From cae42e74905f1ef50edc881e4cfadad8787a498e Mon Sep 17 00:00:00 2001 From: Lars Thorsen Date: Tue, 6 Dec 2011 13:06:51 +0100 Subject: [orber] Update documentation according to the new handling of SSL options --- lib/orber/doc/src/ch_install.xml | 122 ++++--------------------------------- lib/orber/doc/src/ch_security.xml | 91 ++++++--------------------- lib/orber/doc/src/corba.xml | 16 ++--- lib/orber/doc/src/corba_object.xml | 11 ++-- lib/orber/doc/src/orber.xml | 94 ++++++---------------------- 5 files changed, 58 insertions(+), 276 deletions(-) (limited to 'lib/orber/doc/src') diff --git a/lib/orber/doc/src/ch_install.xml b/lib/orber/doc/src/ch_install.xml index dde4bf4006..de9c0e3a9d 100644 --- a/lib/orber/doc/src/ch_install.xml +++ b/lib/orber/doc/src/ch_install.xml @@ -1,10 +1,10 @@ - +
- 19972010 + 19972011 Ericsson AB. All Rights Reserved. @@ -394,84 +394,16 @@ nodeB@hostB> orber:start(). The same as iiop_ssl_port - ssl_server_cacertfile - string() - - - - - ssl_server_certfile - string() - - - - - ssl_server_verify - 0 | 1 | 2 - - - - - ssl_server_depth - integer() - - - - - ssl_server_password - string() - - - - - ssl_server_keyfile - string() - - - - - ssl_server_ciphers - string() - - + ssl_server_options + list() + See the SSL application + for valid options. - ssl_server_cachetimeout - integer() | infinity - infinity - - - ssl_client_cacertfile - string() - - - - - ssl_client_certfile - string() - - - - - ssl_client_verify - 0 | 1 | 2 - - - - - ssl_client_depth - integer() - - - - - ssl_client_password - string() - - - - - ssl_client_keyfile - string() - - - - - ssl_client_ciphers - string() - - - - - ssl_client_cachetimeout - integer() | infinity - infinity + ssl_client_options + list() + See the SSL application + for valid options. iiop_ssl_out_keepalive @@ -698,40 +630,10 @@ nodeB@hostB> orber:start(). If set, the value must be an integer greater than zero or {local, DefaultNATPort, [{Port, NATPort}]}. See also Firewall Configuration. - ssl_server_cacertfile + ssl_server_options the file path to a server side CA certificate. - ssl_server_certfile - The path to a file containing a chain of PEM encoded certificates. - ssl_server_verify - The type of verification used by SSL during authentication of the - other peer for incoming calls. - ssl_server_depth - The SSL verification depth for outgoing calls. - ssl_server_password - The server side key string. - ssl_server_keyfile - The file path to a server side key. - ssl_server_ciphers - The server side cipher string. - ssl_server_cachetimeout - The server side cache timeout. - ssl_client_cacertfile - The file path to a client side CA certificate. - ssl_client_certfile + ssl_client_options The path to a file containing a chain of PEM encoded certificates. - ssl_client_verify - The type of verification used by SSL during authentication of the - other peer for outgoing calls. - ssl_client_depth - The SSL verification depth for incoming calls. - ssl_client_password - The client side key string. - ssl_client_keyfile - The file path to a client side key. - ssl_client_ciphers - The client side cipher string. - ssl_client_cachetimeout - The client side cache timeout. iiop_ssl_out_keepalive Enables periodic transmission on a connected socket, when no other data is being exchanged. If the other end does not respond, the diff --git a/lib/orber/doc/src/ch_security.xml b/lib/orber/doc/src/ch_security.xml index 938025a629..a25a8a5052 100644 --- a/lib/orber/doc/src/ch_security.xml +++ b/lib/orber/doc/src/ch_security.xml @@ -1,10 +1,10 @@ - +
- 19992009 + 19992011 Ericsson AB. All Rights Reserved. @@ -55,40 +55,15 @@
Configurations when Orber is Used on the Server Side -

The following three configuration variables can be used to configure Orber's SSL - behavior on the server side.

