Changes in / [9a06bbd:c4a015b] in mod_gnutls

Files:

• README (modified) (1 diff)
• configure.ac (modified) (1 diff)
• docs/mod_gnutls_manual.mdwn (modified) (1 diff)
• include/mod_gnutls.h.in (modified) (8 diffs)
• src/gnutls_config.c (modified) (29 diffs)
• src/gnutls_hooks.c (modified) (9 diffs)
• src/mod_gnutls.c (modified) (1 diff)

README

@@ -22 +22 @@
 -------------
 
- * GnuTLS          >= 2.12.6 <http://www.gnutls.org/> (3.* preferred)
+ * GnuTLS          >= 3.1.3 <http://www.gnutls.org/> (3.2.* preferred)
  * Apache HTTPD    >= 2.2 <http://httpd.apache.org/> (2.4.* preferred)
  * autotools & gcc

configure.ac

@@ -28 +28 @@
 )
 
-PKG_CHECK_MODULES([LIBGNUTLS], [gnutls >= 2.12.6])
+PKG_CHECK_MODULES([LIBGNUTLS], [gnutls >= 3.1.3])
 
 LIBGNUTLS_VERSION=`pkg-config --modversion gnutls`

docs/mod_gnutls_manual.mdwn

@@ -367 +367 @@
 as protection against statistical attacks to ciphertext data in order to
 achieve maximum compatibility (some broken mobile clients need this).
+
+`GnuTLSPIN`
+------------------
+
+Set the PIN to be used to access encrypted key files or PKCS #11 objects.
+
+    GnuTLSPIN XXXXXX
+
+Default: *none*\
+Context: server config, virtual host
+
+Takes a string to be used as a PIN for the protected objects in
+a security module, or as a key to be used to decrypt PKCS #8, PKCS #12,
+or openssl encrypted keys.
+
+`GnuTLSSRKPIN`
+------------------
+
+Set the SRK PIN to be used to unlaccess the TPM.
+
+    GnuTLSSRKPIN XXXXXX
+
+Default: *none*\
+Context: server config, virtual host
+
+Takes a string to be used as a PIN for the protected objects in
+the TPM module.
 
 `GnuTLSExportCertificates`

include/mod_gnutls.h.in

@@ -34 +34 @@
 #include <gnutls/extra.h>
 #endif
+#include <gnutls/abstract.h>
 #include <gnutls/openpgp.h>
 #include <gnutls/x509.h>
@@ -104 +105 @@
 /* Server Configuration Record */
 typedef struct {
+    /* --- Configuration values --- */
+        /* Is the module enabled? */
+    int enabled;
+        /* Is mod_proxy enabled? */
+    int proxy_enabled;
+        /* A Plain HTTP request */
+    int non_ssl_request;
+
+    /* PIN used for PKCS #11 operations */
+    char *pin;
+
+    /* the SRK PIN used in TPM operations */
+    char *srk_pin;
+
+    char *x509_cert_file;
+    char *x509_key_file;
+    char *x509_ca_file;
+
+    char *pgp_cert_file;
+    char *pgp_key_file;
+    char *pgp_ring_file;
+
+    char *dh_file;
+
+    char *priorities_str;
+
+    const char* srp_tpasswd_file;
+    const char* srp_tpasswd_conf_file;
+
+        /* Cache timeout value */
+    int cache_timeout;
+        /* Chose Cache Type */
+    mgs_cache_e cache_type;
+    const char* cache_config;
+
+        /* GnuTLS uses Session Tickets */
+    int tickets;
+
+    /* --- Things initialized at _child_init --- */
+
         /* x509 Certificate Structure */
     gnutls_certificate_credentials_t certs;
@@ -113 +154 @@
     char* cert_cn;
         /* Current x509 Certificate SAN [Subject Alternate Name]s*/
-        char* cert_san[MAX_CERT_SAN];
-        /* A x509 Certificate Chain */
-    gnutls_x509_crt_t *certs_x509_chain;
-        /* Current x509 Certificate Private Key */
-    gnutls_x509_privkey_t privkey_x509;
-        /* OpenPGP Certificate */
-    gnutls_openpgp_crt_t cert_pgp;
-        /* OpenPGP Certificate Private Key */
-    gnutls_openpgp_privkey_t privkey_pgp;
+    char* cert_san[MAX_CERT_SAN];
+        /* An x509 Certificate Chain */
+    gnutls_pcert_st *certs_x509_chain;
+    gnutls_x509_crt_t *certs_x509_crt_chain;
         /* Number of Certificates in Chain */
     unsigned int certs_x509_chain_num;
-        /* Is the module enabled? */
-    int enabled;
+
+        /* Current x509 Certificate Private Key */
+    gnutls_privkey_t privkey_x509;
+
+        /* OpenPGP Certificate */
+    gnutls_pcert_st *cert_pgp;
+    gnutls_openpgp_crt_t *cert_crt_pgp;
+
+        /* OpenPGP Certificate Private Key */
+    gnutls_privkey_t privkey_pgp;
+
     /* Export full certificates to CGI environment: */
     int export_certificates_size;
@@ -132 +177 @@
         /* GnuTLS DH Parameters */
     gnutls_dh_params_t dh_params;
-        /* Cache timeout value */
-    int cache_timeout;
-        /* Chose Cache Type */
-    mgs_cache_e cache_type;
-    const char* cache_config;
-    const char* srp_tpasswd_file;
-    const char* srp_tpasswd_conf_file;
         /* A list of CA Certificates */
     gnutls_x509_crt_t *ca_list;
@@ -151 +189 @@
         /* Last Cache timestamp */
     apr_time_t last_cache_check;
-        /* GnuTLS uses Session Tickets */
-    int tickets;
-        /* Is mod_proxy enabled? */
-    int proxy_enabled;
-        /* A Plain HTTP request */
-    int non_ssl_request;
 } mgs_srvconf_rec;
 
@@ -304 +336 @@
 
 /**
+ * Perform any reinitialization required in PKCS #11
+ */
+int mgs_pkcs11_reinit(server_rec * s);
+
+/**
  * Convert a SSL Session ID into a Null Terminated Hex Encoded String
  * @param id raw SSL Session ID
@@ -323 +360 @@
 
 /* Configuration Functions */
+
+/* Loads all files set in the configuration */
+int mgs_load_files(apr_pool_t * p, server_rec * s);
 
 const char *mgs_set_srp_tpasswd_conf_file(cmd_parms * parms, void *dummy,
@@ -356 +396 @@
 const char *mgs_set_client_ca_file(cmd_parms * parms, void *dummy,
                                    const char *arg);
+const char *mgs_set_pin(cmd_parms * parms, void *dummy,
+                                   const char *arg);
+
+const char *mgs_set_srk_pin(cmd_parms * parms, void *dummy,
+                                   const char *arg);
 
 const char *mgs_set_keyring_file(cmd_parms * parms, void *dummy,

src/gnutls_config.c

@@ -20 +20 @@
 #include "mod_gnutls.h"
 #include "apr_lib.h"
+#include <gnutls/abstract.h>
+
+#define INIT_CA_SIZE 128
 
 #ifdef APLOG_USE_MODULE
@@ -25 +28 @@
 #endif
 
+static int pin_callback(void *user, int attempt __attribute__((unused)),
+                        const char *token_url __attribute__((unused)),
+                        const char *token_label, unsigned int flags,
+                        char *pin, size_t pin_max)
+{
+    mgs_srvconf_rec *sc = user;
+
+    if (sc->pin == NULL || flags & GNUTLS_PIN_FINAL_TRY ||
+        flags & GNUTLS_PIN_WRONG) {
+        return -1;
+    }
+
+    if (token_label && strcmp(token_label, "SRK") == 0) {
+         snprintf(pin, pin_max, "%s", sc->srk_pin);
+    } else {
+         snprintf(pin, pin_max, "%s", sc->pin);
+    }
+    return 0;
+}
+
 static int load_datum_from_file(apr_pool_t * pool,
-        const char *file, gnutls_datum_t * data) {
+                                const char *file, gnutls_datum_t * data)
+{
     apr_file_t *fp;
     apr_finfo_t finfo;
@@ -33 +57 @@
 
     rv = apr_file_open(&fp, file, APR_READ | APR_BINARY,
-            APR_OS_DEFAULT, pool);
+                       APR_OS_DEFAULT, pool);
     if (rv != APR_SUCCESS) {
-        return rv;
+        return rv;
     }
 
