\n"));
+ Dmsg2(dbglvl, "remote_need=%d local_need=%d\n", tls_remote_need, tls_local_need);
+ auth_success = false;
+ goto auth_fatal;
+ }