Globus XIO GSI Driver

# Opening/Closing

An XIO handle with the gsi driver can be created with either globus_xio_handle_create () or globus_xio_server_register_accept ().

If the handle is created with globus_xio_server_register_accept (), the globus_xio_register_open () call will proceed to accept a GSSAPI security context. Upon successful completion of the open (after the open callback has been called) the application may proceed to read or write data associated with the GSI session.

If the handle is created with globus_xio_handle_create (), then the XIO handle will implement the client-side (init) of the GSSAPI call sequence and establish a security context with the accepting side indicated by the contact_string passed to globus_xio_register_open ().

# Reading/Writing

The GSI driver behaves similar to the underlying transport driver with respect to reads and writes, except for the try-read and try-write operations (ie. waitforbytes ==0) which always return immediately. This is due to the fact that the security layer needs to read and write tokens of a certain minimal size and thus needs to rely on the underlying transport to handle greater than 0 reads/write which is not possible in "try" mode.

# Server

globus_xio_server_create() causes a new transport-specific listener socket to be created to handle new GSI connections. globus_xio_server_register_accept() will accept a new connection for processing. globus_xio_server_register_close() cleans up the internal resources associated with the http server and calls close on the listener.

All accepted handles inherit all GSI-specific attributes set in the attr to globus_xio_server_create(), but can be overridden with the attr to globus_xio_register_open(). Furthermore, accepted handles will use the GSSAPI accept security context call unless explicitly overridden during the globus_xio_register_open() call ( GLOBUS_XIO_GSI_FORCE_SERVER_MODE).

# Environment Variables

The gsi driver uses the following environment variables

- X509_USER_PROXY
- X509_USER_CERT
- X509_USER_KEY
- X509_CERT_DIR

For details see Globus: GSI Environment Variables

# Attributes and Cntls

GSI driver specific attrs and cntls

See also
  globus_xio_attr_cntl ()
  globus_xio_handle_cntl ()

# Error Types

The GSI driver uses mostly GSSAPI calls, so it generally just wraps the underlying GSSAPI errors or uses generic XIO errors.

See also
  globus_xio_driver_error_match ()
  globus_error_gssapi_match ()
  globus_error_match_openssl_error ()