@@ -41 +65 @@
 
     if (rv != APR_SUCCESS) {
-        return rv;
+        return rv;
     }
 
@@ -48 +72 @@
 
     if (rv != APR_SUCCESS) {
-        return rv;
+        return rv;
     }
     apr_file_close(fp);
@@ -58 +82 @@
 }
 
-const char *mgs_set_dh_file(cmd_parms * parms, void *dummy __attribute__((unused)),
-        const char *arg) {
+/* 2048-bit group parameters from SRP specification */
+const char static_dh_params[] = "-----BEGIN DH PARAMETERS-----\n"
+        "MIIBBwKCAQCsa9tBMkqam/Fm3l4TiVgvr3K2ZRmH7gf8MZKUPbVgUKNzKcu0oJnt\n"
+        "gZPgdXdnoT3VIxKrSwMxDc1/SKnaBP1Q6Ag5ae23Z7DPYJUXmhY6s2YaBfvV+qro\n"
+        "KRipli8Lk7hV+XmT7Jde6qgNdArb9P90c1nQQdXDPqcdKB5EaxR3O8qXtDoj+4AW\n"
+        "dr0gekNsZIHx0rkHhxdGGludMuaI+HdIVEUjtSSw1X1ep3onddLs+gMs+9v1L7N4\n"
+        "YWAnkATleuavh05zA85TKZzMBBx7wwjYKlaY86jQw4JxrjX46dv7tpS1yAPYn3rk\n"
+        "Nd4jbVJfVHWbZeNy/NaO8g+nER+eSv9zAgEC\n"
+        "-----END DH PARAMETERS-----\n";
+
+int mgs_load_files(apr_pool_t * p, server_rec * s)
+{
+    apr_pool_t *spool;
+    const char *file;
+    gnutls_datum_t data;
     int ret;
-    gnutls_datum_t data;
-    const char *file;
-    apr_pool_t *spool;
-    mgs_srvconf_rec *sc =
-            (mgs_srvconf_rec *) ap_get_module_config(parms->server->
-            module_config,
-            &gnutls_module);
-
-    apr_pool_create(&spool, parms->pool);
-
-    file = ap_server_root_relative(spool, arg);
-
-    if (load_datum_from_file(spool, file, &data) != 0) {
-        return apr_psprintf(parms->pool, "GnuTLS: Error Reading "
-                "DH params '%s'", file);
-    }
+    mgs_srvconf_rec *sc =
+        (mgs_srvconf_rec *) ap_get_module_config(s->module_config,
+                                                 &gnutls_module);
+
+    apr_pool_create(&spool, p);
+
+    sc->cert_pgp = apr_pcalloc(p, sizeof(sc->cert_pgp[0]));
+    sc->cert_crt_pgp = apr_pcalloc(p, sizeof(sc->cert_crt_pgp[0]));
+    sc->certs_x509_chain =
+        apr_pcalloc(p, MAX_CHAIN_SIZE * sizeof(sc->certs_x509_chain[0]));
+    sc->certs_x509_crt_chain =
+        apr_pcalloc(p,
+                    MAX_CHAIN_SIZE * sizeof(sc->certs_x509_crt_chain[0]));
+
+    ret = gnutls_certificate_allocate_credentials(&sc->certs);
+    if (ret < 0) {
+        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                     "GnuTLS: Failed to initialize" ": (%d) %s", ret,
+                     gnutls_strerror(ret));
+        ret = -1;
+        goto cleanup;
+    }
+
+    ret = gnutls_anon_allocate_server_credentials(&sc->anon_creds);
+    if (ret < 0) {
+        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                     "GnuTLS: Failed to initialize" ": (%d) %s", ret,
+                     gnutls_strerror(ret));
+        ret = -1;
+        goto cleanup;
+    }
+
+    /* Load SRP parameters */
+#ifdef ENABLE_SRP
+    ret = gnutls_srp_allocate_server_credentials(&sc->srp_creds);
+    if (ret < 0) {
+        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                     "GnuTLS: Failed to initialize" ": (%d) %s", ret,
+                     gnutls_strerror(ret));
+        ret = -1;
+        goto cleanup;
+    }
+
+    if (sc->srp_tpasswd_conf_file != NULL && sc->srp_tpasswd_file != NULL) {
+        ret = gnutls_srp_set_server_credentials_file
+            (sc->srp_creds, sc->srp_tpasswd_file,
+             sc->srp_tpasswd_conf_file);
+
+        if (ret < 0 && sc->enabled == GNUTLS_ENABLED_TRUE) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0,
+                         s,
+                         "GnuTLS: Host '%s:%d' is missing a "
+                         "SRP password or conf File!",
+                         s->server_hostname, s->port);
+            ret = -1;
+            goto cleanup;
+        }
+    }
+#endif
 
