Changeset 2cde026d in mod_gnutls for docs/mod_gnutls_manual.mdwn

Timestamp:

Apr 21, 2015, 8:09:54 AM (6 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, jessie-backports, master, proxy-ticket, upstream

Children:

4133f2d

Parents:

73f6f12 (diff), d04f7da (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

git-author:

Thomas Klute <thomas2.klute@…> (04/21/15 06:25:30)

git-committer:

Thomas Klute <thomas2.klute@…> (04/21/15 08:09:54)

Message:

Merge branch 'new-gnutls-api'

Merge my TLS proxy implementation with Nikos Mavrogiannopoulos' changes
to use the new GnuTLS key handling API. Some conflicts had to be
resolved.

In Nikos' branch, structures for credentials and priorities are
allocated in mgs_load_files (gnutls_config.c), rather than during server
config structure creation as before. This makes sense, but his patch
doesn't consider the proxy credentials because they didn't exist at the
time.

To minimize additional changes during the merge, proxy credentials are
now allocated in load_proxy_x509_credentials (gnutls_hooks.c), and
mgs_set_priorities (gnutls_config.c) treats proxy and front end
credentials differently (value of GnuTLSPriorities is stored for
mgs_load_files, GnuTLSProxyPriorities is parsed immediately).

Unified handling of priority strings in mgs_set_priorities should be
restored later (towards parsing in post config), handling front end and
proxy credentials separately makes sense because the latter need only be
loaded when TLS proxy operation is enabled and there are some
differences between client (proxy back end) and server (front end)
operation.

File:

• docs/mod_gnutls_manual.mdwn (modified) (1 diff)

docs/mod_gnutls_manual.mdwn

@@ -367 +367 @@
 as protection against statistical attacks to ciphertext data in order to
 achieve maximum compatibility (some broken mobile clients need this).
+
+`GnuTLSPIN`
+------------------
+
+Set the PIN to be used to access encrypted key files or PKCS #11 objects.
+
+    GnuTLSPIN XXXXXX
+
+Default: *none*\
+Context: server config, virtual host
+
+Takes a string to be used as a PIN for the protected objects in
+a security module, or as a key to be used to decrypt PKCS #8, PKCS #12,
+or openssl encrypted keys.
+
+`GnuTLSSRKPIN`
+------------------
+
+Set the SRK PIN to be used to unlaccess the TPM.
+
+    GnuTLSSRKPIN XXXXXX
+
+Default: *none*\
+Context: server config, virtual host
+
+Takes a string to be used as a PIN for the protected objects in
+the TPM module.
 
 `GnuTLSExportCertificates`