+

There is a variable to conficure Orber's SSL behavior on the server side.

- ssl_server_certfile - which is a path to a file containing a - chain of PEM encoded certificates for the Orber domain as server. - ssl_server_cacertfile - which is a path to a file containing - a chain of PEM encoded certificates for the Orber domain as server. - ssl_server_verify - which specifies type of verification: - 0 = do not verify peer; 1 = verify peer, verify client once, - 2 = verify peer, verify client once, fail if no peer certificate. - The default value is 0. - ssl_server_depth - which specifies verification depth, i.e. - how far in a chain of certificates the verification process shall - proceed before the verification is considered successful. The default - value is 1. - ssl_server_keyfile - which is a path to a file containing a - PEM encoded key for the Orber domain as server. - ssl_server_password - only used if the private keyfile is - password protected. - ssl_server_ciphers - which is string of ciphers as a colon - separated list of ciphers. - ssl_server_cachetimeout - which is the session cache timeout - in seconds. + ssl_server_options - which is a list of options to ssl. + See the SSL application for further + descriptions on these options. -

There also exist a number of API functions for accessing the values of these variables:

+

There also exist an API function for accessing the value of this variable:

- orber:ssl_server_certfile/0 - orber:ssl_server_cacertfile/0 - orber:ssl_server_verify/0 - orber:ssl_server_depth/0 - orber:ssl_server_keyfile/0 - orber:ssl_server_password/0 - orber:ssl_server_ciphers/0 - orber:ssl_server_cachetimeout/0 + orber:ssl_server_options/0
@@ -97,50 +72,22 @@

When the Orber enabled application is the client side in the secure connection the different configurations can be set per client process instead and not for the whole domain as for incoming calls.

-

One can use configuration variables to set default values for the domain but they can be changed - per client process. Below is the list of client configuration variables.

+

There is a variable to set default values for the domain but they can be changed + per client process.

- ssl_client_certfile - which is a path to a file containing a - chain of PEM encoded certificates used in outgoing calls in the current - process. - ssl_client_cacertfile - which is a path to a file containing a - chain of PEM encoded CA certificates used in outgoing calls in the - current process. - ssl_client_verify - which specifies type of verification: - 0 = do not verify peer; 1 = verify peer, verify client once, - 2 = verify peer, verify client once, fail if no peer certificate. - The default value is 0. - ssl_client_depth - which specifies verification depth, i.e. - how far in a chain of certificates the verification process shall proceed - before the verification is considered successful. The default value is 1. - ssl_client_keyfile - which is a path to a file containing a - PEM encoded key when Orber act as client side ORB. - ssl_client_password - only used if the private keyfile is - password protected. - ssl_client_ciphers - which is string of ciphers as a colon - separated list of ciphers. - ssl_client_cachetimeout - which is the session cache timeout - in seconds. + ssl_client_options - which is a list of options to ssl. + See the SSL application for further + descriptions on these options. -

There also exist a number of API functions for accessing and changing the values of this - variables in the client processes.

-

Access functions:

+

There also exist two API functions for accessing and changing the values of this + variable in the client processes.

+

Access function:

- orber:ssl_client_certfile/0 - orber:ssl_client_cacertfile/0 - orber:ssl_client_verify/0 - orber:ssl_client_depth/0 - orber:ssl_client_keyfile/0 - orber:ssl_client_password/0 - orber:ssl_client_ciphers/0 - orber:ssl_client_cachetimeout/0 + orber:ssl_client_options/0 -

Modify functions:

+

Modify function:

