ceph: add support for auth_x authentication protocol

The auth_x protocol implements support for a kerberos-like mutual
authentication infrastructure used by Ceph.  We do not simply use vanilla
kerberos because of scalability and performance issues when dealing with
a large cluster of nodes providing a single logical service.

Auth_x provides mutual authentication of client and server and protects
against replay and man in the middle attacks.  It does not encrypt
the full session over the wire, however, so data payload may still be
snooped.

Signed-off-by: Yehuda Sadeh <yehuda@hq.newdream.net>
Signed-off-by: Sage Weil <sage@newdream.net>

1 files changed, 90 insertions, 0 deletions

diff --git a/fs/ceph/auth_x_protocol.h b/fs/ceph/auth_x_protocol.h
new file mode 100644
index 000000000000..671d30576c4f
--- /dev/null
+++ b/fs/ceph/auth_x_protocol.h
@@ -0,0 +1,90 @@
+#ifndef __FS_CEPH_AUTH_X_PROTOCOL
+#define __FS_CEPH_AUTH_X_PROTOCOL
+
+#define CEPHX_GET_AUTH_SESSION_KEY      0x0100
+#define CEPHX_GET_PRINCIPAL_SESSION_KEY 0x0200
+#define CEPHX_GET_ROTATING_KEY          0x0400
+
+/* common bits */
+struct ceph_x_ticket_blob {
+        __u8 struct_v;
+        __le64 secret_id;
+        __le32 blob_len;
+        char blob[];
+} __attribute__ ((packed));
+
+
+/* common request/reply headers */
+struct ceph_x_request_header {
+        __le16 op;
+} __attribute__ ((packed));
+
+struct ceph_x_reply_header {
+        __le16 op;
+        __le32 result;
+} __attribute__ ((packed));
+
+
+/* authenticate handshake */
+
+/* initial hello (no reply header) */
+struct ceph_x_server_challenge {
+        __u8 struct_v;
+        __le64 server_challenge;
+} __attribute__ ((packed));
+
+struct ceph_x_authenticate {
+        __u8 struct_v;
+        __le64 client_challenge;
+        __le64 key;
+        /* ticket blob */
+} __attribute__ ((packed));
+
+struct ceph_x_service_ticket_request {
+        __u8 struct_v;
+        __le32 keys;
+} __attribute__ ((packed));
+
+struct ceph_x_challenge_blob {
+        __le64 server_challenge;
+        __le64 client_challenge;
+} __attribute__ ((packed));
+
+
+
+/* authorize handshake */
+
+/*
+ * The authorizer consists of two pieces:
+ *  a - service id, ticket blob
+ *  b - encrypted with session key
+ */
+struct ceph_x_authorize_a {
+        __u8 struct_v;
+        __le64 global_id;
+        __le32 service_id;
+        struct ceph_x_ticket_blob ticket_blob;
+} __attribute__ ((packed));
+
+struct ceph_x_authorize_b {
+        __u8 struct_v;
+        __le64 nonce;
+} __attribute__ ((packed));
+
+struct ceph_x_authorize_reply {
+        __u8 struct_v;
+        __le64 nonce_plus_one;
+} __attribute__ ((packed));
+
+
+/*
+ * encyption bundle
+ */
+#define CEPHX_ENC_MAGIC 0xff009cad8826aa55ull
+
+struct ceph_x_encrypt_header {
+        __u8 struct_v;
+        __le64 magic;
+} __attribute__ ((packed));
+
+#endif