X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=bacula%2Fsrc%2Ffiled%2Fauthenticate.c;h=7609d108eb66f621c23ef9a83bb05ef7246ebfe7;hb=2c10d832689907ccbbd02369a7a397c545145837;hp=1a2b6b4d7242ffb85ac8a722bc3afdb89d2aa6ef;hpb=b5752d5d38754259dc2bb30e1461ae0431c2333d;p=bacula%2Fbacula diff --git a/bacula/src/filed/authenticate.c b/bacula/src/filed/authenticate.c index 1a2b6b4d72..7609d108eb 100644 --- a/bacula/src/filed/authenticate.c +++ b/bacula/src/filed/authenticate.c @@ -4,28 +4,23 @@ * Kern Sibbald, October 2000 * * Version $Id$ - * + * */ /* - Copyright (C) 2000, 2001, 2002 Kern Sibbald and John Walker + Copyright (C) 2000-2005 Kern Sibbald This program is free software; you can redistribute it and/or - modify it under the terms of the GNU General Public License as - published by the Free Software Foundation; either version 2 of - the License, or (at your option) any later version. + modify it under the terms of the GNU General Public License + version 2 as amended with additional clauses defined in the + file LICENSE in the main source directory. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - General Public License for more details. - - You should have received a copy of the GNU General Public - License along with this program; if not, write to the Free - Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, - MA 02111-1307, USA. + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + the file LICENSE for additional details. */ - + #include "bacula.h" #include "filed.h" @@ -33,45 +28,129 @@ static char OK_hello[] = "2000 OK Hello\n"; static char Dir_sorry[] = "2999 No go\n"; -/********************************************************************* +/********************************************************************* * */ -static int authenticate(int rcode, BSOCK *bs) +static int authenticate(int rcode, BSOCK *bs, JCR* jcr) { - char *name; + POOLMEM *dirname; DIRRES *director; + int tls_local_need = BNET_TLS_NONE; + int tls_remote_need = BNET_TLS_NONE; + bool auth_success = false; + alist *verify_list = NULL; if (rcode != R_DIRECTOR) { + Dmsg1(50, "I only authenticate directors, not %d\n", rcode); Emsg1(M_FATAL, 0, _("I only authenticate directors, not %d\n"), rcode); return 0; } - name = (char *) get_pool_memory(PM_MESSAGE); - name = (char *) check_pool_memory_size(name, bs->msglen); + if (bs->msglen < 25 || bs->msglen > 200) { + Dmsg2(50, "Bad Hello command from Director at %s. Len=%d.\n", + bs->who, bs->msglen); + Emsg2(M_FATAL, 0, _("Bad Hello command from Director at %s. Len=%d.\n"), + bs->who, bs->msglen); + return 0; + } + dirname = get_pool_memory(PM_MESSAGE); + dirname = check_pool_memory_size(dirname, bs->msglen); - if (sscanf(bs->msg, "Hello Director %s calling\n", name) != 1) { - free_pool_memory(name); - Emsg1(M_FATAL, 0, _("Authentication failure: %s"), bs->msg); + if (sscanf(bs->msg, "Hello Director %s calling\n", dirname) != 1) { + free_pool_memory(dirname); + bs->msg[100] = 0; + Dmsg2(50, "Bad Hello command from Director at %s: %s\n", + bs->who, bs->msg); + Emsg2(M_FATAL, 0, _("Bad Hello command from Director at %s: %s\n"), + bs->who, bs->msg); return 0; } - director = NULL; + unbash_spaces(dirname); LockRes(); - while ((director=(DIRRES *)GetNextRes(rcode, (RES *)director))) { - if (strcmp(director->hdr.name, name) == 0) - break; + foreach_res(director, R_DIRECTOR) { + if (strcmp(director->hdr.name, dirname) == 0) + break; } UnlockRes(); - if (director && (!cram_md5_auth(bs, director->password) || - !cram_md5_get_auth(bs, director->password))) { + if (!director) { + Dmsg2(50, "Connection from unknown Director %s at %s rejected.\n", + dirname, bs->who); + Emsg2(M_FATAL, 0, _("Connection from unknown Director %s at %s rejected.\n" + "Please see http://www.bacula.org/rel-manual/faq.html#AuthorizationErrors for help.\n"), + dirname, bs->who); + free_pool_memory(dirname); + return 0; + } + + if (have_tls) { + /* TLS Requirement */ + if (director->tls_enable) { + if (director->tls_require) { + tls_local_need = BNET_TLS_REQUIRED; + } else { + tls_local_need = BNET_TLS_OK; + } + } + + if (director->tls_verify_peer) { + verify_list = director->tls_allowed_cns; + } + } + + btimer_t *tid = start_bsock_timer(bs, AUTH_TIMEOUT); + auth_success = cram_md5_auth(bs, director->password, tls_local_need); + if (auth_success) { + auth_success = cram_md5_get_auth(bs, director->password, &tls_remote_need); + if (!auth_success) { + Dmsg1(50, "cram_get_auth failed for %s\n", bs->who); + } + } else { + Dmsg1(50, "cram_auth failed for %s\n", bs->who); + } + if (!auth_success) { + Emsg1(M_FATAL, 0, _("Incorrect password given by Director at %s.