Win32 tweaks

[bacula/bacula] / bacula / src / console / authenticate.c

diff --git a/bacula/src/console/authenticate.c b/bacula/src/console/authenticate.c
index fe242c256b332af2c63ed57bb76750407d618e6d..52b6f2ad9af86378d00e3a989f38d49292d89d96 100644 (file)
--- a/bacula/src/console/authenticate.c
+++ b/bacula/src/console/authenticate.c
@@ -11,22 +11,18 @@
  *
  */
 /*
-   Copyright (C) 2001-2004 Kern Sibbald and John Walker
+   Copyright (C) 2001-2005 Kern Sibbald
 
    This program is free software; you can redistribute it and/or
    modify it under the terms of the GNU General Public License
-   as published by the Free Software Foundation; either version 2
-   of the License, or (at your option) any later version.
+   version 2 as amended with additional clauses defined in the
+   file LICENSE in the main source directory.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 
+   the file LICENSE for additional details.
 
-   You should have received a copy of the GNU General Public
-   License along with this program; if not, write to the Free
-   Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, 
-   MA 02111-1307, USA.
  */
 
 #include "bacula.h"
@@ -35,13 +31,13 @@
 
 
 void senditf(const char *fmt, ...);
-void sendit(const char *buf); 
+void sendit(const char *buf);
 
 /* Commands sent to Director */
-static char hello[]    = "Hello %s calling\n";
+static char hello[]    = N_("Hello %s calling\n");
 
 /* Response from Director */
-static char OKhello[]   = "1000 OK:";
+static char OKhello[]   = N_("1000 OK:");
 
 /* Forward referenced functions */
 
@@ -51,48 +47,105 @@ static char OKhello[]   = "1000 OK:";
 int authenticate_director(JCR *jcr, DIRRES *director, CONRES *cons)
 {
    BSOCK *dir = jcr->dir_bsock;
-   int ssl_need = BNET_SSL_NONE;
+   int tls_local_need = BNET_TLS_NONE;
+   int tls_remote_need = BNET_TLS_NONE;
    char bashed_name[MAX_NAME_LENGTH];
    char *password;
+   TLS_CONTEXT *tls_ctx = NULL;
 
-   /* 
+   /*
     * Send my name to the Director then do authentication
     */
    if (cons) {
       bstrncpy(bashed_name, cons->hdr.name, sizeof(bashed_name));
       bash_spaces(bashed_name);
       password = cons->password;
+      /* TLS Requirement */
+      if (cons->tls_enable) {
+         if (cons->tls_require) {
+            tls_local_need = BNET_TLS_REQUIRED;
+         } else {
+            tls_local_need = BNET_TLS_OK;
+         }
+      }
+
+      tls_ctx = cons->tls_ctx;
    } else {
       bstrncpy(bashed_name, "*UserAgent*", sizeof(bashed_name));
       password = director->password;
+      /* TLS Requirement */
+      if (director->tls_enable) {
+         if (director->tls_require) {
+            tls_local_need = BNET_TLS_REQUIRED;
+         } else {
+            tls_local_need = BNET_TLS_OK;
+         }
+      }
+
+      tls_ctx = director->tls_ctx;
    }
+
+   
    /* Timeout Hello after 5 mins */
    btimer_t *tid = start_bsock_timer(dir, 60 * 5);
    bnet_fsend(dir, hello, bashed_name);
 
-   if (!cram_md5_get_auth(dir, password, ssl_need) || 
-       !cram_md5_auth(dir, password, ssl_need)) {
-      stop_bsock_timer(tid);
-      sendit( _("Director authorization problem.\n"
-            "Most likely the passwords do not agree.\n"     
-       "Please see http://www.bacula.org/html-manual/faq.html#AuthorizationErrors for help.\n"));
-      return 0;
+   if (!cram_md5_get_auth(dir, password, &tls_remote_need) ||
+       !cram_md5_auth(dir, password, tls_local_need)) {
+      goto bail_out;
+   }
+
+   /* Verify that the remote host is willing to meet our TLS requirements */
+   if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
+      sendit(_("Authorization problem:"
+             " Remote server did not advertise required TLS support.\n"));
+      goto bail_out;
+   }
+
+   /* Verify that we are willing to meet the remote host's requirements */
+   if (tls_remote_need > tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
+      sendit(_("Authorization problem:"
+             " Remote server requires TLS.\n"));
+      goto bail_out;
    }
 
+   /* Is TLS Enabled? */
+   if (have_tls) {
+      if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) {
+         /* Engage TLS! Full Speed Ahead! */
+         if (!bnet_tls_client(tls_ctx, dir)) {
+            sendit(_("TLS negotiation failed\n"));
+            goto bail_out;
+         }
+      }
+   }
+
+   /*
+    * It's possible that the TLS connection will
+    * be dropped here if an invalid client certificate was presented
+    */
    Dmsg1(6, ">dird: %s", dir->msg);
    if (bnet_recv(dir) <= 0) {
-      stop_bsock_timer(tid);
       senditf(_("Bad response to Hello command: ERR=%s\n"),
-        bnet_strerror(dir));
-      return 0;
+         bnet_strerror(dir));
+      goto bail_out;
    }
+
    Dmsg1(10, "<dird: %s", dir->msg);
-   stop_bsock_timer(tid);
    if (strncmp(dir->msg, OKhello, sizeof(OKhello)-1) != 0) {
       sendit(_("Director rejected Hello command\n"));
-      return 0;
+      goto bail_out;
    } else {
       sendit(dir->msg);
    }
+   stop_bsock_timer(tid);
    return 1;
+
+bail_out:
+   stop_bsock_timer(tid);
+   sendit( _("Director authorization problem.\n"
+             "Most likely the passwords do not agree.\n"
+             "If you are using TLS, there may have been a certificate validation error during the TLS handshake.\n"
+             "Please see http://www.bacula.org/rel-manual/faq.html#AuthorizationErrors for help.\n"));
+   return 0;
 }