auth: use u64 nonce, not timestamp, in authorizer[_reply]

diff --git a/src/auth/cephx/CephxProtocol.cc b/src/auth/cephx/CephxProtocol.cc
index f58431a0c1b0627c1837843b25ac90293d07551c..be521548c4a3e166b1610b2471f59c98187a3d1f 100644 (file)
--- a/src/auth/cephx/CephxProtocol.cc
+++ b/src/auth/cephx/CephxProtocol.cc
@@ -212,13 +212,13 @@ CephXAuthorizer *CephXTicketHandler::build_authorizer()
 {
   CephXAuthorizer *a = new CephXAuthorizer;
   a->session_key = session_key;
-  a->timestamp = g_clock.now();
+  a->nonce = ((__u64)rand() << 32) + rand();
 
   ::encode(service_id, a->bl);
   ::encode(ticket, a->bl);
 
   CephXAuthorize msg;
-  msg.now = a->timestamp;
+  msg.nonce = a->nonce;
   if (encode_encrypt(msg, session_key, a->bl) < 0) {
     delete a;
     return 0;
@@ -298,8 +298,7 @@ bool cephx_verify_authorizer(KeyStore& keys, bufferlist::iterator& indata,
    */
   CephXAuthorizeReply reply;
   // reply.trans_id = auth_msg.trans_id;
-  reply.timestamp = auth_msg.now;
-  reply.timestamp.sec_ref() += 1;
+  reply.nonce_plus_one = auth_msg.nonce + 1;
   if (encode_encrypt(reply, ticket_info.session_key, reply_bl) < 0)
     return false;
 
@@ -316,11 +315,10 @@ bool CephXAuthorizer::verify_reply(bufferlist::iterator& indata)
     return false;
   }
 
-  utime_t expect = timestamp;
-  expect.sec_ref() += 1;
-  if (expect != reply.timestamp) {
-    dout(0) << "verify_authorizer_reply bad ts got " << reply.timestamp << " expected " << expect
-           << " sent " << timestamp << dendl;
+  __u32 expect = nonce + 1;
+  if (expect != reply.nonce_plus_one) {
+    dout(0) << "verify_authorizer_reply bad ts got " << reply.nonce_plus_one << " expected " << expect
+           << " sent " << nonce << dendl;
     return false;
   }
   return true;

diff --git a/src/auth/cephx/CephxProtocol.h b/src/auth/cephx/CephxProtocol.h
index 28d419a799403b57efcb9bb189ecc8539e678135..e4d2d24c21df0b808ec4b89249339b7850aecd27 100644 (file)
--- a/src/auth/cephx/CephxProtocol.h
+++ b/src/auth/cephx/CephxProtocol.h
@@ -206,19 +206,19 @@ WRITE_CLASS_ENCODER(CephXServiceTicketRequest);
  */
 
 struct CephXAuthorizeReply {
-  utime_t timestamp;
+  __u64 nonce_plus_one;
   void encode(bufferlist& bl) const {
-    ::encode(timestamp, bl);
+    ::encode(nonce_plus_one, bl);
   }
   void decode(bufferlist::iterator& bl) {
-    ::decode(timestamp, bl);
+    ::decode(nonce_plus_one, bl);
   }
 };
 WRITE_CLASS_ENCODER(CephXAuthorizeReply);
 
 
 struct CephXAuthorizer : public AuthAuthorizer {
-  utime_t timestamp;
+  __u64 nonce;
   CryptoKey session_key;
 
   CephXAuthorizer() : AuthAuthorizer(CEPH_AUTH_CEPHX) {}