- orber:set_ssl_client_certfile/1 - orber:set_ssl_client_cacertfile/1 - orber:set_ssl_client_verify/1 - orber:set_ssl_client_depth/1 + orber:set_ssl_client_options/1 diff --git a/lib/orber/doc/src/corba.xml b/lib/orber/doc/src/corba.xml index cae0e09b0b..08ec555f94 100644 --- a/lib/orber/doc/src/corba.xml +++ b/lib/orber/doc/src/corba.xml @@ -1,10 +1,10 @@ - +
- 19972009 + 19972011 Ericsson AB. All Rights Reserved. @@ -221,8 +221,7 @@ Example: CtxData = {interface, Interface} | {userspecific, term()} | {configuration, Options} Interface = string() Options = [{Key, Value}] - Key = ssl_client_verify | ssl_client_depth | ssl_client_certfile | ssl_client_cacertfile | - ssl_client_password | ssl_client_keyfile | ssl_client_ciphers | ssl_client_cachetimeout + Key = ssl_client_options Value = allowed value associated with the given key Object = #objref @@ -287,8 +286,7 @@ Example: CtxData = {interface, Interface} | {userspecific, term()} | {configuration, Options} Interface = string() Options = [{Key, Value}] - Key = ssl_client_verify | ssl_client_depth | ssl_client_certfile | ssl_client_cacertfile | - ssl_client_password | ssl_client_keyfile | ssl_client_ciphers | ssl_client_cachetimeout + Key = ssl_client_options Value = allowed value associated with the given key Object = #objref @@ -319,8 +317,7 @@ Example: CtxData = {interface, Interface} | {userspecific, term()} | {configuration, Options} Interface = string() Options = [{Key, Value}] - Key = ssl_client_verify | ssl_client_depth | ssl_client_certfile | ssl_client_cacertfile | - ssl_client_password | ssl_client_keyfile | ssl_client_ciphers | ssl_client_cachetimeout + Key = ssl_client_options Value = allowed value associated with the given key ObjectId = string() @@ -360,8 +357,7 @@ Example: CtxData = {interface, Interface} | {userspecific, term()} | {configuration, Options} Interface = string() Options = [{Key, Value}] - Key = ssl_client_verify | ssl_client_depth | ssl_client_certfile | ssl_client_cacertfile | - ssl_client_password | ssl_client_keyfile | ssl_client_ciphers | ssl_client_cachetimeout + Key = ssl_client_options Value = allowed value associated with the given key Object = #objref diff --git a/lib/orber/doc/src/corba_object.xml b/lib/orber/doc/src/corba_object.xml index e0f9a9f503..ef440f1a2d 100644 --- a/lib/orber/doc/src/corba_object.xml +++ b/lib/orber/doc/src/corba_object.xml @@ -1,4 +1,4 @@ - + @@ -75,8 +75,7 @@ CtxData = {interface, Interface} | {userspecific, term()} | {configuration, Options} Interface = string() Options = [{Key, Value}] - Key = ssl_client_verify | ssl_client_depth | ssl_client_certfile | ssl_client_cacertfile | - ssl_client_password | ssl_client_keyfile | ssl_client_ciphers | ssl_client_cachetimeout + Key = ssl_client_options Value = allowed value associated with the given key Return = boolean() | {'EXCEPTION', E} @@ -117,8 +116,7 @@ CtxData = {interface, Interface} | {userspecific, term()} | {configuration, Options} Interface = string() Options = [{Key, Value}] - Key = ssl_client_verify | ssl_client_depth | ssl_client_certfile | ssl_client_cacertfile | - ssl_client_password | ssl_client_keyfile | ssl_client_ciphers | ssl_client_cachetimeout + Key = ssl_client_options Value = allowed value associated with the given key Return = boolean() | {'EXCEPTION', E} @@ -149,8 +147,7 @@ CtxData = {interface, Interface} | {userspecific, term()} | {configuration, Options} Interface = string() Options = [{Key, Value}] - Key = ssl_client_verify | ssl_client_depth | ssl_client_certfile | ssl_client_cacertfile | - ssl_client_password | ssl_client_keyfile | ssl_client_ciphers | ssl_client_cachetimeout + Key = ssl_client_options Value = allowed value associated with the given key Return = boolean() | {'EXCEPTION', E} diff --git a/lib/orber/doc/src/orber.xml b/lib/orber/doc/src/orber.xml index 5e38e4cf9f..35e9f57008 100644 --- a/lib/orber/doc/src/orber.xml +++ b/lib/orber/doc/src/orber.xml @@ -1,10 +1,10 @@ - +
- 19972010 + 19972011 Ericsson AB. All Rights Reserved. @@ -356,7 +356,7 @@ Type = normal | ssl Port = integer() > 0 ConfigurationParameters = [{Key, Value}] - Key = flags | iiop_in_connection_timeout | iiop_max_fragments | iiop_max_in_requests | interceptors | iiop_port | iiop_ssl_port + Key = flags | iiop_in_connection_timeout | iiop_max_fragments | iiop_max_in_requests | interceptors | iiop_port | iiop_ssl_port | ssl_server_options Value = as described in the User's Guide Result = {ok, Ref} | {error, Reason} | {'EXCEPTION', #'BAD_PARAM'{}} Ref = #Ref @@ -378,7 +378,7 @@ counterparts (See the Configuration chapter in the User's Guide). - But the following parameters there are a few restrictions:

