/*
* See who is connecting and lookup the authentication information.
* First make him prove his identity and then prove our identity to the Remote daemon.
*/
static inline bool two_way_authenticate(int rcode, BSOCK *bs, JCR* jcr)
{
POOLMEM *dirname = get_pool_memory(PM_MESSAGE);
DIRRES *director = NULL;
int tls_local_need = BNET_TLS_NONE;
int tls_remote_need = BNET_TLS_NONE;
bool compatible = true; /* Want md5 compatible DIR */
bool auth_success = false;
alist *verify_list = NULL;
btimer_t *tid = NULL;
if (rcode != R_DIRECTOR) {
Dmsg1(dbglvl, "I only authenticate directors, not %d\n", rcode);
Jmsg1(jcr, M_FATAL, 0, _("I only authenticate directors, not %d\n"), rcode);
goto auth_fatal;
}
if (bs->msglen < 25 || bs->msglen > 500) {
Dmsg2(dbglvl, "Bad Hello command from Director at %s. Len=%d.\n",
bs->who(), bs->msglen);
char addr[64];
char *who = bnet_get_peer(bs, addr, sizeof(addr)) ? bs->who() : addr;
Jmsg2(jcr, M_FATAL, 0, _("Bad Hello command from Director at %s. Len=%d.\n"),
who, bs->msglen);
goto auth_fatal;
}
dirname = check_pool_memory_size(dirname, bs->msglen);
if (sscanf(bs->msg, "Hello Director %s calling", dirname) != 1) {
char addr[64];
char *who = bnet_get_peer(bs, addr, sizeof(addr)) ? bs->who() : addr;
bs->msg[100] = 0;
Dmsg2(dbglvl, "Bad Hello command from Director at %s: %s\n",
bs->who(), bs->msg);
Jmsg2(jcr, M_FATAL, 0, _("Bad Hello command from Director at %s: %s\n"),
who, bs->msg);
goto auth_fatal;
}
unbash_spaces(dirname);
foreach_res(director, R_DIRECTOR) {
if (bstrcmp(director->hdr.name, dirname))
break;
}
if (!director) {
char addr[64];
char *who = bnet_get_peer(bs, addr, sizeof(addr)) ? bs->who() : addr;
Jmsg2(jcr, M_FATAL, 0, _("Connection from unknown Director %s at %s rejected.\n"),
dirname, who);
goto auth_fatal;
}
if (have_tls) {
/*
* TLS Requirement
*/
if (director->tls_enable) {
if (director->tls_require) {
tls_local_need = BNET_TLS_REQUIRED;
} else {
tls_local_need = BNET_TLS_OK;
}
}
if (director->tls_authenticate) {
tls_local_need = BNET_TLS_REQUIRED;
}
if (director->tls_verify_peer) {
verify_list = director->tls_allowed_cns;
}
}
/*
* Timeout Hello after 10 min
*/
tid = start_bsock_timer(bs, AUTH_TIMEOUT);
/*
* Sanity check.
*/
ASSERT(director->password.encoding == p_encoding_md5);
/*
* Challenge the director
*/
auth_success = cram_md5_challenge(bs, director->password.value, tls_local_need, compatible);
if (job_canceled(jcr)) {
auth_success = false;
goto auth_fatal; /* quick exit */
}
if (auth_success) {
auth_success = cram_md5_respond(bs, director->password.value, &tls_remote_need, &compatible);
if (!auth_success) {
char addr[64];
char *who = bnet_get_peer(bs, addr, sizeof(addr)) ? bs->who() : addr;
Dmsg1(dbglvl, "cram_get_auth failed for %s\n", who);
}
} else {
char addr[64];
char *who = bnet_get_peer(bs, addr, sizeof(addr)) ? bs->who() : addr;
Dmsg1(dbglvl, "cram_auth failed for %s\n", who);
}
if (!auth_success) {
Emsg1(M_FATAL, 0, _("Incorrect password given by Director at %s.\n"),
bs->who());
goto auth_fatal;
}
/*
* Verify that the remote host is willing to meet our TLS requirements
*/
if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
Jmsg0(jcr, M_FATAL, 0, _("Authorization problem: Remote server did not"
" advertize required TLS support.\n"));
Dmsg2(dbglvl, "remote_need=%d local_need=%d\n", tls_remote_need, tls_local_need);
auth_success = false;
goto auth_fatal;
}
/*
* Verify that we are willing to meet the remote host's requirements
*/
if (tls_remote_need > tls_local_need && tls_local_need != BNET_TLS_OK && tls_remote_need != BNET_TLS_OK) {
Jmsg0(jcr, M_FATAL, 0, _("Authorization problem: Remote server requires TLS.\n"));
Dmsg2(dbglvl, "remote_need=%d local_need=%d\n", tls_remote_need, tls_local_need);
auth_success = false;
goto auth_fatal;
}
if (tls_local_need >= BNET_TLS_OK && tls_remote_need >= BNET_TLS_OK) {
/*
* Engage TLS! Full Speed Ahead!