     ret = gnutls_dh_params_init(&sc->dh_params);
     if (ret < 0) {
-        return apr_psprintf(parms->pool,
-                "GnuTLS: Failed to initialize"
-                ": (%d) %s", ret,
-                gnutls_strerror(ret));
-    }
-
-    ret =
-            gnutls_dh_params_import_pkcs3(sc->dh_params, &data,
-            GNUTLS_X509_FMT_PEM);
-    if (ret < 0) {
-        return apr_psprintf(parms->pool,
-                "GnuTLS: Failed to Import "
-                "DH params '%s': (%d) %s", file, ret,
-                gnutls_strerror(ret));
-    }
-
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Failed to initialize"
+                         ": (%d) %s", ret, gnutls_strerror(ret));
+            ret = -1;
+            goto cleanup;
+    }
+
+    /* Load DH parameters */
+    if (sc->dh_file) {
+        if (load_datum_from_file(spool, sc->dh_file, &data) != 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Error Reading " "DH params '%s'", sc->dh_file);
+            ret = -1;
+            goto cleanup;
+        }
+
+        ret =
+            gnutls_dh_params_import_pkcs3(sc->dh_params, &data,
+                                          GNUTLS_X509_FMT_PEM);
+        if (ret < 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Failed to Import "
+                         "DH params '%s': (%d) %s", sc->dh_file, ret,
+                         gnutls_strerror(ret));
+            ret = -1;
+            goto cleanup;
+        }
+    } else {
+        gnutls_datum_t pdata = {
+            (void *) static_dh_params,
+            sizeof(static_dh_params)
+        };
+
+        ret = gnutls_dh_params_import_pkcs3(sc->dh_params, &pdata, GNUTLS_X509_FMT_PEM);
+        if (ret < 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                    "GnuTLS: Unable to generate or load DH Params: (%d) %s",
+                    ret, gnutls_strerror(ret));
+            ret = -1;
+            goto cleanup;
+        }
+    }
+
+    if (sc->x509_cert_file != NULL) {
+        unsigned int chain_num, i;
+        unsigned format = GNUTLS_X509_FMT_PEM;
+
+        /* Load X.509 certificate */
+        if (strncmp(sc->x509_cert_file, "pkcs11:", 7) == 0) {
+            gnutls_pkcs11_obj_t obj;
+
+            file = sc->x509_cert_file;
+
+            ret = gnutls_pkcs11_obj_init(&obj);
+            if (ret < 0) {
+                ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                             "GnuTLS: Error Initializing PKCS #11 object");
+                ret = -1;
+                goto cleanup;
+            }
+
+            gnutls_pkcs11_obj_set_pin_function(obj, pin_callback, sc);
+
+            ret = gnutls_pkcs11_obj_import_url(obj, file, GNUTLS_PKCS11_OBJ_FLAG_LOGIN);
+            if (ret < 0) {
+                ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                             "GnuTLS: Error Importing PKCS #11 object: '%s': %s",
+                             file, gnutls_strerror(ret));
+                ret = -1;
+                goto cleanup;
+            }
+
+            format = GNUTLS_X509_FMT_DER;
+            ret = gnutls_pkcs11_obj_export2(obj, &data);
+            if (ret < 0) {
+                ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                             "GnuTLS: Error Exporting a PKCS #11 object: '%s': %s",
+                             file, gnutls_strerror(ret));
+                ret = -1;
+                goto cleanup;
+            }
+
+            gnutls_pkcs11_obj_deinit(obj);
+        } else {
+            file = ap_server_root_relative(spool, sc->x509_cert_file);
+
+            ret = gnutls_load_file(file, &data);
+            if (ret < 0) {
+                ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                             "GnuTLS: Error Reading Certificate '%s': %s",
+                             file, gnutls_strerror(ret));
+                ret = -1;
+                goto cleanup;
+            }
+        }
+
+        ret =
+            gnutls_x509_crt_list_import2(&sc->certs_x509_crt_chain,
+                                        &chain_num, &data, format,
+                                        GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED);
+        gnutls_free(data.data);
+        sc->certs_x509_chain_num = chain_num;
+
+        if (ret < 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Failed to Import Certificate Chain '%s': (%d) %s",
+                         file, ret, gnutls_strerror(ret));
+            ret = -1;
+            goto cleanup;
+        }
+
+        for (i = 0; i < chain_num; i++) {
+            ret =
+                gnutls_pcert_import_x509(&sc->certs_x509_chain[i],
+                                         sc->certs_x509_crt_chain[i], 0);
+            if (ret < 0) {
+                ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                             "GnuTLS: Failed to Import pCertificate '%s': (%d) %s",
+                             file, ret, gnutls_strerror(ret));
+                ret = -1;
+                goto cleanup;
+            }
+        }
+        sc->certs_x509_chain_num = chain_num;
+    }
+
+    if (sc->x509_key_file) {
+        ret = gnutls_privkey_init(&sc->privkey_x509);
+        if (ret < 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Failed to initialize: (%d) %s", ret,
+                         gnutls_strerror(ret));
+            ret = -1;
+            goto cleanup;
+        }
+
+        if (gnutls_url_is_supported(sc->x509_key_file) != 0) {
+            file = sc->x509_key_file;
+
+            gnutls_privkey_set_pin_function(sc->privkey_x509, pin_callback,
+                                            sc);
+
+            ret = gnutls_privkey_import_url(sc->privkey_x509, file, 0);
+
+            if (ret < 0) {
+                ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                             "GnuTLS: Failed to Import Private Key URL '%s': (%d) %s",
+                             file, ret, gnutls_strerror(ret));
+                ret = -1;
+                goto cleanup;
+            }
+        } else {
+            file = ap_server_root_relative(spool, sc->x509_key_file);
+
+            if (load_datum_from_file(spool, file, &data) != 0) {
+                ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                             "GnuTLS: Error Reading Private Key '%s'",
+                             file);
+                ret = -1;
+                goto cleanup;
+            }
+
+            ret =
+                gnutls_privkey_import_x509_raw(sc->privkey_x509, &data,
+                                               GNUTLS_X509_FMT_PEM, sc->pin,
+                                               0);
+
+            if (ret < 0) {
+                ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                             "GnuTLS: Failed to Import Private Key '%s': (%d) %s",
+                             file, ret, gnutls_strerror(ret));
+                ret = -1;
+                goto cleanup;
+            }
+        }
+    }
+
+    /* Load the X.509 CA file */
+    if (sc->x509_ca_file) {
+        if (load_datum_from_file(spool, sc->x509_ca_file, &data) != 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Error Reading " "Client CA File '%s'",
+                         sc->x509_ca_file);
+            ret = -1;
+            goto cleanup;
+        }
+
+        ret = gnutls_x509_crt_list_import2(&sc->ca_list, &sc->ca_list_size,
+                                         &data, GNUTLS_X509_FMT_PEM, 0);
+        if (ret < 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Failed to load "
+                         "Client CA File '%s': (%d) %s", sc->x509_ca_file,
+                         ret, gnutls_strerror(ret));
+            ret = -1;
+            goto cleanup;
+        }
+    }
+
+    if (sc->pgp_cert_file) {
+        if (load_datum_from_file(spool, sc->pgp_cert_file, &data) != 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Error Reading " "Certificate '%s'",
+                         sc->pgp_cert_file);
+            ret = -1;
+            goto cleanup;
+        }
+
+        ret = gnutls_openpgp_crt_init(&sc->cert_crt_pgp[0]);
+        if (ret < 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Failed to Init "
+                         "PGP Certificate: (%d) %s", ret,
+                         gnutls_strerror(ret));
+            ret = -1;
+            goto cleanup;
+        }
+
+        ret =
+            gnutls_openpgp_crt_import(sc->cert_crt_pgp[0], &data,
+                                      GNUTLS_OPENPGP_FMT_BASE64);
+        if (ret < 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Failed to Import "
+                         "PGP Certificate: (%d) %s", ret,
+                         gnutls_strerror(ret));
+            ret = -1;
+            goto cleanup;
+        }
+
+        ret =
+            gnutls_pcert_import_openpgp(sc->cert_pgp, sc->cert_crt_pgp[0],
+                                        0);
+        if (ret < 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Failed to Import "
+                         "PGP pCertificate: (%d) %s", ret,
+                         gnutls_strerror(ret));
+            ret = -1;
+            goto cleanup;
+        }
+    }
+
+    /* Load the PGP key file */
+    if (sc->pgp_key_file) {
+        if (load_datum_from_file(spool, sc->pgp_key_file, &data) != 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Error Reading " "Private Key '%s'",
+                         sc->pgp_key_file);
+            ret = -1;
+            goto cleanup;
+        }
+
+        ret = gnutls_privkey_init(&sc->privkey_pgp);
+        if (ret < 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Failed to initialize"
+                         ": (%d) %s", ret, gnutls_strerror(ret));
+            ret = -1;
+            goto cleanup;
+        }
+
+        ret =
+            gnutls_privkey_import_openpgp_raw(sc->privkey_pgp, &data,
+                                              GNUTLS_OPENPGP_FMT_BASE64,
+                                              NULL, NULL);
+        if (ret != 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Failed to Import "
+                         "PGP Private Key '%s': (%d) %s",
+                         sc->pgp_key_file, ret, gnutls_strerror(ret));
+            ret = -1;
+            goto cleanup;
+        }
+    }
+
+    /* Load the keyring file */
+    if (sc->pgp_ring_file) {
+        if (load_datum_from_file(spool, sc->pgp_ring_file, &data) != 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Error Reading " "Keyring File '%s'",
+                         sc->pgp_ring_file);
+            ret = -1;
+            goto cleanup;
+        }
+
+        ret = gnutls_openpgp_keyring_init(&sc->pgp_list);
+        if (ret < 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Failed to initialize"
+                         "keyring: (%d) %s", ret, gnutls_strerror(ret));
+            ret = -1;
+            goto cleanup;
+        }
+
+        ret = gnutls_openpgp_keyring_import(sc->pgp_list, &data,
+                                           GNUTLS_OPENPGP_FMT_BASE64);
+        if (ret < 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Failed to load "
+                         "Keyring File '%s': (%d) %s", sc->pgp_ring_file,
+                         ret, gnutls_strerror(ret));
+            ret = -1;
+            goto cleanup;
+        }
+    }
+
+    if (sc->priorities_str) {
+        const char *err;
+        ret = gnutls_priority_init(&sc->priorities, sc->priorities_str, &err);
+
+        if (ret < 0) {
+            if (ret == GNUTLS_E_INVALID_REQUEST) {
+                ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                             "GnuTLS: Syntax error parsing priorities string at: %s",
+                             err);
+            } else {
+                ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                             "GnuTLS: error parsing priorities string");
+
+            }
+            ret = -1;
+            goto cleanup;
+        }
+    }
+
+    ret = 0;
+  cleanup:
     apr_pool_destroy(spool);
 
+    return ret;
+}
+
+int mgs_pkcs11_reinit(server_rec * base_server)
+{
+    int ret;
+    server_rec *s;
+    mgs_srvconf_rec *sc;
+
+    gnutls_pkcs11_reinit();
+
+    for (s = base_server; s; s = s->next) {
+        sc = (mgs_srvconf_rec *) ap_get_module_config(s->module_config, &gnutls_module);
+
+            /* gnutls caches the session in a private key, so we need to open
+             * a new one */
+            if (sc->x509_key_file && gnutls_url_is_supported(sc->x509_key_file) != 0) {
+                gnutls_privkey_deinit(sc->privkey_x509);
+
+                ret = gnutls_privkey_init(&sc->privkey_x509);
+                if (ret < 0) {
+                    ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
+                                 "GnuTLS: Failed to initialize: (%d) %s", ret,
+                                 gnutls_strerror(ret));
+                    goto fail;
+                }
+
+                gnutls_privkey_set_pin_function(sc->privkey_x509, pin_callback, sc);
+
+                ret = gnutls_privkey_import_url(sc->privkey_x509, sc->x509_key_file, 0);
+                if (ret < 0) {
+                    ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
+                             "GnuTLS: Failed to Re-Import Private Key URL '%s': (%d) %s",
+                             sc->x509_key_file, ret, gnutls_strerror(ret));
+                    goto fail;
+                }
+            }
+    }
+
+    return 0;
+
+ fail:
+    gnutls_privkey_deinit(sc->privkey_x509);
+    return -1;
+}
+
+const char *mgs_set_dh_file(cmd_parms * parms, void *dummy __attribute__((unused)),
+        const char *arg) {
+    mgs_srvconf_rec *sc =
+        (mgs_srvconf_rec *) ap_get_module_config(parms->server->
+                                                 module_config,
+                                                 &gnutls_module);
+
+    sc->dh_file = ap_server_root_relative(parms->pool, arg);
+
     return NULL;
 }
@@ -103 +550 @@
 const char *mgs_set_cert_file(cmd_parms * parms, void *dummy __attribute__((unused)), const char *arg) {
 
