1 .\" Copyright (c) 2008 Isilon Inc http://www.isilon.com/
2 .\" Authors: Doug Rabson <dfr@rabson.org>
3 .\" Developed with Red Inc: Alfred Perlstein <alfred@FreeBSD.org>
5 .\" Redistribution and use in source and binary forms, with or without
6 .\" modification, are permitted provided that the following conditions
8 .\" 1. Redistributions of source code must retain the above copyright
9 .\" notice, this list of conditions and the following disclaimer.
10 .\" 2. Redistributions in binary form must reproduce the above copyright
11 .\" notice, this list of conditions and the following disclaimer in the
12 .\" documentation and/or other materials provided with the distribution.
14 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 .Dt RPC_GSS_SECCREATE 3
32 .Nd "GSS-API based authentication for RPC"
39 is a security mechanism for the RPC protocol.
40 It uses the Generic Security Service API (GSS-API) to establish a
41 security context between a client and a server and to ensure that all
42 subsequent communication between client and server are properly
44 Optionally, extra protection can be applied to the connection.
45 The integrity service uses checksums to ensure that all data sent by
46 a peer is received without modification.
47 The privacy service uses encryption to ensure that no third party can
48 access the data for a connection.
50 To use this system, an application must first use
52 to establish a security context.
54 Data structures used by
57 .Bl -tag -width "MMMM"
58 .It Vt rpc_gss_service_t
59 This type defines the types of security service required for
60 .Fn rpc_gss_seccreate .
63 rpc_gss_svc_default = 0,
65 rpc_gss_svc_integrity = 2,
66 rpc_gss_svc_privacy = 3
69 .It Vt rpc_gss_options_ret_t
70 This structure contains various optional values which are used while
71 creating a security context.
74 int req_flags; /* GSS request bits */
75 int time_req; /* requested lifetime */
76 gss_cred_id_t my_cred; /* GSS credential */
77 gss_channel_bindings_t input_channel_bindings;
78 } rpc_gss_options_req_t;
80 .It Vt rpc_gss_options_ret_t
81 Various details of the created security context are returned using
90 gss_ctx_id_t gss_context;
91 char actual_mechanism[MAX_GSS_MECH];
92 } rpc_gss_options_ret_t;
94 .It Vt rpc_gss_principal_t
95 This type is used to refer to an client principal which is represented
96 in GSS-API exported name form
100 Names in this format may be stored in access control lists or compared
101 with other names in exported name form.
102 This structure is returned by
103 .Fn rpc_gss_get_principal_name
104 and is also referenced by the
105 .Vt rpc_gss_rawcred_t
111 } *rpc_gss_principal_t;
113 .It Vt rpc_gss_rawcred_t
114 This structure is used to access the raw credentials associated with a
118 u_int version; /* RPC version number */
119 const char *mechanism; /* security mechanism */
120 const char *qop; /* quality of protection */
121 rpc_gss_principal_t client_principal; /* client name */
122 const char *svc_principal; /* server name */
123 rpc_gss_service_t service; /* service type */
126 .It Vt rpc_gss_ucred_t
127 Unix credentials which are derived form the raw credentials,
129 .Fn rpc_gss_getcred .
132 uid_t uid; /* user ID */
133 gid_t gid; /* group ID */
135 gid_t *gidlist; /* list of groups */
138 .It Vt rpc_gss_lock_t
139 Structure used to enforce a particular QOP and service.
143 rpc_gss_rawcred_t *raw_cred;
146 .It Vt rpc_gss_callback_t
147 Callback structure used by
148 .Fn rpc_gss_set_callback .
151 u_int program; /* RPC program number */
152 u_int version; /* RPC version number */
153 /* user defined callback */
154 bool_t (*callback)(struct svc_req *req,
156 gss_ctx_id_t gss_context,
157 rpc_gss_lock_t *lock,
159 } rpc_gss_callback_t;
161 .It Vt rpc_gss_error_t
162 Structure used to return error information by
163 .Fn rpc_gss_get_error .
167 int system_error; /* same as errno */
171 * Values for rpc_gss_error
173 #define RPC_GSS_ER_SUCCESS 0 /* no error */
174 #define RPC_GSS_ER_SYSTEMERROR 1 /* system error */
178 .Bl -tag -width "MMMM"
179 .It Xr rpc_gss_seccreate 3
180 Create a new security context
181 .It Xr rpc_gss_set_defaults 3
182 Set service and quality of protection for a context
183 .It Xr rpc_gss_max_data_length 3
184 Calculate maximum client message sizes.
185 .It Xr rpc_gss_get_error 3
186 Get details of the last error
187 .It Xr rpc_gss_mech_to_oid 3
188 Convert a mechanism name to the corresponding GSS-API oid.
189 .It Xr rpc_gss_oid_to_mech 3
190 Convert a GSS-API oid to a mechanism name
191 .It Xr rpc_gss_qop_to_num 3
192 Convert a quality of protection name to the corresponding number
193 .It Xr rpc_gss_get_mechanisms 3
194 Get a list of security mechanisms.
195 .It Xr rpc_gss_get_mech_info 3
196 Return extra information about a security mechanism
197 .It Xr rpc_gss_get_versions 3
198 Return the maximum and minimum supported versions of the
201 .It Xr rpc_gss_is_installed 3
202 Query for the presence of a particular security mechanism
203 .It Xr rpc_gss_set_svc_name 3
204 Set the name of a service principal which matches a given RPC program
206 .It Xr rpc_gss_getcred 3
207 Get credential details for the security context of an RPC request
208 .It Xr rpc_gss_set_callback 3
209 Install a callback routine which is called on the server when new
210 security contexts are created
211 .It Xr rpc_gss_get_principal_name 3
212 Create a client principal name from various strings
213 .It Xr rpc_gss_svc_max_data_length 3
214 Calculate maximum server message sizes.
219 .Xr gss_export_name 3 ,
226 library first appeared in
230 manual page was written by
231 .An Doug Rabson Aq dfr@FreeBSD.org .