Re: [TLS] multiple clients in one process (was: Re: Deployment ... Re: This working group has failed)

[Daniel Kahn Gillmor <[e-mail]>]

On Wed 2013-11-20 01:24:03 -0500, Andy Lutomirski wrote:
> GnuTLS has gnutls_pkcs11_init, which is rather impolite -- it
> manipulates global state, and it sometimes causes things to
> malfunction after forking.  gnutls_global_init is documented as being
> unsafe if called from multiple threads, which seems silly.

fwiw, p11-kit (which gnutls integrates by default) is designed
specifically to solve the concurrency issue.  So iiuc, the only way to
trigger the concern about gnutls_pkcs11_init above is if you use
something other than p11-kit to handle pkcs11 modules.

> (As an even more off-topic aside, how is there nothing better than
> pkcs11 for interfacing with abstract keys?)

it's a shame, isn't it?  Stef Walter addresses this question too in his
response to the issues with gnutls_pkcs11_init:

http://lists.freedesktop.org/archives/p11-glue/2013-November/000397.html

Regards,

        --dkg