Bareos uses TLS to ensure data encryption for all TCP connections between Bareos components. Implemented and working is only OpenSSL.
Starting from Bareos 18.2 every BareosSocket TCP connection has its own SSL_CTX and SSL object. In other words, every time when establishing a new connection a new SSL_CTX object is initialized to create a new SSL object.
For a first overview the following diagram shows the connection sequence of a Bareos Console to a Bareos Director.
TLS Handshake before Bareos 18.2¶
TLS Configuration Implementation¶
TLS configuration directives will be transfered from the configuration into dedicated classes as follows.
TLS API Implementation¶
The following diagramm shows the interface of the TlsOpenSsl class and its aggregation in the BareosSocket class. During initialization and handshake of a TLS connection tls_conn_init will be used and tls_conn is invalid. As soon as the TLS connection is established the pointer from tls_conn_init will be moved to tls_conn and tls_conn_init will become invalid.