-    int ret;
-    gnutls_datum_t data;
-    const char *file;
-    apr_pool_t *spool;
-
-    mgs_srvconf_rec *sc = (mgs_srvconf_rec *) ap_get_module_config(parms->server->module_config, &gnutls_module);
-    apr_pool_create(&spool, parms->pool);
-
-    file = ap_server_root_relative(spool, arg);
-
-    if (load_datum_from_file(spool, file, &data) != 0) {
-                apr_pool_destroy(spool);
-        return apr_psprintf(parms->pool, "GnuTLS: Error Reading Certificate '%s'", file);
-    }
-
-    sc->certs_x509_chain_num = MAX_CHAIN_SIZE;
-    ret = gnutls_x509_crt_list_import(sc->certs_x509_chain, &sc->certs_x509_chain_num, &data, GNUTLS_X509_FMT_PEM, 0);
-    if (ret < 0) {
-                apr_pool_destroy(spool);
-        return apr_psprintf(parms->pool, "GnuTLS: Failed to Import Certificate '%s': (%d) %s", file, ret, gnutls_strerror(ret));
-    }
-
-        apr_pool_destroy(spool);
+    mgs_srvconf_rec *sc =
+        (mgs_srvconf_rec *) ap_get_module_config(parms->
+                                                 server->module_config,
+                                                 &gnutls_module);
+
+    sc->x509_cert_file = apr_pstrdup(parms->pool, arg);
+
     return NULL;
 
@@ -132 +563 @@
 const char *mgs_set_key_file(cmd_parms * parms, void *dummy __attribute__((unused)), const char *arg) {
 
-    int ret;
-    gnutls_datum_t data;
-    const char *file;
-    apr_pool_t *spool;
-    const char *out;
-
-        mgs_srvconf_rec *sc = (mgs_srvconf_rec *) ap_get_module_config(parms->server->module_config, &gnutls_module);
-
-        apr_pool_create(&spool, parms->pool);
-
-    file = ap_server_root_relative(spool, arg);
-
-    if (load_datum_from_file(spool, file, &data) != 0) {
-        out = apr_psprintf(parms->pool, "GnuTLS: Error Reading Private Key '%s'", file);
-                apr_pool_destroy(spool);
-        return out;
-    }
-
-    ret = gnutls_x509_privkey_init(&sc->privkey_x509);
-
-    if (ret < 0) {
-                apr_pool_destroy(spool);
-        return apr_psprintf(parms->pool, "GnuTLS: Failed to initialize: (%d) %s", ret, gnutls_strerror(ret));
-    }
-
-    ret = gnutls_x509_privkey_import(sc->privkey_x509, &data, GNUTLS_X509_FMT_PEM);
-
-    if (ret < 0) {
-        ret = gnutls_x509_privkey_import_pkcs8(sc->privkey_x509, &data, GNUTLS_X509_FMT_PEM, NULL, GNUTLS_PKCS_PLAIN);
-        }
-
-    if (ret < 0) {
-        out = apr_psprintf(parms->pool, "GnuTLS: Failed to Import Private Key '%s': (%d) %s", file, ret, gnutls_strerror(ret));
-                apr_pool_destroy(spool);
-        return out;
-    }
-
-    apr_pool_destroy(spool);
+    mgs_srvconf_rec *sc =
+        (mgs_srvconf_rec *) ap_get_module_config(parms->
+                                                 server->module_config,
+                                                 &gnutls_module);
+
+    sc->x509_key_file = apr_pstrdup(parms->pool, arg);
 
     return NULL;
@@ -175 +574 @@
 
 const char *mgs_set_pgpcert_file(cmd_parms * parms, void *dummy __attribute__((unused)),
-        const char *arg) {
-    int ret;
-    gnutls_datum_t data;
-    const char *file;
-    apr_pool_t *spool;
-    mgs_srvconf_rec *sc =
-            (mgs_srvconf_rec *) ap_get_module_config(parms->server->
-            module_config,
-            &gnutls_module);
-    apr_pool_create(&spool, parms->pool);
-
-    file = ap_server_root_relative(spool, arg);
-
-    if (load_datum_from_file(spool, file, &data) != 0) {
-        return apr_psprintf(parms->pool, "GnuTLS: Error Reading "
-                "Certificate '%s'", file);
-    }
-
-    ret = gnutls_openpgp_crt_init(&sc->cert_pgp);
-    if (ret < 0) {
-        return apr_psprintf(parms->pool, "GnuTLS: Failed to Init "
-                "PGP Certificate: (%d) %s", ret,
-                gnutls_strerror(ret));
-    }
-
-    ret =
-            gnutls_openpgp_crt_import(sc->cert_pgp, &data,
-            GNUTLS_OPENPGP_FMT_BASE64);
-    if (ret < 0) {
-        return apr_psprintf(parms->pool,
-                "GnuTLS: Failed to Import "
-                "PGP Certificate '%s': (%d) %s", file,
-                ret, gnutls_strerror(ret));
-    }
-
-    apr_pool_destroy(spool);
+        const char *arg)
+{
+    mgs_srvconf_rec *sc =
+        (mgs_srvconf_rec *) ap_get_module_config(parms->server->
+                                                 module_config,
+                                                 &gnutls_module);
+
+    sc->pgp_cert_file = ap_server_root_relative(parms->pool, arg);
+
     return NULL;
 }
@@ -216 +588 @@
 const char *mgs_set_pgpkey_file(cmd_parms * parms, void *dummy __attribute__((unused)),
         const char *arg) {
-    int ret;
-    gnutls_datum_t data;
-    const char *file;
-    apr_pool_t *spool;
-    mgs_srvconf_rec *sc =
-            (mgs_srvconf_rec *) ap_get_module_config(parms->server->
-            module_config,
-            &gnutls_module);
-    apr_pool_create(&spool, parms->pool);
-
-    file = ap_server_root_relative(spool, arg);
-
-    if (load_datum_from_file(spool, file, &data) != 0) {
-        return apr_psprintf(parms->pool, "GnuTLS: Error Reading "
-                "Private Key '%s'", file);
-    }
-
-    ret = gnutls_openpgp_privkey_init(&sc->privkey_pgp);
-    if (ret < 0) {
-        return apr_psprintf(parms->pool,
-                "GnuTLS: Failed to initialize"
-                ": (%d) %s", ret,
-                gnutls_strerror(ret));
-    }
-
-    ret =
-            gnutls_openpgp_privkey_import(sc->privkey_pgp, &data,
-            GNUTLS_OPENPGP_FMT_BASE64, NULL,
-            0);
-    if (ret != 0) {
-        return apr_psprintf(parms->pool,
-                "GnuTLS: Failed to Import "
-                "PGP Private Key '%s': (%d) %s", file,
-                ret, gnutls_strerror(ret));
-    }
-    apr_pool_destroy(spool);
+    mgs_srvconf_rec *sc =
+        (mgs_srvconf_rec *) ap_get_module_config(parms->server->
+                                                 module_config,
+                                                 &gnutls_module);
+
+    sc->pgp_key_file = ap_server_root_relative(parms->pool, arg);
+
     return NULL;
 }
@@ -258 +601 @@
         const char *arg) {
     mgs_srvconf_rec *sc =
-            (mgs_srvconf_rec *) ap_get_module_config(parms->server->
-            module_config,
-            &gnutls_module);
+        (mgs_srvconf_rec *) ap_get_module_config(parms->server->
+                                                 module_config,
+                                                 &gnutls_module);
 
     sc->tickets = 0;
     if (strcasecmp("on", arg) == 0) {
-        sc->tickets = 1;
+        sc->tickets = 1;
     }
 