*/
if (!bnet_tls_server(director->tls_ctx, bs, verify_list)) {
Jmsg0(jcr, M_FATAL, 0, _("TLS negotiation failed.\n"));
auth_success = false;
goto auth_fatal;
}
if (director->tls_authenticate) { /* authentication only? */
bs->free_tls(); /* shutodown tls */
}
}
auth_fatal:
if (tid) {
stop_bsock_timer(tid);
tid = NULL;
}
free_pool_memory(dirname);
jcr->director = director;
/*
* Single thread all failures to avoid DOS
*/
if (!auth_success) {
P(mutex);
bmicrosleep(6, 0);
V(mutex);
}
return auth_success;
}
void *handle_stored_connection(BSOCK *sd)
{
JCR *jcr;
char job_name[MAX_NAME_LENGTH];
/*
* Do a sanity check on the message received
*/
if (sd->msglen < 25 || sd->msglen > 256) {
Dmsg1(000, "<filed: %s", sd->msg);
Emsg2(M_ERROR, 0, _("Invalid connection from %s. Len=%d\n"), sd->who(), sd->msglen);
bmicrosleep(5, 0); /* make user wait 5 seconds */
sd->close();
return NULL;
}
if (sscanf(sd->msg, "Hello Storage calling Start Job %127s", job_name) != 1) {
char addr[64];
char *who = bnet_get_peer(sd, addr, sizeof(addr)) ? sd->who() : addr;
sd->msg[100] = 0;
Dmsg2(dbglvl, "Bad Hello command from Director at %s: %s\n", sd->who(), sd->msg);
Jmsg2(NULL, M_FATAL, 0, _("Bad Hello command from Director at %s: %s\n"), who, sd->msg);
sd->close();
return NULL;
}
if (!(jcr = get_jcr_by_full_name(job_name))) {
Jmsg1(NULL, M_FATAL, 0, _("SD connect failed: Job name not found: %s\n"), job_name);
Dmsg1(3, "**** Job \"%s\" not found.\n", job_name);
sd->close();
return NULL;
}
Dmsg1(50, "Found Job %s\n", job_name);
jcr->store_bsock = sd;
jcr->store_bsock->set_jcr(jcr);
/*
* Authenticate the Storage Daemon.
*/
if (!authenticate_storagedaemon(jcr)) {
Dmsg1(50, "Authentication failed Job %s\n", jcr->Job);
Jmsg(jcr, M_FATAL, 0, _("Unable to authenticate File daemon\n"));
jcr->setJobStatus(JS_ErrorTerminated);
} else {
Dmsg2(50, "OK Authentication jid=%u Job %s\n", (uint32_t)jcr->JobId, jcr->Job);
}
if (!jcr->max_bandwidth) {
if (jcr->director->max_bandwidth_per_job) {
jcr->max_bandwidth = jcr->director->max_bandwidth_per_job;
} else if (me->max_bandwidth_per_job) {
jcr->max_bandwidth = me->max_bandwidth_per_job;
}
}
sd->set_bwlimit(jcr->max_bandwidth);
if (me->allow_bw_bursting) {
sd->set_bwlimit_bursting();
}
free_jcr(jcr);
return NULL;
}