\n" + "Please see http://www.bacula.org/rel-manual/faq.html#AuthorizationErrors for help.\n"), + bs->who); + director = NULL; + goto auth_fatal; + } + + /* Verify that the remote host is willing to meet our TLS requirements */ + if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) { + Emsg0(M_FATAL, 0, _("Authorization problem: Remote server did not" + " advertise required TLS support.\n")); + director = NULL; + goto auth_fatal; + } + + /* Verify that we are willing to meet the remote host's requirements */ + if (tls_remote_need > tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) { + Emsg0(M_FATAL, 0, _("Authorization problem: Remote server requires TLS.\n")); director = NULL; + goto auth_fatal; } - free_pool_memory(name); + + if (have_tls) { + if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) { + /* Engage TLS! Full Speed Ahead! */ + if (!bnet_tls_server(director->tls_ctx, bs, verify_list)) { + Emsg0(M_FATAL, 0, _("TLS negotiation failed.\n")); + director = NULL; + goto auth_fatal; + } + } + } + +auth_fatal: + stop_bsock_timer(tid); + free_pool_memory(dirname); + jcr->director = director; return (director != NULL); } /* * Inititiate the communications with the Director. * He has made a connection to our server. - * + * * Basic tasks done here: * We read Director's initial message and authorize him. * @@ -80,9 +159,10 @@ int authenticate_director(JCR *jcr) { BSOCK *dir = jcr->dir_bsock; - if (!authenticate(R_DIRECTOR, dir)) { + if (!authenticate(R_DIRECTOR, dir, jcr)) { bnet_fsend(dir, "%s", Dir_sorry); - Emsg0(M_ERROR, 0, _("Unable to authenticate Director\n")); + Emsg0(M_FATAL, 0, _("Unable to authenticate Director\n")); + bmicrosleep(5, 0); return 0; } return bnet_fsend(dir, "%s", OK_hello); @@ -95,7 +175,68 @@ int authenticate_director(JCR *jcr) int authenticate_storagedaemon(JCR *jcr) { BSOCK *sd = jcr->store_bsock; + int tls_local_need = BNET_TLS_NONE; + int tls_remote_need = BNET_TLS_NONE; + bool auth_success = false; + +#ifdef HAVE_TLS + /* TLS Requirement */ + if (me->tls_enable) { + if (me->tls_require) { + tls_local_need = BNET_TLS_REQUIRED; + } else { + tls_local_need = BNET_TLS_OK; + } + } +#endif /* HAVE_TLS */ + + btimer_t *tid = start_bsock_timer(sd, AUTH_TIMEOUT); + auth_success = cram_md5_get_auth(sd, jcr->sd_auth_key, &tls_remote_need); + if (!auth_success) { + Dmsg1(50, "cram_get_auth failed for %s\n", sd->who); + } else { + auth_success = cram_md5_auth(sd, jcr->sd_auth_key, tls_local_need); + if (!auth_success) { + Dmsg1(50, "cram_auth failed for %s\n", sd->who); + } + } + + /* Destroy session key */ + memset(jcr->sd_auth_key, 0, strlen(jcr->sd_auth_key)); + + if (!auth_success) { + Jmsg(jcr, M_FATAL, 0, _("Authorization key rejected by Storage daemon.\n" + "Please see http://www.bacula.org/rel-manual/faq.html#AuthorizationErrors for help.\n")); + goto auth_fatal; + } + + /* Verify that the remote host is willing to meet our TLS requirements */ + if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) { + Jmsg(jcr, M_FATAL, 0, _("Authorization problem: Remote server did not" + " advertise required TLS support.\n")); + auth_success = false; + goto auth_fatal; + } + + /* Verify that we are willing to meet the remote host's requirements */ + if (tls_remote_need > tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) { + Jmsg(jcr, M_FATAL, 0, _("Authorization problem: Remote server requires TLS.\n")); + auth_success = false; + goto auth_fatal; + } + +#ifdef HAVE_TLS + if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) { + /* Engage TLS! Full Speed Ahead! */ + if (!bnet_tls_client(me->tls_ctx, sd)) { + Jmsg(jcr, M_FATAL, 0, _("TLS negotiation failed.\n")); + auth_success = false; + goto auth_fatal; + } + } +#endif /* HAVE_TLS */ - return cram_md5_get_auth(sd, jcr->sd_auth_key) && - cram_md5_auth(sd, jcr->sd_auth_key); +auth_fatal: + stop_bsock_timer(tid); + return auth_success; }