aboutsummaryrefslogtreecommitdiffstats
path: root/fs/ceph/auth_x.h
diff options
context:
space:
mode:
authorSage Weil <sage@newdream.net>2010-02-02 16:25:35 -0800
committerSage Weil <sage@newdream.net>2010-02-11 11:48:45 -0800
commitec0994e48ea2aebf62ff08376227f3a9ccf46262 (patch)
treefdfd595b36619507d25a6b06e14b86db0ee3849a /fs/ceph/auth_x.h
parent07c8739c521cb029d0f3549556aae2d304513978 (diff)
downloadkernel_samsung_smdk4412-ec0994e48ea2aebf62ff08376227f3a9ccf46262.zip
kernel_samsung_smdk4412-ec0994e48ea2aebf62ff08376227f3a9ccf46262.tar.gz
kernel_samsung_smdk4412-ec0994e48ea2aebf62ff08376227f3a9ccf46262.tar.bz2
ceph: add support for auth_x authentication protocol
The auth_x protocol implements support for a kerberos-like mutual authentication infrastructure used by Ceph. We do not simply use vanilla kerberos because of scalability and performance issues when dealing with a large cluster of nodes providing a single logical service. Auth_x provides mutual authentication of client and server and protects against replay and man in the middle attacks. It does not encrypt the full session over the wire, however, so data payload may still be snooped. Signed-off-by: Yehuda Sadeh <yehuda@hq.newdream.net> Signed-off-by: Sage Weil <sage@newdream.net>
Diffstat (limited to 'fs/ceph/auth_x.h')
-rw-r--r--fs/ceph/auth_x.h49
1 files changed, 49 insertions, 0 deletions
diff --git a/fs/ceph/auth_x.h b/fs/ceph/auth_x.h
new file mode 100644
index 0000000..ff6f818
--- /dev/null
+++ b/fs/ceph/auth_x.h
@@ -0,0 +1,49 @@
+#ifndef _FS_CEPH_AUTH_X_H
+#define _FS_CEPH_AUTH_X_H
+
+#include <linux/rbtree.h>
+
+#include "crypto.h"
+#include "auth.h"
+#include "auth_x_protocol.h"
+
+/*
+ * Handle ticket for a single service.
+ */
+struct ceph_x_ticket_handler {
+ struct rb_node node;
+ unsigned service;
+
+ struct ceph_crypto_key session_key;
+ struct ceph_timespec validity;
+
+ u64 secret_id;
+ struct ceph_buffer *ticket_blob;
+
+ unsigned long renew_after, expires;
+};
+
+
+struct ceph_x_authorizer {
+ struct ceph_buffer *buf;
+ unsigned service;
+ u64 nonce;
+ char reply_buf[128]; /* big enough for encrypted blob */
+};
+
+struct ceph_x_info {
+ struct ceph_crypto_key secret;
+
+ bool starting;
+ u64 server_challenge;
+
+ unsigned have_keys;
+ struct rb_root ticket_handlers;
+
+ struct ceph_x_authorizer auth_authorizer;
+};
+
+extern int ceph_x_init(struct ceph_auth_client *ac);
+
+#endif
+