When a client establishes authenticated RPC, it can specify the level of protection to be applied to its communications with the server. The protection level determines how much of client/server messages are encrypted. As a rule, the more restrictive the protection level, the greater the impact on performance. Different levels are provided so that applications can control the protection versus performance tradeoffs.
Note that the protection level is entirely a client responsibility. When a server registers its supported authentication service with the RPC runtime, it does not specify any protection information for that service. However, the server can include the protection level used for a particular operation when deciding if the caller is authorized to perform the operation.
Authenticated RPC supports the following protection levels:
rpc_c_protect_level_default
Uses the default protection level for the specified authentication service.
rpc_c_protect_level_none
There is no protection level.
rpc_c_protect_level_connect
Performs protection only when the client establishes a relationship with the server. This level performs an encrypted handshake when the client
first communicates with the server. Encryption or decryption is not performed on the data sent between the client and server. The fact that the handshake succeeds indicates that the client is
active on the network.
rpc_c_protect_level_call
Performs protection only at the beginning of each remote procedure call when the server receives the request. This level attaches a verifier to each
client call and server response.
This level does not apply to remote procedure calls made over a connection-based protocol sequence; that is, ncacn_ip_tcp. If this level is specified and the binding handle uses a connection-based protocol sequence, the routine uses the rpc_c_protect_level_pkt level instead.
rpc_c_protect_level_pkt
Ensures that all data received is from the expected client. This level attaches a verifier to each message.
rpc_c_protect_level_pkt_integrity
Ensures and verifies that none of the data transferred between client and server has been modified. This level computes a cryptographic
checksum of each message to verify that none of the data transferred between the client and server has been modified in transit.
This is the highest protection level that is guaranteed to be present in the RPC runtime.
rpc_c_protect_level_pkt_privacy
Performs protection as specified by all of the previous levels and also encrypts each remote procedure call argument and return values. This
level encrypts all user data in each call.
This is the highest protection level, but it may not be available in the RPC runtime.
If a client wants to use the default protection level but does not know what this level is, it can use the rpc_mgmt_inq_dflt_protect_level( ) routine to determine what the default level is.