gsi.conf.h

00001 static char *globus_l_gsi_conf_string  =
00002 "# Flag to choose SSL or TLS for GSSAPI protocol.\n"
00003 "# Set to true to disable SSLv3, or false to allow either to be \n"
00004 "# negotiated. The value of the GLOBUS_GSSAPI_FORCE_TLS environment\n"
00005 "# variable overrides this\n"
00006 "FORCE_TLS=false\n"
00007 "# GSSAPI Name compatibility mode when trying to determine\n"
00008 "# if a host certificate is legitimate. GSI predates RFC2818,\n"
00009 "# so there are some old, less-secure, practices by default.\n"
00010 "# The different modes are:\n"
00011 "# STRICT_GT2:\n"
00012 "#     Strictly backward-compatible with GT 2.0 name matching. \n"
00013 "#     X.509 subjectAltName values are ignored. Names with\n"
00014 "#     hyphens are treated as wildcarded such that \n"
00015 "#     host-ANYTHING.example.com will match a certificate named\n"
00016 "#     host.example.com. The name matching will rely on canonical\n"
00017 "#     host (as resolved via getnameinfo) name associated with\n"
00018 "#     a connection's IP addresses.\n"
00019 "# STRICT_RFC2818:\n"
00020 "#     Support RFC 2818 server identity processing. Hyphen \n"
00021 "#     characters are treated as normal part of a host name. \n"
00022 "#     dnsName and ipAddress subjectAltName extensions are matched\n"
00023 "#     against the host and port passed to GSSAPI. If subjectAltName \n"
00024 "#     is present, X.509 SubjectName is ignored. \n"
00025 "# HYBRID:\n"
00026 "#     Support a hybrid of the two previous name matching algorithms,\n"
00027 "#     liberally matching both hyphen wildcards, canonical names\n"
00028 "#     associated with IP addresses, and subjectAltName extensions.\n"
00029 "#     This has been the default since GT 4.2\n"
00030 "NAME_COMPATIBILITY=STRICT_RFC2818\n"
00031 "# OpenSSL Cipher List. This is an preference-ordered list of OpenSSL cipher\n"
00032 "# names. \n"
00033 "CIPHERS=HIGH\n"
00034 "# If true, when choosing a cipher, a server will use its own preferred\n"
00035 "# order instead of the cipher order presented by the client. When not set, the\n"
00036 "# SSL server will always follow the clients preferences.\n"
00037 "SERVER_CIPHER_ORDER=true\n"
00038 "# If true, when computing a message integrity check, use the original\n"
00039 "# implementation, which inspects internal OpenSSL structures. Otherwise,\n"
00040 "# use keying material and sequence counters in the GSSAPI structures only.\n"
00041 "# The true setting is only available for OpenSSL < 1.1.0\n"
00042 "BACKWARD_COMPATIBLE_MIC=true\n"
00043 "# If true, when verifying a message integrity check, accept MICs generated\n"
00044 "# using the original implementation, which inspects internal OpenSSL\n"
00045 "# structures. Otherwise, only use the new code which relies on use keying\n"
00046 "# material and sequence counters in the GSSAPI structures only.\n"
00047 "# The true setting is only available for OpenSSL < 1.1.0\n"
00048 "ACCEPT_BACKWARD_COMPATIBLE_MIC=true\n"
00049 ;

Generated on 10 Mar 2017 for globus_gssapi_gsi by  doxygen 1.4.7