@@ -276 +619 @@
         const char *arg) {
     mgs_srvconf_rec *sc =
-            (mgs_srvconf_rec *) ap_get_module_config(parms->server->
-            module_config,
-            &gnutls_module);
+        (mgs_srvconf_rec *) ap_get_module_config(parms->server->
+                                                 module_config,
+                                                 &gnutls_module);
 
     sc->srp_tpasswd_file = ap_server_root_relative(parms->pool, arg);
@@ -288 +631 @@
         const char *arg) {
     mgs_srvconf_rec *sc =
-            (mgs_srvconf_rec *) ap_get_module_config(parms->server->
-            module_config,
-            &gnutls_module);
-
-    sc->srp_tpasswd_conf_file =
-            ap_server_root_relative(parms->pool, arg);
+        (mgs_srvconf_rec *) ap_get_module_config(parms->server->
+                                                 module_config,
+                                                 &gnutls_module);
+
+    sc->srp_tpasswd_conf_file = ap_server_root_relative(parms->pool, arg);
 
     return NULL;
@@ -304 +646 @@
     const char *err;
     mgs_srvconf_rec *sc =
-            ap_get_module_config(parms->server->module_config,
-            &gnutls_module);
+        ap_get_module_config(parms->server->module_config,
+                             &gnutls_module);
     if ((err = ap_check_cmd_context(parms, GLOBAL_ONLY))) {
-        return err;
+        return err;
     }
 
     if (strcasecmp("none", type) == 0) {
-        sc->cache_type = mgs_cache_none;
-        sc->cache_config = NULL;
-        return NULL;
+        sc->cache_type = mgs_cache_none;
+        sc->cache_config = NULL;
+        return NULL;
     } else if (strcasecmp("dbm", type) == 0) {
-        sc->cache_type = mgs_cache_dbm;
+        sc->cache_type = mgs_cache_dbm;
     } else if (strcasecmp("gdbm", type) == 0) {
-        sc->cache_type = mgs_cache_gdbm;
+        sc->cache_type = mgs_cache_gdbm;
     }
 #if HAVE_APR_MEMCACHE
     else if (strcasecmp("memcache", type) == 0) {
-        sc->cache_type = mgs_cache_memcache;
+        sc->cache_type = mgs_cache_memcache;
     }
 #endif
     else {
-        return "Invalid Type for GnuTLSCache!";
+        return "Invalid Type for GnuTLSCache!";
     }
 
     if (arg == NULL)
-        return "Invalid argument 2 for GnuTLSCache!";
+        return "Invalid argument 2 for GnuTLSCache!";
 
     if (sc->cache_type == mgs_cache_dbm
-            || sc->cache_type == mgs_cache_gdbm) {
-        sc->cache_config =
-                ap_server_root_relative(parms->pool, arg);
+        || sc->cache_type == mgs_cache_gdbm) {
+        sc->cache_config = ap_server_root_relative(parms->pool, arg);
     } else {
-        sc->cache_config = apr_pstrdup(parms->pool, arg);
+        sc->cache_config = apr_pstrdup(parms->pool, arg);
     }
 
@@ -347 +688 @@
     const char *err;
     mgs_srvconf_rec *sc =
-            (mgs_srvconf_rec *) ap_get_module_config(parms->server->
-            module_config,
-            &gnutls_module);
+        (mgs_srvconf_rec *) ap_get_module_config(parms->server->
+                                                 module_config,
+                                                 &gnutls_module);
 
     if ((err = ap_check_cmd_context(parms, GLOBAL_ONLY))) {
-        return err;
+        return err;
     }
 
@@ -358 +699 @@
 
     if (argint < 0) {
-        return "GnuTLSCacheTimeout: Invalid argument";
+        return "GnuTLSCacheTimeout: Invalid argument";
     } else if (argint == 0) {
-        sc->cache_timeout = 0;
+        sc->cache_timeout = 0;
     } else {
-        sc->cache_timeout = apr_time_from_sec(argint);
+        sc->cache_timeout = apr_time_from_sec(argint);
     }
 
@@ -373 +714 @@
 
     if (strcasecmp("cartel", arg) == 0) {
-        sc->client_verify_method = mgs_cvm_cartel;
+        sc->client_verify_method = mgs_cvm_cartel;
     } else if (strcasecmp("msva", arg) == 0) {
 #ifdef ENABLE_MSVA
-        sc->client_verify_method = mgs_cvm_msva;
+        sc->client_verify_method = mgs_cvm_msva;
 #else
-        return "GnuTLSClientVerifyMethod: msva is not supported";
+        return "GnuTLSClientVerifyMethod: msva is not supported";
 #endif
     } else {
-        return "GnuTLSClientVerifyMethod: Invalid argument";
+        return "GnuTLSClientVerifyMethod: Invalid argument";
     }
 
@@ -393 +734 @@
 
     if (strcasecmp("none", arg) == 0 || strcasecmp("ignore", arg) == 0) {
-        mode = GNUTLS_CERT_IGNORE;
+        mode = GNUTLS_CERT_IGNORE;
     } else if (strcasecmp("optional", arg) == 0
-            || strcasecmp("request", arg) == 0) {
-        mode = GNUTLS_CERT_REQUEST;
+               || strcasecmp("request", arg) == 0) {
+        mode = GNUTLS_CERT_REQUEST;
     } else if (strcasecmp("require", arg) == 0) {
-        mode = GNUTLS_CERT_REQUIRE;
+        mode = GNUTLS_CERT_REQUIRE;
     } else {
-        return "GnuTLSClientVerify: Invalid argument";
+        return "GnuTLSClientVerify: Invalid argument";
     }
 
@@ -408 +749 @@
         dc->client_verify_mode = mode;
     } else {
-        mgs_srvconf_rec *sc =
-                (mgs_srvconf_rec *)
-                ap_get_module_config(parms->server->module_config,
-                &gnutls_module);
-        sc->client_verify_mode = mode;
-    }
-
-    return NULL;
-}
-
-#define INIT_CA_SIZE 128
+        mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
+            ap_get_module_config(parms->server->module_config,
+                                 &gnutls_module);
+        sc->client_verify_mode = mode;
+    }
+
+    return NULL;
+}
 
 const char *mgs_set_client_ca_file(cmd_parms * parms, void *dummy __attribute__((unused)),
         const char *arg) {
-    int rv;
-    const char *file;
-    apr_pool_t *spool;
-    gnutls_datum_t data;
-
-    mgs_srvconf_rec *sc =
-            (mgs_srvconf_rec *) ap_get_module_config(parms->server->
-            module_config,
-            &gnutls_module);
-    apr_pool_create(&spool, parms->pool);
-
-    file = ap_server_root_relative(spool, arg);
-
-    if (load_datum_from_file(spool, file, &data) != 0) {
-        return apr_psprintf(parms->pool, "GnuTLS: Error Reading "
-                "Client CA File '%s'", file);
-    }
-
-    sc->ca_list_size = INIT_CA_SIZE;
-    sc->ca_list = malloc(sc->ca_list_size * sizeof (*sc->ca_list));
-    if (sc->ca_list == NULL) {
-        return apr_psprintf(parms->pool,
-                "mod_gnutls: Memory allocation error");
-    }
-
-    rv = gnutls_x509_crt_list_import(sc->ca_list, &sc->ca_list_size,
-            &data, GNUTLS_X509_FMT_PEM,
-            GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED);
-    if (rv < 0 && rv != GNUTLS_E_SHORT_MEMORY_BUFFER) {
-        return apr_psprintf(parms->pool, "GnuTLS: Failed to load "
-                "Client CA File '%s': (%d) %s", file,
-                rv, gnutls_strerror(rv));
-    }
-
-    if (INIT_CA_SIZE < sc->ca_list_size) {
-        sc->ca_list =
-                realloc(sc->ca_list,
-                sc->ca_list_size * sizeof (*sc->ca_list));
-        if (sc->ca_list == NULL) {
-            return apr_psprintf(parms->pool,
-                    "mod_gnutls: Memory allocation error");
-        }
-
-        /* re-read */
-        rv = gnutls_x509_crt_list_import(sc->ca_list,
-                &sc->ca_list_size, &data,
-                GNUTLS_X509_FMT_PEM, 0);
-
-        if (rv < 0) {
-            return apr_psprintf(parms->pool,
-                    "GnuTLS: Failed to load "
-                    "Client CA File '%s': (%d) %s",
-                    file, rv, gnutls_strerror(rv));
-        }
-    }
-
-    apr_pool_destroy(spool);
+    mgs_srvconf_rec *sc =
+        (mgs_srvconf_rec *) ap_get_module_config(parms->server->
+                                                 module_config,
+                                                 &gnutls_module);
+
+    sc->x509_ca_file = ap_server_root_relative(parms->pool, arg);
+
     return NULL;
 }
@@ -484 +772 @@
 const char *mgs_set_keyring_file(cmd_parms * parms, void *dummy __attribute__((unused)),
         const char *arg) {
-    int rv;
-    const char *file;
-    apr_pool_t *spool;
-    gnutls_datum_t data;
-
-    mgs_srvconf_rec *sc =
-            (mgs_srvconf_rec *) ap_get_module_config(parms->server->
-            module_config,
-            &gnutls_module);
-    apr_pool_create(&spool, parms->pool);
-
-    file = ap_server_root_relative(spool, arg);
-
-    if (load_datum_from_file(spool, file, &data) != 0) {
-        return apr_psprintf(parms->pool, "GnuTLS: Error Reading "
-                "Keyring File '%s'", file);
-    }
-
-    rv = gnutls_openpgp_keyring_init(&sc->pgp_list);
-    if (rv < 0) {
-        return apr_psprintf(parms->pool,
-                "GnuTLS: Failed to initialize"
-                "keyring: (%d) %s", rv,
-                gnutls_strerror(rv));
-    }
-
-    rv = gnutls_openpgp_keyring_import(sc->pgp_list, &data,
-            GNUTLS_OPENPGP_FMT_BASE64);
-    if (rv < 0) {
-        return apr_psprintf(parms->pool, "GnuTLS: Failed to load "
-                "Keyring File '%s': (%d) %s", file, rv,
-                gnutls_strerror(rv));
-    }
-
-    apr_pool_destroy(spool);
+    mgs_srvconf_rec *sc =
+        (mgs_srvconf_rec *) ap_get_module_config(parms->server->
+                                                 module_config,
+                                                 &gnutls_module);
+
+    sc->pgp_ring_file = ap_server_root_relative(parms->pool, arg);
+
     return NULL;
 }
@@ -525 +785 @@
         const char *arg) {
 