+ But for the following parameters there are a few restrictions:

flags - currently it is only possible to override the global setting for the Use Current Interface in IOR and @@ -450,92 +450,32 @@ - ssl_server_certfile() -> string() - Display the path to the server certificate + ssl_server_options() -> list() + Display the SSL server options -

This function returns a path to a file containing a chain of PEM encoded - certificates for the Orber domain as server. +

This function returns the list of SSL options set for the Orber domain as server. This is configured by setting the application variable - ssl_server_certfile.

+ ssl_server_options.

 - ssl_client_certfile() -> string() - Display the path to the client certificate + ssl_client_options() -> list() + Display the SSL client options -

This function returns a path to a file containing a chain of PEM encoded - certificates used in outgoing calls in the current process. +

This function returns the list of SSL options used in outgoing calls in the current process. The default value is configured by setting the application variable - ssl_client_certfile.

+ ssl_client_options.

 - set_ssl_client_certfile(Path) -> ok - Set the value of the client certificate + set_ssl_client_options(Options) -> ok + Set the SSL options for the client - Path = string() + Options = list() -

This function takes a path to a file containing a chain of PEM encoded - certificates as parameter and sets it for the current process.

- - - - ssl_server_verify() -> 0 | 1 | 2 - Display the SSL verification type for incoming calls - -

This function returns the type of verification used by SSL during authentication of the other - peer for incoming calls. - It is configured by setting the application variable - ssl_server_verify.

- - - - ssl_client_verify() -> 0 | 1 | 2 - Display the SSL verification type for outgoing calls - -

This function returns the type of verification used by SSL during authentication of the other - peer for outgoing calls. - The default value is configured by setting the application variable - ssl_client_verify.

- - - - set_ssl_client_verify(Value) -> ok - Set the value of the SSL verification type for outgoing calls - - Value = 0 | 1 | 2 - - -

This function sets the SSL verification type for the other peer of outgoing calls.

- - - - ssl_server_depth() -> int() - Display the SSL verification depth for incoming calls - -

This function returns the SSL verification depth for incoming calls. - It is configured by setting the application variable - ssl_server_depth.

- - - - ssl_client_depth() -> int() - Display the SSL verification depth for outgoing calls - -

This function returns the SSL verification depth for outgoing calls. - The default value is configured by setting the application variable - ssl_client_depth.

- - - - set_ssl_client_depth(Depth) -> ok - Sets the value of the SSL verification depth for outgoing calls - - Depth = int() - - -

This function sets the SSL verification depth for the other peer of outgoing calls.

+

This function takes a list of SSL options as parameter and sets + it for the current process.

 -- cgit v1.2.3