X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=bacula%2Fsrc%2Fstored%2Fauthenticate.c;h=bffb987e159539784e8d838bd25ce2933d152284;hb=9db867609d49aeb8284b62812e17ae26d212c700;hp=49f6551fc54a719ea13dc57fcca3043620736c58;hpb=e5dc3c1823a1ff704b6d05bd2b888001c1d7ec2c;p=bacula%2Fbacula

diff --git a/bacula/src/stored/authenticate.c b/bacula/src/stored/authenticate.c
index 49f6551fc5..bffb987e15 100644
--- a/bacula/src/stored/authenticate.c
+++ b/bacula/src/stored/authenticate.c
@@ -60,13 +60,13 @@ static int authenticate(int rcode, BSOCK *bs, JCR* jcr)
 
    if (rcode != R_DIRECTOR) {
       Dmsg1(dbglvl, "I only authenticate Directors, not %d\n", rcode);
-      Emsg1(M_FATAL, 0, _("I only authenticate Directors, not %d\n"), rcode);
+      Jmsg1(jcr, M_FATAL, 0, _("I only authenticate Directors, not %d\n"), rcode);
       return 0;
    }
    if (bs->msglen < 25 || bs->msglen > 500) {
       Dmsg2(dbglvl, "Bad Hello command from Director at %s. Len=%d.\n",
             bs->who(), bs->msglen);
-      Emsg2(M_FATAL, 0, _("Bad Hello command from Director at %s. Len=%d.\n"),
+      Jmsg2(jcr, M_FATAL, 0, _("Bad Hello command from Director at %s. Len=%d.\n"),
             bs->who(), bs->msglen);
       return 0;
    }
@@ -77,7 +77,7 @@ static int authenticate(int rcode, BSOCK *bs, JCR* jcr)
       bs->msg[100] = 0;
       Dmsg2(dbglvl, "Bad Hello command from Director at %s: %s\n",
             bs->who(), bs->msg);
-      Emsg2(M_FATAL, 0, _("Bad Hello command from Director at %s: %s\n"),
+      Jmsg2(jcr, M_FATAL, 0, _("Bad Hello command from Director at %s: %s\n"),
             bs->who(), bs->msg);
       return 0;
    }
@@ -90,7 +90,7 @@ static int authenticate(int rcode, BSOCK *bs, JCR* jcr)
    if (!director) {
       Dmsg2(dbglvl, "Connection from unknown Director %s at %s rejected.\n",
             dirname, bs->who());
-      Emsg2(M_FATAL, 0, _("Connection from unknown Director %s at %s rejected.\n"
+      Jmsg2(jcr, M_FATAL, 0, _("Connection from unknown Director %s at %s rejected.\n"
        "Please see http://www.bacula.org/rel-manual/faq.html#AuthorizationErrors for help.\n"),
             dirname, bs->who());
       free_pool_memory(dirname);
@@ -106,6 +106,10 @@ static int authenticate(int rcode, BSOCK *bs, JCR* jcr)
       }
    }
 
+   if (director->tls_authenticate) {
+      tls_local_need = BNET_TLS_REQUIRED;
+   }
+
    if (director->tls_verify_peer) {
       verify_list = director->tls_allowed_cns;
    }
@@ -123,7 +127,7 @@ static int authenticate(int rcode, BSOCK *bs, JCR* jcr)
    }
 
    if (!auth_success) {
-      Emsg0(M_FATAL, 0, _("Incorrect password given by Director.\n"
+      Jmsg0(jcr, M_FATAL, 0, _("Incorrect password given by Director.\n"
        "Please see http://www.bacula.org/rel-manual/faq.html#AuthorizationErrors for help.\n"));
       auth_success = false;
       goto auth_fatal;
@@ -131,15 +135,17 @@ static int authenticate(int rcode, BSOCK *bs, JCR* jcr)
 
    /* Verify that the remote host is willing to meet our TLS requirements */
    if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
-      Emsg0(M_FATAL, 0, _("Authorization problem: Remote server did not" 
-           " advertise required TLS support.\n"));
+      Jmsg0(jcr, M_FATAL, 0, _("Authorization problem: Remote server did not" 
+           " advertize required TLS support.\n"));
+      Dmsg2(dbglvl, "remote_need=%d local_need=%d\n", tls_remote_need, tls_local_need);
       auth_success = false;
       goto auth_fatal;
    }
 