-    mgs_srvconf_rec *sc =(mgs_srvconf_rec *)
-            ap_get_module_config(parms->server->module_config, &gnutls_module);
+    mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
+        ap_get_module_config(parms->server->module_config, &gnutls_module);
 
     if (!strcasecmp(arg, "On")) {
-        sc->proxy_enabled = GNUTLS_ENABLED_TRUE;
+        sc->proxy_enabled = GNUTLS_ENABLED_TRUE;
     } else if (!strcasecmp(arg, "Off")) {
-        sc->proxy_enabled = GNUTLS_ENABLED_FALSE;
+        sc->proxy_enabled = GNUTLS_ENABLED_FALSE;
     } else {
-        return "SSLProxyEngine must be set to 'On' or 'Off'";
+        return "SSLProxyEngine must be set to 'On' or 'Off'";
     }
 
@@ -542 +802 @@
         const char *arg) {
     mgs_srvconf_rec *sc =
-            (mgs_srvconf_rec *) ap_get_module_config(parms->server->
-            module_config,
-            &gnutls_module);
+        (mgs_srvconf_rec *) ap_get_module_config(parms->server->
+                                                 module_config,
+                                                 &gnutls_module);
     if (!strcasecmp(arg, "On")) {
-        sc->enabled = GNUTLS_ENABLED_TRUE;
+        sc->enabled = GNUTLS_ENABLED_TRUE;
     } else if (!strcasecmp(arg, "Off")) {
-        sc->enabled = GNUTLS_ENABLED_FALSE;
+        sc->enabled = GNUTLS_ENABLED_FALSE;
     } else {
-        return "GnuTLSEnable must be set to 'On' or 'Off'";
+        return "GnuTLSEnable must be set to 'On' or 'Off'";
     }
 
@@ -559 +819 @@
     mgs_srvconf_rec *sc = (mgs_srvconf_rec *) ap_get_module_config(parms->server->module_config, &gnutls_module);
     if (!strcasecmp(arg, "On")) {
-        sc->export_certificates_size = 16 * 1024;
+        sc->export_certificates_size = 16 * 1024;
     } else if (!strcasecmp(arg, "Off")) {
-        sc->export_certificates_size = 0;
+        sc->export_certificates_size = 0;
     } else {
-        char* endptr;
-        sc->export_certificates_size = strtol(arg, &endptr, 10);
-        while (apr_isspace(*endptr)) endptr++;
-        if (*endptr == '\0' || *endptr == 'b' || *endptr == 'B') {
-            ;
-        } else if (*endptr == 'k' || *endptr == 'K') {
-            sc->export_certificates_size *= 1024;
-        } else {
-            return "GnuTLSExportCertificates must be set to a size (in bytes) or 'On' or 'Off'";
-        }
-    }
-
-    return NULL;
-}
-
-const char *mgs_set_priorities(cmd_parms * parms, void *dummy __attribute__((unused)), const char *arg) {
-
-        int ret;
-    const char *err;
-
+        char *endptr;
+        sc->export_certificates_size = strtol(arg, &endptr, 10);
+        while (apr_isspace(*endptr))
+            endptr++;
+        if (*endptr == '\0' || *endptr == 'b' || *endptr == 'B') {
+            ;
+        } else if (*endptr == 'k' || *endptr == 'K') {
+            sc->export_certificates_size *= 1024;
+        } else {
+            return
+                "GnuTLSExportCertificates must be set to a size (in bytes) or 'On' or 'Off'";
+        }
+    }
+
+    return NULL;
+}
+
+const char *mgs_set_priorities(cmd_parms * parms, void *dummy __attribute__((unused)), const char *arg)
+{
     mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
-                                                  ap_get_module_config(parms->server->module_config, &gnutls_module);
-
-    ret = gnutls_priority_init(&sc->priorities, arg, &err);
-
-    if (ret < 0) {
-        if (ret == GNUTLS_E_INVALID_REQUEST) {
-            return apr_psprintf(parms->pool,
-                                                                "GnuTLS: Syntax error parsing priorities string at: %s", err);
-                }
-        return "Error setting priorities";
-    }
-
-    return NULL;
-}
-
-static mgs_srvconf_rec *_mgs_config_server_create(apr_pool_t * p, char** err) {
-    mgs_srvconf_rec *sc = apr_pcalloc(p, sizeof (*sc));
-    int ret;
+        ap_get_module_config(parms->server->module_config, &gnutls_module);
+
+    sc->priorities_str = apr_pstrdup(parms->pool, arg);
+
+    return NULL;
+}
+
+const char *mgs_set_pin(cmd_parms * parms, void *dummy __attribute__((unused)),
+                        const char *arg)
+{
+
+    mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
+        ap_get_module_config(parms->server->module_config, &gnutls_module);
+
+    sc->pin = apr_pstrdup(parms->pool, arg);
+
+    return NULL;
+}
+
+const char *mgs_set_srk_pin(cmd_parms * parms,
+                            void *dummy __attribute__((unused)),
+                            const char *arg)
+{
+
+    mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
+        ap_get_module_config(parms->server->module_config, &gnutls_module);
+
+    sc->srk_pin = apr_pstrdup(parms->pool, arg);
+
+    return NULL;
+}
+
+static mgs_srvconf_rec *_mgs_config_server_create(apr_pool_t * p,
+                                                  char **err __attribute__((unused)))
+{
+    mgs_srvconf_rec *sc = apr_pcalloc(p, sizeof(*sc));
 
     sc->enabled = GNUTLS_ENABLED_UNSET;
 
-    ret = gnutls_certificate_allocate_credentials(&sc->certs);
-    if (ret < 0) {
-        *err = apr_psprintf(p, "GnuTLS: Failed to initialize"
-                            ": (%d) %s", ret,
-                            gnutls_strerror(ret));
-        return NULL;
-    }
-
-    ret = gnutls_anon_allocate_server_credentials(&sc->anon_creds);
-    if (ret < 0) {
-        *err = apr_psprintf(p, "GnuTLS: Failed to initialize"
-                            ": (%d) %s", ret,
-                            gnutls_strerror(ret));
-        return NULL;
-    }
-#ifdef ENABLE_SRP
-    ret = gnutls_srp_allocate_server_credentials(&sc->srp_creds);
-    if (ret < 0) {
-        *err =  apr_psprintf(p, "GnuTLS: Failed to initialize"
-                             ": (%d) %s", ret,
-                             gnutls_strerror(ret));
-        return NULL;
-    }
-
-    sc->srp_tpasswd_conf_file = NULL;
-    sc->srp_tpasswd_file = NULL;
-#endif
 
     sc->privkey_x509 = NULL;
-        /* Initialize all Certificate Chains */
-    /* FIXME: how do we indicate that this is unset for a merge? (that
-     * is, how can a subordinate server override the chain by setting
-     * an empty one?  what would that even look like in the
-     * configuration?) */
-        sc->certs_x509_chain = malloc(MAX_CHAIN_SIZE * sizeof (*sc->certs_x509_chain));
+    sc->privkey_pgp = NULL;
     sc->certs_x509_chain_num = 0;
-    sc->cache_timeout = -1; /* -1 means "unset" */
+    sc->cache_timeout = -1;     /* -1 means "unset" */
     sc->cache_type = mgs_cache_unset;
     sc->cache_config = NULL;
@@ -661 +906 @@
     char *err = NULL;
     mgs_srvconf_rec *sc = _mgs_config_server_create(p, &err);
-    if (sc) return sc; else return err;
+    if (sc)
+        return sc;
+    else
+        return err;
 }
 
