/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos.xml

  • Committer: Teddy Hogeborn
  • Date: 2015-03-10 18:52:09 UTC
  • Revision ID: teddy@recompile.se-20150310185209-lxuovbu09zwyk9bx
Automatically determine the number of DH bits in the TLS handshake.

Instead of using a default value of 1024, check the OpenPGP key and
determine an appropriate number of DH bits to use, (using GnuTLS
functions made for this).  Document this new default behavior.

* plugins.d/mandos-client.c (safe_string): New function.
  (init_gnutls_global): If not specified, determine the number of DH
                        bits to use, based on the OpenPGP key.
* plugins.d/mandos-client.xml (OPTIONS): Document this new default of
                                         the --dh-bits option.

Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos">
5
 
<!ENTITY TIMESTAMP "2014-06-15">
 
5
<!ENTITY TIMESTAMP "2015-01-25">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
707
707
      </varlistentry>
708
708
      <varlistentry>
709
709
        <term>
710
 
          <ulink url="http://www.gnu.org/software/gnutls/"
711
 
          >GnuTLS</ulink>
 
710
          <ulink url="http://gnutls.org/">GnuTLS</ulink>
712
711
        </term>
713
712
      <listitem>
714
713
        <para>
752
751
      </varlistentry>
753
752
      <varlistentry>
754
753
        <term>
755
 
          RFC 4346: <citetitle>The Transport Layer Security (TLS)
756
 
          Protocol Version 1.1</citetitle>
 
754
          RFC 5246: <citetitle>The Transport Layer Security (TLS)
 
755
          Protocol Version 1.2</citetitle>
757
756
        </term>
758
757
      <listitem>
759
758
        <para>
760
 
          TLS 1.1 is the protocol implemented by GnuTLS.
 
759
          TLS 1.2 is the protocol implemented by GnuTLS.
761
760
        </para>
762
761
      </listitem>
763
762
      </varlistentry>
773
772
      </varlistentry>
774
773
      <varlistentry>
775
774
        <term>
776
 
          RFC 5081: <citetitle>Using OpenPGP Keys for Transport Layer
777
 
          Security</citetitle>
 
775
          RFC 6091: <citetitle>Using OpenPGP Keys for Transport Layer
 
776
          Security (TLS) Authentication</citetitle>
778
777
        </term>
779
778
      <listitem>
780
779
        <para>