Authentication Negotiation
Keywords: developers

#
Authentication Negotiation

Backwards compatibility with the existing SSL negotiation hooks implemented in src/lib/cram-md5.c have been maintained. The cram_md5_get_auth() function has been modified to accept an integer pointer argument, tls_remote_need. The TLS requirement advertised by the remote host is returned via this pointer.

After exchanging cram-md5 authentication and TLS requirements, both the client and server independently decide whether to continue:

    if (!cram_md5_get_auth(dir, password, &tls_remote_need) ||
            !cram_md5_auth(dir, password, tls_local_need)) {
    [snip]
    /* Verify that the remote host is willing to meet our TLS requirements */
    if (tls_remote_need < tls_local_need && tls_local_need != BNET_TLS_OK &&
            tls_remote_need != BNET_TLS_OK) {
       sendit(_("Authorization problem:"
                " Remote server did not advertise required TLS support.\n"));
       auth_success = false;
       goto auth_done;
    }

    /* Verify that we are willing to meet the remote host's requirements */
    if (tls_remote_need > tls_local_need && tls_local_need != BNET_TLS_OK &&
            tls_remote_need != BNET_TLS_OK) {
       sendit(_("Authorization problem:"
                " Remote server requires TLS.\n"));
       auth_success = false;
       goto auth_done;
    }