@@ -667 +915 @@
 #define gnutls_srvconf_assign(t) sc->t = add->t
 
-void *mgs_config_server_merge(apr_pool_t *p, void *BASE, void *ADD) {
+void *mgs_config_server_merge(apr_pool_t * p, void *BASE, void *ADD)
+{
     int i;
     char *err = NULL;
-    mgs_srvconf_rec *base = (mgs_srvconf_rec *)BASE;
-    mgs_srvconf_rec *add = (mgs_srvconf_rec *)ADD;
+    mgs_srvconf_rec *base = (mgs_srvconf_rec *) BASE;
+    mgs_srvconf_rec *add = (mgs_srvconf_rec *) ADD;
     mgs_srvconf_rec *sc = _mgs_config_server_create(p, &err);
-    if (NULL == sc) return err;
+    if (NULL == sc)
+        return err;
 
     gnutls_srvconf_merge(enabled, GNUTLS_ENABLED_UNSET);
@@ -683 +933 @@
     gnutls_srvconf_merge(srp_tpasswd_file, NULL);
     gnutls_srvconf_merge(srp_tpasswd_conf_file, NULL);
-    gnutls_srvconf_merge(privkey_x509, NULL);
-    gnutls_srvconf_merge(priorities, NULL);
-    gnutls_srvconf_merge(dh_params, NULL);
+    gnutls_srvconf_merge(x509_cert_file, NULL);
+
+    gnutls_srvconf_merge(x509_key_file, NULL);
+    gnutls_srvconf_merge(x509_ca_file, NULL);
+    gnutls_srvconf_merge(pin, NULL);
+    gnutls_srvconf_merge(pgp_cert_file, NULL);
+    gnutls_srvconf_merge(pgp_key_file, NULL);
+    gnutls_srvconf_merge(pgp_ring_file, NULL);
+    gnutls_srvconf_merge(dh_file, NULL);
+    gnutls_srvconf_merge(priorities_str, NULL);
 
     /* FIXME: the following items are pre-allocated, and should be
      * properly disposed of before assigning in order to avoid leaks;
      * so at the moment, we can't actually have them in the config.
-     * what happens during de-allocation?
-
-     * This is probably leaky.
-     */
+     * what happens during de-allocation? */
+    gnutls_srvconf_assign(ca_list);
+    gnutls_srvconf_assign(ca_list_size);
+    gnutls_srvconf_assign(cert_pgp);
+    gnutls_srvconf_assign(cert_crt_pgp);
+    gnutls_srvconf_assign(pgp_list);
     gnutls_srvconf_assign(certs);
     gnutls_srvconf_assign(anon_creds);
     gnutls_srvconf_assign(srp_creds);
     gnutls_srvconf_assign(certs_x509_chain);
+    gnutls_srvconf_assign(certs_x509_crt_chain);
     gnutls_srvconf_assign(certs_x509_chain_num);
 
@@ -704 +964 @@
     gnutls_srvconf_assign(cert_cn);
     for (i = 0; i < MAX_CERT_SAN; i++)
-        gnutls_srvconf_assign(cert_san[i]);
-    gnutls_srvconf_assign(ca_list);
-    gnutls_srvconf_assign(ca_list_size);
-    gnutls_srvconf_assign(cert_pgp);
-    gnutls_srvconf_assign(pgp_list);
-    gnutls_srvconf_assign(privkey_pgp);
+        gnutls_srvconf_assign(cert_san[i]);
 
     return sc;
@@ -724 +979 @@
     mgs_dirconf_rec *add = (mgs_dirconf_rec *) addv;
 
-    new = (mgs_dirconf_rec *) apr_pcalloc(p, sizeof (mgs_dirconf_rec));
+    new = (mgs_dirconf_rec *) apr_pcalloc(p, sizeof(mgs_dirconf_rec));
     new->client_verify_mode = add->client_verify_mode;
     return new;
@@ -735 +990 @@
     return dc;
 }
-

src/gnutls_hooks.c

@@ -171 +171 @@
 
 static int cert_retrieve_fn(gnutls_session_t session,
-                                                        const gnutls_datum_t * req_ca_rdn __attribute__((unused)), int nreqs __attribute__((unused)),
-                                                        const gnutls_pk_algorithm_t * pk_algos __attribute__((unused)), int pk_algos_length __attribute__((unused)),
-                                                        gnutls_retr2_st *ret) {
-
-
-        _gnutls_log(debug_log_fp, "%s: %d\n", __func__, __LINE__);
-
-        mgs_handle_t *ctxt;
+                            const gnutls_datum_t * req_ca_rdn __attribute__((unused)),
+                            int nreqs __attribute__((unused)),
+                            const gnutls_pk_algorithm_t * pk_algos __attribute__((unused)),
+                            int pk_algos_length __attribute__((unused)),
+                            gnutls_pcert_st **pcerts,
+                            unsigned int *pcert_length,
+                            gnutls_privkey_t *privkey)
+{
+    _gnutls_log(debug_log_fp, "%s: %d\n", __func__, __LINE__);
+
+    mgs_handle_t *ctxt;
 
     if (session == NULL) {
                 // ERROR INVALID SESSION
-                ret->ncerts = 0;
-                ret->deinit_all = 1;
         return -1;
-        }
+    }
+
     ctxt = gnutls_transport_get_ptr(session);
 
     if (gnutls_certificate_type_get(session) == GNUTLS_CRT_X509) {
                 // X509 CERTIFICATE
-                ret->cert_type = GNUTLS_CRT_X509;
-                ret->key_type = GNUTLS_PRIVKEY_X509;
-        ret->ncerts = ctxt->sc->certs_x509_chain_num;
-        ret->deinit_all = 0;
-        ret->cert.x509 = ctxt->sc->certs_x509_chain;
-        ret->key.x509 = ctxt->sc->privkey_x509;
+        *pcerts = ctxt->sc->certs_x509_chain;
+        *pcert_length = ctxt->sc->certs_x509_chain_num;
+        *privkey = ctxt->sc->privkey_x509;
         return 0;
     } else if (gnutls_certificate_type_get(session) == GNUTLS_CRT_OPENPGP) {
                 // OPENPGP CERTIFICATE
-                ret->cert_type = GNUTLS_CRT_OPENPGP;
-                ret->key_type = GNUTLS_PRIVKEY_OPENPGP;
-        ret->ncerts = 1;
-        ret->deinit_all = 0;
-        ret->cert.pgp = ctxt->sc->cert_pgp;
-        ret->key.pgp = ctxt->sc->privkey_pgp;
+        *pcerts = ctxt->sc->cert_pgp;
+        *pcert_length = 1;
+        *privkey = ctxt->sc->privkey_pgp;
         return 0;
     } else {
                 // UNKNOWN CERTIFICATE
-                ret->ncerts = 0;
-                ret->deinit_all = 1;
             return -1;
         }
 }
-
-/* 2048-bit group parameters from SRP specification */
-const char static_dh_params[] = "-----BEGIN DH PARAMETERS-----\n"
-        "MIIBBwKCAQCsa9tBMkqam/Fm3l4TiVgvr3K2ZRmH7gf8MZKUPbVgUKNzKcu0oJnt\n"
-        "gZPgdXdnoT3VIxKrSwMxDc1/SKnaBP1Q6Ag5ae23Z7DPYJUXmhY6s2YaBfvV+qro\n"
-        "KRipli8Lk7hV+XmT7Jde6qgNdArb9P90c1nQQdXDPqcdKB5EaxR3O8qXtDoj+4AW\n"
-        "dr0gekNsZIHx0rkHhxdGGludMuaI+HdIVEUjtSSw1X1ep3onddLs+gMs+9v1L7N4\n"
-        "YWAnkATleuavh05zA85TKZzMBBx7wwjYKlaY86jQw4JxrjX46dv7tpS1yAPYn3rk\n"
-        "Nd4jbVJfVHWbZeNy/NaO8g+nER+eSv9zAgEC\n"
-        "-----END DH PARAMETERS-----\n";
 
 /* Read the common name or the alternative name of the certificate.
@@ -322 +306 @@
     }
 
-
     s = base_server;
     sc_base = (mgs_srvconf_rec *) ap_get_module_config(s->module_config, &gnutls_module);
 
