--- name: "rpcsec_gss" section: "3" platform: "freebsd" package: "base" version: "16.0-CURRENT-20261027-61c70dc16a79" release: "FreeBSD 16.0-CURRENT (2026-10-27)" platforms: ["freebsd"] url: "https://new.carta.tech/rpcsec_gss" --- # rpcsec\_gss(3) GSS-API based authentication for RPC ## NAME **RPCSEC\_GSS** – GSS-API based authentication for RPC ## LIBRARY library “librpcsec\_gss” ## SYNOPSIS **#include \** ## DESCRIPTION **RPCSEC\_GSS** is a security mechanism for the RPC protocol. It uses the Generic Security Service API (GSS-API) to establish a security context between a client and a server and to ensure that all subsequent communication between client and server are properly authenticated. Optionally, extra protection can be applied to the connection. The integrity service uses checksums to ensure that all data sent by a peer is received without modification. The privacy service uses encryption to ensure that no third party can access the data for a connection. To use this system, an application must first use **rpc\_gss\_seccreate**() to establish a security context. ## DATA STRUCTURES Data structures used by **RPCSEC\_GSS** appear below. - *rpc\_gss\_service\_t* This type defines the types of security service required for **rpc\_gss\_seccreate**(). ``` typedef enum { rpc_gss_svc_default = 0, rpc_gss_svc_none = 1, rpc_gss_svc_integrity = 2, rpc_gss_svc_privacy = 3 } rpc_gss_service_t; ``` - *rpc\_gss\_options\_ret\_t* This structure contains various optional values which are used while creating a security context. ``` typedef struct { int req_flags; /* GSS request bits */ int time_req; /* requested lifetime */ gss_cred_id_t my_cred; /* GSS credential */ gss_channel_bindings_t input_channel_bindings; } rpc_gss_options_req_t; ``` - *rpc\_gss\_options\_ret\_t* Various details of the created security context are returned using this structure. ``` typedef struct { int major_status; int minor_status; u_int rpcsec_version; int ret_flags; int time_req; gss_ctx_id_t gss_context; char actual_mechanism[MAX_GSS_MECH]; } rpc_gss_options_ret_t; ``` - *rpc\_gss\_principal\_t* This type is used to refer to an client principal which is represented in GSS-API exported name form (see [gss\_export\_name(3)](/gss_export_name/3.md) for more details). Names in this format may be stored in access control lists or compared with other names in exported name form. This structure is returned by **rpc\_gss\_get\_principal\_name**() and is also referenced by the *rpc\_gss\_rawcred\_t* structure. ``` typedef struct { int len; char name[1]; } *rpc_gss_principal_t; ``` - *rpc\_gss\_rawcred\_t* This structure is used to access the raw credentials associated with a security context. ``` typedef struct { u_int version; /* RPC version number */ const char *mechanism; /* security mechanism */ const char *qop; /* quality of protection */ rpc_gss_principal_t client_principal; /* client name */ const char *svc_principal; /* server name */ rpc_gss_service_t service; /* service type */ } rpc_gss_rawcred_t; ``` - *rpc\_gss\_ucred\_t* Unix credentials which are derived form the raw credentials, accessed via **rpc\_gss\_getcred**(). ``` typedef struct { uid_t uid; /* user ID */ gid_t gid; /* group ID */ short gidlen; gid_t *gidlist; /* list of groups */ } rpc_gss_ucred_t; ``` - *rpc\_gss\_lock\_t* Structure used to enforce a particular QOP and service. ``` typedef struct { bool_t locked; rpc_gss_rawcred_t *raw_cred; } rpc_gss_lock_t; ``` - *rpc\_gss\_callback\_t* Callback structure used by **rpc\_gss\_set\_callback**(). ``` typedef struct { u_int program; /* RPC program number */ u_int version; /* RPC version number */ /* user defined callback */ bool_t (*callback)(struct svc_req *req, gss_cred_id_t deleg, gss_ctx_id_t gss_context, rpc_gss_lock_t *lock, void **cookie); } rpc_gss_callback_t; ``` - *rpc\_gss\_error\_t* Structure used to return error information by **rpc\_gss\_get\_error**(). ``` typedef struct { int rpc_gss_error; int system_error; /* same as errno */ } rpc_gss_error_t; /* * Values for rpc_gss_error */ #define RPC_GSS_ER_SUCCESS 0 /* no error */ #define RPC_GSS_ER_SYSTEMERROR 1 /* system error */ ``` ## INDEX - [rpc\_gss\_seccreate(3)](/rpc_gss_seccreate/3.md) Create a new security context - [rpc\_gss\_set\_defaults(3)](/rpc_gss_set_defaults/3.md) Set service and quality of protection for a context - [rpc\_gss\_max\_data\_length(3)](/rpc_gss_max_data_length/3.md) Calculate maximum client message sizes. - [rpc\_gss\_get\_error(3)](/rpc_gss_get_error/3.md) Get details of the last error - [rpc\_gss\_mech\_to\_oid(3)](/rpc_gss_mech_to_oid/3.md) Convert a mechanism name to the corresponding GSS-API oid. - [rpc\_gss\_oid\_to\_mech(3)](/rpc_gss_oid_to_mech/3.md) Convert a GSS-API oid to a mechanism name - [rpc\_gss\_qop\_to\_num(3)](/rpc_gss_qop_to_num/3.md) Convert a quality of protection name to the corresponding number - [rpc\_gss\_get\_mechanisms(3)](/rpc_gss_get_mechanisms/3.md) Get a list of security mechanisms. - [rpc\_gss\_get\_mech\_info(3)](/rpc_gss_get_mech_info/3.md) Return extra information about a security mechanism - [rpc\_gss\_get\_versions(3)](/rpc_gss_get_versions/3.md) Return the maximum and minimum supported versions of the **RPCSEC\_GSS** protocol - [rpc\_gss\_is\_installed(3)](/rpc_gss_is_installed/3.md) Query for the presence of a particular security mechanism - [rpc\_gss\_set\_svc\_name(3)](/rpc_gss_set_svc_name/3.md) Set the name of a service principal which matches a given RPC program plus version pair - [rpc\_gss\_getcred(3)](/rpc_gss_getcred/3.md) Get credential details for the security context of an RPC request - [rpc\_gss\_set\_callback(3)](/rpc_gss_set_callback/3.md) Install a callback routine which is called on the server when new security contexts are created - [rpc\_gss\_get\_principal\_name(3)](/rpc_gss_get_principal_name/3.md) Create a client principal name from various strings - [rpc\_gss\_svc\_max\_data\_length(3)](/rpc_gss_svc_max_data_length/3.md) Calculate maximum server message sizes. ## SEE ALSO [gss\_export\_name(3)](/gss_export_name/3.md), [gssapi(3)](/gssapi/3.md), [rpc(3)](/rpc/3.md), [mech(5)](/mech/5.md), [qop(5)](/qop/5.md) ## HISTORY The **RPCSEC\_GSS** library first appeared in FreeBSD 8.0. ## AUTHORS This manual page was written by Doug Rabson ⟨*dfr@FreeBSD.org*⟩.