RPC_GSS_SET_CALLBACK(3)

💖 RPC_GSS_SET_CALLBACK 💖

okay bestie, so rpc_gss_set_callback lives in section 3 of the library functions manual, and it's literally the girlboss gatekeeper of security context creation on your server. she's giving bouncer-at-the-club energy and honestly? iconic. let's get into it 🫶

✨ NAME ✨

rpc_gss_set_callback — Register a security context creation callback

🌸 SYNOPSIS 🌸

#include <rpc/rpcsec_gss.h>

bool_t
(*callback)(struct svc_req *req, gss_cred_id_t deleg,
    gss_ctx_id_t gss_context, rpc_gss_lock_t *lock, void **cookie);

bool_t
rpc_gss_set_callback(rpc_gss_callback_t *cb);

🦋 DESCRIPTION 🦋

so basically you're registering a function that gets called whenever brand new security contexts get created on a server. it's giving "notify me when the new girlies arrive" 💅

this function fires on the first RPC request that uses that context, and it gets the opportunity to reject the request — like, say, after matching the request credentials against an access control list. yk, the vibe check of it all.

to accept the new security context, the callback should return TRUE. otherwise FALSE. simple as that, no cap.

real talk tho: if the callback accepts a context, it becomes responsible for the lifetime of the delegated client credentials (if any). that's main character responsibility, bestie. don't drop the ball 🙈

it's also possible to 'lock' the values of service and quality of protection used by the context. if a context is locked, any subsequent requests that use different values for service and quality of protection will be rejected. locked in fr fr 🔒

🎀 PARAMETERS 🎀

• cb — a structure holding the RPC program and version for this callback, plus a function that gets called when new contexts are created for that given RPC program and version. she's the whole package.
• req — the RPC request using the new context
• deleg — GSS-API delegated credentials (if any)
• gss_context — the GSS-API context
• lock — a structure used to enforce a particular QOP and service. set lock->locked to TRUE to lock the service and QOP values. that's the whole point of her ✨
• cookie — the callback function may set *cookie to any pointer sized value. this value can be accessed during the lifetime of the context via rpc_gss_getcred(). she's your little secret keeper 🍓

⭐ RETURN VALUES ⭐

returns TRUE if the callback was registered successfully, or FALSE otherwise. that's it, that's the tweet.

🌈 AVAILABILITY 🌈

the rpc_gss_set_callback() function is part of libtirpc. she's repping that library, periodt.

👑 SEE ALSO 👑

rpc(3), gssapi(3), rpc_gss_getcred(3) rpcsec_gss(3)

💜 AUTHORS 💜

this manual page was written by Doug Rabson <dfr@FreeBSD.org>. thank you king 🫶

💀 BUGS 💀

there is no mechanism for informing a server when a security context has been deleted. which makes it difficult to allocate resources (e.g. to return via the callback's cookie argument). yeah. it's giving unfinished business. we don't love that for us 😭

mwah 💋 this one's from Debian, dated January 26, 2010, and it's RPC_GSS_SET_CALLBACK(3) signing off — stay secure, stay slay 🎀✨