-    gnutls_dh_params_init(&dh_params);
-
-    if (sc_base->dh_params == NULL) {
-        gnutls_datum_t pdata = {
-            (void *) static_dh_params,
-            sizeof(static_dh_params)
-        };
-        rv = gnutls_dh_params_import_pkcs3(dh_params, &pdata, GNUTLS_X509_FMT_PEM);
-        /* Generate DH Params
-        int dh_bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH,
-                GNUTLS_SEC_PARAM_NORMAL);
-        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
-            "GnuTLS: Generating DH Params of %i bits.  "
-            "To avoid this use GnuTLSDHFile to specify DH Params for this host",
-            dh_bits);
-#if MOD_GNUTLS_DEBUG
-            ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
-                    "GnuTLS: Generated DH Params of %i bits",dh_bits);
-#endif
-        rv = gnutls_dh_params_generate2 (dh_params,dh_bits);
-        */
-        if (rv < 0) {
-            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
-                    "GnuTLS: Unable to generate or load DH Params: (%d) %s",
-                    rv, gnutls_strerror(rv));
-            exit(rv);
-        }
-    } else {
-        dh_params = sc_base->dh_params;
-    }
 
     rv = mgs_cache_post_config(p, s, sc_base);
@@ -370 +323 @@
         sc->cache_config = sc_base->cache_config;
         sc->cache_timeout = sc_base->cache_timeout;
+
+        rv = mgs_load_files(p, s);
+        if (rv != 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                "GnuTLS: Loading required files failed."
+                " Shutting Down.");
+            exit(-1);
+        }
 
         /* defaults for unset values: */
@@ -383 +344 @@
             sc->client_verify_method = mgs_cvm_cartel;
 
-
         /* Check if the priorities have been set */
         if (sc->priorities == NULL && sc->enabled == GNUTLS_ENABLED_TRUE) {
@@ -401 +361 @@
         }
 
-        gnutls_certificate_set_retrieve_function(sc->certs, cert_retrieve_fn);
-
-#ifdef ENABLE_SRP
-        if (sc->srp_tpasswd_conf_file != NULL
-                && sc->srp_tpasswd_file != NULL) {
-            rv = gnutls_srp_set_server_credentials_file
-                    (sc->srp_creds, sc->srp_tpasswd_file,
-                    sc->srp_tpasswd_conf_file);
-
-            if (rv < 0 && sc->enabled == GNUTLS_ENABLED_TRUE) {
-                ap_log_error(APLOG_MARK, APLOG_STARTUP, 0,
-                        s,
-                        "[GnuTLS] - Host '%s:%d' is missing a "
-                        "SRP password or conf File!",
-                        s->server_hostname, s->port);
-                exit(-1);
-            }
-        }
-#endif
+        gnutls_certificate_set_retrieve_function2(sc->certs, cert_retrieve_fn);
 
         if ((sc->certs_x509_chain == NULL || sc->certs_x509_chain_num < 1) &&
             sc->cert_pgp == NULL && sc->enabled == GNUTLS_ENABLED_TRUE) {
                         ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
-                                                "[GnuTLS] - Host '%s:%d' is missing a Certificate File!",
+                                                "GnuTLS: Host '%s:%d' is missing a Certificate File!",
                                                 s->server_hostname, s->port);
             exit(-1);
         }
-
         if (sc->enabled == GNUTLS_ENABLED_TRUE &&
-            ((sc->certs_x509_chain != NULL && sc->certs_x509_chain_num > 0 && sc->privkey_x509 == NULL) ||
-             (sc->cert_pgp != NULL && sc->privkey_pgp == NULL))) {
+            ((sc->certs_x509_chain_num > 0 && sc->privkey_x509 == NULL) ||
+             (sc->cert_crt_pgp[0] != NULL && sc->privkey_pgp == NULL))) {
                         ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
-                                                "[GnuTLS] - Host '%s:%d' is missing a Private Key File!",
+                                                "GnuTLS: Host '%s:%d' is missing a Private Key File!",
                                                 s->server_hostname, s->port);
             exit(-1);
@@ -441 +382 @@
             rv = -1;
             if (sc->certs_x509_chain_num > 0) {
-                rv = read_crt_cn(s, p, sc->certs_x509_chain[0], &sc->cert_cn);
+                rv = read_crt_cn(s, p, sc->certs_x509_crt_chain[0], &sc->cert_cn);
             }
             if (rv < 0 && sc->cert_pgp != NULL) {
-                rv = read_pgpcrt_cn(s, p, sc->cert_pgp, &sc->cert_cn);
+                rv = read_pgpcrt_cn(s, p, sc->cert_crt_pgp[0], &sc->cert_cn);
                         }
 
             if (rv < 0) {
                 ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
-                                                        "[GnuTLS] - Cannot find a certificate for host '%s:%d'!",
+                                                        "GnuTLS: Cannot find a certificate for host '%s:%d'!",
                                                         s->server_hostname, s->port);
                 sc->cert_cn = NULL;
@@ -474 +415 @@
 }
 
-void mgs_hook_child_init(apr_pool_t * p, server_rec * s) {
+void mgs_hook_child_init(apr_pool_t * p, server_rec *s) {
     apr_status_t rv = APR_SUCCESS;
-    mgs_srvconf_rec *sc = ap_get_module_config(s->module_config,
-            &gnutls_module);
-
-    _gnutls_log(debug_log_fp, "%s: %d\n", __func__, __LINE__);
+    mgs_srvconf_rec *sc =
+        (mgs_srvconf_rec *) ap_get_module_config(s->module_config, &gnutls_module);
+
+    _gnutls_log(debug_log_fp, "%s: %d\n", __func__, __LINE__);
+    /* if we use PKCS #11 reinitialize it */
+
+    if (mgs_pkcs11_reinit(s) < 0) {
+            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
+                    "GnuTLS: Failed to reinitialize PKCS #11");
+            exit(-1);
+    }
+
     if (sc->cache_type != mgs_cache_none) {
         rv = mgs_cache_child_init(p, s, sc);
         if (rv != APR_SUCCESS) {
             ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s,
-                    "[GnuTLS] - Failed to run Cache Init");
+                    "GnuTLS: Failed to run Cache Init");
         }
     }
@@ -605 +554 @@
 
     if (tsc->certs_x509_chain_num > 0) {
-        /* why are we doing this check? */
-        ret = gnutls_x509_crt_check_hostname(tsc->certs_x509_chain[0], s->server_hostname);
+        /* this check is there to warn administrator of any missing hostname
+         * in the certificate. */
+        ret = gnutls_x509_crt_check_hostname(tsc->certs_x509_crt_chain[0], s->server_hostname);
         if (0 == ret)
-            ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
-                         "GnuTLS: Error checking certificate for hostname "
+            ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
+                         "GnuTLS: the certificate doesn't match requested hostname "
                          "'%s'", s->server_hostname);
     } else {
@@ -841 +791 @@
 
     if (gnutls_certificate_type_get(ctxt->session) == GNUTLS_CRT_X509) {
-                mgs_add_common_cert_vars(r, ctxt->sc->certs_x509_chain[0], 0, ctxt->sc->export_certificates_size);
-        } else if (gnutls_certificate_type_get(ctxt->session) == GNUTLS_CRT_OPENPGP) {
-        mgs_add_common_pgpcert_vars(r, ctxt->sc->cert_pgp, 0, ctxt->sc->export_certificates_size);
-        }
+        mgs_add_common_cert_vars(r, ctxt->sc->certs_x509_crt_chain[0], 0, ctxt->sc->export_certificates_size);
+    } else if (gnutls_certificate_type_get(ctxt->session) == GNUTLS_CRT_OPENPGP) {
+        mgs_add_common_pgpcert_vars(r, ctxt->sc->cert_crt_pgp[0], 0, ctxt->sc->export_certificates_size);
+    }
 
     return rv;

src/mod_gnutls.c

@@ -118 +118 @@
     RSRC_CONF | OR_AUTHCFG,
     "Enable SSL Proxy Engine"),
+    AP_INIT_RAW_ARGS("GnuTLSPIN", mgs_set_pin,
+    NULL,
+    RSRC_CONF,
+    "The PIN to use in case of encrypted keys or PKCS #11 tokens."),
+    AP_INIT_RAW_ARGS("GnuTLSSRKPIN", mgs_set_srk_pin,
+    NULL,
+    RSRC_CONF,
+    "The SRK PIN to use in case of TPM keys."),
     AP_INIT_TAKE1("GnuTLSClientVerify", mgs_set_client_verify,
     NULL,