    /* Verify that we are willing to meet the remote host's requirements */
    if (tls_remote_need > tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
-      Emsg0(M_FATAL, 0, _("Authorization problem: Remote server requires TLS.\n"));
+      Jmsg0(jcr, M_FATAL, 0, _("Authorization problem: Remote server requires TLS.\n"));
+      Dmsg2(dbglvl, "remote_need=%d local_need=%d\n", tls_remote_need, tls_local_need);
       auth_success = false;
       goto auth_fatal;
    }
@@ -147,10 +153,14 @@ static int authenticate(int rcode, BSOCK *bs, JCR* jcr)
    if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) {
       /* Engage TLS! Full Speed Ahead! */
       if (!bnet_tls_server(director->tls_ctx, bs, verify_list)) {
-         Emsg0(M_FATAL, 0, _("TLS negotiation failed.\n"));
+         Jmsg(jcr, M_FATAL, 0, _("TLS negotiation failed with DIR at \"%s:%d\"\n"),
+            bs->host(), bs->port());
          auth_success = false;
          goto auth_fatal;
       }
+      if (director->tls_authenticate) {     /* authenticate with tls only? */
+         bs->free_tls();                    /* yes, shut it down */
+      }
    }
 
 auth_fatal:
@@ -179,7 +189,7 @@ int authenticate_director(JCR *jcr)
    if (!authenticate(R_DIRECTOR, dir, jcr)) {
       dir->fsend("%s", Dir_sorry);
       Dmsg1(dbglvl, "Unable to authenticate Director at %s.\n", dir->who());
-      Emsg1(M_ERROR, 0, _("Unable to authenticate Director at %s.\n"), dir->who());
+      Jmsg1(jcr, M_ERROR, 0, _("Unable to authenticate Director at %s.\n"), dir->who());
       bmicrosleep(5, 0);
       return 0;
    }
@@ -204,6 +214,10 @@ int authenticate_filed(JCR *jcr)
       }
    }
 
+   if (me->tls_authenticate) {
+      tls_local_need = BNET_TLS_REQUIRED;
+   }
+
    if (me->tls_verify_peer) {
       verify_list = me->tls_allowed_cns;
    }
@@ -233,7 +247,8 @@ int authenticate_filed(JCR *jcr)
    /* Verify that the remote host is willing to meet our TLS requirements */
    if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
       Jmsg(jcr, M_FATAL, 0, _("Authorization problem: Remote server did not" 
-           " advertise required TLS support.\n"));
+           " advertize required TLS support.\n"));
+      Dmsg2(dbglvl, "remote_need=%d local_need=%d\n", tls_remote_need, tls_local_need);
       auth_success = false;
       goto auth_fatal;
    }
@@ -241,6 +256,7 @@ int authenticate_filed(JCR *jcr)
    /* Verify that we are willing to meet the remote host's requirements */
    if (tls_remote_need > tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
       Jmsg(jcr, M_FATAL, 0, _("Authorization problem: Remote server requires TLS.\n"));
+      Dmsg2(dbglvl, "remote_need=%d local_need=%d\n", tls_remote_need, tls_local_need);
       auth_success = false;
       goto auth_fatal;
    }
@@ -248,10 +264,14 @@ int authenticate_filed(JCR *jcr)
    if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) {
       /* Engage TLS! Full Speed Ahead! */
       if (!bnet_tls_server(me->tls_ctx, fd, verify_list)) {
-         Jmsg(jcr, M_FATAL, 0, _("TLS negotiation failed.\n"));
+         Jmsg(jcr, M_FATAL, 0, _("TLS negotiation failed with FD at \"%s:%d\"\n"),
+            fd->host(), fd->port());
          auth_success = false;
          goto auth_fatal;
       }
+      if (me->tls_authenticate) {          /* tls authenticate only? */
+         fd->free_tls();                   /* yes, shut it down */
+      }
    }
 
 auth_fatal: