Constructing secured and safe C/UNIX programs 1 Constructing Secured and Safe C/UNIX Programs presenter: shilan habibi

constructing secured and safe C/UNIX programs

1

Constructing Secured and Safe C/UNIX Programs

presenter: shilan habibi


2

• Secured Network Programming

• Generic Security Service Application Program Interface

• Open Secure Socket Layer Application Program Interface

• Sockets

• Raw Socket

• UNIX Virtualization

Title list:


3

Secured Network Programming

• API GSS-APIRPCSECSSLTLS


4

Generic Security Service Applicatio Program Interface

GSS-API offers:

• Confidentiality

• integrity

• authentication

• nonrepudiation


5

Generic Security Service Application Program Interface

GSS-API does two things:

1- creates a security context between applications

2-secured data transfers between applications


6


The GSS-API stack


7


RPCSEC_GSS:

• is an additional layer that seamlessly integrates GSS-API with RPC

• it provides all the functionality of GSS-API in a way that is tailored to RPC


8


some of the significant APIs from the GSS-API list:• GSS_Acquire_cred• GSS_Import_name• GSS_Init_sec_context• GSS_Accept_sec_context• GSS_Wrap• GSS_Unwrap


9

Secure Network Programming

SNP provides secure network communication with:

• data origin authenticity

• data integrity

• data confidentiality services on top of the usual stream

• datagram services provided by sockets or TCP/IP


10


SNP has three protocols:

• a secure bootstrap protocol

• a user–host mutual authentication protocol

• a protocol for named service


11


list of services provided by SNP:• Persistent delivery (PD)

• Best effort delivery (BED)

• Sequenced delivery (SD)

• Data confidentiality (DC)

• Data integrity (DI)

• Data origin authenticity)DOA)

• Data destination authenticity (DDA)

• Connection authenticity (CA)


12


For initialization, SNP off ers the following API:

• int snp (int family, int type, int protocol)

• int snp_bind (int snp_ep, struct sockaddr *local_addr, int addr_len)

• int snp_listen (int snp_ep, int backlog)

• int snp_attach (int snp_ep, struct name_s *local_name, struct name_s *peer_name)


13


For connection establishment, SNP off ers the following API:

• int snp_connect (int snp_ep, struct sockaddr *peer_addr, int peer_addr_len)

• int snp_accept (int snp_ep, struct sockaddr *peer_addr, int peer_addr_len)


14


For data transfer, SNP offers the following API:• int snp_write (int snp_ep, char *buf, int nbytes)

• int snp_read (int snp_ep, char *buf, int nbytes)

• int snp_send (int snp_ep, char *buf, int nbytes, int fl ags)

• int snp_recv (int snp_ep, char *buf, int nbytes, int fl ags)

• int snp_sendto (int snp_ep, char *buf, int nbytes, int fl ags, struct sockaddr *to, int tolen)

• int snp_recvfrom (int snp_ep, char *buf, int nbytes, int fl ags, struct sockaddr *from, int *fromlen)


15


For connection release, SNP off ers the following API:

• int snp_close (int snp_ep)

• int snp_shutdown (int snp_ep, int how)


16


For utility-related functions, SNP off ers the following API:

• int snp_setopt (int snp_ep, int level, int optname, char *optval, int optlen)

• Int snp_perror (const char *s).

• int snp_getpeerid (int snp_ep, struct name_s *peer_name).


17

Open Secure Socket Layer Application Program Interface

• SSL

• TLS

• OpenSSL


18


OpenSSL ssl library functions deals with the following data structur:

• SSL_METHOD

• SSL_CIPHER

• SSL_CTX

• SSL_SESSION

• SSL


19


Currently the OpenSSL ssl library exports API functions:

• API dealing protocol methods

• API dealing ciphers

• API dealing protocol context

• API dealing sessions

• API dealing connections


20

Sockets

Socket(2) creates an endpoint for communication and returns a descriptor.

A server typically calls socket(2), bind(2), listen(2), and accept(2) or select(2).

A client typically calls socket(2), bind(2). send(2), recv(2), write(2), or read(2).

for data exchange. close(2) or shutdown(2) to close the socket.


21

Raw Socket

• You will never need to write code using raw socket.Raw socket is a computer networking term used to describe a socket that allows access to packet headers on incoming

and outgoing packets.

• To open a raw socket

int fd = socket (PF _ INET, SOCK _ RAW, IPPROTO _ TCP);


22

UNIX Virtualization

• Virtualization is a philosophy wherein the

operating environment abstracts the

computer resources. UNIX offers memory

virtualization where UNIX attempts to offer

an unlimited memory to the application or the user.


23

UNIX Virtualization

• Chroot in UNIX is another type of virtualization. It is

used to restrict access to fi les and directories.

• #include <unistd.h>

chdir(“/foo/bar”);

chroot(“/foo/bar”);

setuid(non zero UID);


24

REGARD

Documents

Constructing secured and safe C/UNIX programs 1 Constructing Secured and Safe C/UNIX Programs presenter: shilan habibi